Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
FileZilla_3.67.1_win64_sponsored-setup.exe

Overview

General Information

Sample name:FileZilla_3.67.1_win64_sponsored-setup.exe
Analysis ID:1478260
MD5:ac97e64c3e2e865c50155dfdffe5428a
SHA1:d473e2d49e908e6d1abfa614c55bdae485508153
SHA256:6113a3f7c9469fcd9b53ea3ecb16bbefb71318af2864ae0a74a8fb633a05f24a
Infos:

Detection

Score:56
Range:0 - 100
Whitelisted:false
Confidence:100%

Compliance

Score:53
Range:0 - 100

Signatures

Multi AV Scanner detection for dropped file
Yara detected Powershell download and execute
Creates an autostart registry key pointing to binary in C:\Windows
Creates an undocumented autostart registry key
Creates files in the system32 config directory
Creates multiple autostart registry keys
Detected potential unwanted application
Modifies Internet Explorer zone settings
Modifies Internet Explorer zonemap settings
Overwrites Mozilla Firefox settings
Sigma detected: Dot net compiler compiles file from suspicious location
Tries to delay execution (extensive OutputDebugStringW loop)
Tries to harvest and steal browser information (history, passwords, etc)
Uses netsh to modify the Windows network and firewall settings
Writes a notice file (html or txt) to demand a ransom
Yara detected Generic Downloader
Abnormal high CPU Usage
Adds / modifies Windows certificates
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Compiles C# or VB.Net code
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates driver files
Creates files inside the driver directory
Creates files inside the system directory
Creates or modifies windows services
Deletes files inside the Windows folder
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Drops certificate files (DER)
Enables debug privileges
Found dropped PE file which has not been started or loaded
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
Is looking for software installed on the system
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains an invalid checksum
PE file contains executable resources (Code or Archives)
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Queries time zone information
Registers a DLL
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Classes Autorun Keys Modification
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: IE Change Domain Zone
Stores files to the Windows start menu directory
Uses 32bit PE files
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

  • System is w10x64
  • FileZilla_3.67.1_win64_sponsored-setup.exe (PID: 6844 cmdline: "C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe" MD5: AC97E64C3E2E865C50155DFDFFE5428A)
    • WcInstaller.exe (PID: 6104 cmdline: "C:\Users\user\AppData\Local\Temp\nsnF7E7.tmp\WcInstaller.exe" --silent --partner=FZ210427 --searchenbl MD5: CA94290A5FB89E0AAACBF01585718B17)
      • WebCompanionInstaller.exe (PID: 5436 cmdline: .\WebCompanionInstaller.exe --partner=FZ210427 --version=9.1.0.993 --silent --partner=FZ210427 --searchenbl MD5: 80619C0E2165AB0C217D4355461DA07D)
        • sc.exe (PID: 5676 cmdline: "sc.exe" Create "WCAssistantService" binPath= "C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe" DisplayName= "WC Assistant" start= auto MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)
          • conhost.exe (PID: 796 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • sc.exe (PID: 3492 cmdline: "sc.exe" failure WCAssistantService reset= 30 actions= restart/60000 MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)
          • conhost.exe (PID: 2492 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • sc.exe (PID: 6532 cmdline: "sc.exe" description "WCAssistantService" "Ad-Aware Web Companion Internet security service" MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)
          • conhost.exe (PID: 6712 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • rundll32.exe (PID: 2024 cmdline: "C:\Windows\sysnative\RunDLL32.Exe" syssetup,SetupInfObjectInstallAction BootInstall 128 C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bddci.inf MD5: EF3179D498793BF4234F708D3BE28633)
          • runonce.exe (PID: 6976 cmdline: "C:\Windows\system32\runonce.exe" -r MD5: 9ADEF025B168447C1E8514D919CB5DC0)
            • grpconv.exe (PID: 4144 cmdline: "C:\Windows\System32\grpconv.exe" -o MD5: 8531882ACC33CB4BDC11B305A01581CE)
        • net.exe (PID: 2328 cmdline: "C:\Windows\sysnative\net.exe" start bddci MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)
          • conhost.exe (PID: 6332 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
          • net1.exe (PID: 3344 cmdline: C:\Windows\system32\net1 start bddci MD5: 55693DF2BB3CBE2899DFDDF18B4EB8C9)
        • sc.exe (PID: 6352 cmdline: "sc.exe" Create "DCIService" binPath= "C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\DCIService.exe" DisplayName= "DCIService" start= auto MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)
          • conhost.exe (PID: 6304 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • sc.exe (PID: 5960 cmdline: "sc.exe" description "DCIService" "Webprotection Bridge service" MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)
          • conhost.exe (PID: 5548 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • cmd.exe (PID: 5932 cmdline: "C:\Windows\System32\cmd.exe" /C "C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bridge_start.cmd" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
          • conhost.exe (PID: 6044 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
          • sc.exe (PID: 1780 cmdline: sc start DCIService MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)
        • cmd.exe (PID: 2160 cmdline: "C:\Windows\System32\cmd.exe" /C netsh http add urlacl url=http://+:9007/ user=Everyone MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
          • conhost.exe (PID: 4336 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
          • netsh.exe (PID: 6048 cmdline: netsh http add urlacl url=http://+:9007/ user=Everyone MD5: 4E89A1A088BE715D6C946E55AB07C7DF)
        • WebCompanion.exe (PID: 940 cmdline: "C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe" --silent --install --geo= --searchenbl MD5: 11CE0FC17BFCDCCF929515BD90455BAF)
          • csc.exe (PID: 3284 cmdline: "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\rsvnd5a7.cmdline" MD5: 2B9482EB5D3AF71029277E18F6C656C0)
            • conhost.exe (PID: 2112 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
            • cvtres.exe (PID: 5680 cmdline: C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES71F3.tmp" "c:\Users\user\AppData\Local\Temp\CSC7165.tmp" MD5: E118330B4629B12368D91B9DF6488BE0)
    • regsvr32.exe (PID: 2288 cmdline: "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\FileZilla FTP Client\fzshellext_64.dll" MD5: B0C2FA35D14A9FAD919E99D9D75E1B9E)
    • filezilla.exe (PID: 4624 cmdline: "C:\Program Files\FileZilla FTP Client\filezilla.exe" MD5: 0B8A7845DA90F16EABDAEB3D9B0F018A)
  • DCIService.exe (PID: 4556 cmdline: "C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\DCIService.exe" MD5: 3827CA1C0EC114A29BB576BEF431F070)
  • Lavasoft.WCAssistant.WinService.exe (PID: 5180 cmdline: "C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe" MD5: 3442D7F43B57552DB02DD69C13F6E682)
    • cmd.exe (PID: 6520 cmdline: "C:\Windows\System32\cmd.exe" /C netsh http add urlacl url=http://+:9007/ user=Everyone MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 6568 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • netsh.exe (PID: 6744 cmdline: netsh http add urlacl url=http://+:9007/ user=Everyone MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)
  • WebCompanion.exe (PID: 7000 cmdline: "C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe" --minimize MD5: 11CE0FC17BFCDCCF929515BD90455BAF)
  • WebCompanion.exe (PID: 984 cmdline: "C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe" --minimize MD5: 11CE0FC17BFCDCCF929515BD90455BAF)
    • csc.exe (PID: 3696 cmdline: "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\fr_px-r0.cmdline" MD5: 2B9482EB5D3AF71029277E18F6C656C0)
      • conhost.exe (PID: 6048 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • cvtres.exe (PID: 3004 cmdline: C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES822F.tmp" "c:\Users\user\AppData\Local\Temp\CSC821F.tmp" MD5: E118330B4629B12368D91B9DF6488BE0)
    • csc.exe (PID: 3332 cmdline: "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\xsc65psb.cmdline" MD5: 2B9482EB5D3AF71029277E18F6C656C0)
      • conhost.exe (PID: 5764 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • cvtres.exe (PID: 5408 cmdline: C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES827D.tmp" "c:\Users\user\AppData\Local\Temp\CSC826D.tmp" MD5: E118330B4629B12368D91B9DF6488BE0)
    • Lavasoft.Search.exe (PID: 1772 cmdline: "C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Search.exe" --searchConfigPath="C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Options\SearchMetadata.txt" --eventConfigPath="C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Options\EventMetadata.txt" MD5: 1A6E64A89F37623232F7A79A91042012)
    • Lavasoft.Search.exe (PID: 8252 cmdline: "C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Search.exe" --searchConfigPath="C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Options\SearchMetadata.txt" --eventConfigPath="C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Options\EventMetadata.txt" MD5: 1A6E64A89F37623232F7A79A91042012)
  • PresentationFontCache.exe (PID: 5640 cmdline: C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe MD5: 91857D4F6633493CF03C22BD86ED7F81)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Dropped Files

SourceRuleDescriptionAuthorStrings
C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeJoeSecurity_GenericDownloader_1Yara detected Generic DownloaderJoe Security
    C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.adblocker.dllJoeSecurity_GenericDownloader_1Yara detected Generic DownloaderJoe Security
      C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Search.exeJoeSecurity_GenericDownloader_1Yara detected Generic DownloaderJoe Security
        C:\ProgramData\Lavasoft\Web Companion\Logs\Webcompanion\webcompanion.logJoeSecurity_PowershellDownloadAndExecuteYara detected Powershell download and executeJoe Security
          C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Utils.dllJoeSecurity_GenericDownloader_1Yara detected Generic DownloaderJoe Security
            Click to see the 2 entries

            Sigma Signatures

            System Summary

            barindex
            Sigma detected: Classes Autorun Keys Modification
            Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: {DB70412E-EEC9-479C-BBA9-BE36BFDDA41B}, EventID: 13, EventType: SetValue, Image: C:\Windows\System32\regsvr32.exe, ProcessId: 2288, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\CopyHookHandlers\FileZilla3CopyHook\(Default)
            Sigma detected: CurrentVersion Autorun Keys Modification
            Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: grpconv -o, EventID: 13, EventType: SetValue, Image: C:\Windows\System32\rundll32.exe, ProcessId: 2024, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv
            Sigma detected: IE Change Domain Zone
            Source: Registry Key setAuthor: frack113: Data: Details: 2, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe, ProcessId: 5436, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\localhost\*
            Sigma detected: Dynamic CSharp Compile Artefact
            Source: File createdAuthor: frack113: Data: EventID: 11, Image: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe, ProcessId: 940, TargetFilename: C:\Users\user\AppData\Local\Temp\rsvnd5a7.cmdline
            Sigma detected: Modification of IE Registry Settings
            Source: Registry Key setAuthor: frack113: Data: Details: 3, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe, ProcessId: 5436, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2301
            Sigma detected: Net.exe Execution
            Source: Process startedAuthor: Michael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements): Data: Command: "C:\Windows\sysnative\net.exe" start bddci, CommandLine: "C:\Windows\sysnative\net.exe" start bddci, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: .\WebCompanionInstaller.exe --partner=FZ210427 --version=9.1.0.993 --silent --partner=FZ210427 --searchenbl, ParentImage: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe, ParentProcessId: 5436, ParentProcessName: WebCompanionInstaller.exe, ProcessCommandLine: "C:\Windows\sysnative\net.exe" start bddci, ProcessId: 2328, ProcessName: net.exe
            Sigma detected: New Service Creation Using Sc.EXE
            Source: Process startedAuthor: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: "sc.exe" Create "WCAssistantService" binPath= "C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe" DisplayName= "WC Assistant" start= auto, CommandLine: "sc.exe" Create "WCAssistantService" binPath= "C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe" DisplayName= "WC Assistant" start= auto, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\sc.exe, NewProcessName: C:\Windows\SysWOW64\sc.exe, OriginalFileName: C:\Windows\SysWOW64\sc.exe, ParentCommandLine: .\WebCompanionInstaller.exe --partner=FZ210427 --version=9.1.0.993 --silent --partner=FZ210427 --searchenbl, ParentImage: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe, ParentProcessId: 5436, ParentProcessName: WebCompanionInstaller.exe, ProcessCommandLine: "sc.exe" Create "WCAssistantService" binPath= "C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe" DisplayName= "WC Assistant" start= auto, ProcessId: 5676, ProcessName: sc.exe
            Sigma detected: Start Windows Service Via Net.EXE
            Source: Process startedAuthor: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: "C:\Windows\sysnative\net.exe" start bddci, CommandLine: "C:\Windows\sysnative\net.exe" start bddci, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: .\WebCompanionInstaller.exe --partner=FZ210427 --version=9.1.0.993 --silent --partner=FZ210427 --searchenbl, ParentImage: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe, ParentProcessId: 5436, ParentProcessName: WebCompanionInstaller.exe, ProcessCommandLine: "C:\Windows\sysnative\net.exe" start bddci, ProcessId: 2328, ProcessName: net.exe

            Data Obfuscation

            barindex
            Sigma detected: Dot net compiler compiles file from suspicious location
            Source: Process startedAuthor: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\rsvnd5a7.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\rsvnd5a7.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe, ParentCommandLine: "C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe" --silent --install --geo= --searchenbl , ParentImage: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe, ParentProcessId: 940, ParentProcessName: WebCompanion.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\rsvnd5a7.cmdline", ProcessId: 3284, ProcessName: csc.exe

            Snort Signatures

            ⊘No Snort rule has matched

            Suricata Signatures

            Timestamp:2024-07-22T12:35:18.698320+0200
            SID:2849740
            Source Port:50129
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:45.194908+0200
            SID:2849740
            Source Port:50489
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:42.920963+0200
            SID:2849740
            Source Port:50243
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:56.719562+0200
            SID:2849740
            Source Port:50012
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:16.531247+0200
            SID:2849740
            Source Port:49791
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:50.180410+0200
            SID:2849740
            Source Port:50568
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:06.463822+0200
            SID:2849740
            Source Port:50070
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:24.441989+0200
            SID:2849740
            Source Port:49812
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:49.346125+0200
            SID:2849740
            Source Port:49964
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:08.807582+0200
            SID:2849740
            Source Port:50085
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:09.364213+0200
            SID:2849740
            Source Port:50372
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:57.510685+0200
            SID:2849740
            Source Port:50020
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:49.726547+0200
            SID:2849740
            Source Port:50266
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:32.247926+0200
            SID:2849740
            Source Port:50187
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:59.557611+0200
            SID:2849740
            Source Port:50027
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:29.510723+0200
            SID:2849740
            Source Port:50172
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:00.510704+0200
            SID:2849740
            Source Port:50035
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:41.834737+0200
            SID:2849740
            Source Port:50474
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:52.909247+0200
            SID:2849740
            Source Port:50285
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:50.685706+0200
            SID:2849740
            Source Port:50274
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:57.452787+0200
            SID:2849740
            Source Port:50019
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:46.401822+0200
            SID:2849740
            Source Port:50511
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:04.240268+0200
            SID:2849740
            Source Port:50058
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:45.312519+0200
            SID:2849740
            Source Port:50493
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:43.965136+0200
            SID:2849740
            Source Port:50482
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:39.206261+0200
            SID:2849740
            Source Port:50224
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:33.684613+0200
            SID:2849740
            Source Port:49862
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:22.348665+0200
            SID:2849740
            Source Port:50148
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:24.666958+0200
            SID:2849740
            Source Port:50156
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:20.760467+0200
            SID:2849740
            Source Port:50432
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:07.361283+0200
            SID:2849740
            Source Port:50077
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:19.510733+0200
            SID:2849740
            Source Port:50137
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:05.510705+0200
            SID:2849740
            Source Port:50066
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:58.777862+0200
            SID:2849740
            Source Port:50306
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:45.806707+0200
            SID:2849740
            Source Port:50503
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:37.914150+0200
            SID:2849740
            Source Port:50216
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:42.775017+0200
            SID:2849740
            Source Port:50478
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:35.297997+0200
            SID:2849740
            Source Port:49874
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:35.885864+0200
            SID:2849740
            Source Port:49881
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:58.743490+0200
            SID:2849740
            Source Port:50023
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:15.173986+0200
            SID:2849740
            Source Port:50412
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:34.921792+0200
            SID:2849740
            Source Port:50462
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:35.582652+0200
            SID:2849740
            Source Port:50204
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:10.573207+0200
            SID:2849740
            Source Port:50089
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:11.146224+0200
            SID:2849740
            Source Port:50096
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:56.692934+0200
            SID:2849740
            Source Port:50303
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:12.762848+0200
            SID:2849740
            Source Port:50391
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:42.602477+0200
            SID:2849740
            Source Port:50477
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:34.179661+0200
            SID:2849740
            Source Port:49869
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:13.719862+0200
            SID:2849740
            Source Port:50110
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:15.956253+0200
            SID:2849740
            Source Port:50117
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:31.198221+0200
            SID:2849740
            Source Port:50183
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:30.167071+0200
            SID:2849740
            Source Port:50176
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:48.621414+0200
            SID:2849740
            Source Port:50542
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:50.188432+0200
            SID:2849740
            Source Port:50564
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:50.233831+0200
            SID:2849740
            Source Port:50269
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:37.557543+0200
            SID:2849740
            Source Port:49897
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:58.746835+0200
            SID:2849740
            Source Port:50024
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:44.489983+0200
            SID:2849740
            Source Port:50247
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:02.716201+0200
            SID:2849740
            Source Port:50046
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:48.698261+0200
            SID:2849740
            Source Port:49961
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:29.402747+0200
            SID:2849740
            Source Port:49831
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:53.073165+0200
            SID:2849740
            Source Port:49983
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:18.870087+0200
            SID:2849740
            Source Port:50133
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:14.307589+0200
            SID:2849740
            Source Port:50111
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:15.662882+0200
            SID:2849740
            Source Port:49776
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:25.699562+0200
            SID:2849740
            Source Port:50144
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:05.753543+0200
            SID:2849740
            Source Port:50341
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:03.726778+0200
            SID:2849740
            Source Port:50329
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:34.640622+0200
            SID:2849740
            Source Port:50199
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:01.018008+0200
            SID:2849740
            Source Port:50318
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:31.276065+0200
            SID:2849740
            Source Port:49847
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:55.819519+0200
            SID:2849740
            Source Port:50297
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:06.908707+0200
            SID:2849740
            Source Port:50073
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:50.232665+0200
            SID:2849740
            Source Port:50270
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:52.428123+0200
            SID:2849740
            Source Port:50281
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:13.074147+0200
            SID:2849740
            Source Port:49759
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:51.398948+0200
            SID:2849740
            Source Port:50565
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:50.211290+0200
            SID:2849740
            Source Port:49967
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:47.306447+0200
            SID:2849740
            Source Port:49956
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:46.623030+0200
            SID:2849740
            Source Port:49945
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:43.451026+0200
            SID:2849740
            Source Port:49934
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:46.394376+0200
            SID:2849740
            Source Port:50510
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:45.306068+0200
            SID:2849740
            Source Port:50494
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:05.512903+0200
            SID:2849740
            Source Port:50063
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:13.427881+0200
            SID:2849740
            Source Port:50107
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:16.444396+0200
            SID:2849740
            Source Port:49784
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:36.857757+0200
            SID:2849740
            Source Port:49892
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:48.629659+0200
            SID:2849740
            Source Port:50546
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:54.815860+0200
            SID:2849740
            Source Port:50294
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:48.209939+0200
            SID:2849740
            Source Port:49957
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:05.442200+0200
            SID:2849740
            Source Port:50338
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:45.896315+0200
            SID:2849740
            Source Port:50502
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:38.747735+0200
            SID:2849740
            Source Port:49913
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:50.105078+0200
            SID:2849740
            Source Port:50271
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:16.339473+0200
            SID:2849740
            Source Port:50121
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:41.786359+0200
            SID:2849740
            Source Port:49928
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:33.559442+0200
            SID:2849740
            Source Port:50194
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:43.713780+0200
            SID:2849740
            Source Port:49936
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:36.024017+0200
            SID:2849740
            Source Port:50207
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:29.277492+0200
            SID:2849740
            Source Port:49828
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:07.912269+0200
            SID:2849740
            Source Port:50359
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:41.309383+0200
            SID:2849740
            Source Port:50471
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:13.638602+0200
            SID:2849740
            Source Port:50109
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:37.801618+0200
            SID:2849740
            Source Port:49905
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:20.700727+0200
            SID:2849740
            Source Port:50140
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:47.642286+0200
            SID:2849740
            Source Port:50533
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:12.747809+0200
            SID:2849740
            Source Port:50392
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:05.186418+0200
            SID:2849740
            Source Port:50336
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:45.781493+0200
            SID:2849740
            Source Port:50500
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:30.001346+0200
            SID:2849740
            Source Port:49840
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:35.888714+0200
            SID:2849740
            Source Port:49884
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:47.260507+0200
            SID:2849740
            Source Port:50525
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:15.338750+0200
            SID:2849740
            Source Port:50413
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:14.318840+0200
            SID:2849740
            Source Port:50402
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:56.628996+0200
            SID:2849740
            Source Port:50011
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:59.763977+0200
            SID:2849740
            Source Port:50317
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:11.604157+0200
            SID:2849740
            Source Port:50099
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:29.146229+0200
            SID:2849740
            Source Port:49817
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:57.161396+0200
            SID:2849740
            Source Port:50304
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:47.862274+0200
            SID:2849740
            Source Port:50535
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:17.877925+0200
            SID:2849740
            Source Port:49795
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:06.969078+0200
            SID:2849740
            Source Port:50349
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:17.898805+0200
            SID:2849740
            Source Port:49796
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:10.715470+0200
            SID:2849740
            Source Port:50383
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:29.155094+0200
            SID:2849740
            Source Port:49816
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:00.192598+0200
            SID:2849740
            Source Port:50031
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:14.460131+0200
            SID:2849740
            Source Port:50404
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:03.565002+0200
            SID:2849740
            Source Port:50053
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:56.430776+0200
            SID:2849740
            Source Port:50009
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:46.474516+0200
            SID:2849740
            Source Port:50512
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:46.481316+0200
            SID:2849740
            Source Port:49947
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:47.637902+0200
            SID:2849740
            Source Port:50534
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:41.464060+0200
            SID:2849740
            Source Port:49925
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:33.133455+0200
            SID:2849740
            Source Port:49860
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:30.001450+0200
            SID:2849740
            Source Port:49839
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:44.569028+0200
            SID:2849740
            Source Port:50492
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:58.107470+0200
            SID:2849740
            Source Port:50021
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:00.480587+0200
            SID:2849740
            Source Port:50032
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:02.504318+0200
            SID:2849740
            Source Port:50043
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:15.335683+0200
            SID:2849740
            Source Port:50414
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:18.516951+0200
            SID:2849740
            Source Port:50425
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:41.705353+0200
            SID:2849740
            Source Port:50240
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:39.148988+0200
            SID:2849740
            Source Port:49915
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:47.698282+0200
            SID:2849740
            Source Port:50262
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:43.707366+0200
            SID:2849740
            Source Port:49937
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:05.688616+0200
            SID:2849740
            Source Port:50065
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:48.571675+0200
            SID:2849740
            Source Port:49959
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:41.837909+0200
            SID:2849740
            Source Port:50239
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:09.095327+0200
            SID:2849740
            Source Port:50087
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:37.921426+0200
            SID:2849740
            Source Port:50217
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:31.480871+0200
            SID:2849740
            Source Port:50185
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:31.957644+0200
            SID:2849740
            Source Port:49849
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:13.970848+0200
            SID:2849740
            Source Port:50108
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:26.598382+0200
            SID:2849740
            Source Port:50163
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:12.757723+0200
            SID:2849740
            Source Port:50393
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:10.702613+0200
            SID:2849740
            Source Port:50382
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:50.870444+0200
            SID:2849740
            Source Port:49970
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:30.305184+0200
            SID:2849740
            Source Port:49841
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:53.522237+0200
            SID:2849740
            Source Port:50287
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:43.621231+0200
            SID:2849740
            Source Port:50480
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:40.166952+0200
            SID:2849740
            Source Port:49920
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:16.010721+0200
            SID:2849740
            Source Port:50120
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:13.067122+0200
            SID:2849740
            Source Port:49762
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:32.715283+0200
            SID:2849740
            Source Port:49856
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:43.464609+0200
            SID:2849740
            Source Port:49935
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:04.198608+0200
            SID:2849740
            Source Port:50056
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:11.906276+0200
            SID:2849740
            Source Port:50389
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:29.289631+0200
            SID:2849740
            Source Port:49829
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:45.861458+0200
            SID:2849740
            Source Port:49943
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:45.768293+0200
            SID:2849740
            Source Port:50501
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:58.774981+0200
            SID:2849740
            Source Port:50308
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:48.391690+0200
            SID:2849740
            Source Port:49958
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:07.901311+0200
            SID:2849740
            Source Port:50079
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:09.018742+0200
            SID:2849740
            Source Port:50366
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:31.707839+0200
            SID:2849740
            Source Port:49848
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:13.331377+0200
            SID:2849740
            Source Port:50397
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:26.510810+0200
            SID:2849740
            Source Port:50162
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:52.310847+0200
            SID:2849740
            Source Port:50280
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:49.565122+0200
            SID:2849740
            Source Port:50555
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:16.373264+0200
            SID:2849740
            Source Port:50418
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:59.418831+0200
            SID:2849740
            Source Port:50025
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:06.646520+0200
            SID:2849740
            Source Port:50347
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:06.760752+0200
            SID:2849740
            Source Port:50072
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:09.366432+0200
            SID:2849740
            Source Port:50370
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:07.702895+0200
            SID:2849740
            Source Port:50358
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:50.915330+0200
            SID:2849740
            Source Port:50558
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:48.726249+0200
            SID:2849740
            Source Port:50547
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:43.621166+0200
            SID:2849740
            Source Port:50479
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:12.166983+0200
            SID:2849740
            Source Port:50101
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:59.108579+0200
            SID:2849740
            Source Port:50312
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:39.760681+0200
            SID:2849740
            Source Port:49895
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:58.154233+0200
            SID:2849740
            Source Port:50022
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:01.147583+0200
            SID:2849740
            Source Port:50320
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:39.221987+0200
            SID:2849740
            Source Port:50230
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:42.821507+0200
            SID:2849740
            Source Port:50241
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:44.568489+0200
            SID:2849740
            Source Port:50487
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:51.188557+0200
            SID:2849740
            Source Port:49974
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:29.306534+0200
            SID:2849740
            Source Port:49830
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:51.862465+0200
            SID:2849740
            Source Port:50276
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:03.382947+0200
            SID:2849740
            Source Port:50052
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:01.898946+0200
            SID:2849740
            Source Port:50030
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:57.291209+0200
            SID:2849740
            Source Port:50017
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:51.803091+0200
            SID:2849740
            Source Port:50570
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:44.189905+0200
            SID:2849740
            Source Port:50248
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:02.635173+0200
            SID:2849740
            Source Port:50045
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:47.370152+0200
            SID:2849740
            Source Port:50260
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:09.978336+0200
            SID:2849740
            Source Port:50378
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:18.807672+0200
            SID:2849740
            Source Port:50132
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:54.963588+0200
            SID:2849740
            Source Port:50002
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:23.612707+0200
            SID:2849740
            Source Port:50154
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:52.002487+0200
            SID:2849740
            Source Port:50571
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:53.700632+0200
            SID:2849740
            Source Port:49990
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:35.298808+0200
            SID:2849740
            Source Port:49875
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:32.474260+0200
            SID:2849740
            Source Port:49853
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:39.257230+0200
            SID:2849740
            Source Port:50225
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:36.745491+0200
            SID:2849740
            Source Port:50203
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:36.701263+0200
            SID:2849740
            Source Port:50210
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:16.529099+0200
            SID:2849740
            Source Port:49782
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:02.179955+0200
            SID:2849740
            Source Port:50324
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:11.864289+0200
            SID:2849740
            Source Port:50100
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:28.184937+0200
            SID:2849740
            Source Port:50166
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:24.698678+0200
            SID:2849740
            Source Port:50155
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:21.917171+0200
            SID:2849740
            Source Port:49803
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:18.260809+0200
            SID:2849740
            Source Port:50127
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:13.326881+0200
            SID:2849740
            Source Port:50396
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:11.302822+0200
            SID:2849740
            Source Port:50385
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:09.372403+0200
            SID:2849740
            Source Port:50374
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:08.864656+0200
            SID:2849740
            Source Port:50084
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:51.370606+0200
            SID:2849740
            Source Port:50275
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:44.835554+0200
            SID:2849740
            Source Port:50253
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:34.499431+0200
            SID:2849740
            Source Port:50461
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:38.737441+0200
            SID:2849740
            Source Port:49912
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:14.548466+0200
            SID:2849740
            Source Port:50406
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:36.241111+0200
            SID:2849740
            Source Port:49891
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:37.544370+0200
            SID:2849740
            Source Port:49901
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:54.802347+0200
            SID:2849740
            Source Port:50292
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:49.500511+0200
            SID:2849740
            Source Port:50554
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:47.864583+0200
            SID:2849740
            Source Port:50543
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:35.300949+0200
            SID:2849740
            Source Port:49880
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:47.137700+0200
            SID:2849740
            Source Port:50521
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:44.219774+0200
            SID:2849740
            Source Port:50483
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:52.073181+0200
            SID:2849740
            Source Port:49978
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:10.960055+0200
            SID:2849740
            Source Port:50095
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:47.904377+0200
            SID:2849740
            Source Port:50265
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:47.306950+0200
            SID:2849740
            Source Port:50517
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:14.760768+0200
            SID:2849740
            Source Port:50113
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:15.524047+0200
            SID:2849740
            Source Port:49778
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:29.963525+0200
            SID:2849740
            Source Port:49834
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:29.268658+0200
            SID:2849740
            Source Port:50171
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:01.612223+0200
            SID:2849740
            Source Port:50321
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:41.858045+0200
            SID:2849740
            Source Port:50473
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:08.814456+0200
            SID:2849740
            Source Port:50367
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:08.242176+0200
            SID:2849740
            Source Port:50365
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:40.213806+0200
            SID:2849740
            Source Port:49921
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:44.788713+0200
            SID:2849740
            Source Port:50488
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:14.886032+0200
            SID:2849740
            Source Port:50409
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:13.901727+0200
            SID:2849740
            Source Port:50400
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:46.385654+0200
            SID:2849740
            Source Port:50509
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:36.679931+0200
            SID:2849740
            Source Port:49886
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:56.453591+0200
            SID:2849740
            Source Port:50300
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:30.809577+0200
            SID:2849740
            Source Port:49842
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:40.998292+0200
            SID:2849740
            Source Port:50236
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:06.360005+0200
            SID:2849740
            Source Port:50344
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:49.278107+0200
            SID:2849740
            Source Port:50550
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:38.142832+0200
            SID:2849740
            Source Port:49911
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:14.323330+0200
            SID:2849740
            Source Port:50407
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:55.544426+0200
            SID:2849740
            Source Port:50003
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:46.926596+0200
            SID:2849740
            Source Port:50519
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:03.073271+0200
            SID:2849740
            Source Port:50047
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:46.462279+0200
            SID:2849740
            Source Port:50257
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:29.410668+0200
            SID:2849740
            Source Port:49832
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:04.510688+0200
            SID:2849740
            Source Port:50061
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:34.698251+0200
            SID:2849740
            Source Port:50200
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:11.529288+0200
            SID:2849740
            Source Port:50094
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:18.702537+0200
            SID:2849740
            Source Port:49799
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:17.698211+0200
            SID:2849740
            Source Port:50123
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:02.179609+0200
            SID:2849740
            Source Port:50323
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:28.256497+0200
            SID:2849740
            Source Port:50167
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:14.881172+0200
            SID:2849740
            Source Port:50410
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:26.139693+0200
            SID:2849740
            Source Port:50159
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:16.307595+0200
            SID:2849740
            Source Port:50115
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:31.564243+0200
            SID:2849740
            Source Port:50181
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:06.041289+0200
            SID:2849740
            Source Port:50342
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:33.178021+0200
            SID:2849740
            Source Port:50192
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:09.406858+0200
            SID:2849740
            Source Port:50375
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:11.300612+0200
            SID:2849740
            Source Port:50386
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:45.277354+0200
            SID:2849740
            Source Port:50498
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:09.979631+0200
            SID:2849740
            Source Port:50377
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:12.547641+0200
            SID:2849740
            Source Port:50102
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:47.249336+0200
            SID:2849740
            Source Port:50528
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:17.667002+0200
            SID:2849740
            Source Port:50124
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:48.142803+0200
            SID:2849740
            Source Port:50541
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:21.057634+0200
            SID:2849740
            Source Port:50146
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:13.747854+0200
            SID:2849740
            Source Port:49767
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:12.355457+0200
            SID:2849740
            Source Port:50103
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:07.353352+0200
            SID:2849740
            Source Port:50354
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:08.363382+0200
            SID:2849740
            Source Port:50081
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:09.407432+0200
            SID:2849740
            Source Port:50376
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:01.903728+0200
            SID:2849740
            Source Port:50038
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:56.301814+0200
            SID:2849740
            Source Port:50299
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:51.955642+0200
            SID:2849740
            Source Port:50277
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:13.247632+0200
            SID:2849740
            Source Port:49768
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:55.319396+0200
            SID:2849740
            Source Port:49998
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:08.516298+0200
            SID:2849740
            Source Port:50082
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:59.313817+0200
            SID:2849740
            Source Port:50026
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:53.917761+0200
            SID:2849740
            Source Port:50289
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:16.362925+0200
            SID:2849740
            Source Port:50419
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:24.665035+0200
            SID:2849740
            Source Port:50442
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:42.296859+0200
            SID:2849740
            Source Port:50475
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:35:33.034117+0200
            SID:2849740
            Source Port:50191
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:36.378928+0200
            SID:2849740
            Source Port:50464
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:44.561375+0200
            SID:2849740
            Source Port:50486
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:13.512936+0200
            SID:2849740
            Source Port:50398
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:47.644130+0200
            SID:2849740
            Source Port:50540
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:17.101582+0200
            SID:2849740
            Source Port:49790
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:49.375024+0200
            SID:2849740
            Source Port:50551
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:52.004912+0200
            SID:2849740
            Source Port:50573
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:34.667222+0200
            SID:2849740
            Source Port:49866
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:47.744200+0200
            SID:2849740
            Source Port:50529
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:24.537917+0200
            SID:2849740
            Source Port:49811
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:36:47.035054+0200
            SID:2849740
            Source Port:50518
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected
            Timestamp:2024-07-22T12:34:29.972712+0200
            SID:2849740
            Source Port:49833
            Destination Port:443
            Protocol:TCP
            Classtype:Possibly Unwanted Program Detected

            Joe Sandbox Signatures

            Click to jump to signature section

            Show All Signature Results

            AV Detection

            barindex
            Multi AV Scanner detection for dropped file
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanionInstaller.exeReversingLabs: Detection: 13%
            Source: DCIService.exe, 0000001C.00000000.2321641309.00007FF7EB15A000.00000002.00000001.01000000.0000002B.sdmpBinary or memory string: -----BEGIN PUBLIC KEY-----memstr_0edcd9ff-b

            Compliance

            barindex
            Uses 32bit PE files
            Source: FileZilla_3.67.1_win64_sponsored-setup.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
            Found installer window with terms and condition text
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeWindow detected: I &AgreeCancelNullsoft Install System v3.09 Nullsoft Install System v3.09License AgreementPlease review the license terms before installing FileZilla Client 3.67.1.Press Page Down to see the rest of the agreement. GNU GENERAL PUBLIC LICENSE Version 2 June 1991 Copyright (C) 1989 1991 Free Software Foundation Inc. 59 Temple Place Suite 330 Boston MA 02111-1307 USA Everyone is permitted to copy and distribute verbatim copies of this license document but changing it is not allowed. Preamble The licenses for most software are designed to take away yourfreedom to share and change it. By contrast the GNU General PublicLicense is intended to guarantee your freedom to share and change freesoftware--to make sure the software is free for all its users. ThisGeneral Public License applies to most of the Free SoftwareFoundation's software and to any other program whose authors commit tousing it. (Some other Free Software Foundation software is covered bythe GNU Library General Public License instead.) You can apply it toyour programs too. When we speak of free software we are referring to freedom notprice. Our General Public Licenses are designed to make sure that youhave the freedom to distribute copies of free software (and charge forthis service if you wish) that you receive source code or can get itif you want it that you can change the software or use pieces of itin new free programs; and that you know you can do these things. To protect your rights we need to make restrictions that forbidanyone to deny you these rights or to ask you to surrender the rights.These restrictions translate to certain responsibilities for you if youdistribute copies of the software or if you modify it. For example if you distribute copies of such a program whethergratis or for a fee you must give the recipients all the rights thatyou have. You must make sure that they too receive or can get thesource code. And you must show them these terms so they know theirrights. We protect your rights with two steps: (1) copyright the software and(2) offer you this license which gives you legal permission to copydistribute and/or modify the software. Also for each author's protection and ours we want to make certainthat everyone understands that there is no warranty for this freesoftware. If the software is modified by someone else and passed on wewant its recipients to know that what they have is not the original sothat any problems introduced by others will not reflect on the originalauthors' reputations. Finally any free program is threatened constantly by softwarepatents. We wish to avoid the danger that redistributors of a freeprogram will individually obtain patent licenses in effect making theprogram proprietary. To prevent this we have made it clear that anypatent must be licensed for everyone's free use or not licensed at all. The precise terms and conditions for copying distribution andmodification follow. GNU GENERAL PUBLIC LICEN
            Creates a directory in C:\Program Files
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP ClientJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\filezilla.exeJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\fzsftp.exeJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\fzputtygen.exeJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\fzstorj.exeJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\GPL.htmlJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\NEWSJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\AUTHORSJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\libgmp-10.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\libnettle-8.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\libhogweed-6.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\libgcc_s_seh-1.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\libgnutls-30.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\libstdc++-6.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\libfilezilla-45.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\libfzclient-private-3-67-1.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\libfzclient-commonui-private-3-67-1.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\zlib1.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\wxbase32u_gcc_custom.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\libpng16-16.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\wxmsw32u_core_gcc_custom.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\wxmsw32u_aui_gcc_custom.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\wxbase32u_xml_gcc_custom.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\wxmsw32u_xrc_gcc_custom.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\libsqlite3-0.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resourcesJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\defaultfilters.xmlJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\finished.wavJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\16x16Jump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\16x16\filezilla.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\16x16\unknown.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\16x16\throbber.gifJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\20x20Jump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\20x20\unknown.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\24x24Jump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\24x24\unknown.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\32x32Jump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\32x32\filezilla.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\48x48Jump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\48x48\filezilla.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\480x480Jump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\480x480\filezilla.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\defaultJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\theme.xmlJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480Jump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\ascii.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\auto.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\binary.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\bookmark.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\bookmarks.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\cancel.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\close.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\compare.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\disconnect.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\download.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\downloadadd.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\dropdown.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\file.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\filter.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\find.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\folder.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\folderback.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\folderclosed.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\folderup.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\help.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\leds.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\localtreeview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\lock.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\logview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\processqueue.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\queueview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\reconnect.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\refresh.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\remotetreeview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\server.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\showhidden.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\sitemanager.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\sort_down_dark.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\sort_down_light.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\sort_up_dark.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\sort_up_light.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\speedlimits.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\symlink.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\synchronize.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\synctransfer.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\treeitem_collapsed_dark.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\treeitem_collapsed_light.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\treeitem_expanded_dark.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\treeitem_expanded_light.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\upload.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\uploadadd.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\docsJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\docs\fzdefaults.xml.exampleJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\uninstall.exeJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukisJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\theme.xmlJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\16x16Jump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\ascii.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\auto.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\binary.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\bookmark.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\bookmarks.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\cancel.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\compare.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\disconnect.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\download.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\downloadadd.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\file.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\filter.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\find.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\folder.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\folderback.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\folderclosed.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\folderup.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\help.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\localtreeview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\lock.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\logview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\processqueue.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\queueview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\reconnect.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\refresh.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\remotetreeview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\server.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\showhidden.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\sitemanager.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\speedlimits.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\symlink.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\synchronize.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\upload.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\uploadadd.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\32x32Jump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\ascii.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\auto.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\binary.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\bookmark.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\bookmarks.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\cancel.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\compare.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\disconnect.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\download.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\downloadadd.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\file.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\filter.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\find.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\folder.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\folderback.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\folderclosed.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\folderup.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\help.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\localtreeview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\lock.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\logview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\processqueue.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\queueview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\reconnect.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\refresh.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\remotetreeview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\server.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\showhidden.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\sitemanager.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\speedlimits.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\symlink.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\synchronize.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\upload.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\uploadadd.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\48x48Jump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\ascii.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\auto.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\binary.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\bookmark.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\bookmarks.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\cancel.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\compare.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\disconnect.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\download.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\downloadadd.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\file.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\filter.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\find.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\folder.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\folderback.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\folderclosed.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\folderup.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\help.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\localtreeview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\lock.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\logview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\processqueue.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\queueview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\reconnect.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\refresh.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\remotetreeview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\server.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\showhidden.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\sitemanager.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\speedlimits.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\symlink.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\synchronize.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\upload.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\uploadadd.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\classicJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\classic\theme.xmlJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\classic\16x16Jump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\classic\16x16\ascii.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\classic\16x16\auto.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\classic\16x16\binary.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\classic\16x16\bookmark.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\classic\16x16\cancel.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\classic\16x16\compare.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\classic\16x16\disconnect.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\classic\16x16\download.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\classic\16x16\downloadadd.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\classic\16x16\file.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\classic\16x16\filter.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\classic\16x16\find.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\classic\16x16\folder.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\classic\16x16\folderclosed.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\classic\16x16\localtreeview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\classic\16x16\lock.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\classic\16x16\logview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\classic\16x16\processqueue.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\classic\16x16\queueview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\classic\16x16\reconnect.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\classic\16x16\refresh.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\classic\16x16\remotetreeview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\classic\16x16\server.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\classic\16x16\sitemanager.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\classic\16x16\speedlimits.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\classic\16x16\symlink.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\classic\16x16\synchronize.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\classic\16x16\upload.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\classic\16x16\uploadadd.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\cyrilJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\cyril\theme.xmlJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\cyril\16x16Jump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\ascii.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\auto.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\binary.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\bookmark.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\cancel.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\compare.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\disconnect.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\download.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\downloadadd.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\file.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\folder.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\folderback.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\folderclosed.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\folderup.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\help.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\localtreeview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\logview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\processqueue.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\queueview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\reconnect.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\refresh.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\remotetreeview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\server.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\showhidden.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\sitemanager.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\speedlimits.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\synchronize.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\upload.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\uploadadd.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzillaJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\theme.xmlJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16Jump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\ascii.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\auto.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\binary.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\bookmark.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\cancel.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\compare.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\disconnect.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\download.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\downloadadd.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\file.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\filter.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\find.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\folder.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\folderclosed.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\help.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\leds.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\localtreeview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\lock.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\logview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\processqueue.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\queueview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\reconnect.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\refresh.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\remotetreeview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\server.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\sitemanager.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\speedlimits.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\synchronize.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\upload.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\uploadadd.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24Jump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\ascii.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\auto.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\binary.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\bookmark.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\cancel.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\compare.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\disconnect.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\download.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\downloadadd.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\file.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\filter.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\find.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\folder.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\folderclosed.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\help.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\leds.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\localtreeview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\lock.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\logview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\processqueue.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\queueview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\reconnect.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\refresh.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\remotetreeview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\server.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\sitemanager.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\speedlimits.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\synchronize.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\upload.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\uploadadd.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32Jump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\ascii.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\auto.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\binary.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\bookmark.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\cancel.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\compare.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\disconnect.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\download.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\downloadadd.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\file.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\filter.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\find.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\folder.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\folderclosed.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\help.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\leds.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\localtreeview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\lock.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\logview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\processqueue.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\queueview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\reconnect.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\refresh.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\remotetreeview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\server.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\sitemanager.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\speedlimits.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\synchronize.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\upload.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\uploadadd.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48Jump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\ascii.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\auto.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\binary.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\bookmark.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\cancel.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\compare.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\disconnect.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\download.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\downloadadd.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\file.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\filter.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\find.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\folder.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\folderclosed.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\help.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\leds.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\localtreeview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\lock.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\logview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\processqueue.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\queueview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\reconnect.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\refresh.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\remotetreeview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\server.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\sitemanager.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\speedlimits.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\synchronize.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\upload.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\uploadadd.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\loneJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\theme.xmlJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\16x16Jump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\16x16\ascii.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\16x16\auto.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\16x16\binary.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\16x16\bookmark.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\16x16\cancel.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\16x16\compare.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\16x16\disconnect.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\16x16\download.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\16x16\downloadadd.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\16x16\file.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\16x16\filter.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\16x16\folder.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\16x16\folderback.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\16x16\folderclosed.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\16x16\folderup.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\16x16\help.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\16x16\localtreeview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\16x16\lock.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\16x16\logview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\16x16\processqueue.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\16x16\queueview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\16x16\reconnect.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\16x16\refresh.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\16x16\remotetreeview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\16x16\server.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\16x16\showhidden.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\16x16\sitemanager.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\16x16\speedlimits.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\16x16\synchronize.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\16x16\upload.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\16x16\uploadadd.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\32x32Jump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\32x32\ascii.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\32x32\auto.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\32x32\binary.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\32x32\bookmark.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\32x32\cancel.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\32x32\compare.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\32x32\disconnect.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\32x32\download.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\32x32\downloadadd.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\32x32\file.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\32x32\filter.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\32x32\folder.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\32x32\folderback.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\32x32\folderclosed.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\32x32\folderup.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\32x32\help.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\32x32\localtreeview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\32x32\lock.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\32x32\logview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\32x32\processqueue.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\32x32\queueview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\32x32\reconnect.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\32x32\refresh.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\32x32\remotetreeview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\32x32\showhidden.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\32x32\sitemanager.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\32x32\speedlimits.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\32x32\synchronize.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\32x32\upload.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\32x32\uploadadd.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\48x48Jump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\48x48\ascii.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\48x48\auto.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\48x48\binary.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\48x48\bookmark.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\48x48\cancel.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\48x48\compare.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\48x48\disconnect.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\48x48\download.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\48x48\downloadadd.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\48x48\file.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\48x48\filter.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\48x48\folder.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\48x48\folderback.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\48x48\folderclosed.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\48x48\folderup.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\48x48\help.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\48x48\localtreeview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\48x48\lock.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\48x48\logview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\48x48\processqueue.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\48x48\queueview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\48x48\reconnect.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\48x48\refresh.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\48x48\remotetreeview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\48x48\showhidden.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\48x48\sitemanager.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\48x48\speedlimits.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\48x48\synchronize.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\48x48\upload.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\48x48\uploadadd.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\minimalJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\minimal\theme.xmlJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\minimal\16x16Jump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\minimal\16x16\ascii.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\minimal\16x16\auto.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\minimal\16x16\binary.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\minimal\16x16\bookmark.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\minimal\16x16\bookmarks.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\minimal\16x16\cancel.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\minimal\16x16\compare.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\minimal\16x16\disconnect.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\minimal\16x16\download.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\minimal\16x16\downloadadd.pngJump to behavior
            Creates a software uninstall entry
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeRegistry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FileZilla ClientJump to behavior
            Creates install or setup log file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Users\user\AppData\Local\Temp\WcInstaller.logJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\ProgramData\Lavasoft\Web Companion\Options\install.txtJump to behavior
            PE / OLE file has a valid certificate
            Source: FileZilla_3.67.1_win64_sponsored-setup.exeStatic PE information: certificate valid
            Uses new MSVCR Dlls
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dllJump to behavior
            Uses secure TLS version for HTTPS connections
            Source: unknownHTTPS traffic detected: 49.12.121.47:443 -> 192.168.2.4:49733 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.19.159.224:443 -> 192.168.2.4:49738 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.19.208.152:443 -> 192.168.2.4:49745 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:49749 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49750 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:49757 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:49755 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:49760 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49762 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49759 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:49761 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:49764 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:49766 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49768 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49767 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49765 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:49770 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:49774 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49778 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49776 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:49781 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:49783 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49785 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49791 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49789 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49790 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49782 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49794 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49803 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:49809 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49812 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49811 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:49815 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:49814 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49817 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49828 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49829 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:49827 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49822 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:49835 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49833 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49832 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49831 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49830 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49834 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49840 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49841 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49839 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49842 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49847 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:49851 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:49850 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49854 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49857 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49869 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:49871 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:49873 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49874 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49875 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:49876 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49880 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49881 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49884 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:49882 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:49878 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49888 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49887 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49891 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49892 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49901 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49905 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49906 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49907 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:49910 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49912 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49913 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:49919 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49922 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49923 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49934 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49935 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49979 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49996 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49997 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50003 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50009 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50011 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50024 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50026 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50025 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:50041 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50049 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50159 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50185 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50187 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50191 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50194 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:50205 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50203 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:50211 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:50212 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:50218 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:50221 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50224 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50225 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:50233 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:50226 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:50231 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:50232 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:50228 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:50234 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50236 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:50235 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50240 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50239 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50241 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50243 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:50242 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:50245 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50246 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50249 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50248 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50247 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50252 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50253 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50254 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50256 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50257 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50258 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50259 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50261 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50264 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50265 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50267 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50266 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50271 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50268 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50270 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50269 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50272 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50274 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50275 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50273 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50276 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50277 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50278 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50280 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50279 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50281 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50284 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50285 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50286 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50287 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50288 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50289 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50292 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50295 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50294 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50293 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50297 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50296 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50296 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50299 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50298 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50300 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50302 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50303 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50304 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50305 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50309 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50308 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50306 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50307 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50310 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50314 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50313 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50312 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50317 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50319 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50318 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50320 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50321 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50322 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50323 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50324 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50326 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50327 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50328 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50329 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50330 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50333 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50336 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50338 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50341 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50340 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50339 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50342 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50343 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50344 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50345 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50347 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50349 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50351 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50351 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50352 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50354 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50355 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50357 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50358 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50359 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50363 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50362 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50365 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50367 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50366 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50369 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50368 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50370 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50372 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50373 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50376 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50374 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50375 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50378 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50377 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50382 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50383 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50386 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50385 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50389 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50392 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50393 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50391 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50396 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50397 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50398 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50400 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50402 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50401 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50404 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50406 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50405 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50407 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50409 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50410 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50412 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50413 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50414 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50419 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50418 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50425 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50432 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50442 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50461 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50462 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50463 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50464 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50471 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50474 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50473 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50475 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50477 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50478 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50479 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50480 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50482 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50483 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50486 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50487 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50488 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50489 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50490 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50498 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50491 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50492 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50494 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50493 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50501 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50500 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50503 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50502 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50505 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50506 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50509 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50510 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50511 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50512 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50519 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50514 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50516 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50518 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50521 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50523 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50517 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50525 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50524 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50528 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50526 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50532 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50529 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50534 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50533 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50527 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50539 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50537 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50541 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50542 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50540 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50546 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50547 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50544 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50543 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50549 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50550 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50551 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50535 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50554 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50555 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50545 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50556 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50559 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50558 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50560 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50563 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50562 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50564 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50568 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50565 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50570 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50571 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50573 version: TLS 1.2
            Contains modern PE file flags such as dynamic base (ASLR) or NX
            Source: FileZilla_3.67.1_win64_sponsored-setup.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
            Binary contains paths to debug symbols
            Source: Binary string: c:\Projects\WebCompanion\Common\SearchProtect.Service.Logger\obj\Debug\Lavasoft.WCAssistant.Service.Logger.pdb source: Lavasoft.WCAssistant.Service.Logger.dll.3.dr
            Source: Binary string: crypto\stack\stack.ccompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PICcrypto\ex_data.c source: DCIService.exe, 0000001C.00000000.2321641309.00007FF7EB15A000.00000002.00000001.01000000.0000002B.sdmp
            Source: Binary string: api-ms-win-crt-utility-l1-1-0.pdb source: api-ms-win-crt-utility-l1-1-0.dll.3.dr
            Source: Binary string: d:\agent\_work\2\s\\binaries\amd64ret\bin\amd64\\msvcp140_codecvt_ids.amd64.pdb source: msvcp140_codecvt_ids.dll0.3.dr
            Source: Binary string: api-ms-win-core-string-l1-1-0.pdb source: api-ms-win-core-string-l1-1-0.dll.3.dr
            Source: Binary string: c:\Windows\Temp\drone-ITnqm7dmUCKa46Dt\drone\src\WebCompanion\Companion.UI\obj\x86\Debug\WebCompanion.pdb source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmp
            Source: Binary string: api-ms-win-core-console-l1-1-0.pdb source: api-ms-win-core-console-l1-1-0.dll.3.dr
            Source: Binary string: C:\Windows\TEMP\drone-kwRqivJrrmmjgcRp\drone\src\DCIService\x64\Release\DCIService.pdb source: DCIService.exe, 0000001C.00000000.2321641309.00007FF7EB15A000.00000002.00000001.01000000.0000002B.sdmp
            Source: Binary string: c:\Temp\Release\Working\Newtonsoft.Json\Src\Newtonsoft.Json\obj\Release\Newtonsoft.Json.pdb source: WcInstaller.exe, 00000002.00000003.1866843878.00000000021C3000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000028.00000002.2591364130.0000000006C62000.00000002.00000001.01000000.00000040.sdmp
            Source: Binary string: c:\Windows\Temp\drone-ITnqm7dmUCKa46Dt\drone\src\WebCompanion\Installer\WebCompanionInstaller\obj\Release\WebCompanionInstaller.pdb source: WcInstaller.exe, 00000002.00000003.1867085226.00000000005D0000.00000004.00001000.00020000.00000000.sdmp, WcInstaller.exe, 00000002.00000003.1866843878.00000000021C3000.00000004.00000020.00020000.00000000.sdmp, WebCompanionInstaller.exe, 00000003.00000000.1867314648.0000000000782000.00000002.00000001.01000000.0000000F.sdmp
            Source: Binary string: E:\builds\DCI-BDDCI345-ISV_new\bin\x64\Release\bddci.pdb source: rundll32.exe, 0000000F.00000003.2309637269.000001B0C8176000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: c:\Windows\Temp\drone-ITnqm7dmUCKa46Dt\drone\src\WebCompanion\Companion.UI\obj\x86\Debug\WebCompanion.pdb` source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmp
            Source: Binary string: C:\Projects\WebCompanion\Common\SearchProtect.WinService\obj\Debug\Lavasoft.WCAssistant.WinService.pdb source: Lavasoft.WCAssistant.WinService.exe, 00000022.00000000.2458759751.00000000006F2000.00000002.00000001.01000000.0000004B.sdmp
            Source: Binary string: D:\Projects\Adaware\webcompanion\Common\SearchProtect.Business\obj\x86\Debug\Lavasoft.SearchProtect.Business.pdb source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmp
            Source: Binary string: D:\Projects\Adaware\webcompanion\Common\Lavasoft.Utils\obj\x86\Debug\Lavasoft.Utils.pdb source: WebCompanion.exe, 00000028.00000002.2590279307.0000000006A72000.00000002.00000001.01000000.0000003E.sdmp
            Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC source: DCIService.exe, 0000001C.00000000.2321641309.00007FF7EB15A000.00000002.00000001.01000000.0000002B.sdmp
            Source: Binary string: D:\Projects\Adaware\webcompanion\Common\Lavasoft.Events\obj\x86\Debug\Lavasoft.Events.pdb source: WebCompanion.exe, 00000028.00000002.2590522947.0000000006AC2000.00000002.00000001.01000000.0000003F.sdmp
            Source: Binary string: c:\Windows\Temp\drone-ITnqm7dmUCKa46Dt\drone\src\WebCompanion\Lavasoft.AppCore\obj\Debug\Lavasoft.AppCore.pdb source: WebCompanion.exe, 00000028.00000002.2589134775.00000000065A2000.00000002.00000001.01000000.0000003D.sdmp
            Source: Binary string: api-ms-win-crt-string-l1-1-0.pdb source: api-ms-win-crt-string-l1-1-0.dll0.3.dr
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeFile opened: C:\Users\user\AppData\RoamingJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.iniJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeFile opened: C:\Users\userJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeFile opened: C:\Users\user\AppData\Roaming\MicrosoftJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeFile opened: C:\Users\user\AppDataJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\WindowsJump to behavior

            Networking

            barindex
            Yara detected Generic Downloader
            Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe, type: DROPPED
            Source: Yara matchFile source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.adblocker.dll, type: DROPPED
            Source: Yara matchFile source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Search.exe, type: DROPPED
            Source: Yara matchFile source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll, type: DROPPED
            Source: Yara matchFile source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanionInstaller.exe, type: DROPPED
            Source: Yara matchFile source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe, type: DROPPED
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/dci/latest/Webprotection.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /api/v2/url/permanentwhitelist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /permanentUrlWhitelist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 364Connection: Keep-Alive
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 364Connection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 364Connection: Keep-Alive
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=DownloadError&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 411Connection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=DownloadError&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 411
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 364
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 364
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 364
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 364
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /api/v2/url/permanentwhitelist HTTP/1.1Host: acs.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 364Connection: Keep-Alive
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=Error&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 665Connection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=Error&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 665
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 364
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 364
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=DownloadError&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 517
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=Error&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 665
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=DownloadError&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 517
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=Error&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 665
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 364Connection: Keep-Alive
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 364Connection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=Error&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 665
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 364
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 364
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=BrowserExtension&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 3043
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=NanoBrowser&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 1654
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=NanoBrowser&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 1649
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 364
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=Error&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 665
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 364
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=Error&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 665
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 364
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=Error&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 665
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=Error&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 665
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=BrowserExtension&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 3043Connection: Keep-Alive
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=BrowserExtension&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 3043Connection: Keep-Alive
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 364Connection: Keep-Alive
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=Error&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 665Connection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 364
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 364
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=Error&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 665
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 364
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 364
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=BrowserExtension&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 3043
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 364
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=BrowserExtension&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 3043
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 364
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=Error&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 665
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=BrowserExtension&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 3043
            Source: global trafficHTTP traffic detected: GET /api/v2/url/permanentwhitelist HTTP/1.1Host: acs.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=BrowserExtension&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 3043
            Source: global trafficHTTP traffic detected: GET /permanentUrlWhitelist.json HTTP/1.1Host: acscdn.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=BrowserExtension&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 3043
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/permanentwhitelist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 364Connection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /api/v2/url/permanentwhitelist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=BrowserExtension&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 3043
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /permanentUrlWhitelist.json HTTP/1.1Host: acscdn.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /permanentUrlWhitelist.json HTTP/1.1Host: acscdn.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=NanoBrowser&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 1654
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 364
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=NanoBrowser&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 1654
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 364
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 364
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=ValidateMicrotargeting&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 683
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=ValidateMicrotargeting&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 683
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/permanentwhitelist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=BrowserExtension&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 3043
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=NanoBrowser&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 1654
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=BrowserExtension&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 3043
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=NanoBrowser&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 1654
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=ValidateMicrotargeting&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 683
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=BrowserExtension&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 3043
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=BrowserExtension&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 3043
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=BrowserExtension&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 3043
            Source: global trafficHTTP traffic detected: GET /permanentUrlWhitelist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=Error&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 665
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=FeatureActionInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 513
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=ValidateMicrotargeting&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 683
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=BrowserExtension&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 3043
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=NanoBrowser&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 1654
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 364
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 364
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=ValidateMicrotargeting&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 684
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=BrowserExtension&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 3043
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=ValidateMicrotargeting&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 683
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=Error&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 665
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=Error&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 1612
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=NanoBrowser&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 1654
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=BrowserExtension&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 3043
            Source: global trafficHTTP traffic detected: GET /api/v2/url/permanentwhitelist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=BrowserExtension&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 3043
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=FeatureActionInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 510
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 364
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 364
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=FeatureActionInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 513
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=BrowserExtension&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 3043
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=BrowserExtension&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 3043
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=FeatureActionInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 513
            Source: global trafficHTTP traffic detected: GET /permanentUrlWhitelist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 364
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=Error&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 665
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 364
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=NanoBrowser&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 1654
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 364
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=BrowserExtension&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 3043
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=NanoBrowser&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 1654
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 364
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=Error&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 1612
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 364
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=Error&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 665
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=ValidateMicrotargeting&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 683
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=FeatureActionInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 510
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=DownloadError&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 411
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=ValidateMicrotargeting&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 683
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 364
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 364
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=NanoBrowser&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 1654
            Source: global trafficHTTP traffic detected: GET /api/v2/url/permanentwhitelist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=ValidateMicrotargeting&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 678
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=ValidateMicrotargeting&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 683
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=Error&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 665
            Source: global trafficHTTP traffic detected: GET /api/v2/url/permanentwhitelist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /permanentUrlWhitelist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 364
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=NanoBrowser&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 1654
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=BrowserExtension&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 3043
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=BrowserExtension&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 3043
            Source: global trafficHTTP traffic detected: GET /api/v2/url/permanentwhitelist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 364
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=FeatureActionInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 1059
            Source: global trafficHTTP traffic detected: GET /permanentUrlWhitelist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /permanentUrlWhitelist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=FeatureActionInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 1059
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=DownloadError&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 517
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=BrowserExtension&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 3043
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 364
            Source: global trafficHTTP traffic detected: GET /api/v2/url/permanentwhitelist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 364
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=ValidateMicrotargeting&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 683
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 364
            Source: global trafficHTTP traffic detected: GET /api/v2/url/permanentwhitelist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=FeatureActionInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 513
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 364
            Source: global trafficHTTP traffic detected: GET /permanentUrlWhitelist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 364
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=FeatureActionInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 925
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 364
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=FeatureActionInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 513
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=FeatureActionInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 513
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/permanentwhitelist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/permanentwhitelist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=BrowserExtension&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 3043
            Source: global trafficHTTP traffic detected: GET /permanentUrlWhitelist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 364
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=ValidateMicrotargeting&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 683
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 364
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=ValidateMicrotargeting&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 683
            Source: global trafficHTTP traffic detected: GET /permanentUrlWhitelist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 364
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=BrowserExtension&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 3043
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=FeatureActionInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 510
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=FeatureActionInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 513
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=FeatureActionInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 516
            Source: global trafficHTTP traffic detected: GET /api/v2/url/permanentwhitelist HTTP/1.1Host: acs.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /api/v2/url/permanentwhitelist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 364
            Source: global trafficHTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 364
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 538Connection: Keep-Alive
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 413
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 419
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 397
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 389
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 391
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 406
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 422
            Source: global trafficHTTP traffic detected: POST /update.asmx HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/GetComponentsVersionInfo"Host: wc-update-service.lavasoft.comContent-Length: 280Connection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /9.1.0.993/WebCompanion-9.1.0.993-prod.zip HTTP/1.1Host: wcdownloadercdn.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 448
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 422
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 427
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 438
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 422
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 425
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 420
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 397
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 397
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 418
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 414
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 457
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 470
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 464
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 434
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 458
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 459
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 442
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 453
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 452
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 452
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /Partner.svc/GetPartnerInfo?partner=FZ210427 HTTP/1.1Host: wc-partners.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /Partner.svc/GetPartnerInfo?partner=FZ210427_wb HTTP/1.1Host: wc-partners.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /Partner.svc/GetPartnerInfo?partner=FZ210427_ab HTTP/1.1Host: wc-partners.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /Partner.svc/GetPartnerInfo?partner=FZ210427_ac HTTP/1.1Host: wc-partners.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 239Connection: Keep-Alive
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 239Connection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 239
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 239
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 239
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 239
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 239
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 239
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 239
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 239
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 239
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 239
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=FirstRun&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 265
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 239
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 239
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 239
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 239Connection: Keep-Alive
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 239Connection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 239Connection: Keep-Alive
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 239Connection: Keep-Alive
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 239
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 239
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 239
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 239
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 239
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 239
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: POST /ipservice.asmx HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://lavasoft.com/GetLocation"Host: wsgeoip.lavasoft.comContent-Length: 236Connection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 239Connection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 239Connection: Keep-Alive
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 239
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: POST /ipservice.asmx HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://lavasoft.com/GetLocation"Host: wsgeoip.lavasoft.comContent-Length: 236Connection: Keep-Alive
            Source: global trafficHTTP traffic detected: POST /ipservice.asmx HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://lavasoft.com/GetLocation"Host: wsgeoip.lavasoft.comContent-Length: 236Connection: Keep-Alive
            Source: global trafficHTTP traffic detected: POST /ipservice.asmx HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://lavasoft.com/GetLocation"Host: wsgeoip.lavasoft.comContent-Length: 236
            Source: global trafficHTTP traffic detected: POST /ipservice.asmx HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://lavasoft.com/GetLocation"Host: wsgeoip.lavasoft.comContent-Length: 236
            Source: global trafficHTTP traffic detected: POST /components.asmx HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/GetComponentsInfo"Host: wc-update-service.lavasoft.comContent-Length: 342Connection: Keep-Alive
            Source: global trafficHTTP traffic detected: POST /ipservice.asmx HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://lavasoft.com/GetLocation"Host: wsgeoip.lavasoft.comContent-Length: 236
            Source: global trafficHTTP traffic detected: POST /ipservice.asmx HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://lavasoft.com/GetLocation"Host: wsgeoip.lavasoft.comContent-Length: 236
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /version_logs?json=true&version=9.1.0.993 HTTP/1.1Host: webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: POST /ipservice.asmx HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://lavasoft.com/GetLocation"Host: wsgeoip.lavasoft.comContent-Length: 236Connection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 239Connection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 239Connection: Keep-Alive
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 239Connection: Keep-Alive
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 239Connection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 239
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 239
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 239Connection: Keep-Alive
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 239Connection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: POST /components.asmx HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/GetComponentsInfo"Host: wc-update-service.lavasoft.comContent-Length: 342Connection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 239Connection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /version_logs?json=true&version=9.1.0.993 HTTP/1.1Host: webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 239Connection: Keep-Alive
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 239Connection: Keep-Alive
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 239
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 239
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 239
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 239
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 239
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 239
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 239
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /version_logs?json=true&version=9.1.0.993 HTTP/1.1Host: webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 239Connection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 239
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 239Connection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 239Connection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 239Connection: Keep-Alive
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 239Connection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 239
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 239
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 239
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 239
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 239
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 239
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 239
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 239
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 239
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 239
            Source: global trafficHTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 239
            Source: Joe Sandbox ViewIP Address: 64.18.87.4 64.18.87.4
            Source: Joe Sandbox ViewIP Address: 64.18.87.81 64.18.87.81
            Source: Joe Sandbox ViewASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
            Source: Joe Sandbox ViewJA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
            Source: Joe Sandbox ViewJA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:33:22 GMTContent-Type: application/zipContent-Length: 12024981Connection: keep-aliveETag: "1474771251"Last-Modified: Fri, 24 Nov 2023 19:05:15 GMTCF-Cache-Status: REVALIDATEDExpires: Mon, 22 Jul 2024 14:33:22 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c5a85e7743af-EWRData Raw: 50 4b 03 04 14 00 00 00 08 00 27 2d 78 57 0a 72 2c 2d 67 46 03 00 d8 24 07 00 13 00 00 00 41 70 70 6c 69 63 61 74 69 6f 6e 2f 37 7a 61 2e 65 78 65 ec bd 79 78 54 45 d6 38 7c 7b 49 d2 59 48 27 40 43 58 c4 56 5b 8d 84 25 43 50 93 34 68 5f d2 4d 6e 43 47 40 44 51 a3 a0 68 0b ae 18 fa 86 20 8b 60 27 be e9 5c 5b 1d c5 19 75 1c c7 79 67 9c cf 19 97 51 47 59 5c bb 13 c8 c2 be b8 b0 8c 8a 7b 85 16 64 91 10 b6 dc ef 9c 53 b7 b7 10 a2 cf f7 fc 7e ff 7d 79 9e f4 dd aa 4e 9d 3a 75 ea d4 a9 53 a7 4e 55 dc f4 a4 60 10 04 c1 08 ff aa 2a 08 6b 04 fe e7 10 7e fd 8f c1 7f f6 f9 ef 65 0b ef a4 6f be 60 8d ce b3 f9 82 eb e6 ce 5b 60 9d 5f f5 c0 5d 55 b7 dd 67 9d 73 db fd f7 3f e0 b3 de 7e a7 b5 4a be df 3a ef 7e ab 73 ca 74 eb 7d 0f dc 71 e7 a8 3e 7d 32 6c 1a 8c f3 87 dd dd 75 f3 c3 c6 d7 a3 ff 23 bf 59 f4 fa 4d 74 7d f8 f5 a9 f4 2e e5 f5 36 7a be fb f5 1c ba ce 7b fd 3a b8 3a be 79 5e 4b 57 a3 5d 97 d0 f5 da 79 73 e6 22 9c ee b8 4e 75 09 c2 1d 8f a6 08 f3 bf bf ef a6 e8 bb 43 c2 45 42 a6 de 24 08 cd 50 fb 6b f4 f4 2e a7 0d ee 73 12 28 80 f7 7a 4e 1f fc 4b 11 f4 1a 81 d2 e8 e5 a2 e7 d2 90 7e 2b b4 4c b1 cb d9 cf 49 b7 82 f3 f1 54 a1 06 6f 0a d3 84 1c 6c 80 6d a9 c2 cc 59 70 3d 92 2a ec 1a 23 fc 7f ff db 67 14 72 8c e7 fe 3c ca 77 67 8d 0f ae 19 eb b4 7a 62 dd bb a5 b7 0a c2 ec 51 55 77 dc e6 bb 4d 10 3a de d3 11 4c e1 03 b8 6e 48 4e 08 14 72 8c e2 c9 84 5d 23 e0 e7 a5 54 41 00 72 0a 8f a6 76 4f 17 1a 35 9f 27 a4 3a 42 5d 85 d9 70 7d 3c f5 6c 78 55 0b aa e6 20 ad 0c 9c 36 84 db c1 b3 d3 09 ff ff df ff 91 3f 69 fa 8c eb 6f 10 af 13 67 88 d7 8b 37 48 fe 9f f2 25 45 5f b4 b7 42 e9 0c dc 64 f2 06 f2 dc 8a 20 06 66 e2 5d c9 8d 26 49 d9 ef 51 da 9d 0d 47 95 53 d5 0f 78 94 6f dd 8a 4b 10 cd ab c7 1a bd fe 2e ab 2f 15 7e d3 e5 14 67 e9 51 5f 19 dc 5e 28 a7 c3 ad 68 5e d9 1c b9 44 71 99 4a 5c 59 32 00 d8 cc ee 19 26 08 ca 0c b8 ad 10 bc 81 b1 d3 d4 46 6f 60 e8 b4 c0 0c 93 d2 a8 b6 b8 fd eb f4 a2 7d a9 a9 ea e5 88 39 38 45 27 05 fb 4b 6e 65 2b 63 17 08 82 fd 94 f9 99 90 e4 5f 97 2f ce 12 6f 15 6f 11 2b 67 dd 7a cb cd 4d 9b 36 11 fe 84 f7 1c 44 f0 44 dd 5e 49 39 ea 1b 21 85 7f 30 48 4a 9a e4 3f 68 f2 37 a9 92 32 22 55 aa 3b e0 cb c5 52 59 1b b0 3d 62 12 86 6b dd 5e 79 97 a4 98 11 30 02 6c 7f 1d de 6d 2a 0a d5 eb a4 80 68 0a 88 39 01 b1 bf a4 84 b1 9c 80 c7 66 9a 0e 05 15 4a 2d 4e 9b b5 4b 55 01 ea ee a2 90 14 48 48 da 22 e6 a9 f8 c1 1f b6 b2 59 83 04 e1 49 29 38 b9 90 3d 73 3e de 29 4d 50 48 21 a2 4c 7f d2 0c 80 65 05 8a 02 4a 0e c8 60 62 63 28 e7 3a eb 2d 4d 3d 7d b7 b2 f7 76 18 04 fe 3d b1 ce 39 b1 3a 8f e4 75 2e 37 f5 58 e9 4f cc bc d2 9b cc Data Ascii: PK'-xWr,-gF$Applic
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:34:10 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 380Expires: Mon, 22 Jul 2024 14:34:10 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c6d85a9f0f75-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:34:11 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 381Expires: Mon, 22 Jul 2024 14:34:11 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c6ddae1c1760-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:34:12 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 382Expires: Mon, 22 Jul 2024 14:34:12 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c6e32edf0f80-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:34:12 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 382Expires: Mon, 22 Jul 2024 14:34:12 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c6e68eac0cb5-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:34:14 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 384Expires: Mon, 22 Jul 2024 14:34:14 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c6ee3aa40fa7-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:34:14 GMTContent-Type: application/zipContent-Length: 9891Connection: keep-aliveETag: "3914547665"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 81Expires: Mon, 22 Jul 2024 14:34:14 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c6eefffe43c8-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d 2f df fd fa 21 ed 80 77 a9 39 90 7f fa 30 d1 2f b5 c5 80 5e 25 58 2d 8f a1 ec 2e 30 28 d8 18 6d 56 50 fc 6e ec c2 5d 3d 18 63 ce 72 b7 5f 01 fc dc 41 24 ef 91 b3 a5 3c 11 42 57 ad f6 79 b8 df a4 65 32 ed 62 09 bd cf 4b 04 a0 ab 90 7b 6a 96 ae c5 f8 4f c3 d0 64 c7 78 a2 5a c5 a0 76 c7 40 5b 87 4e 4c 9d 44 55 7c 00 5f a3 f8 84 92 b2 84 31 53 a4 b9 70 e7 95 1c e8 0b 7e 50 61 9f 71 c7 d0 3e 8d fb a4 df 7d 29 24 71 b6 48 37 bb 2c 68 81 bc 8b b9 06 c1 6d 29 49 07 9d 9b 98 ee f3 61 73 d4 3c bd 54 57 1f d8 eb b5 75 dd 24 3f 88 01 a3 ac f3 e6 45 d6 e0 df bc 79 85 0b f8 fb 95 40 58 89 df b0 b9 97 de 75 87 40 11 35 b7 2a 9a dc 55 4a 85 01 4c 9c 6a 61 1e d9 e0 04 30 e5 a4 76 9d 18 5e 0a aa d1 51 88 20 28 4f 7d 6b 2b 66 77 b2 76 98 66 96 7a ec 07 62 cd 68 ef 46 45 14 1c 3c 70 6c f8 c8 4c 57 5a 49 89 ff 8e 2a 2e 34 23 16 a6 b5 ff 2c b5 58 a6 9a bb 60 3d 18 db 62 c8 b2 1f 97 65 56 85 b2 57 b6 29 57 2a 02 a6 3b fb 51 2c 94 27 78 b7 3e f3 da 4a 71 9d fa 8d 0a 20 10 d8 5f 19 1d 54 3c 65 61 26 77 6f aa e5 2f 52 9b 4d d7 32 e6 60 72 58 b9 46 a9 fa 1a a7 14 de e2 0d 92 45 be 8c f7 63 3a f6 9b 41 df 39 ca 37 41 8e 09 ca 85 d6 f5 df f3 17 34 ee c6 46 54 cd d3 0e a1 30 ca 8d d1 40 7f a4 77 75 85 4a 49 d2 e0 42 64 dc 35 0d be 42 11 f8 68 77 fa 17 1e 9e 11 93 7d 16 6f 45 dc 86 40 de f9 4e 3d de e2 d1 99 9e 5a 24 80 29 36 f1 40 db de 8d 1f d3 95 73 05 ea 58 f5 ce a8 cf 72 d3 f5 d3 9b f6 bb 00 a7 ab a4 75 9f 25 de 96 1e 99 65 9f 49 b4 67 a8 f1 35 bf 72 75 1f 41 8b ff 3a 0e 38 31 d1 26 a7 a8 7f 22 bc 7f 65 a0 5f 0e f7 86 27 eb f3 85 12 8a 42 ac 04 92 65 aa Data Ascii: PKIX6%
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:34:14 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 384Expires: Mon, 22 Jul 2024 14:34:14 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c6f358d272c2-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:34:15 GMTContent-Type: application/zipContent-Length: 9891Connection: keep-aliveETag: "3914547665"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 82Expires: Mon, 22 Jul 2024 14:34:15 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c6f6d88c4219-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d 2f df fd fa 21 ed 80 77 a9 39 90 7f fa 30 d1 2f b5 c5 80 5e 25 58 2d 8f a1 ec 2e 30 28 d8 18 6d 56 50 fc 6e ec c2 5d 3d 18 63 ce 72 b7 5f 01 fc dc 41 24 ef 91 b3 a5 3c 11 42 57 ad f6 79 b8 df a4 65 32 ed 62 09 bd cf 4b 04 a0 ab 90 7b 6a 96 ae c5 f8 4f c3 d0 64 c7 78 a2 5a c5 a0 76 c7 40 5b 87 4e 4c 9d 44 55 7c 00 5f a3 f8 84 92 b2 84 31 53 a4 b9 70 e7 95 1c e8 0b 7e 50 61 9f 71 c7 d0 3e 8d fb a4 df 7d 29 24 71 b6 48 37 bb 2c 68 81 bc 8b b9 06 c1 6d 29 49 07 9d 9b 98 ee f3 61 73 d4 3c bd 54 57 1f d8 eb b5 75 dd 24 3f 88 01 a3 ac f3 e6 45 d6 e0 df bc 79 85 0b f8 fb 95 40 58 89 df b0 b9 97 de 75 87 40 11 35 b7 2a 9a dc 55 4a 85 01 4c 9c 6a 61 1e d9 e0 04 30 e5 a4 76 9d 18 5e 0a aa d1 51 88 20 28 4f 7d 6b 2b 66 77 b2 76 98 66 96 7a ec 07 62 cd 68 ef 46 45 14 1c 3c 70 6c f8 c8 4c 57 5a 49 89 ff 8e 2a 2e 34 23 16 a6 b5 ff 2c b5 58 a6 9a bb 60 3d 18 db 62 c8 b2 1f 97 65 56 85 b2 57 b6 29 57 2a 02 a6 3b fb 51 2c 94 27 78 b7 3e f3 da 4a 71 9d fa 8d 0a 20 10 d8 5f 19 1d 54 3c 65 61 26 77 6f aa e5 2f 52 9b 4d d7 32 e6 60 72 58 b9 46 a9 fa 1a a7 14 de e2 0d 92 45 be 8c f7 63 3a f6 9b 41 df 39 ca 37 41 8e 09 ca 85 d6 f5 df f3 17 34 ee c6 46 54 cd d3 0e a1 30 ca 8d d1 40 7f a4 77 75 85 4a 49 d2 e0 42 64 dc 35 0d be 42 11 f8 68 77 fa 17 1e 9e 11 93 7d 16 6f 45 dc 86 40 de f9 4e 3d de e2 d1 99 9e 5a 24 80 29 36 f1 40 db de 8d 1f d3 95 73 05 ea 58 f5 ce a8 cf 72 d3 f5 d3 9b f6 bb 00 a7 ab a4 75 9f 25 de 96 1e 99 65 9f 49 b4 67 a8 f1 35 bf 72 75 1f 41 8b ff 3a 0e 38 31 d1 26 a7 a8 7f 22 bc 7f 65 a0 5f 0e f7 86 27 eb f3 85 12 8a 42 ac 04 92 65 aa Data Ascii: PKIX6%
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:34:15 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 385Expires: Mon, 22 Jul 2024 14:34:15 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c6f94e584381-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:34:16 GMTContent-Type: application/zipContent-Length: 9891Connection: keep-aliveETag: "3914547665"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 83Expires: Mon, 22 Jul 2024 14:34:16 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c6fea85e1839-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d 2f df fd fa 21 ed 80 77 a9 39 90 7f fa 30 d1 2f b5 c5 80 5e 25 58 2d 8f a1 ec 2e 30 28 d8 18 6d 56 50 fc 6e ec c2 5d 3d 18 63 ce 72 b7 5f 01 fc dc 41 24 ef 91 b3 a5 3c 11 42 57 ad f6 79 b8 df a4 65 32 ed 62 09 bd cf 4b 04 a0 ab 90 7b 6a 96 ae c5 f8 4f c3 d0 64 c7 78 a2 5a c5 a0 76 c7 40 5b 87 4e 4c 9d 44 55 7c 00 5f a3 f8 84 92 b2 84 31 53 a4 b9 70 e7 95 1c e8 0b 7e 50 61 9f 71 c7 d0 3e 8d fb a4 df 7d 29 24 71 b6 48 37 bb 2c 68 81 bc 8b b9 06 c1 6d 29 49 07 9d 9b 98 ee f3 61 73 d4 3c bd 54 57 1f d8 eb b5 75 dd 24 3f 88 01 a3 ac f3 e6 45 d6 e0 df bc 79 85 0b f8 fb 95 40 58 89 df b0 b9 97 de 75 87 40 11 35 b7 2a 9a dc 55 4a 85 01 4c 9c 6a 61 1e d9 e0 04 30 e5 a4 76 9d 18 5e 0a aa d1 51 88 20 28 4f 7d 6b 2b 66 77 b2 76 98 66 96 7a ec 07 62 cd 68 ef 46 45 14 1c 3c 70 6c f8 c8 4c 57 5a 49 89 ff 8e 2a 2e 34 23 16 a6 b5 ff 2c b5 58 a6 9a bb 60 3d 18 db 62 c8 b2 1f 97 65 56 85 b2 57 b6 29 57 2a 02 a6 3b fb 51 2c 94 27 78 b7 3e f3 da 4a 71 9d fa 8d 0a 20 10 d8 5f 19 1d 54 3c 65 61 26 77 6f aa e5 2f 52 9b 4d d7 32 e6 60 72 58 b9 46 a9 fa 1a a7 14 de e2 0d 92 45 be 8c f7 63 3a f6 9b 41 df 39 ca 37 41 8e 09 ca 85 d6 f5 df f3 17 34 ee c6 46 54 cd d3 0e a1 30 ca 8d d1 40 7f a4 77 75 85 4a 49 d2 e0 42 64 dc 35 0d be 42 11 f8 68 77 fa 17 1e 9e 11 93 7d 16 6f 45 dc 86 40 de f9 4e 3d de e2 d1 99 9e 5a 24 80 29 36 f1 40 db de 8d 1f d3 95 73 05 ea 58 f5 ce a8 cf 72 d3 f5 d3 9b f6 bb 00 a7 ab a4 75 9f 25 de 96 1e 99 65 9f 49 b4 67 a8 f1 35 bf 72 75 1f 41 8b ff 3a 0e 38 31 d1 26 a7 a8 7f 22 bc 7f 65 a0 5f 0e f7 86 27 eb f3 85 12 8a 42 ac 04 92 65 aa Data Ascii: PKIX6%
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:34:17 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 387Expires: Mon, 22 Jul 2024 14:34:17 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c702ada9439f-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:34:18 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 388Expires: Mon, 22 Jul 2024 14:34:18 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c708599443a7-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:34:19 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 389Expires: Mon, 22 Jul 2024 14:34:19 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c7107edf8ca7-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:34:22 GMTContent-Type: application/zipContent-Length: 9891Connection: keep-aliveETag: "3914547665"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 89Expires: Mon, 22 Jul 2024 14:34:22 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c721cd5c4308-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d 2f df fd fa 21 ed 80 77 a9 39 90 7f fa 30 d1 2f b5 c5 80 5e 25 58 2d 8f a1 ec 2e 30 28 d8 18 6d 56 50 fc 6e ec c2 5d 3d 18 63 ce 72 b7 5f 01 fc dc 41 24 ef 91 b3 a5 3c 11 42 57 ad f6 79 b8 df a4 65 32 ed 62 09 bd cf 4b 04 a0 ab 90 7b 6a 96 ae c5 f8 4f c3 d0 64 c7 78 a2 5a c5 a0 76 c7 40 5b 87 4e 4c 9d 44 55 7c 00 5f a3 f8 84 92 b2 84 31 53 a4 b9 70 e7 95 1c e8 0b 7e 50 61 9f 71 c7 d0 3e 8d fb a4 df 7d 29 24 71 b6 48 37 bb 2c 68 81 bc 8b b9 06 c1 6d 29 49 07 9d 9b 98 ee f3 61 73 d4 3c bd 54 57 1f d8 eb b5 75 dd 24 3f 88 01 a3 ac f3 e6 45 d6 e0 df bc 79 85 0b f8 fb 95 40 58 89 df b0 b9 97 de 75 87 40 11 35 b7 2a 9a dc 55 4a 85 01 4c 9c 6a 61 1e d9 e0 04 30 e5 a4 76 9d 18 5e 0a aa d1 51 88 20 28 4f 7d 6b 2b 66 77 b2 76 98 66 96 7a ec 07 62 cd 68 ef 46 45 14 1c 3c 70 6c f8 c8 4c 57 5a 49 89 ff 8e 2a 2e 34 23 16 a6 b5 ff 2c b5 58 a6 9a bb 60 3d 18 db 62 c8 b2 1f 97 65 56 85 b2 57 b6 29 57 2a 02 a6 3b fb 51 2c 94 27 78 b7 3e f3 da 4a 71 9d fa 8d 0a 20 10 d8 5f 19 1d 54 3c 65 61 26 77 6f aa e5 2f 52 9b 4d d7 32 e6 60 72 58 b9 46 a9 fa 1a a7 14 de e2 0d 92 45 be 8c f7 63 3a f6 9b 41 df 39 ca 37 41 8e 09 ca 85 d6 f5 df f3 17 34 ee c6 46 54 cd d3 0e a1 30 ca 8d d1 40 7f a4 77 75 85 4a 49 d2 e0 42 64 dc 35 0d be 42 11 f8 68 77 fa 17 1e 9e 11 93 7d 16 6f 45 dc 86 40 de f9 4e 3d de e2 d1 99 9e 5a 24 80 29 36 f1 40 db de 8d 1f d3 95 73 05 ea 58 f5 ce a8 cf 72 d3 f5 d3 9b f6 bb 00 a7 ab a4 75 9f 25 de 96 1e 99 65 9f 49 b4 67 a8 f1 35 bf 72 75 1f 41 8b ff 3a 0e 38 31 d1 26 a7 a8 7f 22 bc 7f 65 a0 5f 0e f7 86 27 eb f3 85 12 8a 42 ac 04 92 65 aa Data Ascii: PKIX6%
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:34:22 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 392Expires: Mon, 22 Jul 2024 14:34:22 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c7220f1d5e76-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:34:23 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 393Expires: Mon, 22 Jul 2024 14:34:23 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c7269ac842a7-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:34:23 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 393Expires: Mon, 22 Jul 2024 14:34:23 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c7269ac842a7-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:34:29 GMTContent-Type: application/zipContent-Length: 9891Connection: keep-aliveETag: "3914547665"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 96Expires: Mon, 22 Jul 2024 14:34:29 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c74cdc91c32a-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d 2f df fd fa 21 ed 80 77 a9 39 90 7f fa 30 d1 2f b5 c5 80 5e 25 58 2d 8f a1 ec 2e 30 28 d8 18 6d 56 50 fc 6e ec c2 5d 3d 18 63 ce 72 b7 5f 01 fc dc 41 24 ef 91 b3 a5 3c 11 42 57 ad f6 79 b8 df a4 65 32 ed 62 09 bd cf 4b 04 a0 ab 90 7b 6a 96 ae c5 f8 4f c3 d0 64 c7 78 a2 5a c5 a0 76 c7 40 5b 87 4e 4c 9d 44 55 7c 00 5f a3 f8 84 92 b2 84 31 53 a4 b9 70 e7 95 1c e8 0b 7e 50 61 9f 71 c7 d0 3e 8d fb a4 df 7d 29 24 71 b6 48 37 bb 2c 68 81 bc 8b b9 06 c1 6d 29 49 07 9d 9b 98 ee f3 61 73 d4 3c bd 54 57 1f d8 eb b5 75 dd 24 3f 88 01 a3 ac f3 e6 45 d6 e0 df bc 79 85 0b f8 fb 95 40 58 89 df b0 b9 97 de 75 87 40 11 35 b7 2a 9a dc 55 4a 85 01 4c 9c 6a 61 1e d9 e0 04 30 e5 a4 76 9d 18 5e 0a aa d1 51 88 20 28 4f 7d 6b 2b 66 77 b2 76 98 66 96 7a ec 07 62 cd 68 ef 46 45 14 1c 3c 70 6c f8 c8 4c 57 5a 49 89 ff 8e 2a 2e 34 23 16 a6 b5 ff 2c b5 58 a6 9a bb 60 3d 18 db 62 c8 b2 1f 97 65 56 85 b2 57 b6 29 57 2a 02 a6 3b fb 51 2c 94 27 78 b7 3e f3 da 4a 71 9d fa 8d 0a 20 10 d8 5f 19 1d 54 3c 65 61 26 77 6f aa e5 2f 52 9b 4d d7 32 e6 60 72 58 b9 46 a9 fa 1a a7 14 de e2 0d 92 45 be 8c f7 63 3a f6 9b 41 df 39 ca 37 41 8e 09 ca 85 d6 f5 df f3 17 34 ee c6 46 54 cd d3 0e a1 30 ca 8d d1 40 7f a4 77 75 85 4a 49 d2 e0 42 64 dc 35 0d be 42 11 f8 68 77 fa 17 1e 9e 11 93 7d 16 6f 45 dc 86 40 de f9 4e 3d de e2 d1 99 9e 5a 24 80 29 36 f1 40 db de 8d 1f d3 95 73 05 ea 58 f5 ce a8 cf 72 d3 f5 d3 9b f6 bb 00 a7 ab a4 75 9f 25 de 96 1e 99 65 9f 49 b4 67 a8 f1 35 bf 72 75 1f 41 8b ff 3a 0e 38 31 d1 26 a7 a8 7f 22 bc 7f 65 a0 5f 0e f7 86 27 eb f3 85 12 8a 42 ac 04 92 65 aa Data Ascii: PKIX6%
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:34:29 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 399Expires: Mon, 22 Jul 2024 14:34:29 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c74dfe1a198e-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:34:29 GMTContent-Type: application/zipContent-Length: 9891Connection: keep-aliveETag: "3914547665"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 96Expires: Mon, 22 Jul 2024 14:34:29 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c74ecd76c32a-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d 2f df fd fa 21 ed 80 77 a9 39 90 7f fa 30 d1 2f b5 c5 80 5e 25 58 2d 8f a1 ec 2e 30 28 d8 18 6d 56 50 fc 6e ec c2 5d 3d 18 63 ce 72 b7 5f 01 fc dc 41 24 ef 91 b3 a5 3c 11 42 57 ad f6 79 b8 df a4 65 32 ed 62 09 bd cf 4b 04 a0 ab 90 7b 6a 96 ae c5 f8 4f c3 d0 64 c7 78 a2 5a c5 a0 76 c7 40 5b 87 4e 4c 9d 44 55 7c 00 5f a3 f8 84 92 b2 84 31 53 a4 b9 70 e7 95 1c e8 0b 7e 50 61 9f 71 c7 d0 3e 8d fb a4 df 7d 29 24 71 b6 48 37 bb 2c 68 81 bc 8b b9 06 c1 6d 29 49 07 9d 9b 98 ee f3 61 73 d4 3c bd 54 57 1f d8 eb b5 75 dd 24 3f 88 01 a3 ac f3 e6 45 d6 e0 df bc 79 85 0b f8 fb 95 40 58 89 df b0 b9 97 de 75 87 40 11 35 b7 2a 9a dc 55 4a 85 01 4c 9c 6a 61 1e d9 e0 04 30 e5 a4 76 9d 18 5e 0a aa d1 51 88 20 28 4f 7d 6b 2b 66 77 b2 76 98 66 96 7a ec 07 62 cd 68 ef 46 45 14 1c 3c 70 6c f8 c8 4c 57 5a 49 89 ff 8e 2a 2e 34 23 16 a6 b5 ff 2c b5 58 a6 9a bb 60 3d 18 db 62 c8 b2 1f 97 65 56 85 b2 57 b6 29 57 2a 02 a6 3b fb 51 2c 94 27 78 b7 3e f3 da 4a 71 9d fa 8d 0a 20 10 d8 5f 19 1d 54 3c 65 61 26 77 6f aa e5 2f 52 9b 4d d7 32 e6 60 72 58 b9 46 a9 fa 1a a7 14 de e2 0d 92 45 be 8c f7 63 3a f6 9b 41 df 39 ca 37 41 8e 09 ca 85 d6 f5 df f3 17 34 ee c6 46 54 cd d3 0e a1 30 ca 8d d1 40 7f a4 77 75 85 4a 49 d2 e0 42 64 dc 35 0d be 42 11 f8 68 77 fa 17 1e 9e 11 93 7d 16 6f 45 dc 86 40 de f9 4e 3d de e2 d1 99 9e 5a 24 80 29 36 f1 40 db de 8d 1f d3 95 73 05 ea 58 f5 ce a8 cf 72 d3 f5 d3 9b f6 bb 00 a7 ab a4 75 9f 25 de 96 1e 99 65 9f 49 b4 67 a8 f1 35 bf 72 75 1f 41 8b ff 3a 0e 38 31 d1 26 a7 a8 7f 22 bc 7f 65 a0 5f 0e f7 86 27 eb f3 85 12 8a 42 ac 04 92 65 aa Data Ascii: PKIX6%
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:34:30 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 400Expires: Mon, 22 Jul 2024 14:34:30 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c7550ab041f8-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:34:30 GMTContent-Type: application/zipContent-Length: 9891Connection: keep-aliveETag: "3914547665"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 97Expires: Mon, 22 Jul 2024 14:34:30 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c7556f4432f4-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d 2f df fd fa 21 ed 80 77 a9 39 90 7f fa 30 d1 2f b5 c5 80 5e 25 58 2d 8f a1 ec 2e 30 28 d8 18 6d 56 50 fc 6e ec c2 5d 3d 18 63 ce 72 b7 5f 01 fc dc 41 24 ef 91 b3 a5 3c 11 42 57 ad f6 79 b8 df a4 65 32 ed 62 09 bd cf 4b 04 a0 ab 90 7b 6a 96 ae c5 f8 4f c3 d0 64 c7 78 a2 5a c5 a0 76 c7 40 5b 87 4e 4c 9d 44 55 7c 00 5f a3 f8 84 92 b2 84 31 53 a4 b9 70 e7 95 1c e8 0b 7e 50 61 9f 71 c7 d0 3e 8d fb a4 df 7d 29 24 71 b6 48 37 bb 2c 68 81 bc 8b b9 06 c1 6d 29 49 07 9d 9b 98 ee f3 61 73 d4 3c bd 54 57 1f d8 eb b5 75 dd 24 3f 88 01 a3 ac f3 e6 45 d6 e0 df bc 79 85 0b f8 fb 95 40 58 89 df b0 b9 97 de 75 87 40 11 35 b7 2a 9a dc 55 4a 85 01 4c 9c 6a 61 1e d9 e0 04 30 e5 a4 76 9d 18 5e 0a aa d1 51 88 20 28 4f 7d 6b 2b 66 77 b2 76 98 66 96 7a ec 07 62 cd 68 ef 46 45 14 1c 3c 70 6c f8 c8 4c 57 5a 49 89 ff 8e 2a 2e 34 23 16 a6 b5 ff 2c b5 58 a6 9a bb 60 3d 18 db 62 c8 b2 1f 97 65 56 85 b2 57 b6 29 57 2a 02 a6 3b fb 51 2c 94 27 78 b7 3e f3 da 4a 71 9d fa 8d 0a 20 10 d8 5f 19 1d 54 3c 65 61 26 77 6f aa e5 2f 52 9b 4d d7 32 e6 60 72 58 b9 46 a9 fa 1a a7 14 de e2 0d 92 45 be 8c f7 63 3a f6 9b 41 df 39 ca 37 41 8e 09 ca 85 d6 f5 df f3 17 34 ee c6 46 54 cd d3 0e a1 30 ca 8d d1 40 7f a4 77 75 85 4a 49 d2 e0 42 64 dc 35 0d be 42 11 f8 68 77 fa 17 1e 9e 11 93 7d 16 6f 45 dc 86 40 de f9 4e 3d de e2 d1 99 9e 5a 24 80 29 36 f1 40 db de 8d 1f d3 95 73 05 ea 58 f5 ce a8 cf 72 d3 f5 d3 9b f6 bb 00 a7 ab a4 75 9f 25 de 96 1e 99 65 9f 49 b4 67 a8 f1 35 bf 72 75 1f 41 8b ff 3a 0e 38 31 d1 26 a7 a8 7f 22 bc 7f 65 a0 5f 0e f7 86 27 eb f3 85 12 8a 42 ac 04 92 65 aa Data Ascii: PKIX6%
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:34:32 GMTContent-Type: application/zipContent-Length: 9891Connection: keep-aliveETag: "3914547665"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 99Expires: Mon, 22 Jul 2024 14:34:32 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c75f2c574294-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d 2f df fd fa 21 ed 80 77 a9 39 90 7f fa 30 d1 2f b5 c5 80 5e 25 58 2d 8f a1 ec 2e 30 28 d8 18 6d 56 50 fc 6e ec c2 5d 3d 18 63 ce 72 b7 5f 01 fc dc 41 24 ef 91 b3 a5 3c 11 42 57 ad f6 79 b8 df a4 65 32 ed 62 09 bd cf 4b 04 a0 ab 90 7b 6a 96 ae c5 f8 4f c3 d0 64 c7 78 a2 5a c5 a0 76 c7 40 5b 87 4e 4c 9d 44 55 7c 00 5f a3 f8 84 92 b2 84 31 53 a4 b9 70 e7 95 1c e8 0b 7e 50 61 9f 71 c7 d0 3e 8d fb a4 df 7d 29 24 71 b6 48 37 bb 2c 68 81 bc 8b b9 06 c1 6d 29 49 07 9d 9b 98 ee f3 61 73 d4 3c bd 54 57 1f d8 eb b5 75 dd 24 3f 88 01 a3 ac f3 e6 45 d6 e0 df bc 79 85 0b f8 fb 95 40 58 89 df b0 b9 97 de 75 87 40 11 35 b7 2a 9a dc 55 4a 85 01 4c 9c 6a 61 1e d9 e0 04 30 e5 a4 76 9d 18 5e 0a aa d1 51 88 20 28 4f 7d 6b 2b 66 77 b2 76 98 66 96 7a ec 07 62 cd 68 ef 46 45 14 1c 3c 70 6c f8 c8 4c 57 5a 49 89 ff 8e 2a 2e 34 23 16 a6 b5 ff 2c b5 58 a6 9a bb 60 3d 18 db 62 c8 b2 1f 97 65 56 85 b2 57 b6 29 57 2a 02 a6 3b fb 51 2c 94 27 78 b7 3e f3 da 4a 71 9d fa 8d 0a 20 10 d8 5f 19 1d 54 3c 65 61 26 77 6f aa e5 2f 52 9b 4d d7 32 e6 60 72 58 b9 46 a9 fa 1a a7 14 de e2 0d 92 45 be 8c f7 63 3a f6 9b 41 df 39 ca 37 41 8e 09 ca 85 d6 f5 df f3 17 34 ee c6 46 54 cd d3 0e a1 30 ca 8d d1 40 7f a4 77 75 85 4a 49 d2 e0 42 64 dc 35 0d be 42 11 f8 68 77 fa 17 1e 9e 11 93 7d 16 6f 45 dc 86 40 de f9 4e 3d de e2 d1 99 9e 5a 24 80 29 36 f1 40 db de 8d 1f d3 95 73 05 ea 58 f5 ce a8 cf 72 d3 f5 d3 9b f6 bb 00 a7 ab a4 75 9f 25 de 96 1e 99 65 9f 49 b4 67 a8 f1 35 bf 72 75 1f 41 8b ff 3a 0e 38 31 d1 26 a7 a8 7f 22 bc 7f 65 a0 5f 0e f7 86 27 eb f3 85 12 8a 42 ac 04 92 65 aa Data Ascii: PKIX6%
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:34:33 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 403Expires: Mon, 22 Jul 2024 14:34:33 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c7657f3d0f70-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:34:33 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 403Expires: Mon, 22 Jul 2024 14:34:33 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c76818ff0f70-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:34:35 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 405Expires: Mon, 22 Jul 2024 14:34:35 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c7711c227c6c-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:34:35 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 405Expires: Mon, 22 Jul 2024 14:34:35 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c7752d286a56-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:34:35 GMTContent-Type: application/zipContent-Length: 9891Connection: keep-aliveETag: "3914547665"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 102Expires: Mon, 22 Jul 2024 14:34:35 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c7759c3241fe-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d 2f df fd fa 21 ed 80 77 a9 39 90 7f fa 30 d1 2f b5 c5 80 5e 25 58 2d 8f a1 ec 2e 30 28 d8 18 6d 56 50 fc 6e ec c2 5d 3d 18 63 ce 72 b7 5f 01 fc dc 41 24 ef 91 b3 a5 3c 11 42 57 ad f6 79 b8 df a4 65 32 ed 62 09 bd cf 4b 04 a0 ab 90 7b 6a 96 ae c5 f8 4f c3 d0 64 c7 78 a2 5a c5 a0 76 c7 40 5b 87 4e 4c 9d 44 55 7c 00 5f a3 f8 84 92 b2 84 31 53 a4 b9 70 e7 95 1c e8 0b 7e 50 61 9f 71 c7 d0 3e 8d fb a4 df 7d 29 24 71 b6 48 37 bb 2c 68 81 bc 8b b9 06 c1 6d 29 49 07 9d 9b 98 ee f3 61 73 d4 3c bd 54 57 1f d8 eb b5 75 dd 24 3f 88 01 a3 ac f3 e6 45 d6 e0 df bc 79 85 0b f8 fb 95 40 58 89 df b0 b9 97 de 75 87 40 11 35 b7 2a 9a dc 55 4a 85 01 4c 9c 6a 61 1e d9 e0 04 30 e5 a4 76 9d 18 5e 0a aa d1 51 88 20 28 4f 7d 6b 2b 66 77 b2 76 98 66 96 7a ec 07 62 cd 68 ef 46 45 14 1c 3c 70 6c f8 c8 4c 57 5a 49 89 ff 8e 2a 2e 34 23 16 a6 b5 ff 2c b5 58 a6 9a bb 60 3d 18 db 62 c8 b2 1f 97 65 56 85 b2 57 b6 29 57 2a 02 a6 3b fb 51 2c 94 27 78 b7 3e f3 da 4a 71 9d fa 8d 0a 20 10 d8 5f 19 1d 54 3c 65 61 26 77 6f aa e5 2f 52 9b 4d d7 32 e6 60 72 58 b9 46 a9 fa 1a a7 14 de e2 0d 92 45 be 8c f7 63 3a f6 9b 41 df 39 ca 37 41 8e 09 ca 85 d6 f5 df f3 17 34 ee c6 46 54 cd d3 0e a1 30 ca 8d d1 40 7f a4 77 75 85 4a 49 d2 e0 42 64 dc 35 0d be 42 11 f8 68 77 fa 17 1e 9e 11 93 7d 16 6f 45 dc 86 40 de f9 4e 3d de e2 d1 99 9e 5a 24 80 29 36 f1 40 db de 8d 1f d3 95 73 05 ea 58 f5 ce a8 cf 72 d3 f5 d3 9b f6 bb 00 a7 ab a4 75 9f 25 de 96 1e 99 65 9f 49 b4 67 a8 f1 35 bf 72 75 1f 41 8b ff 3a 0e 38 31 d1 26 a7 a8 7f 22 bc 7f 65 a0 5f 0e f7 86 27 eb f3 85 12 8a 42 ac 04 92 65 Data Ascii: PKIX6%Fe
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:34:37 GMTContent-Type: application/zipContent-Length: 9891Connection: keep-aliveETag: "3914547665"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 104Expires: Mon, 22 Jul 2024 14:34:37 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c77f1ec37c6c-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d 2f df fd fa 21 ed 80 77 a9 39 90 7f fa 30 d1 2f b5 c5 80 5e 25 58 2d 8f a1 ec 2e 30 28 d8 18 6d 56 50 fc 6e ec c2 5d 3d 18 63 ce 72 b7 5f 01 fc dc 41 24 ef 91 b3 a5 3c 11 42 57 ad f6 79 b8 df a4 65 32 ed 62 09 bd cf 4b 04 a0 ab 90 7b 6a 96 ae c5 f8 4f c3 d0 64 c7 78 a2 5a c5 a0 76 c7 40 5b 87 4e 4c 9d 44 55 7c 00 5f a3 f8 84 92 b2 84 31 53 a4 b9 70 e7 95 1c e8 0b 7e 50 61 9f 71 c7 d0 3e 8d fb a4 df 7d 29 24 71 b6 48 37 bb 2c 68 81 bc 8b b9 06 c1 6d 29 49 07 9d 9b 98 ee f3 61 73 d4 3c bd 54 57 1f d8 eb b5 75 dd 24 3f 88 01 a3 ac f3 e6 45 d6 e0 df bc 79 85 0b f8 fb 95 40 58 89 df b0 b9 97 de 75 87 40 11 35 b7 2a 9a dc 55 4a 85 01 4c 9c 6a 61 1e d9 e0 04 30 e5 a4 76 9d 18 5e 0a aa d1 51 88 20 28 4f 7d 6b 2b 66 77 b2 76 98 66 96 7a ec 07 62 cd 68 ef 46 45 14 1c 3c 70 6c f8 c8 4c 57 5a 49 89 ff 8e 2a 2e 34 23 16 a6 b5 ff 2c b5 58 a6 9a bb 60 3d 18 db 62 c8 b2 1f 97 65 56 85 b2 57 b6 29 57 2a 02 a6 3b fb 51 2c 94 27 78 b7 3e f3 da 4a 71 9d fa 8d 0a 20 10 d8 5f 19 1d 54 3c 65 61 26 77 6f aa e5 2f 52 9b 4d d7 32 e6 60 72 58 b9 46 a9 fa 1a a7 14 de e2 0d 92 45 be 8c f7 63 3a f6 9b 41 df 39 ca 37 41 8e 09 ca 85 d6 f5 df f3 17 34 ee c6 46 54 cd d3 0e a1 30 ca 8d d1 40 7f a4 77 75 85 4a 49 d2 e0 42 64 dc 35 0d be 42 11 f8 68 77 fa 17 1e 9e 11 93 7d 16 6f 45 dc 86 40 de f9 4e 3d de e2 d1 99 9e 5a 24 80 29 36 f1 40 db de 8d 1f d3 95 73 05 ea 58 f5 ce a8 cf 72 d3 f5 d3 9b f6 bb 00 a7 ab a4 75 9f 25 de 96 1e 99 65 9f 49 b4 67 a8 f1 35 bf 72 75 1f 41 8b ff 3a 0e 38 31 d1 26 a7 a8 7f 22 bc 7f 65 a0 5f 0e f7 86 27 eb f3 85 12 8a 42 ac 04 92 65 Data Ascii: PKIX6%Fe
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:34:37 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 407Expires: Mon, 22 Jul 2024 14:34:37 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c77fcf088c0b-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:34:38 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 408Expires: Mon, 22 Jul 2024 14:34:38 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c787784c0cc2-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:34:41 GMTContent-Type: application/zipContent-Length: 9891Connection: keep-aliveETag: "3914547665"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 108Expires: Mon, 22 Jul 2024 14:34:41 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c79c08de1a3c-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d 2f df fd fa 21 ed 80 77 a9 39 90 7f fa 30 d1 2f b5 c5 80 5e 25 58 2d 8f a1 ec 2e 30 28 d8 18 6d 56 50 fc 6e ec c2 5d 3d 18 63 ce 72 b7 5f 01 fc dc 41 24 ef 91 b3 a5 3c 11 42 57 ad f6 79 b8 df a4 65 32 ed 62 09 bd cf 4b 04 a0 ab 90 7b 6a 96 ae c5 f8 4f c3 d0 64 c7 78 a2 5a c5 a0 76 c7 40 5b 87 4e 4c 9d 44 55 7c 00 5f a3 f8 84 92 b2 84 31 53 a4 b9 70 e7 95 1c e8 0b 7e 50 61 9f 71 c7 d0 3e 8d fb a4 df 7d 29 24 71 b6 48 37 bb 2c 68 81 bc 8b b9 06 c1 6d 29 49 07 9d 9b 98 ee f3 61 73 d4 3c bd 54 57 1f d8 eb b5 75 dd 24 3f 88 01 a3 ac f3 e6 45 d6 e0 df bc 79 85 0b f8 fb 95 40 58 89 df b0 b9 97 de 75 87 40 11 35 b7 2a 9a dc 55 4a 85 01 4c 9c 6a 61 1e d9 e0 04 30 e5 a4 76 9d 18 5e 0a aa d1 51 88 20 28 4f 7d 6b 2b 66 77 b2 76 98 66 96 7a ec 07 62 cd 68 ef 46 45 14 1c 3c 70 6c f8 c8 4c 57 5a 49 89 ff 8e 2a 2e 34 23 16 a6 b5 ff 2c b5 58 a6 9a bb 60 3d 18 db 62 c8 b2 1f 97 65 56 85 b2 57 b6 29 57 2a 02 a6 3b fb 51 2c 94 27 78 b7 3e f3 da 4a 71 9d fa 8d 0a 20 10 d8 5f 19 1d 54 3c 65 61 26 77 6f aa e5 2f 52 9b 4d d7 32 e6 60 72 58 b9 46 a9 fa 1a a7 14 de e2 0d 92 45 be 8c f7 63 3a f6 9b 41 df 39 ca 37 41 8e 09 ca 85 d6 f5 df f3 17 34 ee c6 46 54 cd d3 0e a1 30 ca 8d d1 40 7f a4 77 75 85 4a 49 d2 e0 42 64 dc 35 0d be 42 11 f8 68 77 fa 17 1e 9e 11 93 7d 16 6f 45 dc 86 40 de f9 4e 3d de e2 d1 99 9e 5a 24 80 29 36 f1 40 db de 8d 1f d3 95 73 05 ea 58 f5 ce a8 cf 72 d3 f5 d3 9b f6 bb 00 a7 ab a4 75 9f 25 de 96 1e 99 65 9f 49 b4 67 a8 f1 35 bf 72 75 1f 41 8b ff 3a 0e 38 31 d1 26 a7 a8 7f 22 bc 7f 65 a0 5f 0e f7 86 27 eb f3 85 12 8a 42 ac 04 92 65 Data Ascii: PKIX6%Fe
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:34:42 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 412Expires: Mon, 22 Jul 2024 14:34:42 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c79c6b2a41f9-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:34:45 GMTContent-Type: application/zipContent-Length: 9891Connection: keep-aliveETag: "3914547665"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 112Expires: Mon, 22 Jul 2024 14:34:45 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c7b3aae00cc9-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d 2f df fd fa 21 ed 80 77 a9 39 90 7f fa 30 d1 2f b5 c5 80 5e 25 58 2d 8f a1 ec 2e 30 28 d8 18 6d 56 50 fc 6e ec c2 5d 3d 18 63 ce 72 b7 5f 01 fc dc 41 24 ef 91 b3 a5 3c 11 42 57 ad f6 79 b8 df a4 65 32 ed 62 09 bd cf 4b 04 a0 ab 90 7b 6a 96 ae c5 f8 4f c3 d0 64 c7 78 a2 5a c5 a0 76 c7 40 5b 87 4e 4c 9d 44 55 7c 00 5f a3 f8 84 92 b2 84 31 53 a4 b9 70 e7 95 1c e8 0b 7e 50 61 9f 71 c7 d0 3e 8d fb a4 df 7d 29 24 71 b6 48 37 bb 2c 68 81 bc 8b b9 06 c1 6d 29 49 07 9d 9b 98 ee f3 61 73 d4 3c bd 54 57 1f d8 eb b5 75 dd 24 3f 88 01 a3 ac f3 e6 45 d6 e0 df bc 79 85 0b f8 fb 95 40 58 89 df b0 b9 97 de 75 87 40 11 35 b7 2a 9a dc 55 4a 85 01 4c 9c 6a 61 1e d9 e0 04 30 e5 a4 76 9d 18 5e 0a aa d1 51 88 20 28 4f 7d 6b 2b 66 77 b2 76 98 66 96 7a ec 07 62 cd 68 ef 46 45 14 1c 3c 70 6c f8 c8 4c 57 5a 49 89 ff 8e 2a 2e 34 23 16 a6 b5 ff 2c b5 58 a6 9a bb 60 3d 18 db 62 c8 b2 1f 97 65 56 85 b2 57 b6 29 57 2a 02 a6 3b fb 51 2c 94 27 78 b7 3e f3 da 4a 71 9d fa 8d 0a 20 10 d8 5f 19 1d 54 3c 65 61 26 77 6f aa e5 2f 52 9b 4d d7 32 e6 60 72 58 b9 46 a9 fa 1a a7 14 de e2 0d 92 45 be 8c f7 63 3a f6 9b 41 df 39 ca 37 41 8e 09 ca 85 d6 f5 df f3 17 34 ee c6 46 54 cd d3 0e a1 30 ca 8d d1 40 7f a4 77 75 85 4a 49 d2 e0 42 64 dc 35 0d be 42 11 f8 68 77 fa 17 1e 9e 11 93 7d 16 6f 45 dc 86 40 de f9 4e 3d de e2 d1 99 9e 5a 24 80 29 36 f1 40 db de 8d 1f d3 95 73 05 ea 58 f5 ce a8 cf 72 d3 f5 d3 9b f6 bb 00 a7 ab a4 75 9f 25 de 96 1e 99 65 9f 49 b4 67 a8 f1 35 bf 72 75 1f 41 8b ff 3a 0e 38 31 d1 26 a7 a8 7f 22 bc 7f 65 a0 5f 0e f7 86 27 eb f3 85 12 8a 42 ac 04 92 65 Data Ascii: PKIX6%Fe
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:34:46 GMTContent-Type: application/zipContent-Length: 9891Connection: keep-aliveETag: "3914547665"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 113Expires: Mon, 22 Jul 2024 14:34:46 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c7b6dab10cc4-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d 2f df fd fa 21 ed 80 77 a9 39 90 7f fa 30 d1 2f b5 c5 80 5e 25 58 2d 8f a1 ec 2e 30 28 d8 18 6d 56 50 fc 6e ec c2 5d 3d 18 63 ce 72 b7 5f 01 fc dc 41 24 ef 91 b3 a5 3c 11 42 57 ad f6 79 b8 df a4 65 32 ed 62 09 bd cf 4b 04 a0 ab 90 7b 6a 96 ae c5 f8 4f c3 d0 64 c7 78 a2 5a c5 a0 76 c7 40 5b 87 4e 4c 9d 44 55 7c 00 5f a3 f8 84 92 b2 84 31 53 a4 b9 70 e7 95 1c e8 0b 7e 50 61 9f 71 c7 d0 3e 8d fb a4 df 7d 29 24 71 b6 48 37 bb 2c 68 81 bc 8b b9 06 c1 6d 29 49 07 9d 9b 98 ee f3 61 73 d4 3c bd 54 57 1f d8 eb b5 75 dd 24 3f 88 01 a3 ac f3 e6 45 d6 e0 df bc 79 85 0b f8 fb 95 40 58 89 df b0 b9 97 de 75 87 40 11 35 b7 2a 9a dc 55 4a 85 01 4c 9c 6a 61 1e d9 e0 04 30 e5 a4 76 9d 18 5e 0a aa d1 51 88 20 28 4f 7d 6b 2b 66 77 b2 76 98 66 96 7a ec 07 62 cd 68 ef 46 45 14 1c 3c 70 6c f8 c8 4c 57 5a 49 89 ff 8e 2a 2e 34 23 16 a6 b5 ff 2c b5 58 a6 9a bb 60 3d 18 db 62 c8 b2 1f 97 65 56 85 b2 57 b6 29 57 2a 02 a6 3b fb 51 2c 94 27 78 b7 3e f3 da 4a 71 9d fa 8d 0a 20 10 d8 5f 19 1d 54 3c 65 61 26 77 6f aa e5 2f 52 9b 4d d7 32 e6 60 72 58 b9 46 a9 fa 1a a7 14 de e2 0d 92 45 be 8c f7 63 3a f6 9b 41 df 39 ca 37 41 8e 09 ca 85 d6 f5 df f3 17 34 ee c6 46 54 cd d3 0e a1 30 ca 8d d1 40 7f a4 77 75 85 4a 49 d2 e0 42 64 dc 35 0d be 42 11 f8 68 77 fa 17 1e 9e 11 93 7d 16 6f 45 dc 86 40 de f9 4e 3d de e2 d1 99 9e 5a 24 80 29 36 f1 40 db de 8d 1f d3 95 73 05 ea 58 f5 ce a8 cf 72 d3 f5 d3 9b f6 bb 00 a7 ab a4 75 9f 25 de 96 1e 99 65 9f 49 b4 67 a8 f1 35 bf 72 75 1f 41 8b ff 3a 0e 38 31 d1 26 a7 a8 7f 22 bc 7f 65 a0 5f 0e f7 86 27 eb f3 85 12 8a 42 ac 04 92 65 Data Ascii: PKIX6%Fe
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:34:46 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 416Expires: Mon, 22 Jul 2024 14:34:46 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c7b9deb618f6-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:34:46 GMTContent-Type: application/zipContent-Length: 9891Connection: keep-aliveETag: "3914547665"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 113Expires: Mon, 22 Jul 2024 14:34:46 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c7bb0a081912-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d 2f df fd fa 21 ed 80 77 a9 39 90 7f fa 30 d1 2f b5 c5 80 5e 25 58 2d 8f a1 ec 2e 30 28 d8 18 6d 56 50 fc 6e ec c2 5d 3d 18 63 ce 72 b7 5f 01 fc dc 41 24 ef 91 b3 a5 3c 11 42 57 ad f6 79 b8 df a4 65 32 ed 62 09 bd cf 4b 04 a0 ab 90 7b 6a 96 ae c5 f8 4f c3 d0 64 c7 78 a2 5a c5 a0 76 c7 40 5b 87 4e 4c 9d 44 55 7c 00 5f a3 f8 84 92 b2 84 31 53 a4 b9 70 e7 95 1c e8 0b 7e 50 61 9f 71 c7 d0 3e 8d fb a4 df 7d 29 24 71 b6 48 37 bb 2c 68 81 bc 8b b9 06 c1 6d 29 49 07 9d 9b 98 ee f3 61 73 d4 3c bd 54 57 1f d8 eb b5 75 dd 24 3f 88 01 a3 ac f3 e6 45 d6 e0 df bc 79 85 0b f8 fb 95 40 58 89 df b0 b9 97 de 75 87 40 11 35 b7 2a 9a dc 55 4a 85 01 4c 9c 6a 61 1e d9 e0 04 30 e5 a4 76 9d 18 5e 0a aa d1 51 88 20 28 4f 7d 6b 2b 66 77 b2 76 98 66 96 7a ec 07 62 cd 68 ef 46 45 14 1c 3c 70 6c f8 c8 4c 57 5a 49 89 ff 8e 2a 2e 34 23 16 a6 b5 ff 2c b5 58 a6 9a bb 60 3d 18 db 62 c8 b2 1f 97 65 56 85 b2 57 b6 29 57 2a 02 a6 3b fb 51 2c 94 27 78 b7 3e f3 da 4a 71 9d fa 8d 0a 20 10 d8 5f 19 1d 54 3c 65 61 26 77 6f aa e5 2f 52 9b 4d d7 32 e6 60 72 58 b9 46 a9 fa 1a a7 14 de e2 0d 92 45 be 8c f7 63 3a f6 9b 41 df 39 ca 37 41 8e 09 ca 85 d6 f5 df f3 17 34 ee c6 46 54 cd d3 0e a1 30 ca 8d d1 40 7f a4 77 75 85 4a 49 d2 e0 42 64 dc 35 0d be 42 11 f8 68 77 fa 17 1e 9e 11 93 7d 16 6f 45 dc 86 40 de f9 4e 3d de e2 d1 99 9e 5a 24 80 29 36 f1 40 db de 8d 1f d3 95 73 05 ea 58 f5 ce a8 cf 72 d3 f5 d3 9b f6 bb 00 a7 ab a4 75 9f 25 de 96 1e 99 65 9f 49 b4 67 a8 f1 35 bf 72 75 1f 41 8b ff 3a 0e 38 31 d1 26 a7 a8 7f 22 bc 7f 65 a0 5f 0e f7 86 27 eb f3 85 12 8a 42 ac 04 92 65 Data Ascii: PKIX6%Fe
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:34:50 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 420Expires: Mon, 22 Jul 2024 14:34:50 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c7cfbb511a03-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:34:51 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 421Expires: Mon, 22 Jul 2024 14:34:51 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c7d8df4d7285-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:34:53 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 423Expires: Mon, 22 Jul 2024 14:34:53 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c7e2fddd0f81-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:34:53 GMTContent-Type: application/zipContent-Length: 9891Connection: keep-aliveETag: "3914547665"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 120Expires: Mon, 22 Jul 2024 14:34:53 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c7e2f8fe1855-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d 2f df fd fa 21 ed 80 77 a9 39 90 7f fa 30 d1 2f b5 c5 80 5e 25 58 2d 8f a1 ec 2e 30 28 d8 18 6d 56 50 fc 6e ec c2 5d 3d 18 63 ce 72 b7 5f 01 fc dc 41 24 ef 91 b3 a5 3c 11 42 57 ad f6 79 b8 df a4 65 32 ed 62 09 bd cf 4b 04 a0 ab 90 7b 6a 96 ae c5 f8 4f c3 d0 64 c7 78 a2 5a c5 a0 76 c7 40 5b 87 4e 4c 9d 44 55 7c 00 5f a3 f8 84 92 b2 84 31 53 a4 b9 70 e7 95 1c e8 0b 7e 50 61 9f 71 c7 d0 3e 8d fb a4 df 7d 29 24 71 b6 48 37 bb 2c 68 81 bc 8b b9 06 c1 6d 29 49 07 9d 9b 98 ee f3 61 73 d4 3c bd 54 57 1f d8 eb b5 75 dd 24 3f 88 01 a3 ac f3 e6 45 d6 e0 df bc 79 85 0b f8 fb 95 40 58 89 df b0 b9 97 de 75 87 40 11 35 b7 2a 9a dc 55 4a 85 01 4c 9c 6a 61 1e d9 e0 04 30 e5 a4 76 9d 18 5e 0a aa d1 51 88 20 28 4f 7d 6b 2b 66 77 b2 76 98 66 96 7a ec 07 62 cd 68 ef 46 45 14 1c 3c 70 6c f8 c8 4c 57 5a 49 89 ff 8e 2a 2e 34 23 16 a6 b5 ff 2c b5 58 a6 9a bb 60 3d 18 db 62 c8 b2 1f 97 65 56 85 b2 57 b6 29 57 2a 02 a6 3b fb 51 2c 94 27 78 b7 3e f3 da 4a 71 9d fa 8d 0a 20 10 d8 5f 19 1d 54 3c 65 61 26 77 6f aa e5 2f 52 9b 4d d7 32 e6 60 72 58 b9 46 a9 fa 1a a7 14 de e2 0d 92 45 be 8c f7 63 3a f6 9b 41 df 39 ca 37 41 8e 09 ca 85 d6 f5 df f3 17 34 ee c6 46 54 cd d3 0e a1 30 ca 8d d1 40 7f a4 77 75 85 4a 49 d2 e0 42 64 dc 35 0d be 42 11 f8 68 77 fa 17 1e 9e 11 93 7d 16 6f 45 dc 86 40 de f9 4e 3d de e2 d1 99 9e 5a 24 80 29 36 f1 40 db de 8d 1f d3 95 73 05 ea 58 f5 ce a8 cf 72 d3 f5 d3 9b f6 bb 00 a7 ab a4 75 9f 25 de 96 1e 99 65 9f 49 b4 67 a8 f1 35 bf 72 75 1f 41 8b ff 3a 0e 38 31 d1 26 a7 a8 7f 22 bc 7f 65 a0 5f 0e f7 86 27 eb f3 85 12 8a 42 ac 04 92 65 Data Ascii: PKIX6%Fe
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:34:53 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 423Expires: Mon, 22 Jul 2024 14:34:53 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c7e2fddd0f81-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:34:55 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 425Expires: Mon, 22 Jul 2024 14:34:55 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c7f08e01436f-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:34:56 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 426Expires: Mon, 22 Jul 2024 14:34:56 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c7f6db3e4378-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:34:56 GMTContent-Type: application/zipContent-Length: 9891Connection: keep-aliveETag: "3914547665"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 123Expires: Mon, 22 Jul 2024 14:34:56 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c7f86b358c96-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d 2f df fd fa 21 ed 80 77 a9 39 90 7f fa 30 d1 2f b5 c5 80 5e 25 58 2d 8f a1 ec 2e 30 28 d8 18 6d 56 50 fc 6e ec c2 5d 3d 18 63 ce 72 b7 5f 01 fc dc 41 24 ef 91 b3 a5 3c 11 42 57 ad f6 79 b8 df a4 65 32 ed 62 09 bd cf 4b 04 a0 ab 90 7b 6a 96 ae c5 f8 4f c3 d0 64 c7 78 a2 5a c5 a0 76 c7 40 5b 87 4e 4c 9d 44 55 7c 00 5f a3 f8 84 92 b2 84 31 53 a4 b9 70 e7 95 1c e8 0b 7e 50 61 9f 71 c7 d0 3e 8d fb a4 df 7d 29 24 71 b6 48 37 bb 2c 68 81 bc 8b b9 06 c1 6d 29 49 07 9d 9b 98 ee f3 61 73 d4 3c bd 54 57 1f d8 eb b5 75 dd 24 3f 88 01 a3 ac f3 e6 45 d6 e0 df bc 79 85 0b f8 fb 95 40 58 89 df b0 b9 97 de 75 87 40 11 35 b7 2a 9a dc 55 4a 85 01 4c 9c 6a 61 1e d9 e0 04 30 e5 a4 76 9d 18 5e 0a aa d1 51 88 20 28 4f 7d 6b 2b 66 77 b2 76 98 66 96 7a ec 07 62 cd 68 ef 46 45 14 1c 3c 70 6c f8 c8 4c 57 5a 49 89 ff 8e 2a 2e 34 23 16 a6 b5 ff 2c b5 58 a6 9a bb 60 3d 18 db 62 c8 b2 1f 97 65 56 85 b2 57 b6 29 57 2a 02 a6 3b fb 51 2c 94 27 78 b7 3e f3 da 4a 71 9d fa 8d 0a 20 10 d8 5f 19 1d 54 3c 65 61 26 77 6f aa e5 2f 52 9b 4d d7 32 e6 60 72 58 b9 46 a9 fa 1a a7 14 de e2 0d 92 45 be 8c f7 63 3a f6 9b 41 df 39 ca 37 41 8e 09 ca 85 d6 f5 df f3 17 34 ee c6 46 54 cd d3 0e a1 30 ca 8d d1 40 7f a4 77 75 85 4a 49 d2 e0 42 64 dc 35 0d be 42 11 f8 68 77 fa 17 1e 9e 11 93 7d 16 6f 45 dc 86 40 de f9 4e 3d de e2 d1 99 9e 5a 24 80 29 36 f1 40 db de 8d 1f d3 95 73 05 ea 58 f5 ce a8 cf 72 d3 f5 d3 9b f6 bb 00 a7 ab a4 75 9f 25 de 96 1e 99 65 9f 49 b4 67 a8 f1 35 bf 72 75 1f 41 8b ff 3a 0e 38 31 d1 26 a7 a8 7f 22 bc 7f 65 a0 5f 0e f7 86 27 eb f3 85 12 8a 42 ac 04 92 65 Data Ascii: PKIX6%Fe
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:35:00 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 430Expires: Mon, 22 Jul 2024 14:35:00 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c80f09f44233-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:35:02 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 432Expires: Mon, 22 Jul 2024 14:35:02 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c81e6c45c342-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:35:03 GMTContent-Type: application/zipContent-Length: 9891Connection: keep-aliveETag: "3914547665"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 130Expires: Mon, 22 Jul 2024 14:35:03 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c8211d1b190e-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d 2f df fd fa 21 ed 80 77 a9 39 90 7f fa 30 d1 2f b5 c5 80 5e 25 58 2d 8f a1 ec 2e 30 28 d8 18 6d 56 50 fc 6e ec c2 5d 3d 18 63 ce 72 b7 5f 01 fc dc 41 24 ef 91 b3 a5 3c 11 42 57 ad f6 79 b8 df a4 65 32 ed 62 09 bd cf 4b 04 a0 ab 90 7b 6a 96 ae c5 f8 4f c3 d0 64 c7 78 a2 5a c5 a0 76 c7 40 5b 87 4e 4c 9d 44 55 7c 00 5f a3 f8 84 92 b2 84 31 53 a4 b9 70 e7 95 1c e8 0b 7e 50 61 9f 71 c7 d0 3e 8d fb a4 df 7d 29 24 71 b6 48 37 bb 2c 68 81 bc 8b b9 06 c1 6d 29 49 07 9d 9b 98 ee f3 61 73 d4 3c bd 54 57 1f d8 eb b5 75 dd 24 3f 88 01 a3 ac f3 e6 45 d6 e0 df bc 79 85 0b f8 fb 95 40 58 89 df b0 b9 97 de 75 87 40 11 35 b7 2a 9a dc 55 4a 85 01 4c 9c 6a 61 1e d9 e0 04 30 e5 a4 76 9d 18 5e 0a aa d1 51 88 20 28 4f 7d 6b 2b 66 77 b2 76 98 66 96 7a ec 07 62 cd 68 ef 46 45 14 1c 3c 70 6c f8 c8 4c 57 5a 49 89 ff 8e 2a 2e 34 23 16 a6 b5 ff 2c b5 58 a6 9a bb 60 3d 18 db 62 c8 b2 1f 97 65 56 85 b2 57 b6 29 57 2a 02 a6 3b fb 51 2c 94 27 78 b7 3e f3 da 4a 71 9d fa 8d 0a 20 10 d8 5f 19 1d 54 3c 65 61 26 77 6f aa e5 2f 52 9b 4d d7 32 e6 60 72 58 b9 46 a9 fa 1a a7 14 de e2 0d 92 45 be 8c f7 63 3a f6 9b 41 df 39 ca 37 41 8e 09 ca 85 d6 f5 df f3 17 34 ee c6 46 54 cd d3 0e a1 30 ca 8d d1 40 7f a4 77 75 85 4a 49 d2 e0 42 64 dc 35 0d be 42 11 f8 68 77 fa 17 1e 9e 11 93 7d 16 6f 45 dc 86 40 de f9 4e 3d de e2 d1 99 9e 5a 24 80 29 36 f1 40 db de 8d 1f d3 95 73 05 ea 58 f5 ce a8 cf 72 d3 f5 d3 9b f6 bb 00 a7 ab a4 75 9f 25 de 96 1e 99 65 9f 49 b4 67 a8 f1 35 bf 72 75 1f 41 8b ff 3a 0e 38 31 d1 26 a7 a8 7f 22 bc 7f 65 a0 5f 0e f7 86 27 eb f3 85 12 8a 42 ac 04 92 65 Data Ascii: PKIX6%Fe
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:35:04 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 434Expires: Mon, 22 Jul 2024 14:35:04 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c828585f8c59-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:35:05 GMTContent-Type: application/zipContent-Length: 9891Connection: keep-aliveETag: "3914547665"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 132Expires: Mon, 22 Jul 2024 14:35:05 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c82e2b384321-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d 2f df fd fa 21 ed 80 77 a9 39 90 7f fa 30 d1 2f b5 c5 80 5e 25 58 2d 8f a1 ec 2e 30 28 d8 18 6d 56 50 fc 6e ec c2 5d 3d 18 63 ce 72 b7 5f 01 fc dc 41 24 ef 91 b3 a5 3c 11 42 57 ad f6 79 b8 df a4 65 32 ed 62 09 bd cf 4b 04 a0 ab 90 7b 6a 96 ae c5 f8 4f c3 d0 64 c7 78 a2 5a c5 a0 76 c7 40 5b 87 4e 4c 9d 44 55 7c 00 5f a3 f8 84 92 b2 84 31 53 a4 b9 70 e7 95 1c e8 0b 7e 50 61 9f 71 c7 d0 3e 8d fb a4 df 7d 29 24 71 b6 48 37 bb 2c 68 81 bc 8b b9 06 c1 6d 29 49 07 9d 9b 98 ee f3 61 73 d4 3c bd 54 57 1f d8 eb b5 75 dd 24 3f 88 01 a3 ac f3 e6 45 d6 e0 df bc 79 85 0b f8 fb 95 40 58 89 df b0 b9 97 de 75 87 40 11 35 b7 2a 9a dc 55 4a 85 01 4c 9c 6a 61 1e d9 e0 04 30 e5 a4 76 9d 18 5e 0a aa d1 51 88 20 28 4f 7d 6b 2b 66 77 b2 76 98 66 96 7a ec 07 62 cd 68 ef 46 45 14 1c 3c 70 6c f8 c8 4c 57 5a 49 89 ff 8e 2a 2e 34 23 16 a6 b5 ff 2c b5 58 a6 9a bb 60 3d 18 db 62 c8 b2 1f 97 65 56 85 b2 57 b6 29 57 2a 02 a6 3b fb 51 2c 94 27 78 b7 3e f3 da 4a 71 9d fa 8d 0a 20 10 d8 5f 19 1d 54 3c 65 61 26 77 6f aa e5 2f 52 9b 4d d7 32 e6 60 72 58 b9 46 a9 fa 1a a7 14 de e2 0d 92 45 be 8c f7 63 3a f6 9b 41 df 39 ca 37 41 8e 09 ca 85 d6 f5 df f3 17 34 ee c6 46 54 cd d3 0e a1 30 ca 8d d1 40 7f a4 77 75 85 4a 49 d2 e0 42 64 dc 35 0d be 42 11 f8 68 77 fa 17 1e 9e 11 93 7d 16 6f 45 dc 86 40 de f9 4e 3d de e2 d1 99 9e 5a 24 80 29 36 f1 40 db de 8d 1f d3 95 73 05 ea 58 f5 ce a8 cf 72 d3 f5 d3 9b f6 bb 00 a7 ab a4 75 9f 25 de 96 1e 99 65 9f 49 b4 67 a8 f1 35 bf 72 75 1f 41 8b ff 3a 0e 38 31 d1 26 a7 a8 7f 22 bc 7f 65 a0 5f 0e f7 86 27 eb f3 85 12 8a 42 ac 04 92 65 Data Ascii: PKIX6%Fe
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:35:07 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 437Expires: Mon, 22 Jul 2024 14:35:07 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c838ff6932fa-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:35:07 GMTContent-Type: application/zipContent-Length: 9891Connection: keep-aliveETag: "3914547665"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 134Expires: Mon, 22 Jul 2024 14:35:07 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c83d88f442d0-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d 2f df fd fa 21 ed 80 77 a9 39 90 7f fa 30 d1 2f b5 c5 80 5e 25 58 2d 8f a1 ec 2e 30 28 d8 18 6d 56 50 fc 6e ec c2 5d 3d 18 63 ce 72 b7 5f 01 fc dc 41 24 ef 91 b3 a5 3c 11 42 57 ad f6 79 b8 df a4 65 32 ed 62 09 bd cf 4b 04 a0 ab 90 7b 6a 96 ae c5 f8 4f c3 d0 64 c7 78 a2 5a c5 a0 76 c7 40 5b 87 4e 4c 9d 44 55 7c 00 5f a3 f8 84 92 b2 84 31 53 a4 b9 70 e7 95 1c e8 0b 7e 50 61 9f 71 c7 d0 3e 8d fb a4 df 7d 29 24 71 b6 48 37 bb 2c 68 81 bc 8b b9 06 c1 6d 29 49 07 9d 9b 98 ee f3 61 73 d4 3c bd 54 57 1f d8 eb b5 75 dd 24 3f 88 01 a3 ac f3 e6 45 d6 e0 df bc 79 85 0b f8 fb 95 40 58 89 df b0 b9 97 de 75 87 40 11 35 b7 2a 9a dc 55 4a 85 01 4c 9c 6a 61 1e d9 e0 04 30 e5 a4 76 9d 18 5e 0a aa d1 51 88 20 28 4f 7d 6b 2b 66 77 b2 76 98 66 96 7a ec 07 62 cd 68 ef 46 45 14 1c 3c 70 6c f8 c8 4c 57 5a 49 89 ff 8e 2a 2e 34 23 16 a6 b5 ff 2c b5 58 a6 9a bb 60 3d 18 db 62 c8 b2 1f 97 65 56 85 b2 57 b6 29 57 2a 02 a6 3b fb 51 2c 94 27 78 b7 3e f3 da 4a 71 9d fa 8d 0a 20 10 d8 5f 19 1d 54 3c 65 61 26 77 6f aa e5 2f 52 9b 4d d7 32 e6 60 72 58 b9 46 a9 fa 1a a7 14 de e2 0d 92 45 be 8c f7 63 3a f6 9b 41 df 39 ca 37 41 8e 09 ca 85 d6 f5 df f3 17 34 ee c6 46 54 cd d3 0e a1 30 ca 8d d1 40 7f a4 77 75 85 4a 49 d2 e0 42 64 dc 35 0d be 42 11 f8 68 77 fa 17 1e 9e 11 93 7d 16 6f 45 dc 86 40 de f9 4e 3d de e2 d1 99 9e 5a 24 80 29 36 f1 40 db de 8d 1f d3 95 73 05 ea 58 f5 ce a8 cf 72 d3 f5 d3 9b f6 bb 00 a7 ab a4 75 9f 25 de 96 1e 99 65 9f 49 b4 67 a8 f1 35 bf 72 75 1f 41 8b ff 3a 0e 38 31 d1 26 a7 a8 7f 22 bc 7f 65 a0 5f 0e f7 86 27 eb f3 85 12 8a 42 ac 04 92 65 Data Ascii: PKIX6%Fe
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:35:08 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 438Expires: Mon, 22 Jul 2024 14:35:08 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c8418e715e78-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:35:10 GMTContent-Type: application/zipContent-Length: 9891Connection: keep-aliveETag: "3914547665"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 137Expires: Mon, 22 Jul 2024 14:35:10 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c84ffe6072aa-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d 2f df fd fa 21 ed 80 77 a9 39 90 7f fa 30 d1 2f b5 c5 80 5e 25 58 2d 8f a1 ec 2e 30 28 d8 18 6d 56 50 fc 6e ec c2 5d 3d 18 63 ce 72 b7 5f 01 fc dc 41 24 ef 91 b3 a5 3c 11 42 57 ad f6 79 b8 df a4 65 32 ed 62 09 bd cf 4b 04 a0 ab 90 7b 6a 96 ae c5 f8 4f c3 d0 64 c7 78 a2 5a c5 a0 76 c7 40 5b 87 4e 4c 9d 44 55 7c 00 5f a3 f8 84 92 b2 84 31 53 a4 b9 70 e7 95 1c e8 0b 7e 50 61 9f 71 c7 d0 3e 8d fb a4 df 7d 29 24 71 b6 48 37 bb 2c 68 81 bc 8b b9 06 c1 6d 29 49 07 9d 9b 98 ee f3 61 73 d4 3c bd 54 57 1f d8 eb b5 75 dd 24 3f 88 01 a3 ac f3 e6 45 d6 e0 df bc 79 85 0b f8 fb 95 40 58 89 df b0 b9 97 de 75 87 40 11 35 b7 2a 9a dc 55 4a 85 01 4c 9c 6a 61 1e d9 e0 04 30 e5 a4 76 9d 18 5e 0a aa d1 51 88 20 28 4f 7d 6b 2b 66 77 b2 76 98 66 96 7a ec 07 62 cd 68 ef 46 45 14 1c 3c 70 6c f8 c8 4c 57 5a 49 89 ff 8e 2a 2e 34 23 16 a6 b5 ff 2c b5 58 a6 9a bb 60 3d 18 db 62 c8 b2 1f 97 65 56 85 b2 57 b6 29 57 2a 02 a6 3b fb 51 2c 94 27 78 b7 3e f3 da 4a 71 9d fa 8d 0a 20 10 d8 5f 19 1d 54 3c 65 61 26 77 6f aa e5 2f 52 9b 4d d7 32 e6 60 72 58 b9 46 a9 fa 1a a7 14 de e2 0d 92 45 be 8c f7 63 3a f6 9b 41 df 39 ca 37 41 8e 09 ca 85 d6 f5 df f3 17 34 ee c6 46 54 cd d3 0e a1 30 ca 8d d1 40 7f a4 77 75 85 4a 49 d2 e0 42 64 dc 35 0d be 42 11 f8 68 77 fa 17 1e 9e 11 93 7d 16 6f 45 dc 86 40 de f9 4e 3d de e2 d1 99 9e 5a 24 80 29 36 f1 40 db de 8d 1f d3 95 73 05 ea 58 f5 ce a8 cf 72 d3 f5 d3 9b f6 bb 00 a7 ab a4 75 9f 25 de 96 1e 99 65 9f 49 b4 67 a8 f1 35 bf 72 75 1f 41 8b ff 3a 0e 38 31 d1 26 a7 a8 7f 22 bc 7f 65 a0 5f 0e f7 86 27 eb f3 85 12 8a 42 ac 04 92 65 Data Ascii: PKIX6%Fe
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:35:15 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 445Expires: Mon, 22 Jul 2024 14:35:15 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c86d9ace7283-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:35:15 GMTContent-Type: application/zipContent-Length: 9891Connection: keep-aliveETag: "3914547665"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 142Expires: Mon, 22 Jul 2024 14:35:15 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c86ec9427ca2-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d 2f df fd fa 21 ed 80 77 a9 39 90 7f fa 30 d1 2f b5 c5 80 5e 25 58 2d 8f a1 ec 2e 30 28 d8 18 6d 56 50 fc 6e ec c2 5d 3d 18 63 ce 72 b7 5f 01 fc dc 41 24 ef 91 b3 a5 3c 11 42 57 ad f6 79 b8 df a4 65 32 ed 62 09 bd cf 4b 04 a0 ab 90 7b 6a 96 ae c5 f8 4f c3 d0 64 c7 78 a2 5a c5 a0 76 c7 40 5b 87 4e 4c 9d 44 55 7c 00 5f a3 f8 84 92 b2 84 31 53 a4 b9 70 e7 95 1c e8 0b 7e 50 61 9f 71 c7 d0 3e 8d fb a4 df 7d 29 24 71 b6 48 37 bb 2c 68 81 bc 8b b9 06 c1 6d 29 49 07 9d 9b 98 ee f3 61 73 d4 3c bd 54 57 1f d8 eb b5 75 dd 24 3f 88 01 a3 ac f3 e6 45 d6 e0 df bc 79 85 0b f8 fb 95 40 58 89 df b0 b9 97 de 75 87 40 11 35 b7 2a 9a dc 55 4a 85 01 4c 9c 6a 61 1e d9 e0 04 30 e5 a4 76 9d 18 5e 0a aa d1 51 88 20 28 4f 7d 6b 2b 66 77 b2 76 98 66 96 7a ec 07 62 cd 68 ef 46 45 14 1c 3c 70 6c f8 c8 4c 57 5a 49 89 ff 8e 2a 2e 34 23 16 a6 b5 ff 2c b5 58 a6 9a bb 60 3d 18 db 62 c8 b2 1f 97 65 56 85 b2 57 b6 29 57 2a 02 a6 3b fb 51 2c 94 27 78 b7 3e f3 da 4a 71 9d fa 8d 0a 20 10 d8 5f 19 1d 54 3c 65 61 26 77 6f aa e5 2f 52 9b 4d d7 32 e6 60 72 58 b9 46 a9 fa 1a a7 14 de e2 0d 92 45 be 8c f7 63 3a f6 9b 41 df 39 ca 37 41 8e 09 ca 85 d6 f5 df f3 17 34 ee c6 46 54 cd d3 0e a1 30 ca 8d d1 40 7f a4 77 75 85 4a 49 d2 e0 42 64 dc 35 0d be 42 11 f8 68 77 fa 17 1e 9e 11 93 7d 16 6f 45 dc 86 40 de f9 4e 3d de e2 d1 99 9e 5a 24 80 29 36 f1 40 db de 8d 1f d3 95 73 05 ea 58 f5 ce a8 cf 72 d3 f5 d3 9b f6 bb 00 a7 ab a4 75 9f 25 de 96 1e 99 65 9f 49 b4 67 a8 f1 35 bf 72 75 1f 41 8b ff 3a 0e 38 31 d1 26 a7 a8 7f 22 bc 7f 65 a0 5f 0e f7 86 27 eb f3 85 12 8a 42 ac 04 92 65 Data Ascii: PKIX6%Fe
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:35:17 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 447Expires: Mon, 22 Jul 2024 14:35:17 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c87aef7a425d-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:35:17 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 447Expires: Mon, 22 Jul 2024 14:35:17 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c87aef7a425d-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:35:18 GMTContent-Type: application/zipContent-Length: 9891Connection: keep-aliveETag: "3914547665"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 145Expires: Mon, 22 Jul 2024 14:35:18 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c8818b485e7d-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d 2f df fd fa 21 ed 80 77 a9 39 90 7f fa 30 d1 2f b5 c5 80 5e 25 58 2d 8f a1 ec 2e 30 28 d8 18 6d 56 50 fc 6e ec c2 5d 3d 18 63 ce 72 b7 5f 01 fc dc 41 24 ef 91 b3 a5 3c 11 42 57 ad f6 79 b8 df a4 65 32 ed 62 09 bd cf 4b 04 a0 ab 90 7b 6a 96 ae c5 f8 4f c3 d0 64 c7 78 a2 5a c5 a0 76 c7 40 5b 87 4e 4c 9d 44 55 7c 00 5f a3 f8 84 92 b2 84 31 53 a4 b9 70 e7 95 1c e8 0b 7e 50 61 9f 71 c7 d0 3e 8d fb a4 df 7d 29 24 71 b6 48 37 bb 2c 68 81 bc 8b b9 06 c1 6d 29 49 07 9d 9b 98 ee f3 61 73 d4 3c bd 54 57 1f d8 eb b5 75 dd 24 3f 88 01 a3 ac f3 e6 45 d6 e0 df bc 79 85 0b f8 fb 95 40 58 89 df b0 b9 97 de 75 87 40 11 35 b7 2a 9a dc 55 4a 85 01 4c 9c 6a 61 1e d9 e0 04 30 e5 a4 76 9d 18 5e 0a aa d1 51 88 20 28 4f 7d 6b 2b 66 77 b2 76 98 66 96 7a ec 07 62 cd 68 ef 46 45 14 1c 3c 70 6c f8 c8 4c 57 5a 49 89 ff 8e 2a 2e 34 23 16 a6 b5 ff 2c b5 58 a6 9a bb 60 3d 18 db 62 c8 b2 1f 97 65 56 85 b2 57 b6 29 57 2a 02 a6 3b fb 51 2c 94 27 78 b7 3e f3 da 4a 71 9d fa 8d 0a 20 10 d8 5f 19 1d 54 3c 65 61 26 77 6f aa e5 2f 52 9b 4d d7 32 e6 60 72 58 b9 46 a9 fa 1a a7 14 de e2 0d 92 45 be 8c f7 63 3a f6 9b 41 df 39 ca 37 41 8e 09 ca 85 d6 f5 df f3 17 34 ee c6 46 54 cd d3 0e a1 30 ca 8d d1 40 7f a4 77 75 85 4a 49 d2 e0 42 64 dc 35 0d be 42 11 f8 68 77 fa 17 1e 9e 11 93 7d 16 6f 45 dc 86 40 de f9 4e 3d de e2 d1 99 9e 5a 24 80 29 36 f1 40 db de 8d 1f d3 95 73 05 ea 58 f5 ce a8 cf 72 d3 f5 d3 9b f6 bb 00 a7 ab a4 75 9f 25 de 96 1e 99 65 9f 49 b4 67 a8 f1 35 bf 72 75 1f 41 8b ff 3a 0e 38 31 d1 26 a7 a8 7f 22 bc 7f 65 a0 5f 0e f7 86 27 eb f3 85 12 8a 42 ac 04 92 65 Data Ascii: PKIX6%Fe
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:35:18 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 448Expires: Mon, 22 Jul 2024 14:35:18 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c8833c525e7d-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:35:20 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 450Expires: Mon, 22 Jul 2024 14:35:20 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c88cde4f8c81-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:35:22 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 452Expires: Mon, 22 Jul 2024 14:35:22 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c898c9f98c75-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:35:26 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 456Expires: Mon, 22 Jul 2024 14:35:26 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c8b19acd9e1a-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:35:28 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 458Expires: Mon, 22 Jul 2024 14:35:28 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c8bcb8727c96-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:35:29 GMTContent-Type: application/zipContent-Length: 9891Connection: keep-aliveETag: "3914547665"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 156Expires: Mon, 22 Jul 2024 14:35:29 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c8c4bc470f4a-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d 2f df fd fa 21 ed 80 77 a9 39 90 7f fa 30 d1 2f b5 c5 80 5e 25 58 2d 8f a1 ec 2e 30 28 d8 18 6d 56 50 fc 6e ec c2 5d 3d 18 63 ce 72 b7 5f 01 fc dc 41 24 ef 91 b3 a5 3c 11 42 57 ad f6 79 b8 df a4 65 32 ed 62 09 bd cf 4b 04 a0 ab 90 7b 6a 96 ae c5 f8 4f c3 d0 64 c7 78 a2 5a c5 a0 76 c7 40 5b 87 4e 4c 9d 44 55 7c 00 5f a3 f8 84 92 b2 84 31 53 a4 b9 70 e7 95 1c e8 0b 7e 50 61 9f 71 c7 d0 3e 8d fb a4 df 7d 29 24 71 b6 48 37 bb 2c 68 81 bc 8b b9 06 c1 6d 29 49 07 9d 9b 98 ee f3 61 73 d4 3c bd 54 57 1f d8 eb b5 75 dd 24 3f 88 01 a3 ac f3 e6 45 d6 e0 df bc 79 85 0b f8 fb 95 40 58 89 df b0 b9 97 de 75 87 40 11 35 b7 2a 9a dc 55 4a 85 01 4c 9c 6a 61 1e d9 e0 04 30 e5 a4 76 9d 18 5e 0a aa d1 51 88 20 28 4f 7d 6b 2b 66 77 b2 76 98 66 96 7a ec 07 62 cd 68 ef 46 45 14 1c 3c 70 6c f8 c8 4c 57 5a 49 89 ff 8e 2a 2e 34 23 16 a6 b5 ff 2c b5 58 a6 9a bb 60 3d 18 db 62 c8 b2 1f 97 65 56 85 b2 57 b6 29 57 2a 02 a6 3b fb 51 2c 94 27 78 b7 3e f3 da 4a 71 9d fa 8d 0a 20 10 d8 5f 19 1d 54 3c 65 61 26 77 6f aa e5 2f 52 9b 4d d7 32 e6 60 72 58 b9 46 a9 fa 1a a7 14 de e2 0d 92 45 be 8c f7 63 3a f6 9b 41 df 39 ca 37 41 8e 09 ca 85 d6 f5 df f3 17 34 ee c6 46 54 cd d3 0e a1 30 ca 8d d1 40 7f a4 77 75 85 4a 49 d2 e0 42 64 dc 35 0d be 42 11 f8 68 77 fa 17 1e 9e 11 93 7d 16 6f 45 dc 86 40 de f9 4e 3d de e2 d1 99 9e 5a 24 80 29 36 f1 40 db de 8d 1f d3 95 73 05 ea 58 f5 ce a8 cf 72 d3 f5 d3 9b f6 bb 00 a7 ab a4 75 9f 25 de 96 1e 99 65 9f 49 b4 67 a8 f1 35 bf 72 75 1f 41 8b ff 3a 0e 38 31 d1 26 a7 a8 7f 22 bc 7f 65 a0 5f 0e f7 86 27 eb f3 85 12 8a 42 ac 04 92 65 Data Ascii: PKIX6%Fe
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:35:30 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 460Expires: Mon, 22 Jul 2024 14:35:30 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c8cca92e4234-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:35:32 GMTContent-Type: application/zipContent-Length: 9891Connection: keep-aliveETag: "3914547665"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 159Expires: Mon, 22 Jul 2024 14:35:32 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c8d6b8a243e2-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d 2f df fd fa 21 ed 80 77 a9 39 90 7f fa 30 d1 2f b5 c5 80 5e 25 58 2d 8f a1 ec 2e 30 28 d8 18 6d 56 50 fc 6e ec c2 5d 3d 18 63 ce 72 b7 5f 01 fc dc 41 24 ef 91 b3 a5 3c 11 42 57 ad f6 79 b8 df a4 65 32 ed 62 09 bd cf 4b 04 a0 ab 90 7b 6a 96 ae c5 f8 4f c3 d0 64 c7 78 a2 5a c5 a0 76 c7 40 5b 87 4e 4c 9d 44 55 7c 00 5f a3 f8 84 92 b2 84 31 53 a4 b9 70 e7 95 1c e8 0b 7e 50 61 9f 71 c7 d0 3e 8d fb a4 df 7d 29 24 71 b6 48 37 bb 2c 68 81 bc 8b b9 06 c1 6d 29 49 07 9d 9b 98 ee f3 61 73 d4 3c bd 54 57 1f d8 eb b5 75 dd 24 3f 88 01 a3 ac f3 e6 45 d6 e0 df bc 79 85 0b f8 fb 95 40 58 89 df b0 b9 97 de 75 87 40 11 35 b7 2a 9a dc 55 4a 85 01 4c 9c 6a 61 1e d9 e0 04 30 e5 a4 76 9d 18 5e 0a aa d1 51 88 20 28 4f 7d 6b 2b 66 77 b2 76 98 66 96 7a ec 07 62 cd 68 ef 46 45 14 1c 3c 70 6c f8 c8 4c 57 5a 49 89 ff 8e 2a 2e 34 23 16 a6 b5 ff 2c b5 58 a6 9a bb 60 3d 18 db 62 c8 b2 1f 97 65 56 85 b2 57 b6 29 57 2a 02 a6 3b fb 51 2c 94 27 78 b7 3e f3 da 4a 71 9d fa 8d 0a 20 10 d8 5f 19 1d 54 3c 65 61 26 77 6f aa e5 2f 52 9b 4d d7 32 e6 60 72 58 b9 46 a9 fa 1a a7 14 de e2 0d 92 45 be 8c f7 63 3a f6 9b 41 df 39 ca 37 41 8e 09 ca 85 d6 f5 df f3 17 34 ee c6 46 54 cd d3 0e a1 30 ca 8d d1 40 7f a4 77 75 85 4a 49 d2 e0 42 64 dc 35 0d be 42 11 f8 68 77 fa 17 1e 9e 11 93 7d 16 6f 45 dc 86 40 de f9 4e 3d de e2 d1 99 9e 5a 24 80 29 36 f1 40 db de 8d 1f d3 95 73 05 ea 58 f5 ce a8 cf 72 d3 f5 d3 9b f6 bb 00 a7 ab a4 75 9f 25 de 96 1e 99 65 9f 49 b4 67 a8 f1 35 bf 72 75 1f 41 8b ff 3a 0e 38 31 d1 26 a7 a8 7f 22 bc 7f 65 a0 5f 0e f7 86 27 eb f3 85 12 8a 42 ac 04 92 65 Data Ascii: PKIX6%Fe
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:35:33 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 463Expires: Mon, 22 Jul 2024 14:35:33 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c8de0d377d06-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:35:36 GMTContent-Type: application/zipContent-Length: 9891Connection: keep-aliveETag: "3914547665"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 163Expires: Mon, 22 Jul 2024 14:35:36 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c8f22d080f7c-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d 2f df fd fa 21 ed 80 77 a9 39 90 7f fa 30 d1 2f b5 c5 80 5e 25 58 2d 8f a1 ec 2e 30 28 d8 18 6d 56 50 fc 6e ec c2 5d 3d 18 63 ce 72 b7 5f 01 fc dc 41 24 ef 91 b3 a5 3c 11 42 57 ad f6 79 b8 df a4 65 32 ed 62 09 bd cf 4b 04 a0 ab 90 7b 6a 96 ae c5 f8 4f c3 d0 64 c7 78 a2 5a c5 a0 76 c7 40 5b 87 4e 4c 9d 44 55 7c 00 5f a3 f8 84 92 b2 84 31 53 a4 b9 70 e7 95 1c e8 0b 7e 50 61 9f 71 c7 d0 3e 8d fb a4 df 7d 29 24 71 b6 48 37 bb 2c 68 81 bc 8b b9 06 c1 6d 29 49 07 9d 9b 98 ee f3 61 73 d4 3c bd 54 57 1f d8 eb b5 75 dd 24 3f 88 01 a3 ac f3 e6 45 d6 e0 df bc 79 85 0b f8 fb 95 40 58 89 df b0 b9 97 de 75 87 40 11 35 b7 2a 9a dc 55 4a 85 01 4c 9c 6a 61 1e d9 e0 04 30 e5 a4 76 9d 18 5e 0a aa d1 51 88 20 28 4f 7d 6b 2b 66 77 b2 76 98 66 96 7a ec 07 62 cd 68 ef 46 45 14 1c 3c 70 6c f8 c8 4c 57 5a 49 89 ff 8e 2a 2e 34 23 16 a6 b5 ff 2c b5 58 a6 9a bb 60 3d 18 db 62 c8 b2 1f 97 65 56 85 b2 57 b6 29 57 2a 02 a6 3b fb 51 2c 94 27 78 b7 3e f3 da 4a 71 9d fa 8d 0a 20 10 d8 5f 19 1d 54 3c 65 61 26 77 6f aa e5 2f 52 9b 4d d7 32 e6 60 72 58 b9 46 a9 fa 1a a7 14 de e2 0d 92 45 be 8c f7 63 3a f6 9b 41 df 39 ca 37 41 8e 09 ca 85 d6 f5 df f3 17 34 ee c6 46 54 cd d3 0e a1 30 ca 8d d1 40 7f a4 77 75 85 4a 49 d2 e0 42 64 dc 35 0d be 42 11 f8 68 77 fa 17 1e 9e 11 93 7d 16 6f 45 dc 86 40 de f9 4e 3d de e2 d1 99 9e 5a 24 80 29 36 f1 40 db de 8d 1f d3 95 73 05 ea 58 f5 ce a8 cf 72 d3 f5 d3 9b f6 bb 00 a7 ab a4 75 9f 25 de 96 1e 99 65 9f 49 b4 67 a8 f1 35 bf 72 75 1f 41 8b ff 3a 0e 38 31 d1 26 a7 a8 7f 22 bc 7f 65 a0 5f 0e f7 86 27 eb f3 85 12 8a 42 ac 04 92 65 Data Ascii: PKIX6%Fe
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:35:37 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 467Expires: Mon, 22 Jul 2024 14:35:37 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c8f7a8da80e2-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:35:38 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 468Expires: Mon, 22 Jul 2024 14:35:38 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c90038b718d0-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:35:38 GMTContent-Type: application/zipContent-Length: 9891Connection: keep-aliveETag: "3914547665"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 165Expires: Mon, 22 Jul 2024 14:35:38 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c9003ca74350-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d 2f df fd fa 21 ed 80 77 a9 39 90 7f fa 30 d1 2f b5 c5 80 5e 25 58 2d 8f a1 ec 2e 30 28 d8 18 6d 56 50 fc 6e ec c2 5d 3d 18 63 ce 72 b7 5f 01 fc dc 41 24 ef 91 b3 a5 3c 11 42 57 ad f6 79 b8 df a4 65 32 ed 62 09 bd cf 4b 04 a0 ab 90 7b 6a 96 ae c5 f8 4f c3 d0 64 c7 78 a2 5a c5 a0 76 c7 40 5b 87 4e 4c 9d 44 55 7c 00 5f a3 f8 84 92 b2 84 31 53 a4 b9 70 e7 95 1c e8 0b 7e 50 61 9f 71 c7 d0 3e 8d fb a4 df 7d 29 24 71 b6 48 37 bb 2c 68 81 bc 8b b9 06 c1 6d 29 49 07 9d 9b 98 ee f3 61 73 d4 3c bd 54 57 1f d8 eb b5 75 dd 24 3f 88 01 a3 ac f3 e6 45 d6 e0 df bc 79 85 0b f8 fb 95 40 58 89 df b0 b9 97 de 75 87 40 11 35 b7 2a 9a dc 55 4a 85 01 4c 9c 6a 61 1e d9 e0 04 30 e5 a4 76 9d 18 5e 0a aa d1 51 88 20 28 4f 7d 6b 2b 66 77 b2 76 98 66 96 7a ec 07 62 cd 68 ef 46 45 14 1c 3c 70 6c f8 c8 4c 57 5a 49 89 ff 8e 2a 2e 34 23 16 a6 b5 ff 2c b5 58 a6 9a bb 60 3d 18 db 62 c8 b2 1f 97 65 56 85 b2 57 b6 29 57 2a 02 a6 3b fb 51 2c 94 27 78 b7 3e f3 da 4a 71 9d fa 8d 0a 20 10 d8 5f 19 1d 54 3c 65 61 26 77 6f aa e5 2f 52 9b 4d d7 32 e6 60 72 58 b9 46 a9 fa 1a a7 14 de e2 0d 92 45 be 8c f7 63 3a f6 9b 41 df 39 ca 37 41 8e 09 ca 85 d6 f5 df f3 17 34 ee c6 46 54 cd d3 0e a1 30 ca 8d d1 40 7f a4 77 75 85 4a 49 d2 e0 42 64 dc 35 0d be 42 11 f8 68 77 fa 17 1e 9e 11 93 7d 16 6f 45 dc 86 40 de f9 4e 3d de e2 d1 99 9e 5a 24 80 29 36 f1 40 db de 8d 1f d3 95 73 05 ea 58 f5 ce a8 cf 72 d3 f5 d3 9b f6 bb 00 a7 ab a4 75 9f 25 de 96 1e 99 65 9f 49 b4 67 a8 f1 35 bf 72 75 1f 41 8b ff 3a 0e 38 31 d1 26 a7 a8 7f 22 bc 7f 65 a0 5f 0e f7 86 27 eb f3 85 12 8a 42 ac 04 92 65 Data Ascii: PKIX6%Fe
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:35:39 GMTContent-Type: application/zipContent-Length: 9891Connection: keep-aliveETag: "3914547665"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 166Expires: Mon, 22 Jul 2024 14:35:39 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c9012d204350-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d 2f df fd fa 21 ed 80 77 a9 39 90 7f fa 30 d1 2f b5 c5 80 5e 25 58 2d 8f a1 ec 2e 30 28 d8 18 6d 56 50 fc 6e ec c2 5d 3d 18 63 ce 72 b7 5f 01 fc dc 41 24 ef 91 b3 a5 3c 11 42 57 ad f6 79 b8 df a4 65 32 ed 62 09 bd cf 4b 04 a0 ab 90 7b 6a 96 ae c5 f8 4f c3 d0 64 c7 78 a2 5a c5 a0 76 c7 40 5b 87 4e 4c 9d 44 55 7c 00 5f a3 f8 84 92 b2 84 31 53 a4 b9 70 e7 95 1c e8 0b 7e 50 61 9f 71 c7 d0 3e 8d fb a4 df 7d 29 24 71 b6 48 37 bb 2c 68 81 bc 8b b9 06 c1 6d 29 49 07 9d 9b 98 ee f3 61 73 d4 3c bd 54 57 1f d8 eb b5 75 dd 24 3f 88 01 a3 ac f3 e6 45 d6 e0 df bc 79 85 0b f8 fb 95 40 58 89 df b0 b9 97 de 75 87 40 11 35 b7 2a 9a dc 55 4a 85 01 4c 9c 6a 61 1e d9 e0 04 30 e5 a4 76 9d 18 5e 0a aa d1 51 88 20 28 4f 7d 6b 2b 66 77 b2 76 98 66 96 7a ec 07 62 cd 68 ef 46 45 14 1c 3c 70 6c f8 c8 4c 57 5a 49 89 ff 8e 2a 2e 34 23 16 a6 b5 ff 2c b5 58 a6 9a bb 60 3d 18 db 62 c8 b2 1f 97 65 56 85 b2 57 b6 29 57 2a 02 a6 3b fb 51 2c 94 27 78 b7 3e f3 da 4a 71 9d fa 8d 0a 20 10 d8 5f 19 1d 54 3c 65 61 26 77 6f aa e5 2f 52 9b 4d d7 32 e6 60 72 58 b9 46 a9 fa 1a a7 14 de e2 0d 92 45 be 8c f7 63 3a f6 9b 41 df 39 ca 37 41 8e 09 ca 85 d6 f5 df f3 17 34 ee c6 46 54 cd d3 0e a1 30 ca 8d d1 40 7f a4 77 75 85 4a 49 d2 e0 42 64 dc 35 0d be 42 11 f8 68 77 fa 17 1e 9e 11 93 7d 16 6f 45 dc 86 40 de f9 4e 3d de e2 d1 99 9e 5a 24 80 29 36 f1 40 db de 8d 1f d3 95 73 05 ea 58 f5 ce a8 cf 72 d3 f5 d3 9b f6 bb 00 a7 ab a4 75 9f 25 de 96 1e 99 65 9f 49 b4 67 a8 f1 35 bf 72 75 1f 41 8b ff 3a 0e 38 31 d1 26 a7 a8 7f 22 bc 7f 65 a0 5f 0e f7 86 27 eb f3 85 12 8a 42 ac 04 92 65 Data Ascii: PKIX6%Fe
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:35:39 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 469Expires: Mon, 22 Jul 2024 14:35:39 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c904cb0d0f84-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:35:40 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 470Expires: Mon, 22 Jul 2024 14:35:40 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c90d0b1d4252-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:35:43 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 472Expires: Mon, 22 Jul 2024 14:35:43 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c919ad0f4367-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:35:44 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 474Expires: Mon, 22 Jul 2024 14:35:44 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c92328f37c90-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:35:44 GMTContent-Type: application/zipContent-Length: 9891Connection: keep-aliveETag: "3914547665"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 171Expires: Mon, 22 Jul 2024 14:35:44 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c9239de80c9e-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d 2f df fd fa 21 ed 80 77 a9 39 90 7f fa 30 d1 2f b5 c5 80 5e 25 58 2d 8f a1 ec 2e 30 28 d8 18 6d 56 50 fc 6e ec c2 5d 3d 18 63 ce 72 b7 5f 01 fc dc 41 24 ef 91 b3 a5 3c 11 42 57 ad f6 79 b8 df a4 65 32 ed 62 09 bd cf 4b 04 a0 ab 90 7b 6a 96 ae c5 f8 4f c3 d0 64 c7 78 a2 5a c5 a0 76 c7 40 5b 87 4e 4c 9d 44 55 7c 00 5f a3 f8 84 92 b2 84 31 53 a4 b9 70 e7 95 1c e8 0b 7e 50 61 9f 71 c7 d0 3e 8d fb a4 df 7d 29 24 71 b6 48 37 bb 2c 68 81 bc 8b b9 06 c1 6d 29 49 07 9d 9b 98 ee f3 61 73 d4 3c bd 54 57 1f d8 eb b5 75 dd 24 3f 88 01 a3 ac f3 e6 45 d6 e0 df bc 79 85 0b f8 fb 95 40 58 89 df b0 b9 97 de 75 87 40 11 35 b7 2a 9a dc 55 4a 85 01 4c 9c 6a 61 1e d9 e0 04 30 e5 a4 76 9d 18 5e 0a aa d1 51 88 20 28 4f 7d 6b 2b 66 77 b2 76 98 66 96 7a ec 07 62 cd 68 ef 46 45 14 1c 3c 70 6c f8 c8 4c 57 5a 49 89 ff 8e 2a 2e 34 23 16 a6 b5 ff 2c b5 58 a6 9a bb 60 3d 18 db 62 c8 b2 1f 97 65 56 85 b2 57 b6 29 57 2a 02 a6 3b fb 51 2c 94 27 78 b7 3e f3 da 4a 71 9d fa 8d 0a 20 10 d8 5f 19 1d 54 3c 65 61 26 77 6f aa e5 2f 52 9b 4d d7 32 e6 60 72 58 b9 46 a9 fa 1a a7 14 de e2 0d 92 45 be 8c f7 63 3a f6 9b 41 df 39 ca 37 41 8e 09 ca 85 d6 f5 df f3 17 34 ee c6 46 54 cd d3 0e a1 30 ca 8d d1 40 7f a4 77 75 85 4a 49 d2 e0 42 64 dc 35 0d be 42 11 f8 68 77 fa 17 1e 9e 11 93 7d 16 6f 45 dc 86 40 de f9 4e 3d de e2 d1 99 9e 5a 24 80 29 36 f1 40 db de 8d 1f d3 95 73 05 ea 58 f5 ce a8 cf 72 d3 f5 d3 9b f6 bb 00 a7 ab a4 75 9f 25 de 96 1e 99 65 9f 49 b4 67 a8 f1 35 bf 72 75 1f 41 8b ff 3a 0e 38 31 d1 26 a7 a8 7f 22 bc 7f 65 a0 5f 0e f7 86 27 eb f3 85 12 8a 42 ac 04 92 65 Data Ascii: PKIX6%Fe
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:35:45 GMTContent-Type: application/zipContent-Length: 9891Connection: keep-aliveETag: "3914547665"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 172Expires: Mon, 22 Jul 2024 14:35:45 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c92b4ed90cb2-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d 2f df fd fa 21 ed 80 77 a9 39 90 7f fa 30 d1 2f b5 c5 80 5e 25 58 2d 8f a1 ec 2e 30 28 d8 18 6d 56 50 fc 6e ec c2 5d 3d 18 63 ce 72 b7 5f 01 fc dc 41 24 ef 91 b3 a5 3c 11 42 57 ad f6 79 b8 df a4 65 32 ed 62 09 bd cf 4b 04 a0 ab 90 7b 6a 96 ae c5 f8 4f c3 d0 64 c7 78 a2 5a c5 a0 76 c7 40 5b 87 4e 4c 9d 44 55 7c 00 5f a3 f8 84 92 b2 84 31 53 a4 b9 70 e7 95 1c e8 0b 7e 50 61 9f 71 c7 d0 3e 8d fb a4 df 7d 29 24 71 b6 48 37 bb 2c 68 81 bc 8b b9 06 c1 6d 29 49 07 9d 9b 98 ee f3 61 73 d4 3c bd 54 57 1f d8 eb b5 75 dd 24 3f 88 01 a3 ac f3 e6 45 d6 e0 df bc 79 85 0b f8 fb 95 40 58 89 df b0 b9 97 de 75 87 40 11 35 b7 2a 9a dc 55 4a 85 01 4c 9c 6a 61 1e d9 e0 04 30 e5 a4 76 9d 18 5e 0a aa d1 51 88 20 28 4f 7d 6b 2b 66 77 b2 76 98 66 96 7a ec 07 62 cd 68 ef 46 45 14 1c 3c 70 6c f8 c8 4c 57 5a 49 89 ff 8e 2a 2e 34 23 16 a6 b5 ff 2c b5 58 a6 9a bb 60 3d 18 db 62 c8 b2 1f 97 65 56 85 b2 57 b6 29 57 2a 02 a6 3b fb 51 2c 94 27 78 b7 3e f3 da 4a 71 9d fa 8d 0a 20 10 d8 5f 19 1d 54 3c 65 61 26 77 6f aa e5 2f 52 9b 4d d7 32 e6 60 72 58 b9 46 a9 fa 1a a7 14 de e2 0d 92 45 be 8c f7 63 3a f6 9b 41 df 39 ca 37 41 8e 09 ca 85 d6 f5 df f3 17 34 ee c6 46 54 cd d3 0e a1 30 ca 8d d1 40 7f a4 77 75 85 4a 49 d2 e0 42 64 dc 35 0d be 42 11 f8 68 77 fa 17 1e 9e 11 93 7d 16 6f 45 dc 86 40 de f9 4e 3d de e2 d1 99 9e 5a 24 80 29 36 f1 40 db de 8d 1f d3 95 73 05 ea 58 f5 ce a8 cf 72 d3 f5 d3 9b f6 bb 00 a7 ab a4 75 9f 25 de 96 1e 99 65 9f 49 b4 67 a8 f1 35 bf 72 75 1f 41 8b ff 3a 0e 38 31 d1 26 a7 a8 7f 22 bc 7f 65 a0 5f 0e f7 86 27 eb f3 85 12 8a 42 ac 04 92 65 Data Ascii: PKIX6%Fe
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:35:47 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 477Expires: Mon, 22 Jul 2024 14:35:47 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c935ae1041d9-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:35:52 GMTContent-Type: application/zipContent-Length: 9891Connection: keep-aliveETag: "3914547665"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 179Expires: Mon, 22 Jul 2024 14:35:52 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c953bbff7c87-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d 2f df fd fa 21 ed 80 77 a9 39 90 7f fa 30 d1 2f b5 c5 80 5e 25 58 2d 8f a1 ec 2e 30 28 d8 18 6d 56 50 fc 6e ec c2 5d 3d 18 63 ce 72 b7 5f 01 fc dc 41 24 ef 91 b3 a5 3c 11 42 57 ad f6 79 b8 df a4 65 32 ed 62 09 bd cf 4b 04 a0 ab 90 7b 6a 96 ae c5 f8 4f c3 d0 64 c7 78 a2 5a c5 a0 76 c7 40 5b 87 4e 4c 9d 44 55 7c 00 5f a3 f8 84 92 b2 84 31 53 a4 b9 70 e7 95 1c e8 0b 7e 50 61 9f 71 c7 d0 3e 8d fb a4 df 7d 29 24 71 b6 48 37 bb 2c 68 81 bc 8b b9 06 c1 6d 29 49 07 9d 9b 98 ee f3 61 73 d4 3c bd 54 57 1f d8 eb b5 75 dd 24 3f 88 01 a3 ac f3 e6 45 d6 e0 df bc 79 85 0b f8 fb 95 40 58 89 df b0 b9 97 de 75 87 40 11 35 b7 2a 9a dc 55 4a 85 01 4c 9c 6a 61 1e d9 e0 04 30 e5 a4 76 9d 18 5e 0a aa d1 51 88 20 28 4f 7d 6b 2b 66 77 b2 76 98 66 96 7a ec 07 62 cd 68 ef 46 45 14 1c 3c 70 6c f8 c8 4c 57 5a 49 89 ff 8e 2a 2e 34 23 16 a6 b5 ff 2c b5 58 a6 9a bb 60 3d 18 db 62 c8 b2 1f 97 65 56 85 b2 57 b6 29 57 2a 02 a6 3b fb 51 2c 94 27 78 b7 3e f3 da 4a 71 9d fa 8d 0a 20 10 d8 5f 19 1d 54 3c 65 61 26 77 6f aa e5 2f 52 9b 4d d7 32 e6 60 72 58 b9 46 a9 fa 1a a7 14 de e2 0d 92 45 be 8c f7 63 3a f6 9b 41 df 39 ca 37 41 8e 09 ca 85 d6 f5 df f3 17 34 ee c6 46 54 cd d3 0e a1 30 ca 8d d1 40 7f a4 77 75 85 4a 49 d2 e0 42 64 dc 35 0d be 42 11 f8 68 77 fa 17 1e 9e 11 93 7d 16 6f 45 dc 86 40 de f9 4e 3d de e2 d1 99 9e 5a 24 80 29 36 f1 40 db de 8d 1f d3 95 73 05 ea 58 f5 ce a8 cf 72 d3 f5 d3 9b f6 bb 00 a7 ab a4 75 9f 25 de 96 1e 99 65 9f 49 b4 67 a8 f1 35 bf 72 75 1f 41 8b ff 3a 0e 38 31 d1 26 a7 a8 7f 22 bc 7f 65 a0 5f 0e f7 86 27 eb f3 85 12 8a 42 ac 04 92 65 Data Ascii: PKIX6%Fe
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:35:52 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 482Expires: Mon, 22 Jul 2024 14:35:52 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c9567a3b42a7-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:35:54 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 484Expires: Mon, 22 Jul 2024 14:35:54 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c9632df14372-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:35:57 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 487Expires: Mon, 22 Jul 2024 14:35:57 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c9750ed01801-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:35:59 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 489Expires: Mon, 22 Jul 2024 14:35:59 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c97dcbc641c3-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:35:59 GMTContent-Type: application/zipContent-Length: 9891Connection: keep-aliveETag: "3914547665"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 186Expires: Mon, 22 Jul 2024 14:35:59 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c981fc514205-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d 2f df fd fa 21 ed 80 77 a9 39 90 7f fa 30 d1 2f b5 c5 80 5e 25 58 2d 8f a1 ec 2e 30 28 d8 18 6d 56 50 fc 6e ec c2 5d 3d 18 63 ce 72 b7 5f 01 fc dc 41 24 ef 91 b3 a5 3c 11 42 57 ad f6 79 b8 df a4 65 32 ed 62 09 bd cf 4b 04 a0 ab 90 7b 6a 96 ae c5 f8 4f c3 d0 64 c7 78 a2 5a c5 a0 76 c7 40 5b 87 4e 4c 9d 44 55 7c 00 5f a3 f8 84 92 b2 84 31 53 a4 b9 70 e7 95 1c e8 0b 7e 50 61 9f 71 c7 d0 3e 8d fb a4 df 7d 29 24 71 b6 48 37 bb 2c 68 81 bc 8b b9 06 c1 6d 29 49 07 9d 9b 98 ee f3 61 73 d4 3c bd 54 57 1f d8 eb b5 75 dd 24 3f 88 01 a3 ac f3 e6 45 d6 e0 df bc 79 85 0b f8 fb 95 40 58 89 df b0 b9 97 de 75 87 40 11 35 b7 2a 9a dc 55 4a 85 01 4c 9c 6a 61 1e d9 e0 04 30 e5 a4 76 9d 18 5e 0a aa d1 51 88 20 28 4f 7d 6b 2b 66 77 b2 76 98 66 96 7a ec 07 62 cd 68 ef 46 45 14 1c 3c 70 6c f8 c8 4c 57 5a 49 89 ff 8e 2a 2e 34 23 16 a6 b5 ff 2c b5 58 a6 9a bb 60 3d 18 db 62 c8 b2 1f 97 65 56 85 b2 57 b6 29 57 2a 02 a6 3b fb 51 2c 94 27 78 b7 3e f3 da 4a 71 9d fa 8d 0a 20 10 d8 5f 19 1d 54 3c 65 61 26 77 6f aa e5 2f 52 9b 4d d7 32 e6 60 72 58 b9 46 a9 fa 1a a7 14 de e2 0d 92 45 be 8c f7 63 3a f6 9b 41 df 39 ca 37 41 8e 09 ca 85 d6 f5 df f3 17 34 ee c6 46 54 cd d3 0e a1 30 ca 8d d1 40 7f a4 77 75 85 4a 49 d2 e0 42 64 dc 35 0d be 42 11 f8 68 77 fa 17 1e 9e 11 93 7d 16 6f 45 dc 86 40 de f9 4e 3d de e2 d1 99 9e 5a 24 80 29 36 f1 40 db de 8d 1f d3 95 73 05 ea 58 f5 ce a8 cf 72 d3 f5 d3 9b f6 bb 00 a7 ab a4 75 9f 25 de 96 1e 99 65 9f 49 b4 67 a8 f1 35 bf 72 75 1f 41 8b ff 3a 0e 38 31 d1 26 a7 a8 7f 22 bc 7f 65 a0 5f 0e f7 86 27 eb f3 85 12 8a 42 ac 04 92 65 Data Ascii: PKIX6%Fe
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:36:02 GMTContent-Type: application/zipContent-Length: 9891Connection: keep-aliveETag: "3914547665"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 189Expires: Mon, 22 Jul 2024 14:36:02 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c994de9241f9-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d 2f df fd fa 21 ed 80 77 a9 39 90 7f fa 30 d1 2f b5 c5 80 5e 25 58 2d 8f a1 ec 2e 30 28 d8 18 6d 56 50 fc 6e ec c2 5d 3d 18 63 ce 72 b7 5f 01 fc dc 41 24 ef 91 b3 a5 3c 11 42 57 ad f6 79 b8 df a4 65 32 ed 62 09 bd cf 4b 04 a0 ab 90 7b 6a 96 ae c5 f8 4f c3 d0 64 c7 78 a2 5a c5 a0 76 c7 40 5b 87 4e 4c 9d 44 55 7c 00 5f a3 f8 84 92 b2 84 31 53 a4 b9 70 e7 95 1c e8 0b 7e 50 61 9f 71 c7 d0 3e 8d fb a4 df 7d 29 24 71 b6 48 37 bb 2c 68 81 bc 8b b9 06 c1 6d 29 49 07 9d 9b 98 ee f3 61 73 d4 3c bd 54 57 1f d8 eb b5 75 dd 24 3f 88 01 a3 ac f3 e6 45 d6 e0 df bc 79 85 0b f8 fb 95 40 58 89 df b0 b9 97 de 75 87 40 11 35 b7 2a 9a dc 55 4a 85 01 4c 9c 6a 61 1e d9 e0 04 30 e5 a4 76 9d 18 5e 0a aa d1 51 88 20 28 4f 7d 6b 2b 66 77 b2 76 98 66 96 7a ec 07 62 cd 68 ef 46 45 14 1c 3c 70 6c f8 c8 4c 57 5a 49 89 ff 8e 2a 2e 34 23 16 a6 b5 ff 2c b5 58 a6 9a bb 60 3d 18 db 62 c8 b2 1f 97 65 56 85 b2 57 b6 29 57 2a 02 a6 3b fb 51 2c 94 27 78 b7 3e f3 da 4a 71 9d fa 8d 0a 20 10 d8 5f 19 1d 54 3c 65 61 26 77 6f aa e5 2f 52 9b 4d d7 32 e6 60 72 58 b9 46 a9 fa 1a a7 14 de e2 0d 92 45 be 8c f7 63 3a f6 9b 41 df 39 ca 37 41 8e 09 ca 85 d6 f5 df f3 17 34 ee c6 46 54 cd d3 0e a1 30 ca 8d d1 40 7f a4 77 75 85 4a 49 d2 e0 42 64 dc 35 0d be 42 11 f8 68 77 fa 17 1e 9e 11 93 7d 16 6f 45 dc 86 40 de f9 4e 3d de e2 d1 99 9e 5a 24 80 29 36 f1 40 db de 8d 1f d3 95 73 05 ea 58 f5 ce a8 cf 72 d3 f5 d3 9b f6 bb 00 a7 ab a4 75 9f 25 de 96 1e 99 65 9f 49 b4 67 a8 f1 35 bf 72 75 1f 41 8b ff 3a 0e 38 31 d1 26 a7 a8 7f 22 bc 7f 65 a0 5f 0e f7 86 27 eb f3 85 12 8a 42 ac 04 92 65 Data Ascii: PKIX6%Fe
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:36:04 GMTContent-Type: application/zipContent-Length: 9891Connection: keep-aliveETag: "3914547665"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 191Expires: Mon, 22 Jul 2024 14:36:04 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c99dbaa07c78-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d 2f df fd fa 21 ed 80 77 a9 39 90 7f fa 30 d1 2f b5 c5 80 5e 25 58 2d 8f a1 ec 2e 30 28 d8 18 6d 56 50 fc 6e ec c2 5d 3d 18 63 ce 72 b7 5f 01 fc dc 41 24 ef 91 b3 a5 3c 11 42 57 ad f6 79 b8 df a4 65 32 ed 62 09 bd cf 4b 04 a0 ab 90 7b 6a 96 ae c5 f8 4f c3 d0 64 c7 78 a2 5a c5 a0 76 c7 40 5b 87 4e 4c 9d 44 55 7c 00 5f a3 f8 84 92 b2 84 31 53 a4 b9 70 e7 95 1c e8 0b 7e 50 61 9f 71 c7 d0 3e 8d fb a4 df 7d 29 24 71 b6 48 37 bb 2c 68 81 bc 8b b9 06 c1 6d 29 49 07 9d 9b 98 ee f3 61 73 d4 3c bd 54 57 1f d8 eb b5 75 dd 24 3f 88 01 a3 ac f3 e6 45 d6 e0 df bc 79 85 0b f8 fb 95 40 58 89 df b0 b9 97 de 75 87 40 11 35 b7 2a 9a dc 55 4a 85 01 4c 9c 6a 61 1e d9 e0 04 30 e5 a4 76 9d 18 5e 0a aa d1 51 88 20 28 4f 7d 6b 2b 66 77 b2 76 98 66 96 7a ec 07 62 cd 68 ef 46 45 14 1c 3c 70 6c f8 c8 4c 57 5a 49 89 ff 8e 2a 2e 34 23 16 a6 b5 ff 2c b5 58 a6 9a bb 60 3d 18 db 62 c8 b2 1f 97 65 56 85 b2 57 b6 29 57 2a 02 a6 3b fb 51 2c 94 27 78 b7 3e f3 da 4a 71 9d fa 8d 0a 20 10 d8 5f 19 1d 54 3c 65 61 26 77 6f aa e5 2f 52 9b 4d d7 32 e6 60 72 58 b9 46 a9 fa 1a a7 14 de e2 0d 92 45 be 8c f7 63 3a f6 9b 41 df 39 ca 37 41 8e 09 ca 85 d6 f5 df f3 17 34 ee c6 46 54 cd d3 0e a1 30 ca 8d d1 40 7f a4 77 75 85 4a 49 d2 e0 42 64 dc 35 0d be 42 11 f8 68 77 fa 17 1e 9e 11 93 7d 16 6f 45 dc 86 40 de f9 4e 3d de e2 d1 99 9e 5a 24 80 29 36 f1 40 db de 8d 1f d3 95 73 05 ea 58 f5 ce a8 cf 72 d3 f5 d3 9b f6 bb 00 a7 ab a4 75 9f 25 de 96 1e 99 65 9f 49 b4 67 a8 f1 35 bf 72 75 1f 41 8b ff 3a 0e 38 31 d1 26 a7 a8 7f 22 bc 7f 65 a0 5f 0e f7 86 27 eb f3 85 12 8a 42 ac 04 92 65 Data Ascii: PKIX6%Fe
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:36:04 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 494Expires: Mon, 22 Jul 2024 14:36:04 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c99e2a924396-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:36:05 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 495Expires: Mon, 22 Jul 2024 14:36:05 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c9a5ae444382-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:36:05 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 495Expires: Mon, 22 Jul 2024 14:36:05 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c9a78f9f4382-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:36:05 GMTContent-Type: application/zipContent-Length: 9891Connection: keep-aliveETag: "3914547665"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 192Expires: Mon, 22 Jul 2024 14:36:05 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c9a8d8544382-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d 2f df fd fa 21 ed 80 77 a9 39 90 7f fa 30 d1 2f b5 c5 80 5e 25 58 2d 8f a1 ec 2e 30 28 d8 18 6d 56 50 fc 6e ec c2 5d 3d 18 63 ce 72 b7 5f 01 fc dc 41 24 ef 91 b3 a5 3c 11 42 57 ad f6 79 b8 df a4 65 32 ed 62 09 bd cf 4b 04 a0 ab 90 7b 6a 96 ae c5 f8 4f c3 d0 64 c7 78 a2 5a c5 a0 76 c7 40 5b 87 4e 4c 9d 44 55 7c 00 5f a3 f8 84 92 b2 84 31 53 a4 b9 70 e7 95 1c e8 0b 7e 50 61 9f 71 c7 d0 3e 8d fb a4 df 7d 29 24 71 b6 48 37 bb 2c 68 81 bc 8b b9 06 c1 6d 29 49 07 9d 9b 98 ee f3 61 73 d4 3c bd 54 57 1f d8 eb b5 75 dd 24 3f 88 01 a3 ac f3 e6 45 d6 e0 df bc 79 85 0b f8 fb 95 40 58 89 df b0 b9 97 de 75 87 40 11 35 b7 2a 9a dc 55 4a 85 01 4c 9c 6a 61 1e d9 e0 04 30 e5 a4 76 9d 18 5e 0a aa d1 51 88 20 28 4f 7d 6b 2b 66 77 b2 76 98 66 96 7a ec 07 62 cd 68 ef 46 45 14 1c 3c 70 6c f8 c8 4c 57 5a 49 89 ff 8e 2a 2e 34 23 16 a6 b5 ff 2c b5 58 a6 9a bb 60 3d 18 db 62 c8 b2 1f 97 65 56 85 b2 57 b6 29 57 2a 02 a6 3b fb 51 2c 94 27 78 b7 3e f3 da 4a 71 9d fa 8d 0a 20 10 d8 5f 19 1d 54 3c 65 61 26 77 6f aa e5 2f 52 9b 4d d7 32 e6 60 72 58 b9 46 a9 fa 1a a7 14 de e2 0d 92 45 be 8c f7 63 3a f6 9b 41 df 39 ca 37 41 8e 09 ca 85 d6 f5 df f3 17 34 ee c6 46 54 cd d3 0e a1 30 ca 8d d1 40 7f a4 77 75 85 4a 49 d2 e0 42 64 dc 35 0d be 42 11 f8 68 77 fa 17 1e 9e 11 93 7d 16 6f 45 dc 86 40 de f9 4e 3d de e2 d1 99 9e 5a 24 80 29 36 f1 40 db de 8d 1f d3 95 73 05 ea 58 f5 ce a8 cf 72 d3 f5 d3 9b f6 bb 00 a7 ab a4 75 9f 25 de 96 1e 99 65 9f 49 b4 67 a8 f1 35 bf 72 75 1f 41 8b ff 3a 0e 38 31 d1 26 a7 a8 7f 22 bc 7f 65 a0 5f 0e f7 86 27 eb f3 85 12 8a 42 ac 04 92 65 Data Ascii: PKIX6%Fe
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:36:06 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 496Expires: Mon, 22 Jul 2024 14:36:06 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c9ad5ab08c42-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:36:06 GMTContent-Type: application/zipContent-Length: 9891Connection: keep-aliveETag: "3914547665"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 193Expires: Mon, 22 Jul 2024 14:36:06 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c9ae7f5943bd-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d 2f df fd fa 21 ed 80 77 a9 39 90 7f fa 30 d1 2f b5 c5 80 5e 25 58 2d 8f a1 ec 2e 30 28 d8 18 6d 56 50 fc 6e ec c2 5d 3d 18 63 ce 72 b7 5f 01 fc dc 41 24 ef 91 b3 a5 3c 11 42 57 ad f6 79 b8 df a4 65 32 ed 62 09 bd cf 4b 04 a0 ab 90 7b 6a 96 ae c5 f8 4f c3 d0 64 c7 78 a2 5a c5 a0 76 c7 40 5b 87 4e 4c 9d 44 55 7c 00 5f a3 f8 84 92 b2 84 31 53 a4 b9 70 e7 95 1c e8 0b 7e 50 61 9f 71 c7 d0 3e 8d fb a4 df 7d 29 24 71 b6 48 37 bb 2c 68 81 bc 8b b9 06 c1 6d 29 49 07 9d 9b 98 ee f3 61 73 d4 3c bd 54 57 1f d8 eb b5 75 dd 24 3f 88 01 a3 ac f3 e6 45 d6 e0 df bc 79 85 0b f8 fb 95 40 58 89 df b0 b9 97 de 75 87 40 11 35 b7 2a 9a dc 55 4a 85 01 4c 9c 6a 61 1e d9 e0 04 30 e5 a4 76 9d 18 5e 0a aa d1 51 88 20 28 4f 7d 6b 2b 66 77 b2 76 98 66 96 7a ec 07 62 cd 68 ef 46 45 14 1c 3c 70 6c f8 c8 4c 57 5a 49 89 ff 8e 2a 2e 34 23 16 a6 b5 ff 2c b5 58 a6 9a bb 60 3d 18 db 62 c8 b2 1f 97 65 56 85 b2 57 b6 29 57 2a 02 a6 3b fb 51 2c 94 27 78 b7 3e f3 da 4a 71 9d fa 8d 0a 20 10 d8 5f 19 1d 54 3c 65 61 26 77 6f aa e5 2f 52 9b 4d d7 32 e6 60 72 58 b9 46 a9 fa 1a a7 14 de e2 0d 92 45 be 8c f7 63 3a f6 9b 41 df 39 ca 37 41 8e 09 ca 85 d6 f5 df f3 17 34 ee c6 46 54 cd d3 0e a1 30 ca 8d d1 40 7f a4 77 75 85 4a 49 d2 e0 42 64 dc 35 0d be 42 11 f8 68 77 fa 17 1e 9e 11 93 7d 16 6f 45 dc 86 40 de f9 4e 3d de e2 d1 99 9e 5a 24 80 29 36 f1 40 db de 8d 1f d3 95 73 05 ea 58 f5 ce a8 cf 72 d3 f5 d3 9b f6 bb 00 a7 ab a4 75 9f 25 de 96 1e 99 65 9f 49 b4 67 a8 f1 35 bf 72 75 1f 41 8b ff 3a 0e 38 31 d1 26 a7 a8 7f 22 bc 7f 65 a0 5f 0e f7 86 27 eb f3 85 12 8a 42 ac 04 92 65 Data Ascii: PKIX6%Fe
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:36:07 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 497Expires: Mon, 22 Jul 2024 14:36:07 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c9b25e8d4373-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:36:07 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 497Expires: Mon, 22 Jul 2024 14:36:07 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c9b42fe84373-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:36:07 GMTContent-Type: application/zipContent-Length: 9891Connection: keep-aliveETag: "3914547665"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 194Expires: Mon, 22 Jul 2024 14:36:07 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c9b4ffad4294-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d 2f df fd fa 21 ed 80 77 a9 39 90 7f fa 30 d1 2f b5 c5 80 5e 25 58 2d 8f a1 ec 2e 30 28 d8 18 6d 56 50 fc 6e ec c2 5d 3d 18 63 ce 72 b7 5f 01 fc dc 41 24 ef 91 b3 a5 3c 11 42 57 ad f6 79 b8 df a4 65 32 ed 62 09 bd cf 4b 04 a0 ab 90 7b 6a 96 ae c5 f8 4f c3 d0 64 c7 78 a2 5a c5 a0 76 c7 40 5b 87 4e 4c 9d 44 55 7c 00 5f a3 f8 84 92 b2 84 31 53 a4 b9 70 e7 95 1c e8 0b 7e 50 61 9f 71 c7 d0 3e 8d fb a4 df 7d 29 24 71 b6 48 37 bb 2c 68 81 bc 8b b9 06 c1 6d 29 49 07 9d 9b 98 ee f3 61 73 d4 3c bd 54 57 1f d8 eb b5 75 dd 24 3f 88 01 a3 ac f3 e6 45 d6 e0 df bc 79 85 0b f8 fb 95 40 58 89 df b0 b9 97 de 75 87 40 11 35 b7 2a 9a dc 55 4a 85 01 4c 9c 6a 61 1e d9 e0 04 30 e5 a4 76 9d 18 5e 0a aa d1 51 88 20 28 4f 7d 6b 2b 66 77 b2 76 98 66 96 7a ec 07 62 cd 68 ef 46 45 14 1c 3c 70 6c f8 c8 4c 57 5a 49 89 ff 8e 2a 2e 34 23 16 a6 b5 ff 2c b5 58 a6 9a bb 60 3d 18 db 62 c8 b2 1f 97 65 56 85 b2 57 b6 29 57 2a 02 a6 3b fb 51 2c 94 27 78 b7 3e f3 da 4a 71 9d fa 8d 0a 20 10 d8 5f 19 1d 54 3c 65 61 26 77 6f aa e5 2f 52 9b 4d d7 32 e6 60 72 58 b9 46 a9 fa 1a a7 14 de e2 0d 92 45 be 8c f7 63 3a f6 9b 41 df 39 ca 37 41 8e 09 ca 85 d6 f5 df f3 17 34 ee c6 46 54 cd d3 0e a1 30 ca 8d d1 40 7f a4 77 75 85 4a 49 d2 e0 42 64 dc 35 0d be 42 11 f8 68 77 fa 17 1e 9e 11 93 7d 16 6f 45 dc 86 40 de f9 4e 3d de e2 d1 99 9e 5a 24 80 29 36 f1 40 db de 8d 1f d3 95 73 05 ea 58 f5 ce a8 cf 72 d3 f5 d3 9b f6 bb 00 a7 ab a4 75 9f 25 de 96 1e 99 65 9f 49 b4 67 a8 f1 35 bf 72 75 1f 41 8b ff 3a 0e 38 31 d1 26 a7 a8 7f 22 bc 7f 65 a0 5f 0e f7 86 27 eb f3 85 12 8a 42 ac 04 92 65 Data Ascii: PKIX6%Fe
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:36:09 GMTContent-Type: application/zipContent-Length: 9891Connection: keep-aliveETag: "3914547665"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 196Expires: Mon, 22 Jul 2024 14:36:09 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c9c1b999435b-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d 2f df fd fa 21 ed 80 77 a9 39 90 7f fa 30 d1 2f b5 c5 80 5e 25 58 2d 8f a1 ec 2e 30 28 d8 18 6d 56 50 fc 6e ec c2 5d 3d 18 63 ce 72 b7 5f 01 fc dc 41 24 ef 91 b3 a5 3c 11 42 57 ad f6 79 b8 df a4 65 32 ed 62 09 bd cf 4b 04 a0 ab 90 7b 6a 96 ae c5 f8 4f c3 d0 64 c7 78 a2 5a c5 a0 76 c7 40 5b 87 4e 4c 9d 44 55 7c 00 5f a3 f8 84 92 b2 84 31 53 a4 b9 70 e7 95 1c e8 0b 7e 50 61 9f 71 c7 d0 3e 8d fb a4 df 7d 29 24 71 b6 48 37 bb 2c 68 81 bc 8b b9 06 c1 6d 29 49 07 9d 9b 98 ee f3 61 73 d4 3c bd 54 57 1f d8 eb b5 75 dd 24 3f 88 01 a3 ac f3 e6 45 d6 e0 df bc 79 85 0b f8 fb 95 40 58 89 df b0 b9 97 de 75 87 40 11 35 b7 2a 9a dc 55 4a 85 01 4c 9c 6a 61 1e d9 e0 04 30 e5 a4 76 9d 18 5e 0a aa d1 51 88 20 28 4f 7d 6b 2b 66 77 b2 76 98 66 96 7a ec 07 62 cd 68 ef 46 45 14 1c 3c 70 6c f8 c8 4c 57 5a 49 89 ff 8e 2a 2e 34 23 16 a6 b5 ff 2c b5 58 a6 9a bb 60 3d 18 db 62 c8 b2 1f 97 65 56 85 b2 57 b6 29 57 2a 02 a6 3b fb 51 2c 94 27 78 b7 3e f3 da 4a 71 9d fa 8d 0a 20 10 d8 5f 19 1d 54 3c 65 61 26 77 6f aa e5 2f 52 9b 4d d7 32 e6 60 72 58 b9 46 a9 fa 1a a7 14 de e2 0d 92 45 be 8c f7 63 3a f6 9b 41 df 39 ca 37 41 8e 09 ca 85 d6 f5 df f3 17 34 ee c6 46 54 cd d3 0e a1 30 ca 8d d1 40 7f a4 77 75 85 4a 49 d2 e0 42 64 dc 35 0d be 42 11 f8 68 77 fa 17 1e 9e 11 93 7d 16 6f 45 dc 86 40 de f9 4e 3d de e2 d1 99 9e 5a 24 80 29 36 f1 40 db de 8d 1f d3 95 73 05 ea 58 f5 ce a8 cf 72 d3 f5 d3 9b f6 bb 00 a7 ab a4 75 9f 25 de 96 1e 99 65 9f 49 b4 67 a8 f1 35 bf 72 75 1f 41 8b ff 3a 0e 38 31 d1 26 a7 a8 7f 22 bc 7f 65 a0 5f 0e f7 86 27 eb f3 85 12 8a 42 ac 04 92 65 Data Ascii: PKIX6%Fe
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:36:09 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 499Expires: Mon, 22 Jul 2024 14:36:09 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c9c1ba3a8c8a-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:36:11 GMTContent-Type: application/zipContent-Length: 3275Connection: keep-aliveETag: "853547074"Last-Modified: Mon, 17 Jun 2024 14:26:00 GMTCF-Cache-Status: HITAge: 242Expires: Mon, 22 Jul 2024 14:36:11 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c9cc79af8c24-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 0c 75 5c 58 54 09 17 6e 1f 0c 00 00 47 0a 01 00 13 00 00 00 73 65 61 72 63 68 65 6e 67 69 6e 65 5f 76 31 2e 74 78 74 eb ca ec 34 c0 58 96 c2 9f 71 1e f6 6f e2 c4 16 1d 9a ec 44 e8 a3 7f 96 ed fd 48 03 e6 a3 d2 d8 22 ed c0 ce 19 91 fd 7b 09 8c 00 4c 61 b8 a5 b8 7d 9a a6 1a 65 dc 42 02 15 89 4c 7e 1c 29 44 8a 0a 7b 3f 86 a9 cf 97 05 ea 60 12 31 a0 79 be 50 e1 84 e1 f5 96 1e ad 04 ae c9 82 cf 7a 2a 7d f0 ae cf 2c b1 5d 4f 65 0c 4d b0 80 d4 cf f2 ba dc 06 d9 d4 4d d5 28 d6 c3 43 2e ce 9e 5b b8 65 4a 9d db 54 fe 82 d4 92 de 50 62 17 1a 94 46 3f 81 59 9f db 9c ce da eb 1e 66 0a 36 a8 f2 34 b6 a8 34 26 eb 93 cd 01 6b 31 c0 26 f2 03 8d 58 c1 90 e7 8d 57 cd dd 90 18 05 1f 2d d1 4f 0a fb 27 12 66 f0 50 fe 3c 71 cf 0a 8f 3c 36 42 9b bc ad bf 05 a6 e1 d9 c6 98 b2 6f e7 0b ec 75 f9 33 36 20 33 c3 24 47 1e ab bc 34 dd fd e5 c9 6c 99 68 a3 15 c2 8b 88 4a 03 b4 8c e5 b5 09 4d 37 55 6f 47 9e 0e c7 69 4f b1 2c da 4e 7d b4 ce 2a 46 de da cd 1a 62 74 88 e6 a4 0e 35 75 c3 b7 7c 2f c3 81 46 6b d8 11 be 39 64 a6 02 d0 e9 75 38 5c 32 c6 94 43 ac 23 b0 01 5f da 05 79 83 32 be 4f 2c 84 8f 59 9f 9f 4b f1 7a af 04 91 56 02 4e a8 f2 8e 6a cc b5 cd b5 98 53 e4 a6 cc 04 df fa 98 69 e7 f6 f6 e4 09 e2 4a 30 89 1f b1 88 4b ec 7f 53 8b 39 9a 3e d7 1b 25 99 95 d5 f5 df 28 e2 56 0f 54 45 ca b3 a2 01 db 53 6a 55 b6 e2 df 9f 8d 73 db f7 99 49 f4 21 21 09 1c d3 7c a9 64 69 1d 91 e4 14 75 1d e5 eb e7 85 70 1a 6f 56 a3 cc 02 b2 f8 dc a1 86 3b d6 88 90 ca 25 6a bf 4b 59 ad 85 1b 21 55 fe b0 1c b3 94 a5 00 17 71 5e b6 3b 2e 2c 94 09 5d a1 dd 61 02 c6 4a c8 8d 1e 8e 89 ca 2d bf 70 f7 a7 98 f3 51 39 4a 9f dd b2 56 48 3a ee ad 1d 7a 52 c5 cc 57 4f c4 49 c1 68 f3 a2 3b ef c5 2b f3 b9 af 09 a6 73 c7 0b ca 24 40 02 1d 76 c1 01 46 4f 42 4b cf e6 4d f3 42 42 06 3f 01 fb 02 f0 0a 47 d2 8f 4e 98 6c c4 ac b7 0b 89 23 3a 92 fe 86 36 23 54 14 2a a3 7f 2c 0b 2d c5 c7 7e 07 35 6e 92 ff a1 66 1d ec 79 5c 7f d0 51 1b aa 78 d5 4f 1e cb bf 3c e8 bd 0d 3a c3 f7 8b af 06 1f 37 42 01 83 76 23 88 98 94 b1 a0 62 64 7a d9 4a eb ec 41 6d e3 81 20 da ef 6b c0 90 bd af 1c 9f 4b 05 0e b3 5e 41 26 15 b5 e5 16 3d d3 4a 5b e7 4b 0d 54 fa 39 9b e3 c3 77 86 5f b0 d2 c7 e1 ae 05 d6 70 fc ba a5 e2 a1 d9 3e 12 14 42 45 71 ce 6a 8c 1a 5e 94 f6 a7 17 41 fa 5d 0e 98 51 71 dd d8 42 fc 62 08 bf b8 a6 ed 8c c0 c7 24 05 06 2f 05 e3 42 78 d9 ef 7e b3 f1 fe 12 d3 1f 8a 8b 30 64 39 7a 3a b3 f3 df 54 7e 30 a5 d0 ea a4 ae 20 62 a4 91 cd a8 ed 69 06 41 c4 46 0c cc 1e 77 dd 30 90 a7 2b 06 c4 a5 47 68 78 5c 89 9d 2b 5a 59 f2 9f 93 38 e6 2d 4d d4 26 6b 9e 54 42 12 f9 31 80 80 be 5a 8b 31 Data Ascii: PKu\XTnG
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:36:11 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 501Expires: Mon, 22 Jul 2024 14:36:11 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c9cc8a010cac-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:36:12 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 502Expires: Mon, 22 Jul 2024 14:36:12 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c9d3c8d80f91-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:36:15 GMTContent-Type: application/zipContent-Length: 9891Connection: keep-aliveETag: "3914547665"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 202Expires: Mon, 22 Jul 2024 14:36:15 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c9e1ad66434f-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d 2f df fd fa 21 ed 80 77 a9 39 90 7f fa 30 d1 2f b5 c5 80 5e 25 58 2d 8f a1 ec 2e 30 28 d8 18 6d 56 50 fc 6e ec c2 5d 3d 18 63 ce 72 b7 5f 01 fc dc 41 24 ef 91 b3 a5 3c 11 42 57 ad f6 79 b8 df a4 65 32 ed 62 09 bd cf 4b 04 a0 ab 90 7b 6a 96 ae c5 f8 4f c3 d0 64 c7 78 a2 5a c5 a0 76 c7 40 5b 87 4e 4c 9d 44 55 7c 00 5f a3 f8 84 92 b2 84 31 53 a4 b9 70 e7 95 1c e8 0b 7e 50 61 9f 71 c7 d0 3e 8d fb a4 df 7d 29 24 71 b6 48 37 bb 2c 68 81 bc 8b b9 06 c1 6d 29 49 07 9d 9b 98 ee f3 61 73 d4 3c bd 54 57 1f d8 eb b5 75 dd 24 3f 88 01 a3 ac f3 e6 45 d6 e0 df bc 79 85 0b f8 fb 95 40 58 89 df b0 b9 97 de 75 87 40 11 35 b7 2a 9a dc 55 4a 85 01 4c 9c 6a 61 1e d9 e0 04 30 e5 a4 76 9d 18 5e 0a aa d1 51 88 20 28 4f 7d 6b 2b 66 77 b2 76 98 66 96 7a ec 07 62 cd 68 ef 46 45 14 1c 3c 70 6c f8 c8 4c 57 5a 49 89 ff 8e 2a 2e 34 23 16 a6 b5 ff 2c b5 58 a6 9a bb 60 3d 18 db 62 c8 b2 1f 97 65 56 85 b2 57 b6 29 57 2a 02 a6 3b fb 51 2c 94 27 78 b7 3e f3 da 4a 71 9d fa 8d 0a 20 10 d8 5f 19 1d 54 3c 65 61 26 77 6f aa e5 2f 52 9b 4d d7 32 e6 60 72 58 b9 46 a9 fa 1a a7 14 de e2 0d 92 45 be 8c f7 63 3a f6 9b 41 df 39 ca 37 41 8e 09 ca 85 d6 f5 df f3 17 34 ee c6 46 54 cd d3 0e a1 30 ca 8d d1 40 7f a4 77 75 85 4a 49 d2 e0 42 64 dc 35 0d be 42 11 f8 68 77 fa 17 1e 9e 11 93 7d 16 6f 45 dc 86 40 de f9 4e 3d de e2 d1 99 9e 5a 24 80 29 36 f1 40 db de 8d 1f d3 95 73 05 ea 58 f5 ce a8 cf 72 d3 f5 d3 9b f6 bb 00 a7 ab a4 75 9f 25 de 96 1e 99 65 9f 49 b4 67 a8 f1 35 bf 72 75 1f 41 8b ff 3a 0e 38 31 d1 26 a7 a8 7f 22 bc 7f 65 a0 5f 0e f7 86 27 eb f3 85 12 8a 42 ac 04 92 65 Data Ascii: PKIX6%Fe
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:36:15 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 505Expires: Mon, 22 Jul 2024 14:36:15 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c9e21e297c6a-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:36:15 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 505Expires: Mon, 22 Jul 2024 14:36:15 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c9e42f587c6a-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:36:16 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 506Expires: Mon, 22 Jul 2024 14:36:16 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c9e9f96b6a55-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:36:16 GMTContent-Type: application/zipContent-Length: 9891Connection: keep-aliveETag: "3914547665"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 203Expires: Mon, 22 Jul 2024 14:36:16 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c9ebca724299-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d 2f df fd fa 21 ed 80 77 a9 39 90 7f fa 30 d1 2f b5 c5 80 5e 25 58 2d 8f a1 ec 2e 30 28 d8 18 6d 56 50 fc 6e ec c2 5d 3d 18 63 ce 72 b7 5f 01 fc dc 41 24 ef 91 b3 a5 3c 11 42 57 ad f6 79 b8 df a4 65 32 ed 62 09 bd cf 4b 04 a0 ab 90 7b 6a 96 ae c5 f8 4f c3 d0 64 c7 78 a2 5a c5 a0 76 c7 40 5b 87 4e 4c 9d 44 55 7c 00 5f a3 f8 84 92 b2 84 31 53 a4 b9 70 e7 95 1c e8 0b 7e 50 61 9f 71 c7 d0 3e 8d fb a4 df 7d 29 24 71 b6 48 37 bb 2c 68 81 bc 8b b9 06 c1 6d 29 49 07 9d 9b 98 ee f3 61 73 d4 3c bd 54 57 1f d8 eb b5 75 dd 24 3f 88 01 a3 ac f3 e6 45 d6 e0 df bc 79 85 0b f8 fb 95 40 58 89 df b0 b9 97 de 75 87 40 11 35 b7 2a 9a dc 55 4a 85 01 4c 9c 6a 61 1e d9 e0 04 30 e5 a4 76 9d 18 5e 0a aa d1 51 88 20 28 4f 7d 6b 2b 66 77 b2 76 98 66 96 7a ec 07 62 cd 68 ef 46 45 14 1c 3c 70 6c f8 c8 4c 57 5a 49 89 ff 8e 2a 2e 34 23 16 a6 b5 ff 2c b5 58 a6 9a bb 60 3d 18 db 62 c8 b2 1f 97 65 56 85 b2 57 b6 29 57 2a 02 a6 3b fb 51 2c 94 27 78 b7 3e f3 da 4a 71 9d fa 8d 0a 20 10 d8 5f 19 1d 54 3c 65 61 26 77 6f aa e5 2f 52 9b 4d d7 32 e6 60 72 58 b9 46 a9 fa 1a a7 14 de e2 0d 92 45 be 8c f7 63 3a f6 9b 41 df 39 ca 37 41 8e 09 ca 85 d6 f5 df f3 17 34 ee c6 46 54 cd d3 0e a1 30 ca 8d d1 40 7f a4 77 75 85 4a 49 d2 e0 42 64 dc 35 0d be 42 11 f8 68 77 fa 17 1e 9e 11 93 7d 16 6f 45 dc 86 40 de f9 4e 3d de e2 d1 99 9e 5a 24 80 29 36 f1 40 db de 8d 1f d3 95 73 05 ea 58 f5 ce a8 cf 72 d3 f5 d3 9b f6 bb 00 a7 ab a4 75 9f 25 de 96 1e 99 65 9f 49 b4 67 a8 f1 35 bf 72 75 1f 41 8b ff 3a 0e 38 31 d1 26 a7 a8 7f 22 bc 7f 65 a0 5f 0e f7 86 27 eb f3 85 12 8a 42 ac 04 92 65 Data Ascii: PKIX6%Fe
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:36:18 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 508Expires: Mon, 22 Jul 2024 14:36:18 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72c9f90e171849-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:36:20 GMTContent-Type: application/zipContent-Length: 9891Connection: keep-aliveETag: "3914547665"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 207Expires: Mon, 22 Jul 2024 14:36:20 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72ca013c0380d9-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d 2f df fd fa 21 ed 80 77 a9 39 90 7f fa 30 d1 2f b5 c5 80 5e 25 58 2d 8f a1 ec 2e 30 28 d8 18 6d 56 50 fc 6e ec c2 5d 3d 18 63 ce 72 b7 5f 01 fc dc 41 24 ef 91 b3 a5 3c 11 42 57 ad f6 79 b8 df a4 65 32 ed 62 09 bd cf 4b 04 a0 ab 90 7b 6a 96 ae c5 f8 4f c3 d0 64 c7 78 a2 5a c5 a0 76 c7 40 5b 87 4e 4c 9d 44 55 7c 00 5f a3 f8 84 92 b2 84 31 53 a4 b9 70 e7 95 1c e8 0b 7e 50 61 9f 71 c7 d0 3e 8d fb a4 df 7d 29 24 71 b6 48 37 bb 2c 68 81 bc 8b b9 06 c1 6d 29 49 07 9d 9b 98 ee f3 61 73 d4 3c bd 54 57 1f d8 eb b5 75 dd 24 3f 88 01 a3 ac f3 e6 45 d6 e0 df bc 79 85 0b f8 fb 95 40 58 89 df b0 b9 97 de 75 87 40 11 35 b7 2a 9a dc 55 4a 85 01 4c 9c 6a 61 1e d9 e0 04 30 e5 a4 76 9d 18 5e 0a aa d1 51 88 20 28 4f 7d 6b 2b 66 77 b2 76 98 66 96 7a ec 07 62 cd 68 ef 46 45 14 1c 3c 70 6c f8 c8 4c 57 5a 49 89 ff 8e 2a 2e 34 23 16 a6 b5 ff 2c b5 58 a6 9a bb 60 3d 18 db 62 c8 b2 1f 97 65 56 85 b2 57 b6 29 57 2a 02 a6 3b fb 51 2c 94 27 78 b7 3e f3 da 4a 71 9d fa 8d 0a 20 10 d8 5f 19 1d 54 3c 65 61 26 77 6f aa e5 2f 52 9b 4d d7 32 e6 60 72 58 b9 46 a9 fa 1a a7 14 de e2 0d 92 45 be 8c f7 63 3a f6 9b 41 df 39 ca 37 41 8e 09 ca 85 d6 f5 df f3 17 34 ee c6 46 54 cd d3 0e a1 30 ca 8d d1 40 7f a4 77 75 85 4a 49 d2 e0 42 64 dc 35 0d be 42 11 f8 68 77 fa 17 1e 9e 11 93 7d 16 6f 45 dc 86 40 de f9 4e 3d de e2 d1 99 9e 5a 24 80 29 36 f1 40 db de 8d 1f d3 95 73 05 ea 58 f5 ce a8 cf 72 d3 f5 d3 9b f6 bb 00 a7 ab a4 75 9f 25 de 96 1e 99 65 9f 49 b4 67 a8 f1 35 bf 72 75 1f 41 8b ff 3a 0e 38 31 d1 26 a7 a8 7f 22 bc 7f 65 a0 5f 0e f7 86 27 eb f3 85 12 8a 42 ac 04 92 65 Data Ascii: PKIX6%Fe
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:36:21 GMTContent-Type: application/zipContent-Length: 9891Connection: keep-aliveETag: "3914547665"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 208Expires: Mon, 22 Jul 2024 14:36:21 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72ca07eb9242a7-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d 2f df fd fa 21 ed 80 77 a9 39 90 7f fa 30 d1 2f b5 c5 80 5e 25 58 2d 8f a1 ec 2e 30 28 d8 18 6d 56 50 fc 6e ec c2 5d 3d 18 63 ce 72 b7 5f 01 fc dc 41 24 ef 91 b3 a5 3c 11 42 57 ad f6 79 b8 df a4 65 32 ed 62 09 bd cf 4b 04 a0 ab 90 7b 6a 96 ae c5 f8 4f c3 d0 64 c7 78 a2 5a c5 a0 76 c7 40 5b 87 4e 4c 9d 44 55 7c 00 5f a3 f8 84 92 b2 84 31 53 a4 b9 70 e7 95 1c e8 0b 7e 50 61 9f 71 c7 d0 3e 8d fb a4 df 7d 29 24 71 b6 48 37 bb 2c 68 81 bc 8b b9 06 c1 6d 29 49 07 9d 9b 98 ee f3 61 73 d4 3c bd 54 57 1f d8 eb b5 75 dd 24 3f 88 01 a3 ac f3 e6 45 d6 e0 df bc 79 85 0b f8 fb 95 40 58 89 df b0 b9 97 de 75 87 40 11 35 b7 2a 9a dc 55 4a 85 01 4c 9c 6a 61 1e d9 e0 04 30 e5 a4 76 9d 18 5e 0a aa d1 51 88 20 28 4f 7d 6b 2b 66 77 b2 76 98 66 96 7a ec 07 62 cd 68 ef 46 45 14 1c 3c 70 6c f8 c8 4c 57 5a 49 89 ff 8e 2a 2e 34 23 16 a6 b5 ff 2c b5 58 a6 9a bb 60 3d 18 db 62 c8 b2 1f 97 65 56 85 b2 57 b6 29 57 2a 02 a6 3b fb 51 2c 94 27 78 b7 3e f3 da 4a 71 9d fa 8d 0a 20 10 d8 5f 19 1d 54 3c 65 61 26 77 6f aa e5 2f 52 9b 4d d7 32 e6 60 72 58 b9 46 a9 fa 1a a7 14 de e2 0d 92 45 be 8c f7 63 3a f6 9b 41 df 39 ca 37 41 8e 09 ca 85 d6 f5 df f3 17 34 ee c6 46 54 cd d3 0e a1 30 ca 8d d1 40 7f a4 77 75 85 4a 49 d2 e0 42 64 dc 35 0d be 42 11 f8 68 77 fa 17 1e 9e 11 93 7d 16 6f 45 dc 86 40 de f9 4e 3d de e2 d1 99 9e 5a 24 80 29 36 f1 40 db de 8d 1f d3 95 73 05 ea 58 f5 ce a8 cf 72 d3 f5 d3 9b f6 bb 00 a7 ab a4 75 9f 25 de 96 1e 99 65 9f 49 b4 67 a8 f1 35 bf 72 75 1f 41 8b ff 3a 0e 38 31 d1 26 a7 a8 7f 22 bc 7f 65 a0 5f 0e f7 86 27 eb f3 85 12 8a 42 ac 04 92 65 Data Ascii: PKIX6%Fe
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:36:21 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 511Expires: Mon, 22 Jul 2024 14:36:21 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72ca07ef12c42a-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:36:21 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 511Expires: Mon, 22 Jul 2024 14:36:21 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72ca0ab949c42a-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:36:22 GMTContent-Type: application/zipContent-Length: 9891Connection: keep-aliveETag: "3914547665"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 209Expires: Mon, 22 Jul 2024 14:36:22 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72ca10987043aa-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d 2f df fd fa 21 ed 80 77 a9 39 90 7f fa 30 d1 2f b5 c5 80 5e 25 58 2d 8f a1 ec 2e 30 28 d8 18 6d 56 50 fc 6e ec c2 5d 3d 18 63 ce 72 b7 5f 01 fc dc 41 24 ef 91 b3 a5 3c 11 42 57 ad f6 79 b8 df a4 65 32 ed 62 09 bd cf 4b 04 a0 ab 90 7b 6a 96 ae c5 f8 4f c3 d0 64 c7 78 a2 5a c5 a0 76 c7 40 5b 87 4e 4c 9d 44 55 7c 00 5f a3 f8 84 92 b2 84 31 53 a4 b9 70 e7 95 1c e8 0b 7e 50 61 9f 71 c7 d0 3e 8d fb a4 df 7d 29 24 71 b6 48 37 bb 2c 68 81 bc 8b b9 06 c1 6d 29 49 07 9d 9b 98 ee f3 61 73 d4 3c bd 54 57 1f d8 eb b5 75 dd 24 3f 88 01 a3 ac f3 e6 45 d6 e0 df bc 79 85 0b f8 fb 95 40 58 89 df b0 b9 97 de 75 87 40 11 35 b7 2a 9a dc 55 4a 85 01 4c 9c 6a 61 1e d9 e0 04 30 e5 a4 76 9d 18 5e 0a aa d1 51 88 20 28 4f 7d 6b 2b 66 77 b2 76 98 66 96 7a ec 07 62 cd 68 ef 46 45 14 1c 3c 70 6c f8 c8 4c 57 5a 49 89 ff 8e 2a 2e 34 23 16 a6 b5 ff 2c b5 58 a6 9a bb 60 3d 18 db 62 c8 b2 1f 97 65 56 85 b2 57 b6 29 57 2a 02 a6 3b fb 51 2c 94 27 78 b7 3e f3 da 4a 71 9d fa 8d 0a 20 10 d8 5f 19 1d 54 3c 65 61 26 77 6f aa e5 2f 52 9b 4d d7 32 e6 60 72 58 b9 46 a9 fa 1a a7 14 de e2 0d 92 45 be 8c f7 63 3a f6 9b 41 df 39 ca 37 41 8e 09 ca 85 d6 f5 df f3 17 34 ee c6 46 54 cd d3 0e a1 30 ca 8d d1 40 7f a4 77 75 85 4a 49 d2 e0 42 64 dc 35 0d be 42 11 f8 68 77 fa 17 1e 9e 11 93 7d 16 6f 45 dc 86 40 de f9 4e 3d de e2 d1 99 9e 5a 24 80 29 36 f1 40 db de 8d 1f d3 95 73 05 ea 58 f5 ce a8 cf 72 d3 f5 d3 9b f6 bb 00 a7 ab a4 75 9f 25 de 96 1e 99 65 9f 49 b4 67 a8 f1 35 bf 72 75 1f 41 8b ff 3a 0e 38 31 d1 26 a7 a8 7f 22 bc 7f 65 a0 5f 0e f7 86 27 eb f3 85 12 8a 42 ac 04 92 65 Data Ascii: PKIX6%Fe
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:36:24 GMTContent-Type: application/zipContent-Length: 9891Connection: keep-aliveETag: "3914547665"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 211Expires: Mon, 22 Jul 2024 14:36:24 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72ca1a5a2843a9-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d 2f df fd fa 21 ed 80 77 a9 39 90 7f fa 30 d1 2f b5 c5 80 5e 25 58 2d 8f a1 ec 2e 30 28 d8 18 6d 56 50 fc 6e ec c2 5d 3d 18 63 ce 72 b7 5f 01 fc dc 41 24 ef 91 b3 a5 3c 11 42 57 ad f6 79 b8 df a4 65 32 ed 62 09 bd cf 4b 04 a0 ab 90 7b 6a 96 ae c5 f8 4f c3 d0 64 c7 78 a2 5a c5 a0 76 c7 40 5b 87 4e 4c 9d 44 55 7c 00 5f a3 f8 84 92 b2 84 31 53 a4 b9 70 e7 95 1c e8 0b 7e 50 61 9f 71 c7 d0 3e 8d fb a4 df 7d 29 24 71 b6 48 37 bb 2c 68 81 bc 8b b9 06 c1 6d 29 49 07 9d 9b 98 ee f3 61 73 d4 3c bd 54 57 1f d8 eb b5 75 dd 24 3f 88 01 a3 ac f3 e6 45 d6 e0 df bc 79 85 0b f8 fb 95 40 58 89 df b0 b9 97 de 75 87 40 11 35 b7 2a 9a dc 55 4a 85 01 4c 9c 6a 61 1e d9 e0 04 30 e5 a4 76 9d 18 5e 0a aa d1 51 88 20 28 4f 7d 6b 2b 66 77 b2 76 98 66 96 7a ec 07 62 cd 68 ef 46 45 14 1c 3c 70 6c f8 c8 4c 57 5a 49 89 ff 8e 2a 2e 34 23 16 a6 b5 ff 2c b5 58 a6 9a bb 60 3d 18 db 62 c8 b2 1f 97 65 56 85 b2 57 b6 29 57 2a 02 a6 3b fb 51 2c 94 27 78 b7 3e f3 da 4a 71 9d fa 8d 0a 20 10 d8 5f 19 1d 54 3c 65 61 26 77 6f aa e5 2f 52 9b 4d d7 32 e6 60 72 58 b9 46 a9 fa 1a a7 14 de e2 0d 92 45 be 8c f7 63 3a f6 9b 41 df 39 ca 37 41 8e 09 ca 85 d6 f5 df f3 17 34 ee c6 46 54 cd d3 0e a1 30 ca 8d d1 40 7f a4 77 75 85 4a 49 d2 e0 42 64 dc 35 0d be 42 11 f8 68 77 fa 17 1e 9e 11 93 7d 16 6f 45 dc 86 40 de f9 4e 3d de e2 d1 99 9e 5a 24 80 29 36 f1 40 db de 8d 1f d3 95 73 05 ea 58 f5 ce a8 cf 72 d3 f5 d3 9b f6 bb 00 a7 ab a4 75 9f 25 de 96 1e 99 65 9f 49 b4 67 a8 f1 35 bf 72 75 1f 41 8b ff 3a 0e 38 31 d1 26 a7 a8 7f 22 bc 7f 65 a0 5f 0e f7 86 27 eb f3 85 12 8a 42 ac 04 92 65 Data Ascii: PKIX6%Fe
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:36:24 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 514Expires: Mon, 22 Jul 2024 14:36:24 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72ca1ecdd841a6-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:36:26 GMTContent-Type: application/zipContent-Length: 9891Connection: keep-aliveETag: "3914547665"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 213Expires: Mon, 22 Jul 2024 14:36:26 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72ca298d6f42e1-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d 2f df fd fa 21 ed 80 77 a9 39 90 7f fa 30 d1 2f b5 c5 80 5e 25 58 2d 8f a1 ec 2e 30 28 d8 18 6d 56 50 fc 6e ec c2 5d 3d 18 63 ce 72 b7 5f 01 fc dc 41 24 ef 91 b3 a5 3c 11 42 57 ad f6 79 b8 df a4 65 32 ed 62 09 bd cf 4b 04 a0 ab 90 7b 6a 96 ae c5 f8 4f c3 d0 64 c7 78 a2 5a c5 a0 76 c7 40 5b 87 4e 4c 9d 44 55 7c 00 5f a3 f8 84 92 b2 84 31 53 a4 b9 70 e7 95 1c e8 0b 7e 50 61 9f 71 c7 d0 3e 8d fb a4 df 7d 29 24 71 b6 48 37 bb 2c 68 81 bc 8b b9 06 c1 6d 29 49 07 9d 9b 98 ee f3 61 73 d4 3c bd 54 57 1f d8 eb b5 75 dd 24 3f 88 01 a3 ac f3 e6 45 d6 e0 df bc 79 85 0b f8 fb 95 40 58 89 df b0 b9 97 de 75 87 40 11 35 b7 2a 9a dc 55 4a 85 01 4c 9c 6a 61 1e d9 e0 04 30 e5 a4 76 9d 18 5e 0a aa d1 51 88 20 28 4f 7d 6b 2b 66 77 b2 76 98 66 96 7a ec 07 62 cd 68 ef 46 45 14 1c 3c 70 6c f8 c8 4c 57 5a 49 89 ff 8e 2a 2e 34 23 16 a6 b5 ff 2c b5 58 a6 9a bb 60 3d 18 db 62 c8 b2 1f 97 65 56 85 b2 57 b6 29 57 2a 02 a6 3b fb 51 2c 94 27 78 b7 3e f3 da 4a 71 9d fa 8d 0a 20 10 d8 5f 19 1d 54 3c 65 61 26 77 6f aa e5 2f 52 9b 4d d7 32 e6 60 72 58 b9 46 a9 fa 1a a7 14 de e2 0d 92 45 be 8c f7 63 3a f6 9b 41 df 39 ca 37 41 8e 09 ca 85 d6 f5 df f3 17 34 ee c6 46 54 cd d3 0e a1 30 ca 8d d1 40 7f a4 77 75 85 4a 49 d2 e0 42 64 dc 35 0d be 42 11 f8 68 77 fa 17 1e 9e 11 93 7d 16 6f 45 dc 86 40 de f9 4e 3d de e2 d1 99 9e 5a 24 80 29 36 f1 40 db de 8d 1f d3 95 73 05 ea 58 f5 ce a8 cf 72 d3 f5 d3 9b f6 bb 00 a7 ab a4 75 9f 25 de 96 1e 99 65 9f 49 b4 67 a8 f1 35 bf 72 75 1f 41 8b ff 3a 0e 38 31 d1 26 a7 a8 7f 22 bc 7f 65 a0 5f 0e f7 86 27 eb f3 85 12 8a 42 ac 04 92 65 Data Ascii: PKIX6%Fe
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:36:27 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 517Expires: Mon, 22 Jul 2024 14:36:27 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72ca31c96a0f3a-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:36:29 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 519Expires: Mon, 22 Jul 2024 14:36:29 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72ca3e0a354378-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:36:31 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 521Expires: Mon, 22 Jul 2024 14:36:31 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72ca49ff6b42ab-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:36:33 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 523Expires: Mon, 22 Jul 2024 14:36:33 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72ca560ea78cba-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:36:36 GMTContent-Type: application/zipContent-Length: 9891Connection: keep-aliveETag: "3914547665"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 223Expires: Mon, 22 Jul 2024 14:36:36 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72ca66fdbe4217-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d 2f df fd fa 21 ed 80 77 a9 39 90 7f fa 30 d1 2f b5 c5 80 5e 25 58 2d 8f a1 ec 2e 30 28 d8 18 6d 56 50 fc 6e ec c2 5d 3d 18 63 ce 72 b7 5f 01 fc dc 41 24 ef 91 b3 a5 3c 11 42 57 ad f6 79 b8 df a4 65 32 ed 62 09 bd cf 4b 04 a0 ab 90 7b 6a 96 ae c5 f8 4f c3 d0 64 c7 78 a2 5a c5 a0 76 c7 40 5b 87 4e 4c 9d 44 55 7c 00 5f a3 f8 84 92 b2 84 31 53 a4 b9 70 e7 95 1c e8 0b 7e 50 61 9f 71 c7 d0 3e 8d fb a4 df 7d 29 24 71 b6 48 37 bb 2c 68 81 bc 8b b9 06 c1 6d 29 49 07 9d 9b 98 ee f3 61 73 d4 3c bd 54 57 1f d8 eb b5 75 dd 24 3f 88 01 a3 ac f3 e6 45 d6 e0 df bc 79 85 0b f8 fb 95 40 58 89 df b0 b9 97 de 75 87 40 11 35 b7 2a 9a dc 55 4a 85 01 4c 9c 6a 61 1e d9 e0 04 30 e5 a4 76 9d 18 5e 0a aa d1 51 88 20 28 4f 7d 6b 2b 66 77 b2 76 98 66 96 7a ec 07 62 cd 68 ef 46 45 14 1c 3c 70 6c f8 c8 4c 57 5a 49 89 ff 8e 2a 2e 34 23 16 a6 b5 ff 2c b5 58 a6 9a bb 60 3d 18 db 62 c8 b2 1f 97 65 56 85 b2 57 b6 29 57 2a 02 a6 3b fb 51 2c 94 27 78 b7 3e f3 da 4a 71 9d fa 8d 0a 20 10 d8 5f 19 1d 54 3c 65 61 26 77 6f aa e5 2f 52 9b 4d d7 32 e6 60 72 58 b9 46 a9 fa 1a a7 14 de e2 0d 92 45 be 8c f7 63 3a f6 9b 41 df 39 ca 37 41 8e 09 ca 85 d6 f5 df f3 17 34 ee c6 46 54 cd d3 0e a1 30 ca 8d d1 40 7f a4 77 75 85 4a 49 d2 e0 42 64 dc 35 0d be 42 11 f8 68 77 fa 17 1e 9e 11 93 7d 16 6f 45 dc 86 40 de f9 4e 3d de e2 d1 99 9e 5a 24 80 29 36 f1 40 db de 8d 1f d3 95 73 05 ea 58 f5 ce a8 cf 72 d3 f5 d3 9b f6 bb 00 a7 ab a4 75 9f 25 de 96 1e 99 65 9f 49 b4 67 a8 f1 35 bf 72 75 1f 41 8b ff 3a 0e 38 31 d1 26 a7 a8 7f 22 bc 7f 65 a0 5f 0e f7 86 27 eb f3 85 12 8a 42 ac 04 92 65 Data Ascii: PKIX6%Fe
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:36:38 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 528Expires: Mon, 22 Jul 2024 14:36:38 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72ca71e83f78d0-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:36:39 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 529Expires: Mon, 22 Jul 2024 14:36:39 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72ca780a6141e6-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:36:39 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 529Expires: Mon, 22 Jul 2024 14:36:39 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72ca7d38db4352-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:36:39 GMTContent-Type: application/zipContent-Length: 9891Connection: keep-aliveETag: "3914547665"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 226Expires: Mon, 22 Jul 2024 14:36:39 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72ca7dc8d24259-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d 2f df fd fa 21 ed 80 77 a9 39 90 7f fa 30 d1 2f b5 c5 80 5e 25 58 2d 8f a1 ec 2e 30 28 d8 18 6d 56 50 fc 6e ec c2 5d 3d 18 63 ce 72 b7 5f 01 fc dc 41 24 ef 91 b3 a5 3c 11 42 57 ad f6 79 b8 df a4 65 32 ed 62 09 bd cf 4b 04 a0 ab 90 7b 6a 96 ae c5 f8 4f c3 d0 64 c7 78 a2 5a c5 a0 76 c7 40 5b 87 4e 4c 9d 44 55 7c 00 5f a3 f8 84 92 b2 84 31 53 a4 b9 70 e7 95 1c e8 0b 7e 50 61 9f 71 c7 d0 3e 8d fb a4 df 7d 29 24 71 b6 48 37 bb 2c 68 81 bc 8b b9 06 c1 6d 29 49 07 9d 9b 98 ee f3 61 73 d4 3c bd 54 57 1f d8 eb b5 75 dd 24 3f 88 01 a3 ac f3 e6 45 d6 e0 df bc 79 85 0b f8 fb 95 40 58 89 df b0 b9 97 de 75 87 40 11 35 b7 2a 9a dc 55 4a 85 01 4c 9c 6a 61 1e d9 e0 04 30 e5 a4 76 9d 18 5e 0a aa d1 51 88 20 28 4f 7d 6b 2b 66 77 b2 76 98 66 96 7a ec 07 62 cd 68 ef 46 45 14 1c 3c 70 6c f8 c8 4c 57 5a 49 89 ff 8e 2a 2e 34 23 16 a6 b5 ff 2c b5 58 a6 9a bb 60 3d 18 db 62 c8 b2 1f 97 65 56 85 b2 57 b6 29 57 2a 02 a6 3b fb 51 2c 94 27 78 b7 3e f3 da 4a 71 9d fa 8d 0a 20 10 d8 5f 19 1d 54 3c 65 61 26 77 6f aa e5 2f 52 9b 4d d7 32 e6 60 72 58 b9 46 a9 fa 1a a7 14 de e2 0d 92 45 be 8c f7 63 3a f6 9b 41 df 39 ca 37 41 8e 09 ca 85 d6 f5 df f3 17 34 ee c6 46 54 cd d3 0e a1 30 ca 8d d1 40 7f a4 77 75 85 4a 49 d2 e0 42 64 dc 35 0d be 42 11 f8 68 77 fa 17 1e 9e 11 93 7d 16 6f 45 dc 86 40 de f9 4e 3d de e2 d1 99 9e 5a 24 80 29 36 f1 40 db de 8d 1f d3 95 73 05 ea 58 f5 ce a8 cf 72 d3 f5 d3 9b f6 bb 00 a7 ab a4 75 9f 25 de 96 1e 99 65 9f 49 b4 67 a8 f1 35 bf 72 75 1f 41 8b ff 3a 0e 38 31 d1 26 a7 a8 7f 22 bc 7f 65 a0 5f 0e f7 86 27 eb f3 85 12 8a 42 ac 04 92 65 Data Ascii: PKIX6%Fe
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:36:41 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 531Expires: Mon, 22 Jul 2024 14:36:41 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72ca86fa13434b-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:36:42 GMTContent-Type: application/zipContent-Length: 9891Connection: keep-aliveETag: "3914547665"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 229Expires: Mon, 22 Jul 2024 14:36:42 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72ca8cbadb4414-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d 2f df fd fa 21 ed 80 77 a9 39 90 7f fa 30 d1 2f b5 c5 80 5e 25 58 2d 8f a1 ec 2e 30 28 d8 18 6d 56 50 fc 6e ec c2 5d 3d 18 63 ce 72 b7 5f 01 fc dc 41 24 ef 91 b3 a5 3c 11 42 57 ad f6 79 b8 df a4 65 32 ed 62 09 bd cf 4b 04 a0 ab 90 7b 6a 96 ae c5 f8 4f c3 d0 64 c7 78 a2 5a c5 a0 76 c7 40 5b 87 4e 4c 9d 44 55 7c 00 5f a3 f8 84 92 b2 84 31 53 a4 b9 70 e7 95 1c e8 0b 7e 50 61 9f 71 c7 d0 3e 8d fb a4 df 7d 29 24 71 b6 48 37 bb 2c 68 81 bc 8b b9 06 c1 6d 29 49 07 9d 9b 98 ee f3 61 73 d4 3c bd 54 57 1f d8 eb b5 75 dd 24 3f 88 01 a3 ac f3 e6 45 d6 e0 df bc 79 85 0b f8 fb 95 40 58 89 df b0 b9 97 de 75 87 40 11 35 b7 2a 9a dc 55 4a 85 01 4c 9c 6a 61 1e d9 e0 04 30 e5 a4 76 9d 18 5e 0a aa d1 51 88 20 28 4f 7d 6b 2b 66 77 b2 76 98 66 96 7a ec 07 62 cd 68 ef 46 45 14 1c 3c 70 6c f8 c8 4c 57 5a 49 89 ff 8e 2a 2e 34 23 16 a6 b5 ff 2c b5 58 a6 9a bb 60 3d 18 db 62 c8 b2 1f 97 65 56 85 b2 57 b6 29 57 2a 02 a6 3b fb 51 2c 94 27 78 b7 3e f3 da 4a 71 9d fa 8d 0a 20 10 d8 5f 19 1d 54 3c 65 61 26 77 6f aa e5 2f 52 9b 4d d7 32 e6 60 72 58 b9 46 a9 fa 1a a7 14 de e2 0d 92 45 be 8c f7 63 3a f6 9b 41 df 39 ca 37 41 8e 09 ca 85 d6 f5 df f3 17 34 ee c6 46 54 cd d3 0e a1 30 ca 8d d1 40 7f a4 77 75 85 4a 49 d2 e0 42 64 dc 35 0d be 42 11 f8 68 77 fa 17 1e 9e 11 93 7d 16 6f 45 dc 86 40 de f9 4e 3d de e2 d1 99 9e 5a 24 80 29 36 f1 40 db de 8d 1f d3 95 73 05 ea 58 f5 ce a8 cf 72 d3 f5 d3 9b f6 bb 00 a7 ab a4 75 9f 25 de 96 1e 99 65 9f 49 b4 67 a8 f1 35 bf 72 75 1f 41 8b ff 3a 0e 38 31 d1 26 a7 a8 7f 22 bc 7f 65 a0 5f 0e f7 86 27 eb f3 85 12 8a 42 ac 04 92 65 Data Ascii: PKIX6%Fe
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:36:42 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 532Expires: Mon, 22 Jul 2024 14:36:42 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72ca8deb954414-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:36:43 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 533Expires: Mon, 22 Jul 2024 14:36:43 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72ca922c438c11-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:36:43 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 533Expires: Mon, 22 Jul 2024 14:36:43 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72ca922c438c11-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:36:44 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 534Expires: Mon, 22 Jul 2024 14:36:44 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72ca984ff75e70-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:36:44 GMTContent-Type: application/zipContent-Length: 9891Connection: keep-aliveETag: "3914547665"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 231Expires: Mon, 22 Jul 2024 14:36:44 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72ca99a8ca0c8e-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d 2f df fd fa 21 ed 80 77 a9 39 90 7f fa 30 d1 2f b5 c5 80 5e 25 58 2d 8f a1 ec 2e 30 28 d8 18 6d 56 50 fc 6e ec c2 5d 3d 18 63 ce 72 b7 5f 01 fc dc 41 24 ef 91 b3 a5 3c 11 42 57 ad f6 79 b8 df a4 65 32 ed 62 09 bd cf 4b 04 a0 ab 90 7b 6a 96 ae c5 f8 4f c3 d0 64 c7 78 a2 5a c5 a0 76 c7 40 5b 87 4e 4c 9d 44 55 7c 00 5f a3 f8 84 92 b2 84 31 53 a4 b9 70 e7 95 1c e8 0b 7e 50 61 9f 71 c7 d0 3e 8d fb a4 df 7d 29 24 71 b6 48 37 bb 2c 68 81 bc 8b b9 06 c1 6d 29 49 07 9d 9b 98 ee f3 61 73 d4 3c bd 54 57 1f d8 eb b5 75 dd 24 3f 88 01 a3 ac f3 e6 45 d6 e0 df bc 79 85 0b f8 fb 95 40 58 89 df b0 b9 97 de 75 87 40 11 35 b7 2a 9a dc 55 4a 85 01 4c 9c 6a 61 1e d9 e0 04 30 e5 a4 76 9d 18 5e 0a aa d1 51 88 20 28 4f 7d 6b 2b 66 77 b2 76 98 66 96 7a ec 07 62 cd 68 ef 46 45 14 1c 3c 70 6c f8 c8 4c 57 5a 49 89 ff 8e 2a 2e 34 23 16 a6 b5 ff 2c b5 58 a6 9a bb 60 3d 18 db 62 c8 b2 1f 97 65 56 85 b2 57 b6 29 57 2a 02 a6 3b fb 51 2c 94 27 78 b7 3e f3 da 4a 71 9d fa 8d 0a 20 10 d8 5f 19 1d 54 3c 65 61 26 77 6f aa e5 2f 52 9b 4d d7 32 e6 60 72 58 b9 46 a9 fa 1a a7 14 de e2 0d 92 45 be 8c f7 63 3a f6 9b 41 df 39 ca 37 41 8e 09 ca 85 d6 f5 df f3 17 34 ee c6 46 54 cd d3 0e a1 30 ca 8d d1 40 7f a4 77 75 85 4a 49 d2 e0 42 64 dc 35 0d be 42 11 f8 68 77 fa 17 1e 9e 11 93 7d 16 6f 45 dc 86 40 de f9 4e 3d de e2 d1 99 9e 5a 24 80 29 36 f1 40 db de 8d 1f d3 95 73 05 ea 58 f5 ce a8 cf 72 d3 f5 d3 9b f6 bb 00 a7 ab a4 75 9f 25 de 96 1e 99 65 9f 49 b4 67 a8 f1 35 bf 72 75 1f 41 8b ff 3a 0e 38 31 d1 26 a7 a8 7f 22 bc 7f 65 a0 5f 0e f7 86 27 eb f3 85 12 8a 42 ac 04 92 65 Data Ascii: PKIX6%Fe
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:36:45 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 535Expires: Mon, 22 Jul 2024 14:36:45 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72ca9dedbfc404-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:36:45 GMTContent-Type: application/zipContent-Length: 9891Connection: keep-aliveETag: "3914547665"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 232Expires: Mon, 22 Jul 2024 14:36:45 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72caa13cf9425c-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d 2f df fd fa 21 ed 80 77 a9 39 90 7f fa 30 d1 2f b5 c5 80 5e 25 58 2d 8f a1 ec 2e 30 28 d8 18 6d 56 50 fc 6e ec c2 5d 3d 18 63 ce 72 b7 5f 01 fc dc 41 24 ef 91 b3 a5 3c 11 42 57 ad f6 79 b8 df a4 65 32 ed 62 09 bd cf 4b 04 a0 ab 90 7b 6a 96 ae c5 f8 4f c3 d0 64 c7 78 a2 5a c5 a0 76 c7 40 5b 87 4e 4c 9d 44 55 7c 00 5f a3 f8 84 92 b2 84 31 53 a4 b9 70 e7 95 1c e8 0b 7e 50 61 9f 71 c7 d0 3e 8d fb a4 df 7d 29 24 71 b6 48 37 bb 2c 68 81 bc 8b b9 06 c1 6d 29 49 07 9d 9b 98 ee f3 61 73 d4 3c bd 54 57 1f d8 eb b5 75 dd 24 3f 88 01 a3 ac f3 e6 45 d6 e0 df bc 79 85 0b f8 fb 95 40 58 89 df b0 b9 97 de 75 87 40 11 35 b7 2a 9a dc 55 4a 85 01 4c 9c 6a 61 1e d9 e0 04 30 e5 a4 76 9d 18 5e 0a aa d1 51 88 20 28 4f 7d 6b 2b 66 77 b2 76 98 66 96 7a ec 07 62 cd 68 ef 46 45 14 1c 3c 70 6c f8 c8 4c 57 5a 49 89 ff 8e 2a 2e 34 23 16 a6 b5 ff 2c b5 58 a6 9a bb 60 3d 18 db 62 c8 b2 1f 97 65 56 85 b2 57 b6 29 57 2a 02 a6 3b fb 51 2c 94 27 78 b7 3e f3 da 4a 71 9d fa 8d 0a 20 10 d8 5f 19 1d 54 3c 65 61 26 77 6f aa e5 2f 52 9b 4d d7 32 e6 60 72 58 b9 46 a9 fa 1a a7 14 de e2 0d 92 45 be 8c f7 63 3a f6 9b 41 df 39 ca 37 41 8e 09 ca 85 d6 f5 df f3 17 34 ee c6 46 54 cd d3 0e a1 30 ca 8d d1 40 7f a4 77 75 85 4a 49 d2 e0 42 64 dc 35 0d be 42 11 f8 68 77 fa 17 1e 9e 11 93 7d 16 6f 45 dc 86 40 de f9 4e 3d de e2 d1 99 9e 5a 24 80 29 36 f1 40 db de 8d 1f d3 95 73 05 ea 58 f5 ce a8 cf 72 d3 f5 d3 9b f6 bb 00 a7 ab a4 75 9f 25 de 96 1e 99 65 9f 49 b4 67 a8 f1 35 bf 72 75 1f 41 8b ff 3a 0e 38 31 d1 26 a7 a8 7f 22 bc 7f 65 a0 5f 0e f7 86 27 eb f3 85 12 8a 42 ac 04 92 65 Data Ascii: PKIX6%Fe
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:36:46 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 536Expires: Mon, 22 Jul 2024 14:36:46 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72caa3d8c80f73-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:36:46 GMTContent-Type: application/zipContent-Length: 9891Connection: keep-aliveETag: "3914547665"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 233Expires: Mon, 22 Jul 2024 14:36:46 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72caa5989d7cac-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d 2f df fd fa 21 ed 80 77 a9 39 90 7f fa 30 d1 2f b5 c5 80 5e 25 58 2d 8f a1 ec 2e 30 28 d8 18 6d 56 50 fc 6e ec c2 5d 3d 18 63 ce 72 b7 5f 01 fc dc 41 24 ef 91 b3 a5 3c 11 42 57 ad f6 79 b8 df a4 65 32 ed 62 09 bd cf 4b 04 a0 ab 90 7b 6a 96 ae c5 f8 4f c3 d0 64 c7 78 a2 5a c5 a0 76 c7 40 5b 87 4e 4c 9d 44 55 7c 00 5f a3 f8 84 92 b2 84 31 53 a4 b9 70 e7 95 1c e8 0b 7e 50 61 9f 71 c7 d0 3e 8d fb a4 df 7d 29 24 71 b6 48 37 bb 2c 68 81 bc 8b b9 06 c1 6d 29 49 07 9d 9b 98 ee f3 61 73 d4 3c bd 54 57 1f d8 eb b5 75 dd 24 3f 88 01 a3 ac f3 e6 45 d6 e0 df bc 79 85 0b f8 fb 95 40 58 89 df b0 b9 97 de 75 87 40 11 35 b7 2a 9a dc 55 4a 85 01 4c 9c 6a 61 1e d9 e0 04 30 e5 a4 76 9d 18 5e 0a aa d1 51 88 20 28 4f 7d 6b 2b 66 77 b2 76 98 66 96 7a ec 07 62 cd 68 ef 46 45 14 1c 3c 70 6c f8 c8 4c 57 5a 49 89 ff 8e 2a 2e 34 23 16 a6 b5 ff 2c b5 58 a6 9a bb 60 3d 18 db 62 c8 b2 1f 97 65 56 85 b2 57 b6 29 57 2a 02 a6 3b fb 51 2c 94 27 78 b7 3e f3 da 4a 71 9d fa 8d 0a 20 10 d8 5f 19 1d 54 3c 65 61 26 77 6f aa e5 2f 52 9b 4d d7 32 e6 60 72 58 b9 46 a9 fa 1a a7 14 de e2 0d 92 45 be 8c f7 63 3a f6 9b 41 df 39 ca 37 41 8e 09 ca 85 d6 f5 df f3 17 34 ee c6 46 54 cd d3 0e a1 30 ca 8d d1 40 7f a4 77 75 85 4a 49 d2 e0 42 64 dc 35 0d be 42 11 f8 68 77 fa 17 1e 9e 11 93 7d 16 6f 45 dc 86 40 de f9 4e 3d de e2 d1 99 9e 5a 24 80 29 36 f1 40 db de 8d 1f d3 95 73 05 ea 58 f5 ce a8 cf 72 d3 f5 d3 9b f6 bb 00 a7 ab a4 75 9f 25 de 96 1e 99 65 9f 49 b4 67 a8 f1 35 bf 72 75 1f 41 8b ff 3a 0e 38 31 d1 26 a7 a8 7f 22 bc 7f 65 a0 5f 0e f7 86 27 eb f3 85 12 8a 42 ac 04 92 65 Data Ascii: PKIX6%Fe
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:36:46 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 536Expires: Mon, 22 Jul 2024 14:36:46 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72caa81a507ca8-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:36:46 GMTContent-Type: application/zipContent-Length: 9891Connection: keep-aliveETag: "3914547665"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 233Expires: Mon, 22 Jul 2024 14:36:46 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72caa99db76a52-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d 2f df fd fa 21 ed 80 77 a9 39 90 7f fa 30 d1 2f b5 c5 80 5e 25 58 2d 8f a1 ec 2e 30 28 d8 18 6d 56 50 fc 6e ec c2 5d 3d 18 63 ce 72 b7 5f 01 fc dc 41 24 ef 91 b3 a5 3c 11 42 57 ad f6 79 b8 df a4 65 32 ed 62 09 bd cf 4b 04 a0 ab 90 7b 6a 96 ae c5 f8 4f c3 d0 64 c7 78 a2 5a c5 a0 76 c7 40 5b 87 4e 4c 9d 44 55 7c 00 5f a3 f8 84 92 b2 84 31 53 a4 b9 70 e7 95 1c e8 0b 7e 50 61 9f 71 c7 d0 3e 8d fb a4 df 7d 29 24 71 b6 48 37 bb 2c 68 81 bc 8b b9 06 c1 6d 29 49 07 9d 9b 98 ee f3 61 73 d4 3c bd 54 57 1f d8 eb b5 75 dd 24 3f 88 01 a3 ac f3 e6 45 d6 e0 df bc 79 85 0b f8 fb 95 40 58 89 df b0 b9 97 de 75 87 40 11 35 b7 2a 9a dc 55 4a 85 01 4c 9c 6a 61 1e d9 e0 04 30 e5 a4 76 9d 18 5e 0a aa d1 51 88 20 28 4f 7d 6b 2b 66 77 b2 76 98 66 96 7a ec 07 62 cd 68 ef 46 45 14 1c 3c 70 6c f8 c8 4c 57 5a 49 89 ff 8e 2a 2e 34 23 16 a6 b5 ff 2c b5 58 a6 9a bb 60 3d 18 db 62 c8 b2 1f 97 65 56 85 b2 57 b6 29 57 2a 02 a6 3b fb 51 2c 94 27 78 b7 3e f3 da 4a 71 9d fa 8d 0a 20 10 d8 5f 19 1d 54 3c 65 61 26 77 6f aa e5 2f 52 9b 4d d7 32 e6 60 72 58 b9 46 a9 fa 1a a7 14 de e2 0d 92 45 be 8c f7 63 3a f6 9b 41 df 39 ca 37 41 8e 09 ca 85 d6 f5 df f3 17 34 ee c6 46 54 cd d3 0e a1 30 ca 8d d1 40 7f a4 77 75 85 4a 49 d2 e0 42 64 dc 35 0d be 42 11 f8 68 77 fa 17 1e 9e 11 93 7d 16 6f 45 dc 86 40 de f9 4e 3d de e2 d1 99 9e 5a 24 80 29 36 f1 40 db de 8d 1f d3 95 73 05 ea 58 f5 ce a8 cf 72 d3 f5 d3 9b f6 bb 00 a7 ab a4 75 9f 25 de 96 1e 99 65 9f 49 b4 67 a8 f1 35 bf 72 75 1f 41 8b ff 3a 0e 38 31 d1 26 a7 a8 7f 22 bc 7f 65 a0 5f 0e f7 86 27 eb f3 85 12 8a 42 ac 04 92 65 Data Ascii: PKIX6%Fe
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:36:47 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 537Expires: Mon, 22 Jul 2024 14:36:47 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72caad7ef77d06-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:36:48 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 538Expires: Mon, 22 Jul 2024 14:36:48 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72cab3cb9e0f36-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:36:49 GMTContent-Type: application/zipContent-Length: 9891Connection: keep-aliveETag: "3914547665"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 236Expires: Mon, 22 Jul 2024 14:36:49 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72cab8dc797ce4-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d 2f df fd fa 21 ed 80 77 a9 39 90 7f fa 30 d1 2f b5 c5 80 5e 25 58 2d 8f a1 ec 2e 30 28 d8 18 6d 56 50 fc 6e ec c2 5d 3d 18 63 ce 72 b7 5f 01 fc dc 41 24 ef 91 b3 a5 3c 11 42 57 ad f6 79 b8 df a4 65 32 ed 62 09 bd cf 4b 04 a0 ab 90 7b 6a 96 ae c5 f8 4f c3 d0 64 c7 78 a2 5a c5 a0 76 c7 40 5b 87 4e 4c 9d 44 55 7c 00 5f a3 f8 84 92 b2 84 31 53 a4 b9 70 e7 95 1c e8 0b 7e 50 61 9f 71 c7 d0 3e 8d fb a4 df 7d 29 24 71 b6 48 37 bb 2c 68 81 bc 8b b9 06 c1 6d 29 49 07 9d 9b 98 ee f3 61 73 d4 3c bd 54 57 1f d8 eb b5 75 dd 24 3f 88 01 a3 ac f3 e6 45 d6 e0 df bc 79 85 0b f8 fb 95 40 58 89 df b0 b9 97 de 75 87 40 11 35 b7 2a 9a dc 55 4a 85 01 4c 9c 6a 61 1e d9 e0 04 30 e5 a4 76 9d 18 5e 0a aa d1 51 88 20 28 4f 7d 6b 2b 66 77 b2 76 98 66 96 7a ec 07 62 cd 68 ef 46 45 14 1c 3c 70 6c f8 c8 4c 57 5a 49 89 ff 8e 2a 2e 34 23 16 a6 b5 ff 2c b5 58 a6 9a bb 60 3d 18 db 62 c8 b2 1f 97 65 56 85 b2 57 b6 29 57 2a 02 a6 3b fb 51 2c 94 27 78 b7 3e f3 da 4a 71 9d fa 8d 0a 20 10 d8 5f 19 1d 54 3c 65 61 26 77 6f aa e5 2f 52 9b 4d d7 32 e6 60 72 58 b9 46 a9 fa 1a a7 14 de e2 0d 92 45 be 8c f7 63 3a f6 9b 41 df 39 ca 37 41 8e 09 ca 85 d6 f5 df f3 17 34 ee c6 46 54 cd d3 0e a1 30 ca 8d d1 40 7f a4 77 75 85 4a 49 d2 e0 42 64 dc 35 0d be 42 11 f8 68 77 fa 17 1e 9e 11 93 7d 16 6f 45 dc 86 40 de f9 4e 3d de e2 d1 99 9e 5a 24 80 29 36 f1 40 db de 8d 1f d3 95 73 05 ea 58 f5 ce a8 cf 72 d3 f5 d3 9b f6 bb 00 a7 ab a4 75 9f 25 de 96 1e 99 65 9f 49 b4 67 a8 f1 35 bf 72 75 1f 41 8b ff 3a 0e 38 31 d1 26 a7 a8 7f 22 bc 7f 65 a0 5f 0e f7 86 27 eb f3 85 12 8a 42 ac 04 92 65 Data Ascii: PKIX6%Fe
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:36:50 GMTContent-Type: application/zipContent-Length: 9891Connection: keep-aliveETag: "3914547665"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 237Expires: Mon, 22 Jul 2024 14:36:50 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72cac1db477ce4-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d 2f df fd fa 21 ed 80 77 a9 39 90 7f fa 30 d1 2f b5 c5 80 5e 25 58 2d 8f a1 ec 2e 30 28 d8 18 6d 56 50 fc 6e ec c2 5d 3d 18 63 ce 72 b7 5f 01 fc dc 41 24 ef 91 b3 a5 3c 11 42 57 ad f6 79 b8 df a4 65 32 ed 62 09 bd cf 4b 04 a0 ab 90 7b 6a 96 ae c5 f8 4f c3 d0 64 c7 78 a2 5a c5 a0 76 c7 40 5b 87 4e 4c 9d 44 55 7c 00 5f a3 f8 84 92 b2 84 31 53 a4 b9 70 e7 95 1c e8 0b 7e 50 61 9f 71 c7 d0 3e 8d fb a4 df 7d 29 24 71 b6 48 37 bb 2c 68 81 bc 8b b9 06 c1 6d 29 49 07 9d 9b 98 ee f3 61 73 d4 3c bd 54 57 1f d8 eb b5 75 dd 24 3f 88 01 a3 ac f3 e6 45 d6 e0 df bc 79 85 0b f8 fb 95 40 58 89 df b0 b9 97 de 75 87 40 11 35 b7 2a 9a dc 55 4a 85 01 4c 9c 6a 61 1e d9 e0 04 30 e5 a4 76 9d 18 5e 0a aa d1 51 88 20 28 4f 7d 6b 2b 66 77 b2 76 98 66 96 7a ec 07 62 cd 68 ef 46 45 14 1c 3c 70 6c f8 c8 4c 57 5a 49 89 ff 8e 2a 2e 34 23 16 a6 b5 ff 2c b5 58 a6 9a bb 60 3d 18 db 62 c8 b2 1f 97 65 56 85 b2 57 b6 29 57 2a 02 a6 3b fb 51 2c 94 27 78 b7 3e f3 da 4a 71 9d fa 8d 0a 20 10 d8 5f 19 1d 54 3c 65 61 26 77 6f aa e5 2f 52 9b 4d d7 32 e6 60 72 58 b9 46 a9 fa 1a a7 14 de e2 0d 92 45 be 8c f7 63 3a f6 9b 41 df 39 ca 37 41 8e 09 ca 85 d6 f5 df f3 17 34 ee c6 46 54 cd d3 0e a1 30 ca 8d d1 40 7f a4 77 75 85 4a 49 d2 e0 42 64 dc 35 0d be 42 11 f8 68 77 fa 17 1e 9e 11 93 7d 16 6f 45 dc 86 40 de f9 4e 3d de e2 d1 99 9e 5a 24 80 29 36 f1 40 db de 8d 1f d3 95 73 05 ea 58 f5 ce a8 cf 72 d3 f5 d3 9b f6 bb 00 a7 ab a4 75 9f 25 de 96 1e 99 65 9f 49 b4 67 a8 f1 35 bf 72 75 1f 41 8b ff 3a 0e 38 31 d1 26 a7 a8 7f 22 bc 7f 65 a0 5f 0e f7 86 27 eb f3 85 12 8a 42 ac 04 92 65 Data Ascii: PKIX6%Fe
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:36:51 GMTContent-Type: application/zipContent-Length: 9891Connection: keep-aliveETag: "3914547665"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 238Expires: Mon, 22 Jul 2024 14:36:51 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72cac32c1f7ce4-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d 2f df fd fa 21 ed 80 77 a9 39 90 7f fa 30 d1 2f b5 c5 80 5e 25 58 2d 8f a1 ec 2e 30 28 d8 18 6d 56 50 fc 6e ec c2 5d 3d 18 63 ce 72 b7 5f 01 fc dc 41 24 ef 91 b3 a5 3c 11 42 57 ad f6 79 b8 df a4 65 32 ed 62 09 bd cf 4b 04 a0 ab 90 7b 6a 96 ae c5 f8 4f c3 d0 64 c7 78 a2 5a c5 a0 76 c7 40 5b 87 4e 4c 9d 44 55 7c 00 5f a3 f8 84 92 b2 84 31 53 a4 b9 70 e7 95 1c e8 0b 7e 50 61 9f 71 c7 d0 3e 8d fb a4 df 7d 29 24 71 b6 48 37 bb 2c 68 81 bc 8b b9 06 c1 6d 29 49 07 9d 9b 98 ee f3 61 73 d4 3c bd 54 57 1f d8 eb b5 75 dd 24 3f 88 01 a3 ac f3 e6 45 d6 e0 df bc 79 85 0b f8 fb 95 40 58 89 df b0 b9 97 de 75 87 40 11 35 b7 2a 9a dc 55 4a 85 01 4c 9c 6a 61 1e d9 e0 04 30 e5 a4 76 9d 18 5e 0a aa d1 51 88 20 28 4f 7d 6b 2b 66 77 b2 76 98 66 96 7a ec 07 62 cd 68 ef 46 45 14 1c 3c 70 6c f8 c8 4c 57 5a 49 89 ff 8e 2a 2e 34 23 16 a6 b5 ff 2c b5 58 a6 9a bb 60 3d 18 db 62 c8 b2 1f 97 65 56 85 b2 57 b6 29 57 2a 02 a6 3b fb 51 2c 94 27 78 b7 3e f3 da 4a 71 9d fa 8d 0a 20 10 d8 5f 19 1d 54 3c 65 61 26 77 6f aa e5 2f 52 9b 4d d7 32 e6 60 72 58 b9 46 a9 fa 1a a7 14 de e2 0d 92 45 be 8c f7 63 3a f6 9b 41 df 39 ca 37 41 8e 09 ca 85 d6 f5 df f3 17 34 ee c6 46 54 cd d3 0e a1 30 ca 8d d1 40 7f a4 77 75 85 4a 49 d2 e0 42 64 dc 35 0d be 42 11 f8 68 77 fa 17 1e 9e 11 93 7d 16 6f 45 dc 86 40 de f9 4e 3d de e2 d1 99 9e 5a 24 80 29 36 f1 40 db de 8d 1f d3 95 73 05 ea 58 f5 ce a8 cf 72 d3 f5 d3 9b f6 bb 00 a7 ab a4 75 9f 25 de 96 1e 99 65 9f 49 b4 67 a8 f1 35 bf 72 75 1f 41 8b ff 3a 0e 38 31 d1 26 a7 a8 7f 22 bc 7f 65 a0 5f 0e f7 86 27 eb f3 85 12 8a 42 ac 04 92 65 Data Ascii: PKIX6%Fe
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:36:51 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 541Expires: Mon, 22 Jul 2024 14:36:51 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72cac429051875-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:36:51 GMTContent-Type: application/zipContent-Length: 9891Connection: keep-aliveETag: "3914547665"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 238Expires: Mon, 22 Jul 2024 14:36:51 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72cac4cd617ce4-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d 2f df fd fa 21 ed 80 77 a9 39 90 7f fa 30 d1 2f b5 c5 80 5e 25 58 2d 8f a1 ec 2e 30 28 d8 18 6d 56 50 fc 6e ec c2 5d 3d 18 63 ce 72 b7 5f 01 fc dc 41 24 ef 91 b3 a5 3c 11 42 57 ad f6 79 b8 df a4 65 32 ed 62 09 bd cf 4b 04 a0 ab 90 7b 6a 96 ae c5 f8 4f c3 d0 64 c7 78 a2 5a c5 a0 76 c7 40 5b 87 4e 4c 9d 44 55 7c 00 5f a3 f8 84 92 b2 84 31 53 a4 b9 70 e7 95 1c e8 0b 7e 50 61 9f 71 c7 d0 3e 8d fb a4 df 7d 29 24 71 b6 48 37 bb 2c 68 81 bc 8b b9 06 c1 6d 29 49 07 9d 9b 98 ee f3 61 73 d4 3c bd 54 57 1f d8 eb b5 75 dd 24 3f 88 01 a3 ac f3 e6 45 d6 e0 df bc 79 85 0b f8 fb 95 40 58 89 df b0 b9 97 de 75 87 40 11 35 b7 2a 9a dc 55 4a 85 01 4c 9c 6a 61 1e d9 e0 04 30 e5 a4 76 9d 18 5e 0a aa d1 51 88 20 28 4f 7d 6b 2b 66 77 b2 76 98 66 96 7a ec 07 62 cd 68 ef 46 45 14 1c 3c 70 6c f8 c8 4c 57 5a 49 89 ff 8e 2a 2e 34 23 16 a6 b5 ff 2c b5 58 a6 9a bb 60 3d 18 db 62 c8 b2 1f 97 65 56 85 b2 57 b6 29 57 2a 02 a6 3b fb 51 2c 94 27 78 b7 3e f3 da 4a 71 9d fa 8d 0a 20 10 d8 5f 19 1d 54 3c 65 61 26 77 6f aa e5 2f 52 9b 4d d7 32 e6 60 72 58 b9 46 a9 fa 1a a7 14 de e2 0d 92 45 be 8c f7 63 3a f6 9b 41 df 39 ca 37 41 8e 09 ca 85 d6 f5 df f3 17 34 ee c6 46 54 cd d3 0e a1 30 ca 8d d1 40 7f a4 77 75 85 4a 49 d2 e0 42 64 dc 35 0d be 42 11 f8 68 77 fa 17 1e 9e 11 93 7d 16 6f 45 dc 86 40 de f9 4e 3d de e2 d1 99 9e 5a 24 80 29 36 f1 40 db de 8d 1f d3 95 73 05 ea 58 f5 ce a8 cf 72 d3 f5 d3 9b f6 bb 00 a7 ab a4 75 9f 25 de 96 1e 99 65 9f 49 b4 67 a8 f1 35 bf 72 75 1f 41 8b ff 3a 0e 38 31 d1 26 a7 a8 7f 22 bc 7f 65 a0 5f 0e f7 86 27 eb f3 85 12 8a 42 ac 04 92 65 Data Ascii: PKIX6%Fe
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:36:52 GMTContent-Type: application/zipContent-Length: 9891Connection: keep-aliveETag: "3914547665"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 239Expires: Mon, 22 Jul 2024 14:36:52 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72cacabba27cf9-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d 2f df fd fa 21 ed 80 77 a9 39 90 7f fa 30 d1 2f b5 c5 80 5e 25 58 2d 8f a1 ec 2e 30 28 d8 18 6d 56 50 fc 6e ec c2 5d 3d 18 63 ce 72 b7 5f 01 fc dc 41 24 ef 91 b3 a5 3c 11 42 57 ad f6 79 b8 df a4 65 32 ed 62 09 bd cf 4b 04 a0 ab 90 7b 6a 96 ae c5 f8 4f c3 d0 64 c7 78 a2 5a c5 a0 76 c7 40 5b 87 4e 4c 9d 44 55 7c 00 5f a3 f8 84 92 b2 84 31 53 a4 b9 70 e7 95 1c e8 0b 7e 50 61 9f 71 c7 d0 3e 8d fb a4 df 7d 29 24 71 b6 48 37 bb 2c 68 81 bc 8b b9 06 c1 6d 29 49 07 9d 9b 98 ee f3 61 73 d4 3c bd 54 57 1f d8 eb b5 75 dd 24 3f 88 01 a3 ac f3 e6 45 d6 e0 df bc 79 85 0b f8 fb 95 40 58 89 df b0 b9 97 de 75 87 40 11 35 b7 2a 9a dc 55 4a 85 01 4c 9c 6a 61 1e d9 e0 04 30 e5 a4 76 9d 18 5e 0a aa d1 51 88 20 28 4f 7d 6b 2b 66 77 b2 76 98 66 96 7a ec 07 62 cd 68 ef 46 45 14 1c 3c 70 6c f8 c8 4c 57 5a 49 89 ff 8e 2a 2e 34 23 16 a6 b5 ff 2c b5 58 a6 9a bb 60 3d 18 db 62 c8 b2 1f 97 65 56 85 b2 57 b6 29 57 2a 02 a6 3b fb 51 2c 94 27 78 b7 3e f3 da 4a 71 9d fa 8d 0a 20 10 d8 5f 19 1d 54 3c 65 61 26 77 6f aa e5 2f 52 9b 4d d7 32 e6 60 72 58 b9 46 a9 fa 1a a7 14 de e2 0d 92 45 be 8c f7 63 3a f6 9b 41 df 39 ca 37 41 8e 09 ca 85 d6 f5 df f3 17 34 ee c6 46 54 cd d3 0e a1 30 ca 8d d1 40 7f a4 77 75 85 4a 49 d2 e0 42 64 dc 35 0d be 42 11 f8 68 77 fa 17 1e 9e 11 93 7d 16 6f 45 dc 86 40 de f9 4e 3d de e2 d1 99 9e 5a 24 80 29 36 f1 40 db de 8d 1f d3 95 73 05 ea 58 f5 ce a8 cf 72 d3 f5 d3 9b f6 bb 00 a7 ab a4 75 9f 25 de 96 1e 99 65 9f 49 b4 67 a8 f1 35 bf 72 75 1f 41 8b ff 3a 0e 38 31 d1 26 a7 a8 7f 22 bc 7f 65 a0 5f 0e f7 86 27 eb f3 85 12 8a 42 ac 04 92 65 Data Ascii: PKIX6%Fe
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:36:52 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 542Expires: Mon, 22 Jul 2024 14:36:52 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72cacabf840f9c-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:36:52 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 542Expires: Mon, 22 Jul 2024 14:36:52 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72cacc28570f9c-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:36:52 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 542Expires: Mon, 22 Jul 2024 14:36:52 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72cacc28570f9c-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:36:53 GMTContent-Type: application/zipContent-Length: 9891Connection: keep-aliveETag: "3914547665"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 240Expires: Mon, 22 Jul 2024 14:36:53 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72cad1bc3372a5-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d 2f df fd fa 21 ed 80 77 a9 39 90 7f fa 30 d1 2f b5 c5 80 5e 25 58 2d 8f a1 ec 2e 30 28 d8 18 6d 56 50 fc 6e ec c2 5d 3d 18 63 ce 72 b7 5f 01 fc dc 41 24 ef 91 b3 a5 3c 11 42 57 ad f6 79 b8 df a4 65 32 ed 62 09 bd cf 4b 04 a0 ab 90 7b 6a 96 ae c5 f8 4f c3 d0 64 c7 78 a2 5a c5 a0 76 c7 40 5b 87 4e 4c 9d 44 55 7c 00 5f a3 f8 84 92 b2 84 31 53 a4 b9 70 e7 95 1c e8 0b 7e 50 61 9f 71 c7 d0 3e 8d fb a4 df 7d 29 24 71 b6 48 37 bb 2c 68 81 bc 8b b9 06 c1 6d 29 49 07 9d 9b 98 ee f3 61 73 d4 3c bd 54 57 1f d8 eb b5 75 dd 24 3f 88 01 a3 ac f3 e6 45 d6 e0 df bc 79 85 0b f8 fb 95 40 58 89 df b0 b9 97 de 75 87 40 11 35 b7 2a 9a dc 55 4a 85 01 4c 9c 6a 61 1e d9 e0 04 30 e5 a4 76 9d 18 5e 0a aa d1 51 88 20 28 4f 7d 6b 2b 66 77 b2 76 98 66 96 7a ec 07 62 cd 68 ef 46 45 14 1c 3c 70 6c f8 c8 4c 57 5a 49 89 ff 8e 2a 2e 34 23 16 a6 b5 ff 2c b5 58 a6 9a bb 60 3d 18 db 62 c8 b2 1f 97 65 56 85 b2 57 b6 29 57 2a 02 a6 3b fb 51 2c 94 27 78 b7 3e f3 da 4a 71 9d fa 8d 0a 20 10 d8 5f 19 1d 54 3c 65 61 26 77 6f aa e5 2f 52 9b 4d d7 32 e6 60 72 58 b9 46 a9 fa 1a a7 14 de e2 0d 92 45 be 8c f7 63 3a f6 9b 41 df 39 ca 37 41 8e 09 ca 85 d6 f5 df f3 17 34 ee c6 46 54 cd d3 0e a1 30 ca 8d d1 40 7f a4 77 75 85 4a 49 d2 e0 42 64 dc 35 0d be 42 11 f8 68 77 fa 17 1e 9e 11 93 7d 16 6f 45 dc 86 40 de f9 4e 3d de e2 d1 99 9e 5a 24 80 29 36 f1 40 db de 8d 1f d3 95 73 05 ea 58 f5 ce a8 cf 72 d3 f5 d3 9b f6 bb 00 a7 ab a4 75 9f 25 de 96 1e 99 65 9f 49 b4 67 a8 f1 35 bf 72 75 1f 41 8b ff 3a 0e 38 31 d1 26 a7 a8 7f 22 bc 7f 65 a0 5f 0e f7 86 27 eb f3 85 12 8a 42 ac 04 92 65 Data Ascii: PKIX6%Fe
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:36:53 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 543Expires: Mon, 22 Jul 2024 14:36:53 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72cad40bc9b9c5-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jul 2024 10:36:55 GMTContent-Type: application/zipContent-Length: 17770Connection: keep-aliveETag: "770472110"Last-Modified: Tue, 11 Jun 2024 17:24:23 GMTCF-Cache-Status: HITAge: 545Expires: Mon, 22 Jul 2024 14:36:55 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 8a72cae1197e42b5-EWRData Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 79 37 13 18 7e 02 86 25 57 3f 1b 37 21 4a ab c5 68 8c 72 66 a5 c6 64 42 aa 5e 4f 51 22 9e 49 44 47 c4 05 fd fd 21 6f de 2b 89 5e 36 1c 56 1d 12 bb 59 b6 a7 36 8c 10 be 3c fc c8 ea f7 dc 77 fa 4e 0e 4e 08 c3 50 a2 b7 50 32 80 d6 b2 f9 5c 81 3f df 97 ff fc a6 9f 45 cd 59 00 5e 98 6a df a0 06 ac b4 8d c3 05 3e 69 fe 5b 98 70 60 8f 4c 5f fd 1a a8 73 c7 58 71 98 3e 23 7e d1 c3 6e 59 e4 0f a4 f7 d3 3e 4c e3 4f 39 72 87 ff 83 a9 73 41 9e 99 53 81 2b cb 67 9b 35 1e 46 42 14 19 69 ee ad 71 99 c1 67 9d 55 66 ea 7b bb 12 2a 76 c9 42 55 a8 07 42 71 e0 cd 0a f9 54 70 b6 f9 f6 4b fe 46 3b 2f 85 ac db 06 cb f7 d9 af bf 5b bd 26 57 49 41 50 d9 de 75 fa 53 8e cb 2d 26 76 a7 33 d8 21 f9 c2 e0 59 27 05 62 4d ce b7 e8 6c 88 e0 d1 7b 5b 3a 98 d6 35 a5 73 90 97 56 0e 85 00 4c 33 01 6f 6d de c2 bd a5 fb c1 fb 09 0e 37 bf 27 e3 b3 aa 4f 34 de 27 28 56 23 ea c3 e5 a0 3a 5c 95 0f d6 d0 03 00 ef 84 23 01 15 f9 e4 c8 56 85 4f c0 4f 26 3c 00 c0 b2 73 84 7d 59 e1 64 f7 7c 18 c0 3c 50 e5 0e b3 40 03 da 8c 8e 6a 89 4d 25 c8 4f 08 08 35 f2 9a fc 1e db 6c 48 01 73 5e 53 59 66 61 b1 8c 43 44 44 9b 96 ed 15 77 9e 19 56 18 a0 7f de 89 ba 1f 0f 13 63 45 f4 38 16 7e 63 45 54 4c d2 cb 30 83 59 d8 49 45 64 40 87 9d 2e d1 5f 50 df 85 51 86 fa 7e 77 c6 07 5c 66 41 b8 54 85 a2 a7 c1 37 4b e5 89 69 b4 de 79 77 71 7c d4 f8 fd 7f e1 14 dd c8 2b 1d 23 09 94 db 5d e5 a6 4e 9e 9e c3 88 e9 97 82 19 02 22 9d 3e 86 28 b0 89 41 10 9e f7 ac 30 b5 62 1d 55 2d a1 6c 9d 44 d4 81 ec 4d 23 ae 45 54 98 13 91 0a 59 61 ba db 8a dd 10 2d 68 d7 12 7d aa 65 f0 70 95 8e ae 3c 29 c4 c0 fd 2c Data Ascii: PK:=AX7\0DrAc
            Source: global trafficHTTP traffic detected: GET /offer.php?v=1&c=2021a HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: offers.filezilla-project.orgConnection: Keep-AliveCache-Control: no-cache
            Source: global trafficHTTP traffic detected: GET /get.php?offer=2021a HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: offers.filezilla-project.orgConnection: Keep-AliveCache-Control: no-cache
            Source: global trafficHTTP traffic detected: GET /nano_download.php?partner=FZ210427 HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Connection: Keep-AliveCache-Control: no-cacheHost: webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/dci/latest/Webprotection.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /api/v2/url/permanentwhitelist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /permanentUrlWhitelist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /api/v2/url/permanentwhitelist HTTP/1.1Host: acs.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/permanentwhitelist HTTP/1.1Host: acs.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /permanentUrlWhitelist.json HTTP/1.1Host: acscdn.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/permanentwhitelist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/permanentwhitelist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /permanentUrlWhitelist.json HTTP/1.1Host: acscdn.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /permanentUrlWhitelist.json HTTP/1.1Host: acscdn.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/permanentwhitelist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /permanentUrlWhitelist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/permanentwhitelist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /permanentUrlWhitelist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/permanentwhitelist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/permanentwhitelist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /permanentUrlWhitelist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/permanentwhitelist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /permanentUrlWhitelist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /permanentUrlWhitelist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/permanentwhitelist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/permanentwhitelist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /permanentUrlWhitelist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/permanentwhitelist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/permanentwhitelist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /permanentUrlWhitelist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /permanentUrlWhitelist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /urlblacklist.json HTTP/1.1Host: acscdn.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /api/v2/url/permanentwhitelist HTTP/1.1Host: acs.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /api/v2/url/permanentwhitelist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /api/v2/url/blacklist HTTP/1.1Host: acs.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /9.1.0.993/WebCompanion-9.1.0.993-prod.zip HTTP/1.1Host: wcdownloadercdn.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /Partner.svc/GetPartnerInfo?partner=FZ210427 HTTP/1.1Host: wc-partners.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /Partner.svc/GetPartnerInfo?partner=FZ210427_wb HTTP/1.1Host: wc-partners.lavasoft.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /Partner.svc/GetPartnerInfo?partner=FZ210427_ab HTTP/1.1Host: wc-partners.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /Partner.svc/GetPartnerInfo?partner=FZ210427_ac HTTP/1.1Host: wc-partners.lavasoft.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /version_logs?json=true&version=9.1.0.993 HTTP/1.1Host: webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /version_logs?json=true&version=9.1.0.993 HTTP/1.1Host: webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /version_logs?json=true&version=9.1.0.993 HTTP/1.1Host: webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/v1/searchengine_v1.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: global trafficHTTP traffic detected: GET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1Host: rt.webcompanion.com
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: <td align="right" width="24"><a target="_blank" href="https://www.facebook.com/lavasoft.adaware"><img src="http://webcompanion.com/images/email/fb-icon.png" width="16" height="16" alt="fb" style="display:block;border:0;" /></a></td> equals www.facebook.com (Facebook)
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: }}uNon elevated process completed for enableEnterprisePolicy.'C:\ffLanguages.json3Search from user config: 9Search from firefox config: +http://www.google.com1http://www.microsoft.com/http://www.facebook.comstop equals www.facebook.com (Facebook)
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: SET NEW TAB$SET DEFAULT SEARCH SET WELCOME PAGE&SET EXSTENSION SIGN&SearchProtectLogger*http://www.yahoo.com/0http://search.yahoo.com/ https://www.{0}/*http://www.naver.com/*http://www.baidu.com/(http://www.bing.com/0http://www.facebook.com/2http://www.pinterest.com/*http://www.yandex.ru/.http://www.youtube.com/(https://twitter.com/Dhttp://securedsearch.lavasoft.com/Dhttps://privatesearch.adaware.com/2https://adaware.start.me/ equals www.facebook.com (Facebook)
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: SET NEW TAB$SET DEFAULT SEARCH SET WELCOME PAGE&SET EXSTENSION SIGN&SearchProtectLogger*http://www.yahoo.com/0http://search.yahoo.com/ https://www.{0}/*http://www.naver.com/*http://www.baidu.com/(http://www.bing.com/0http://www.facebook.com/2http://www.pinterest.com/*http://www.yandex.ru/.http://www.youtube.com/(https://twitter.com/Dhttp://securedsearch.lavasoft.com/Dhttps://privatesearch.adaware.com/2https://adaware.start.me/ equals www.twitter.com (Twitter)
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: SET NEW TAB$SET DEFAULT SEARCH SET WELCOME PAGE&SET EXSTENSION SIGN&SearchProtectLogger*http://www.yahoo.com/0http://search.yahoo.com/ https://www.{0}/*http://www.naver.com/*http://www.baidu.com/(http://www.bing.com/0http://www.facebook.com/2http://www.pinterest.com/*http://www.yandex.ru/.http://www.youtube.com/(https://twitter.com/Dhttp://securedsearch.lavasoft.com/Dhttps://privatesearch.adaware.com/2https://adaware.start.me/ equals www.yahoo.com (Yahoo)
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: SET NEW TAB$SET DEFAULT SEARCH SET WELCOME PAGE&SET EXSTENSION SIGN&SearchProtectLogger*http://www.yahoo.com/0http://search.yahoo.com/ https://www.{0}/*http://www.naver.com/*http://www.baidu.com/(http://www.bing.com/0http://www.facebook.com/2http://www.pinterest.com/*http://www.yandex.ru/.http://www.youtube.com/(https://twitter.com/Dhttp://securedsearch.lavasoft.com/Dhttps://privatesearch.adaware.com/2https://adaware.start.me/ equals www.youtube.com (Youtube)
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: TwitterVisitUrl)http://lavasoft.com/ahttps://www.facebook.com/sharer/sharer.php?u={0}/http://webcompanion.comiWeb Companion. A safer, cleaner browsing experience.Shttps://www.facebook.com/officialadaware/Khttps://plus.google.com/share?url={0}yhttps://plus.google.com/u/0/b/116438965069860868108/+adawareahttp://twitter.com/intent/tweet?text={1}&url={0}Ghttps://twitter.com/officialadawarek/WebCompanion;component/ui/views/featurelistview.xaml equals www.facebook.com (Facebook)
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: TwitterVisitUrl)http://lavasoft.com/ahttps://www.facebook.com/sharer/sharer.php?u={0}/http://webcompanion.comiWeb Companion. A safer, cleaner browsing experience.Shttps://www.facebook.com/officialadaware/Khttps://plus.google.com/share?url={0}yhttps://plus.google.com/u/0/b/116438965069860868108/+adawareahttp://twitter.com/intent/tweet?text={1}&url={0}Ghttps://twitter.com/officialadawarek/WebCompanion;component/ui/views/featurelistview.xaml equals www.twitter.com (Twitter)
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: `https://www.facebook.com/sharer/sharer.php?u={0}Rhttps://www.facebook.com/officialadaware/Jhttps://plus.google.com/share?url={0}xhttps://plus.google.com/u/0/b/116438965069860868108/+adawarehWeb Companion. A safer, cleaner browsing experience..http://webcompanion.com`http://twitter.com/intent/tweet?text={1}&url={0}Fhttps://twitter.com/officialadaware equals www.facebook.com (Facebook)
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: `https://www.facebook.com/sharer/sharer.php?u={0}Rhttps://www.facebook.com/officialadaware/Jhttps://plus.google.com/share?url={0}xhttps://plus.google.com/u/0/b/116438965069860868108/+adawarehWeb Companion. A safer, cleaner browsing experience..http://webcompanion.com`http://twitter.com/intent/tweet?text={1}&url={0}Fhttps://twitter.com/officialadaware equals www.twitter.com (Twitter)
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: bing searchEhttps://www.bing.com/chrome/newtab+https://us.yahoo.com/ equals www.yahoo.com (Yahoo)
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: yahoo.com+http://www.yahoo.com/ equals www.yahoo.com (Yahoo)
            Source: global trafficDNS traffic detected: DNS query: offers.filezilla-project.org
            Source: global trafficDNS traffic detected: DNS query: webcompanion.com
            Source: global trafficDNS traffic detected: DNS query: flow.lavasoft.com
            Source: global trafficDNS traffic detected: DNS query: wc-update-service.lavasoft.com
            Source: global trafficDNS traffic detected: DNS query: wcdownloadercdn.lavasoft.com
            Source: global trafficDNS traffic detected: DNS query: rt.webcompanion.com
            Source: global trafficDNS traffic detected: DNS query: update.filezilla-project.org
            Source: global trafficDNS traffic detected: DNS query: acs.lavasoft.com
            Source: global trafficDNS traffic detected: DNS query: acscdn.lavasoft.com
            Source: global trafficDNS traffic detected: DNS query: wc-partners.lavasoft.com
            Source: global trafficDNS traffic detected: DNS query: ocsp.entrust.net
            Source: global trafficDNS traffic detected: DNS query: crl.entrust.net
            Source: global trafficDNS traffic detected: DNS query: wsgeoip.lavasoft.com
            Source: global trafficDNS traffic detected: DNS query: www.google.com
            Source: unknownHTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 364Connection: Keep-Alive
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmp, WebCompanion.exe, 00000028.00000002.2589134775.00000000065A2000.00000002.00000001.01000000.0000003D.sdmpString found in binary or memory: http://10.45.0.17:8341/api/v1/activeFeatures/filter/partnerId/
            Source: WebCompanion.exe, 00000028.00000002.2589134775.00000000065A2000.00000002.00000001.01000000.0000003D.sdmpString found in binary or memory: http://10.45.0.17:8351/notification-trigger-service/api/v1?partner=
            Source: WebCompanion.exe, 00000028.00000002.2589134775.00000000065A2000.00000002.00000001.01000000.0000003D.sdmpString found in binary or memory: http://10.45.0.17:8351/notification-trigger-service/api/v1?partner=H2OAutoUpdateTesting&trigger=Chro
            Source: WebCompanion.exe, 00000028.00000002.2589134775.00000000065A2000.00000002.00000001.01000000.0000003D.sdmpString found in binary or memory: http://10.45.0.17:8351/notification-trigger-service/api/v1?partner=H2OAutoUpdateTesting&trigger=Fire
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: http://a9.com/-/spec/opensearch/1.1/
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: http://ac.search.naver.com/autocompl?m=s&amp;ie=
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: http://ac.search.naver.com/autocompl?m=s&ie=
            Source: WebCompanion.exe, 00000028.00000002.2581040314.0000000003CB9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ad-blocker-update-service.lavasoft.com/update.asmx
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: http://adaware.com/browser/ff/index.phpSInitializing
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2214412258.00000000055B8000.00000004.00000020.00020000.00000000.sdmp, FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000003.1961222518.00000000055BA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://aia.en
            Source: WcInstaller.exe, 00000002.00000003.1867085226.00000000005D0000.00000004.00001000.00020000.00000000.sdmp, WcInstaller.exe, 00000002.00000003.1866843878.00000000021C3000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000028.00000002.2580296945.0000000001BFF000.00000004.00000020.00020000.00000000.sdmp, WebCompanionInstaller.resources.dll0.3.dr, Lavasoft.WCAssistant.Service.Logger.dll.3.drString found in binary or memory: http://aia.entrust.net/evcs2-chain.p7c01
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://barnamenevis.org/forum/showthread.php?t=207094
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, libpng16-16.dll.0.dr, WebCompanionInstaller.resources.dll0.3.dr, Lavasoft.WCAssistant.Service.Logger.dll.3.dr, nsxF7D6.tmp.0.drString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, libpng16-16.dll.0.dr, WebCompanionInstaller.resources.dll0.3.dr, Lavasoft.WCAssistant.Service.Logger.dll.3.dr, nsxF7D6.tmp.0.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
            Source: WebCompanion.exe, 00000028.00000002.2588730057.0000000006420000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRoo
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, libpng16-16.dll.0.dr, WebCompanionInstaller.resources.dll0.3.dr, Lavasoft.WCAssistant.Service.Logger.dll.3.dr, nsxF7D6.tmp.0.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, libpng16-16.dll.0.dr, nsxF7D6.tmp.0.drString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, libpng16-16.dll.0.dr, nsxF7D6.tmp.0.drString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
            Source: WcInstaller.exe, 00000002.00000003.1867085226.00000000005D0000.00000004.00001000.00020000.00000000.sdmp, WcInstaller.exe, 00000002.00000003.1866843878.00000000021C3000.00000004.00000020.00020000.00000000.sdmp, WebCompanionInstaller.resources.dll0.3.dr, Lavasoft.WCAssistant.Service.Logger.dll.3.drString found in binary or memory: http://crl.entrust.net/csbr1.crl0
            Source: WcInstaller.exe, 00000002.00000003.1867085226.00000000005D0000.00000004.00001000.00020000.00000000.sdmp, WcInstaller.exe, 00000002.00000003.1866843878.00000000021C3000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000028.00000002.2580296945.0000000001BFF000.00000004.00000020.00020000.00000000.sdmp, WebCompanionInstaller.resources.dll0.3.dr, Lavasoft.WCAssistant.Service.Logger.dll.3.drString found in binary or memory: http://crl.entrust.net/evcs2.crl0
            Source: WcInstaller.exe, 00000002.00000003.1867085226.00000000005D0000.00000004.00001000.00020000.00000000.sdmp, WcInstaller.exe, 00000002.00000003.1866843878.00000000021C3000.00000004.00000020.00020000.00000000.sdmp, WebCompanionInstaller.resources.dll0.3.dr, Lavasoft.WCAssistant.Service.Logger.dll.3.drString found in binary or memory: http://crl.entrust.net/g2ca.crl0
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, libpng16-16.dll.0.dr, nsxF7D6.tmp.0.drString found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, libpng16-16.dll.0.dr, nsxF7D6.tmp.0.drString found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
            Source: WebCompanion.exe, 00000028.00000002.2588730057.0000000006420000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.c
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, libpng16-16.dll.0.dr, WebCompanionInstaller.resources.dll0.3.dr, Lavasoft.WCAssistant.Service.Logger.dll.3.dr, nsxF7D6.tmp.0.drString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, libpng16-16.dll.0.dr, WebCompanionInstaller.resources.dll0.3.dr, Lavasoft.WCAssistant.Service.Logger.dll.3.dr, nsxF7D6.tmp.0.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, libpng16-16.dll.0.dr, WebCompanionInstaller.resources.dll0.3.dr, Lavasoft.WCAssistant.Service.Logger.dll.3.dr, nsxF7D6.tmp.0.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, libpng16-16.dll.0.dr, nsxF7D6.tmp.0.drString found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, libpng16-16.dll.0.dr, nsxF7D6.tmp.0.drString found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: http://em.lavasoft.com/subscribe/profile?f=21&amp;id=
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: http://ext.adaware.com/ss/new-tab-may.xpi
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: http://ext.adaware.com/ss/new-tab-may.xpi(FirefoxNtPostInstall2InstallFFRegistrySideload
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmp, WebCompanion.exe, 00000028.00000002.2589134775.00000000065A2000.00000002.00000001.01000000.0000003D.sdmpString found in binary or memory: http://ext.adaware.com/ss/newtab-omni.xpi
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: http://extservice.adaware.com/extension5Inside
            Source: WebCompanion.exe, 00000028.00000002.2581040314.0000000003CB9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://feedback-service.lavasoft.com/feedback.asmx
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://filezilla-project.org/probe.php
            Source: WcInstaller.exe, 00000002.00000003.1867085226.00000000005D0000.00000004.00001000.00020000.00000000.sdmp, WcInstaller.exe, 00000002.00000003.1866843878.00000000021C3000.00000004.00000020.00020000.00000000.sdmp, WebCompanionInstaller.exe, 00000003.00000000.1867314648.0000000000782000.00000002.00000001.01000000.0000000F.sdmp, WebCompanion.exe, 00000028.00000002.2590522947.0000000006AC2000.00000002.00000001.01000000.0000003F.sdmpString found in binary or memory: http://flow.lavasoft.com/v1/event-stat-wc
            Source: WcInstaller.exe, 00000002.00000003.1867085226.00000000005D0000.00000004.00001000.00020000.00000000.sdmp, WcInstaller.exe, 00000002.00000003.1866843878.00000000021C3000.00000004.00000020.00020000.00000000.sdmp, WebCompanionInstaller.exe, 00000003.00000000.1867314648.0000000000782000.00000002.00000001.01000000.0000000F.sdmpString found in binary or memory: http://flow.lavasoft.com/v1/event-stat-wclhttp://staging-cloudflow.lavasoft.net/v1/event-stat-wc
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: http://gossip.ca.yahoo.com/gossip-ca-sayt?output=fxjsonp&command=
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: http://in.adaware.com/wc/extension_install.php?exiturl=aHR0cDovL3d3dy53ZWJjb21wYW5pb24uY29t&utm_camp
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: http://in.adaware.com/wc/extension_install.php?exiturl=aHR0cDovL3dlYmNvbXBhbmlvbi5jb20vaW5zdGFsbC5wa
            Source: filezilla.mo5.0.dr, nsxF7D6.tmp.0.drString found in binary or memory: http://ip.filezilla-project.org/ip.php
            Source: filezilla.exe, 0000000E.00000000.2187422221.00007FF71ED77000.00000002.00000001.01000000.00000018.sdmp, nsxF7D6.tmp.0.drString found in binary or memory: http://ip.filezilla-project.org/ip.php&Don
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ip.filezilla-project.org/ip.phpA
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ip.filezilla-project.org/ip.phpAizkavei
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ip.filezilla-project.org/ip.phpAjavahemik
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ip.filezilla-project.org/ip.phpAmen
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ip.filezilla-project.org/ip.phpBa
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmp, filezilla.mo5.0.drString found in binary or memory: http://ip.filezilla-project.org/ip.phpDelay
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ip.filezilla-project.org/ip.phpDie
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ip.filezilla-project.org/ip.phpEl
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ip.filezilla-project.org/ip.phpEp
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ip.filezilla-project.org/ip.phpEy
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ip.filezilla-project.org/ip.phpF
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ip.filezilla-project.org/ip.phpForsinkelse
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ip.filezilla-project.org/ip.phpForsinkelsen
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ip.filezilla-project.org/ip.phpHuts
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ip.filezilla-project.org/ip.phpIl
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ip.filezilla-project.org/ip.phpInterval
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ip.filezilla-project.org/ip.phpIntervalul
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ip.filezilla-project.org/ip.phpKeterlambatan
            Source: nsxF7D6.tmp.0.drString found in binary or memory: http://ip.filezilla-project.org/ip.phpLast
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ip.filezilla-project.org/ip.phpLe
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ip.filezilla-project.org/ip.phpO
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ip.filezilla-project.org/ip.phpPremor
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ip.filezilla-project.org/ip.phpRhaid
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ip.filezilla-project.org/ip.phpTh
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmp, filezilla.mo34.0.dr, filezilla.mo5.0.drString found in binary or memory: http://ip.filezilla-project.org/ip.phpU
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ip.filezilla-project.org/ip.phpZadr
            Source: WebCompanion.exe, 00000028.00000002.2591364130.0000000006C62000.00000002.00000001.01000000.00000040.sdmpString found in binary or memory: http://james.newtonking.com/projects/json
            Source: csc.exe, 0000002F.00000002.2689512097.0000000000541000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lavasoft.com/
            Source: csc.exe, 00000029.00000002.2643482070.0000000000465000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lavasoft.com/:GetCountryNameByISO2Result
            Source: csc.exe, 00000029.00000002.2643482070.0000000000465000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lavasoft.com/:GetIpLocation_2_0Response
            Source: csc.exe, 00000029.00000002.2643482070.0000000000465000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lavasoft.com/:GetIpLocation_2_0Result
            Source: csc.exe, 00000029.00000002.2643482070.0000000000465000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lavasoft.com/:iso2Code
            Source: WcInstaller.exe, 00000002.00000003.1867085226.00000000005D0000.00000004.00001000.00020000.00000000.sdmp, WcInstaller.exe, 00000002.00000003.1866843878.00000000021C3000.00000004.00000020.00020000.00000000.sdmp, WebCompanionInstaller.exe, 00000003.00000000.1867314648.0000000000782000.00000002.00000001.01000000.0000000F.sdmp, WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: http://lavasoft.com/GetCountryISO2ByNameT
            Source: WcInstaller.exe, 00000002.00000003.1867085226.00000000005D0000.00000004.00001000.00020000.00000000.sdmp, WcInstaller.exe, 00000002.00000003.1866843878.00000000021C3000.00000004.00000020.00020000.00000000.sdmp, WebCompanionInstaller.exe, 00000003.00000000.1867314648.0000000000782000.00000002.00000001.01000000.0000000F.sdmp, WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: http://lavasoft.com/GetCountryNameByISO2T
            Source: WcInstaller.exe, 00000002.00000003.1867085226.00000000005D0000.00000004.00001000.00020000.00000000.sdmp, WcInstaller.exe, 00000002.00000003.1866843878.00000000021C3000.00000004.00000020.00020000.00000000.sdmp, WebCompanionInstaller.exe, 00000003.00000000.1867314648.0000000000782000.00000002.00000001.01000000.0000000F.sdmp, WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: http://lavasoft.com/GetIpLocationT
            Source: WcInstaller.exe, 00000002.00000003.1867085226.00000000005D0000.00000004.00001000.00020000.00000000.sdmp, WcInstaller.exe, 00000002.00000003.1866843878.00000000021C3000.00000004.00000020.00020000.00000000.sdmp, WebCompanionInstaller.exe, 00000003.00000000.1867314648.0000000000782000.00000002.00000001.01000000.0000000F.sdmp, WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: http://lavasoft.com/GetIpLocation_2_0T
            Source: WcInstaller.exe, 00000002.00000003.1867085226.00000000005D0000.00000004.00001000.00020000.00000000.sdmp, WcInstaller.exe, 00000002.00000003.1866843878.00000000021C3000.00000004.00000020.00020000.00000000.sdmp, WebCompanionInstaller.exe, 00000003.00000000.1867314648.0000000000782000.00000002.00000001.01000000.0000000F.sdmp, WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: http://lavasoft.com/GetLocationT
            Source: WcInstaller.exe, 00000002.00000003.1867085226.00000000005D0000.00000004.00001000.00020000.00000000.sdmp, WcInstaller.exe, 00000002.00000003.1866843878.00000000021C3000.00000004.00000020.00020000.00000000.sdmp, WebCompanionInstaller.exe, 00000003.00000000.1867314648.0000000000782000.00000002.00000001.01000000.0000000F.sdmp, WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: http://lavasoft.com/T
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: http://lavasoft.com?utm_source=wc&utm_medium=wc&utm_campaign=wcIhttp://webcompanion.com/version_logs
            Source: WebCompanion.exe, 00000028.00000002.2585618453.0000000006042000.00000002.00000001.01000000.0000003C.sdmpString found in binary or memory: http://logging.apache.org/log4net/release/faq.html#trouble-EventLog
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: http://mozilla.org/MPL/2.0/.
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: http://mysearchengine.co
            Source: FileZilla_3.67.1_win64_sponsored-setup.exeString found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, libpng16-16.dll.0.dr, nsxF7D6.tmp.0.drString found in binary or memory: http://ocsp.comodoca.com0
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, libpng16-16.dll.0.dr, WebCompanionInstaller.resources.dll0.3.dr, Lavasoft.WCAssistant.Service.Logger.dll.3.dr, nsxF7D6.tmp.0.drString found in binary or memory: http://ocsp.digicert.com0A
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, libpng16-16.dll.0.dr, WebCompanionInstaller.resources.dll0.3.dr, Lavasoft.WCAssistant.Service.Logger.dll.3.dr, nsxF7D6.tmp.0.drString found in binary or memory: http://ocsp.digicert.com0C
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, libpng16-16.dll.0.dr, WebCompanionInstaller.resources.dll0.3.dr, Lavasoft.WCAssistant.Service.Logger.dll.3.dr, nsxF7D6.tmp.0.drString found in binary or memory: http://ocsp.digicert.com0X
            Source: A37B8BA80004D3266CB4D93B2052DC10_EBDB5A7037F08CDFB408DBFC0D44B43D.34.drString found in binary or memory: http://ocsp.entrust.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTLXNCzDvBhHecWjg70iJhBW0InywQUanImetAe733nO2lR
            Source: WcInstaller.exe, 00000002.00000003.1867085226.00000000005D0000.00000004.00001000.00020000.00000000.sdmp, WcInstaller.exe, 00000002.00000003.1866843878.00000000021C3000.00000004.00000020.00020000.00000000.sdmp, WebCompanionInstaller.resources.dll0.3.dr, Lavasoft.WCAssistant.Service.Logger.dll.3.drString found in binary or memory: http://ocsp.entrust.net00
            Source: WcInstaller.exe, 00000002.00000003.1867085226.00000000005D0000.00000004.00001000.00020000.00000000.sdmp, WcInstaller.exe, 00000002.00000003.1866843878.00000000021C3000.00000004.00000020.00020000.00000000.sdmp, WebCompanionInstaller.resources.dll0.3.dr, Lavasoft.WCAssistant.Service.Logger.dll.3.drString found in binary or memory: http://ocsp.entrust.net01
            Source: WcInstaller.exe, 00000002.00000003.1867085226.00000000005D0000.00000004.00001000.00020000.00000000.sdmp, WcInstaller.exe, 00000002.00000003.1866843878.00000000021C3000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000028.00000002.2580296945.0000000001BFF000.00000004.00000020.00020000.00000000.sdmp, WebCompanionInstaller.resources.dll0.3.dr, Lavasoft.WCAssistant.Service.Logger.dll.3.drString found in binary or memory: http://ocsp.entrust.net02
            Source: nsxF7D6.tmp.0.drString found in binary or memory: http://ocsp.sectigo.com0
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: http://openapi.naver.com/)
            Source: WebCompanion.exe, 00000028.00000002.2581040314.0000000003BE1000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000028.00000002.2589134775.00000000065A2000.00000002.00000001.01000000.0000003D.sdmpString found in binary or memory: http://pp.webcompanion.com/notifications/download/rt/ActiveFeatures.zip
            Source: WebCompanion.exe, 00000028.00000002.2589134775.00000000065A2000.00000002.00000001.01000000.0000003D.sdmpString found in binary or memory: http://pp.webcompanion.com/notifications/download/rt/Silverlight_x64.exe
            Source: WebCompanion.exe, 00000028.00000002.2589134775.00000000065A2000.00000002.00000001.01000000.0000003D.sdmpString found in binary or memory: http://pp.webcompanion.com/notifications/download/rt/aabrowser.zip
            Source: WebCompanion.exe, 00000028.00000002.2589134775.00000000065A2000.00000002.00000001.01000000.0000003D.sdmpString found in binary or memory: http://pp.webcompanion.com/notifications/download/rt/chbrowser.exe
            Source: WebCompanion.exe, 00000028.00000002.2589134775.00000000065A2000.00000002.00000001.01000000.0000003D.sdmpString found in binary or memory: http://rt.webcompanion.com/notifications/download/rt/ActiveFeatures.zip
            Source: WebCompanion.exe, 00000028.00000002.2581040314.0000000003BE1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://rt.webcompanion.com/notifications/download/rt/ActiveFeatures.zipH
            Source: WebCompanion.exe, 00000028.00000002.2589134775.00000000065A2000.00000002.00000001.01000000.0000003D.sdmpString found in binary or memory: http://rt.webcompanion.com/notifications/download/rt/FeatureActions.zip
            Source: WebCompanion.exe, 00000028.00000002.2589134775.00000000065A2000.00000002.00000001.01000000.0000003D.sdmpString found in binary or memory: http://rt.webcompanion.com/notifications/download/rt/HomepageFilter.zip
            Source: WebCompanion.exe, 00000028.00000002.2589134775.00000000065A2000.00000002.00000001.01000000.0000003D.sdmpString found in binary or memory: http://rt.webcompanion.com/notifications/download/rt/IEBhoHelper.exe
            Source: WebCompanion.exe, 00000028.00000002.2589134775.00000000065A2000.00000002.00000001.01000000.0000003D.sdmpString found in binary or memory: http://rt.webcompanion.com/notifications/download/rt/IEBhoHelperTest.exe
            Source: WebCompanion.exe, 00000028.00000002.2589134775.00000000065A2000.00000002.00000001.01000000.0000003D.sdmpString found in binary or memory: http://rt.webcompanion.com/notifications/download/rt/IESPHelper.exe
            Source: WebCompanion.exe, 00000028.00000002.2589134775.00000000065A2000.00000002.00000001.01000000.0000003D.sdmpString found in binary or memory: http://rt.webcompanion.com/notifications/download/rt/Silverlight_x64.exe
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: http://rt.webcompanion.com/notifications/download/rt/Waterfoxsetup.exe
            Source: WebCompanion.exe, 00000028.00000002.2589134775.00000000065A2000.00000002.00000001.01000000.0000003D.sdmpString found in binary or memory: http://rt.webcompanion.com/notifications/download/rt/aabrowser.zip
            Source: WebCompanion.exe, 00000028.00000002.2589134775.00000000065A2000.00000002.00000001.01000000.0000003D.sdmpString found in binary or memory: http://rt.webcompanion.com/notifications/download/rt/adblocker.zip
            Source: WebCompanion.exe, 00000028.00000002.2589134775.00000000065A2000.00000002.00000001.01000000.0000003D.sdmpString found in binary or memory: http://rt.webcompanion.com/notifications/download/rt/chbrowser.exe
            Source: WebCompanion.exe, 00000028.00000002.2589134775.00000000065A2000.00000002.00000001.01000000.0000003D.sdmpString found in binary or memory: http://rt.webcompanion.com/notifications/download/rt/extension.txt;http://webcompanion.com/check
            Source: WebCompanion.exe, 00000028.00000002.2589134775.00000000065A2000.00000002.00000001.01000000.0000003D.sdmpString found in binary or memory: http://rt.webcompanion.com/notifications/download/rt/postrun/preprod/v1/FeatureActions.zip
            Source: WebCompanion.exe, 00000028.00000002.2589134775.00000000065A2000.00000002.00000001.01000000.0000003D.sdmpString found in binary or memory: http://rt.webcompanion.com/notifications/download/rt/postrun/prod/v1/FeatureActions.zipkhttp://pp.we
            Source: WebCompanion.exe, 00000028.00000002.2590279307.0000000006A72000.00000002.00000001.01000000.0000003E.sdmpString found in binary or memory: http://rt.webcompanion.com/notifications/download/rt/postrun/v1/searchengine_v1.zip
            Source: WebCompanion.exe, 00000028.00000002.2590279307.0000000006A72000.00000002.00000001.01000000.0000003E.sdmpString found in binary or memory: http://rt.webcompanion.com/notifications/download/rt/searchenginetemplate.xmlQhttps://appdownload.la
            Source: WcInstaller.exe, 00000002.00000003.1867085226.00000000005D0000.00000004.00001000.00020000.00000000.sdmp, WcInstaller.exe, 00000002.00000003.1866843878.00000000021C3000.00000004.00000020.00020000.00000000.sdmp, WebCompanionInstaller.exe, 00000003.00000000.1867314648.0000000000782000.00000002.00000001.01000000.0000000F.sdmpString found in binary or memory: http://rt.webcompanion.com/notifications/download/rt/typolist.txt5Creating
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmp, WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: http://schemas.datacontract.org/2004/07/SearchProtect.WcfService
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: http://schemas.datacontract.org/2004/07/SearchProtect.WcfService6
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: http://schemas.datacontract.org/2004/07/SearchProtect.WcfServicef
            Source: WcInstaller.exe, 00000002.00000003.1867085226.00000000005D0000.00000004.00001000.00020000.00000000.sdmp, WcInstaller.exe, 00000002.00000003.1866843878.00000000021C3000.00000004.00000020.00020000.00000000.sdmp, WebCompanionInstaller.exe, 00000003.00000000.1867314648.0000000000782000.00000002.00000001.01000000.0000000F.sdmpString found in binary or memory: http://sdl.adaware.com/?bundleid=WCUN001&savename=WCUN001.exe
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: http://sdl.adaware.com/cdn/NewBrowserExtensionInstaller.exe
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: http://search.lavasoft.com/results.php
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: http://search.lavasoft.com/results.php?search=
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: http://search.naver.com/search.naver?query=
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: http://search.naver.com/search.naver?where=nexearch&amp;sm=osd&amp;ie=
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: http://search.yahoo.com/
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: http://search.yahoo.com/search?ei=
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: http://secure.lavasoft.com/
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: http://secure.lavasoft.com/api/get_alternative_searchterms/?q=
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: http://securedsearch.lavasoft.com
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: http://securedsearch.lavasoft.com/results.php
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: http://securedsearch.lavasoft.com/results.php?pr=vmn&id=webcompa&ent=ch_
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: http://securedsearch.lavasoft.com/templates/home/adaware_securesearch/favicon.ico
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: http://securedsearch.lavasoft.com/templates/home/adaware_securesearch/favicon.ico#GoSearchYahoo.xmlI
            Source: WcInstaller.exe, 00000002.00000003.1867085226.00000000005D0000.00000004.00001000.00020000.00000000.sdmp, WcInstaller.exe, 00000002.00000003.1866843878.00000000021C3000.00000004.00000020.00020000.00000000.sdmp, WebCompanionInstaller.exe, 00000003.00000000.1867314648.0000000000782000.00000002.00000001.01000000.0000000F.sdmp, WebCompanion.exe, 00000028.00000002.2590522947.0000000006AC2000.00000002.00000001.01000000.0000003F.sdmpString found in binary or memory: http://staging-cloudflow.lavasoft.net/v1/event-stat-wc
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: http://suggest.yandex.com/suggest-ff.cgi?part=
            Source: WcInstaller.exe, 00000002.00000003.1867085226.00000000005D0000.00000004.00001000.00020000.00000000.sdmp, WcInstaller.exe, 00000002.00000003.1866843878.00000000021C3000.00000004.00000020.00020000.00000000.sdmp, WebCompanionInstaller.exe, 00000003.00000000.1867314648.0000000000782000.00000002.00000001.01000000.0000000F.sdmp, WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmp, csc.exe, 0000002D.00000002.2688210015.00000000006C2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/
            Source: WcInstaller.exe, 00000002.00000003.1867085226.00000000005D0000.00000004.00001000.00020000.00000000.sdmp, WcInstaller.exe, 00000002.00000003.1866843878.00000000021C3000.00000004.00000020.00020000.00000000.sdmp, WebCompanionInstaller.exe, 00000003.00000000.1867314648.0000000000782000.00000002.00000001.01000000.0000000F.sdmp, WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: http://tempuri.org/$
            Source: csc.exe, 0000002D.00000002.2688210015.00000000006C2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/:re
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: http://tempuri.org/AddT
            Source: WcInstaller.exe, 00000002.00000003.1867085226.00000000005D0000.00000004.00001000.00020000.00000000.sdmp, WcInstaller.exe, 00000002.00000003.1866843878.00000000021C3000.00000004.00000020.00020000.00000000.sdmp, WebCompanionInstaller.exe, 00000003.00000000.1867314648.0000000000782000.00000002.00000001.01000000.0000000F.sdmpString found in binary or memory: http://tempuri.org/GetComponentsInfoByProductT
            Source: WcInstaller.exe, 00000002.00000003.1867085226.00000000005D0000.00000004.00001000.00020000.00000000.sdmp, WcInstaller.exe, 00000002.00000003.1866843878.00000000021C3000.00000004.00000020.00020000.00000000.sdmp, WebCompanionInstaller.exe, 00000003.00000000.1867314648.0000000000782000.00000002.00000001.01000000.0000000F.sdmp, WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: http://tempuri.org/GetComponentsInfoT
            Source: WcInstaller.exe, 00000002.00000003.1867085226.00000000005D0000.00000004.00001000.00020000.00000000.sdmp, WcInstaller.exe, 00000002.00000003.1866843878.00000000021C3000.00000004.00000020.00020000.00000000.sdmp, WebCompanionInstaller.exe, 00000003.00000000.1867314648.0000000000782000.00000002.00000001.01000000.0000000F.sdmp, WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: http://tempuri.org/GetComponentsVersionInfoT
            Source: WcInstaller.exe, 00000002.00000003.1867085226.00000000005D0000.00000004.00001000.00020000.00000000.sdmp, WcInstaller.exe, 00000002.00000003.1866843878.00000000021C3000.00000004.00000020.00020000.00000000.sdmp, WebCompanionInstaller.exe, 00000003.00000000.1867314648.0000000000782000.00000002.00000001.01000000.0000000F.sdmpString found in binary or memory: http://tempuri.org/GetProductInfoT
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmp, WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: http://tempuri.org/IWCAssistantService/CopyFilesResponse
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmp, WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: http://tempuri.org/IWCAssistantService/CopyFilesT
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmp, WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: http://tempuri.org/IWCAssistantService/CreatUninstallInfoResponse
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmp, WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: http://tempuri.org/IWCAssistantService/CreatUninstallInfoT
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmp, WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: http://tempuri.org/IWCAssistantService/GetCurrentHomePageIEResponse
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmp, WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: http://tempuri.org/IWCAssistantService/GetCurrentHomePageIET
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmp, WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: http://tempuri.org/IWCAssistantService/GetCurrentSearchIEResponse
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmp, WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: http://tempuri.org/IWCAssistantService/GetCurrentSearchIET
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmp, WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: http://tempuri.org/IWCAssistantService/ProcessRemoteFeatureResponse
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmp, WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: http://tempuri.org/IWCAssistantService/ProcessRemoteFeatureT
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmp, WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: http://tempuri.org/IWCAssistantService/RunProcessResponse
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmp, WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: http://tempuri.org/IWCAssistantService/RunProcessT
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmp, WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: http://tempuri.org/IWCAssistantService/RunasAdminResponse
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmp, WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: http://tempuri.org/IWCAssistantService/RunasAdminT
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmp, WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: http://tempuri.org/IWCAssistantService/SetAutoRestoreSessionIEResponse
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmp, WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: http://tempuri.org/IWCAssistantService/SetAutoRestoreSessionIET
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmp, WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: http://tempuri.org/IWCAssistantService/SetHomePageIEResponse
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmp, WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: http://tempuri.org/IWCAssistantService/SetHomePageIET
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmp, WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: http://tempuri.org/IWCAssistantService/SetNewTabIEResponse
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmp, WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: http://tempuri.org/IWCAssistantService/SetNewTabIET
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmp, WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: http://tempuri.org/IWCAssistantService/SetSearchEngineIEResponse
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmp, WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: http://tempuri.org/IWCAssistantService/SetSearchEngineIET
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmp, WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: http://tempuri.org/IWCAssistantService/SilentUninstallResponse
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmp, WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: http://tempuri.org/IWCAssistantService/SilentUninstallT
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmp, WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: http://tempuri.org/IWCAssistantService/UpdateUninstallInfoResponse
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmp, WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: http://tempuri.org/IWCAssistantService/UpdateUninstallInfoT
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: http://tempuri.org/SendEmailT
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: http://tempuri.org/SendFeedbackT
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: http://tempuri.org/SendWCFeedbackT
            Source: WcInstaller.exe, 00000002.00000003.1867085226.00000000005D0000.00000004.00001000.00020000.00000000.sdmp, WcInstaller.exe, 00000002.00000003.1866843878.00000000021C3000.00000004.00000020.00020000.00000000.sdmp, WebCompanionInstaller.exe, 00000003.00000000.1867314648.0000000000782000.00000002.00000001.01000000.0000000F.sdmpString found in binary or memory: http://tempuri.org/SignZipInstallerByProductT
            Source: WcInstaller.exe, 00000002.00000003.1867085226.00000000005D0000.00000004.00001000.00020000.00000000.sdmp, WcInstaller.exe, 00000002.00000003.1866843878.00000000021C3000.00000004.00000020.00020000.00000000.sdmp, WebCompanionInstaller.exe, 00000003.00000000.1867314648.0000000000782000.00000002.00000001.01000000.0000000F.sdmp, WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: http://tempuri.org/SignZipInstallerT
            Source: WcInstaller.exe, 00000002.00000003.1867085226.00000000005D0000.00000004.00001000.00020000.00000000.sdmp, WcInstaller.exe, 00000002.00000003.1866843878.00000000021C3000.00000004.00000020.00020000.00000000.sdmp, WebCompanionInstaller.exe, 00000003.00000000.1867314648.0000000000782000.00000002.00000001.01000000.0000000F.sdmp, WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: http://tempuri.org/T
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: http://tempuri.org/WcSendAutoResponseEmailT
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://translationproject.org/team/vi.html
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: http://upclick.com/GetCountryISO2ByNameT
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: http://upclick.com/GetCountryISO2T
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: http://upclick.com/GetCountryNameByISO2T
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: http://upclick.com/GetGeoInfoByHeadersT
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: http://upclick.com/GetGeoInfoByIpAddressT
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: http://upclick.com/GetGeoInfoByIpAddressesT
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: http://upclick.com/GetIpLocationT
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: http://upclick.com/GetLocationInfoT
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: http://upclick.com/T
            Source: WebCompanion.exe, 00000028.00000002.2589134775.00000000065A2000.00000002.00000001.01000000.0000003D.sdmpString found in binary or memory: http://wc-partners.lavasoft.com/Partner.svc/GetPartnerInfo
            Source: WcInstaller.exe, 00000002.00000003.1865082701.00000000021C2000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000028.00000002.2581040314.0000000003CB9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://wc-update-service.lavasoft.com/components.asmx
            Source: WcInstaller.exe, 00000002.00000003.1865082701.00000000021C2000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000028.00000002.2581040314.0000000003CB9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://wc-update-service.lavasoft.com/update.asmx
            Source: WcInstaller.exe, 00000002.00000003.1865082701.00000000021C2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wcdownloadercdn.lavasoft.com/9.1.0.993/WebCompanion-9.1.0.993-prod.zip
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: http://webcompanion.com/1http://www.lavasoft.com/Ghttp://webcompanion.com/unsafe?url=Qhttps://appdow
            Source: WebCompanion.exe, 00000028.00000002.2581040314.0000000003BE1000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000028.00000002.2581040314.0000000003E3F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://webcompanion.com/checkDE
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: http://webcompanion.com/faq
            Source: WebCompanion.exe, 00000028.00000002.2581040314.0000000003CB9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://webcompanion.com/faqH
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: http://webcompanion.com/feedback?utm_source=wc&utm_medium=wc&utm_campaign=wcg/WebCompanion;component
            Source: WebCompanion.exe, 00000028.00000002.2589134775.00000000065A2000.00000002.00000001.01000000.0000003D.sdmpString found in binary or memory: http://webcompanion.com/feedback?utm_source=wc&utm_medium=wc&utm_campaign=wc~http://lavasoft.com?utm
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: http://webcompanion.com/ff_extension/ffLanguages.json
            Source: WebCompanion.exe, 00000028.00000002.2589134775.00000000065A2000.00000002.00000001.01000000.0000003D.sdmpString found in binary or memory: http://webcompanion.com/google_chrome_incompatibility
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: http://webcompanion.com/gw/gateway.php?pid=
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: http://webcompanion.com/help
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: http://webcompanion.com/help#119Help
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: http://webcompanion.com/images/email/hdr_main.png
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: http://webcompanion.com/images/email/tw-icon.png
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: http://webcompanion.com/images/email/wc-title-header.png
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: http://webcompanion.com/installed.php?extinstall=1
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: http://webcompanion.com/mail-report-reply
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: http://webcompanion.com/mz/browser_download.php?partner=
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: http://webcompanion.com/notification?timestamp=
            Source: WebCompanion.exe, 00000028.00000002.2589134775.00000000065A2000.00000002.00000001.01000000.0000003D.sdmpString found in binary or memory: http://webcompanion.com/notifications/includes/wl.phpthttp://webcompanion.com/version_logs?json=true
            Source: WebCompanion.exe, 00000028.00000002.2589134775.00000000065A2000.00000002.00000001.01000000.0000003D.sdmpString found in binary or memory: http://webcompanion.com/search_redirect?hostname=
            Source: WebCompanion.exe, 00000028.00000002.2589134775.00000000065A2000.00000002.00000001.01000000.0000003D.sdmpString found in binary or memory: http://webcompanion.com/switch_to_IE_in_progressxhttp://webcompanion.com/google_chrome_incompatibili
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: http://webcompanion.com/terms?http://webcompanion.com/privacy;RecoverSE
            Source: WcInstaller.exe, 00000002.00000003.1867085226.00000000005D0000.00000004.00001000.00020000.00000000.sdmp, WcInstaller.exe, 00000002.00000003.1866843878.00000000021C3000.00000004.00000020.00020000.00000000.sdmp, WebCompanionInstaller.exe, 00000003.00000000.1867314648.0000000000782000.00000002.00000001.01000000.0000000F.sdmpString found in binary or memory: http://webcompanion.com/uninstall.php?utm_source=wc&utm_medium=
            Source: WebCompanion.exe, 00000028.00000002.2589134775.00000000065A2000.00000002.00000001.01000000.0000003D.sdmpString found in binary or memory: http://webcompanion.com/unsafe
            Source: WebCompanion.exe, 00000028.00000002.2589134775.00000000065A2000.00000002.00000001.01000000.0000003D.sdmpString found in binary or memory: http://webcompanion.com/version_logs?json=true&version=
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: http://webcompanion.com/wc_onboarding_software_noab?lang=
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: http://webcompanion.gosearchresults.com/
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: http://webcompanion.gosearchresults.com/_?pid=5afadebb90911412cb628221&q=
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wiki.filezilla-project.org/Network_Configuration
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wiki.filezilla-project.org/Network_Configuration&Ch
            Source: WcInstaller.exe, 00000002.00000003.1865082701.00000000021C2000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000028.00000002.2581040314.0000000003CB9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://wsgeoip.lavasoft.com/ipservice.asmx
            Source: WebCompanion.exe, 00000028.00000002.2581040314.0000000003CB9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://wsgeoip.lulusoft.com/IPService.asmx
            Source: WebCompanion.exe, 00000028.00000002.2581040314.0000000003CB9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://wsgeoip.upclick.com/IPService.asmx
            Source: WebCompanion.exe, 00000028.00000002.2585618453.0000000006042000.00000002.00000001.01000000.0000003C.sdmpString found in binary or memory: http://www.apache.org/).
            Source: WebCompanion.exe, 00000028.00000002.2585618453.0000000006042000.00000002.00000001.01000000.0000003C.sdmpString found in binary or memory: http://www.apache.org/licenses/
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000BB3000.00000002.00000001.01000000.0000003B.sdmp, WebCompanion.exe, 00000028.00000002.2585618453.0000000006042000.00000002.00000001.01000000.0000003C.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000BB3000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0Copyright
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: http://www.baidu.com
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: http://www.baidu.com/baidu?word=
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: http://www.baidu.com/favicon.ico
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: http://www.baidu.com/s
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000CE4000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: http://www.codeproject.com/Articles/28093/Using-RoutedCommands-with-a-ViewModel-in-WPF
            Source: WcInstaller.exe, 00000002.00000003.1867085226.00000000005D0000.00000004.00001000.00020000.00000000.sdmp, WcInstaller.exe, 00000002.00000003.1866843878.00000000021C3000.00000004.00000020.00020000.00000000.sdmp, WebCompanionInstaller.resources.dll0.3.dr, Lavasoft.WCAssistant.Service.Logger.dll.3.drString found in binary or memory: http://www.entrust.net/rpa0
            Source: WcInstaller.exe, 00000002.00000003.1867085226.00000000005D0000.00000004.00001000.00020000.00000000.sdmp, WcInstaller.exe, 00000002.00000003.1866843878.00000000021C3000.00000004.00000020.00020000.00000000.sdmp, WebCompanionInstaller.resources.dll0.3.dr, Lavasoft.WCAssistant.Service.Logger.dll.3.drString found in binary or memory: http://www.entrust.net/rpa03
            Source: nsxF7D6.tmp.0.drString found in binary or memory: http://www.gnu.org/home.html
            Source: nsxF7D6.tmp.0.drString found in binary or memory: http://www.gnu.org/software/gnutls/security.html
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: http://www.google.com/favicon.ico
            Source: WcInstaller.exe, 00000002.00000003.1867085226.00000000005D0000.00000004.00001000.00020000.00000000.sdmp, WcInstaller.exe, 00000002.00000003.1866843878.00000000021C3000.00000004.00000020.00020000.00000000.sdmp, WebCompanionInstaller.exe, 00000003.00000000.1867314648.0000000000782000.00000002.00000001.01000000.0000000F.sdmp, WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: http://www.lavasoft.com
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: http://www.lavasoft.com/mylavasoft/contact
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: http://www.lavasoft.com/privacy_policy/
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: http://www.lavasoft.com/terms_of_use/Ohttp://www.lavasoft.com/privacy_policy/
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: http://www.lavasoftsupport.com/index.php?/forum/191-web-companion/
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: http://www.mozilla.org/2006/browser/search/
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: http://www.mozilla.org/2006/browser/search/=//msbld:Url
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: http://www.msn.com%WCAssistantServiceSSoftware
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: http://www.naver.com/
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: http://www.naver.com/favicon.ico
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.transifex.com/zeron/filezilla/language/az_AZ/)
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.transifex.com/zeron/filezilla/language/de/)
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmp, libfilezilla.mo38.0.drString found in binary or memory: http://www.transifex.com/zeron/filezilla/language/pl_PL/)
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmp, libfilezilla.mo48.0.drString found in binary or memory: http://www.transifex.com/zeron/filezilla/language/tr_TR/)
            Source: WcInstaller.exe, 00000002.00000003.1867085226.00000000005D0000.00000004.00001000.00020000.00000000.sdmp, WcInstaller.exe, 00000002.00000003.1866843878.00000000021C3000.00000004.00000020.00020000.00000000.sdmp, WebCompanionInstaller.exe, 00000003.00000000.1867314648.0000000000782000.00000002.00000001.01000000.0000000F.sdmpString found in binary or memory: http://www.webcompanion.com
            Source: WcInstaller.exe, 00000002.00000003.1867085226.00000000005D0000.00000004.00001000.00020000.00000000.sdmp, WcInstaller.exe, 00000002.00000003.1866843878.00000000021C3000.00000004.00000020.00020000.00000000.sdmp, WebCompanionInstaller.exe, 00000003.00000000.1867314648.0000000000782000.00000002.00000001.01000000.0000000F.sdmpString found in binary or memory: http://www.webcompanion.com/installerview/consent_2?culture=
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: http://www.yahoo.com/
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: http://www.yahoo.com/0http://search.yahoo.com/
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: http://www.yandex.com.tr/?clid=
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: http://www.yandex.com.tr/yandsearch?text=
            Source: nsxF7D6.tmp.0.drString found in binary or memory: http://www.zlib.net/D
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: http://yandex.st/lego/_/pDu9OWAQKB0s2J9IojKpiS_Eho.ico#yandex-perion.xml
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: http://yandex.st/lego/_/rBTjd6UOPk5913OSn5ZQVYMTQWQ.ico
            Source: WcInstaller.exe, 00000002.00000003.1867085226.00000000005D0000.00000004.00001000.00020000.00000000.sdmp, WcInstaller.exe, 00000002.00000003.1866843878.00000000021C3000.00000004.00000020.00020000.00000000.sdmp, WebCompanionInstaller.exe, 00000003.00000000.1867314648.0000000000782000.00000002.00000001.01000000.0000000F.sdmpString found in binary or memory: https://acs.lavasoft.com/api/v2/url/blacklist7Creating
            Source: WebCompanion.exe, 00000028.00000002.2589134775.00000000065A2000.00000002.00000001.01000000.0000003D.sdmpString found in binary or memory: https://acs.lavasoft.com/api/v2/url/blacklistmhttps://acs.lavasoft.com/api/v2/url/permanentwhitelist
            Source: WcInstaller.exe, 00000002.00000003.1867085226.00000000005D0000.00000004.00001000.00020000.00000000.sdmp, WcInstaller.exe, 00000002.00000003.1866843878.00000000021C3000.00000004.00000020.00020000.00000000.sdmp, WebCompanionInstaller.exe, 00000003.00000000.1867314648.0000000000782000.00000002.00000001.01000000.0000000F.sdmpString found in binary or memory: https://acs.lavasoft.com/api/v2/url/permanentwhitelist7Creating
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: https://adaware.com/ext/ie.php?pid=
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmp, WebCompanion.exe, 00000028.00000002.2581040314.0000000003CB9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://adaware.com/ext/inline.php?pid=
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: https://adaware.start.me/
            Source: WebCompanion.exe, 00000028.00000002.2589134775.00000000065A2000.00000002.00000001.01000000.0000003D.sdmpString found in binary or memory: https://addons.mozilla.org/en-US/firefox/
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: https://aw.gosearchresults.com/
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: https://aw.gosearchresults.com/?pid=5ac784309091147a162b4431&pr=vmn&id=webcompa&ent=ch_
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: https://aw.gosearchresults.com/?pid=5ac784309091147a162b4431&pr=vmn&id=webcompa&ent=hp_
            Source: WebCompanion.exe, 00000028.00000002.2589134775.00000000065A2000.00000002.00000001.01000000.0000003D.sdmpString found in binary or memory: https://blocklists.settings.moz-info.org/v1/blocklist/3/%APP_ID%/%APP_VERSION%/%PRODUCT%/%BUILD_ID%/
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: https://ca.search.yahoo.com/favicon.ico
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: https://cdn.privado.com/images/favicon.png
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmp, WebCompanion.exe, 00000028.00000002.2581040314.0000000003CB9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://chrome.google.com/webstore/detail/adaware-secure-search/mcecnfofnfjclaifchnaodlamfjlofkp
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: https://clients2.google.com/service/update2/crx
            Source: DCIService.exe, 0000001C.00000000.2321641309.00007FF7EB15A000.00000002.00000001.01000000.0000002B.sdmpString found in binary or memory: https://curl.se/docs/alt-svc.html
            Source: DCIService.exe, 0000001C.00000000.2321641309.00007FF7EB15A000.00000002.00000001.01000000.0000002B.sdmpString found in binary or memory: https://curl.se/docs/http-cookies.html
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: https://defaultsearch.co
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: https://defaultsearch.co/?q=
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: https://defaultsearch.co/favicon.ico-defaultsearch-bing.xml
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: https://defaultsearch.co/homepage?hp=1&pId=
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: https://defaultsearch.co?q=
            Source: filezilla.exe, 0000000E.00000000.2187422221.00007FF71ED77000.00000002.00000001.01000000.00000018.sdmp, nsxF7D6.tmp.0.drString found in binary or memory: https://docs.storj.io/how-tos/set-up-filezilla-for-decentralized-file-transferDocsID_DOCShttps://sto
            Source: WebCompanion.exe, 00000028.00000002.2590279307.0000000006A72000.00000002.00000001.01000000.0000003E.sdmpString found in binary or memory: https://easylist-downloads.adblockplus.org/easylist.txtzhttps://easylist-downloads.adblockplus.org/e
            Source: WebCompanion.exe, 00000028.00000002.2590279307.0000000006A72000.00000002.00000001.01000000.0000003E.sdmpString found in binary or memory: https://easylist-downloads.adblockplus.org/easylistgermany.txt
            Source: Lavasoft.Search.exe, 00000034.00000000.3702181456.0000000000C62000.00000002.00000001.01000000.00000054.sdmpString found in binary or memory: https://eventstaging.lavasoft.com/v1/event-stat
            Source: WebCompanion.exe, 00000028.00000002.2590522947.0000000006AC2000.00000002.00000001.01000000.0000003F.sdmpString found in binary or memory: https://eventstaging.lavasoft.com/v1/event-statRhttp://flow.lavasoft.com/v1/event-stat-wclhttp://sta
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: https://ext.adaware.com/
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: https://ext.adaware.com//ts/
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: https://ext.adaware.com/ss/newtab-ext.xpi
            Source: WcInstaller.exe, 00000002.00000003.1867085226.00000000005D0000.00000004.00001000.00020000.00000000.sdmp, WcInstaller.exe, 00000002.00000003.1866843878.00000000021C3000.00000004.00000020.00020000.00000000.sdmp, WebCompanionInstaller.exe, 00000003.00000000.1867314648.0000000000782000.00000002.00000001.01000000.0000000F.sdmp, WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: https://featureflags.lavasoft.com/api/Update/WC
            Source: filezilla.exe, 0000000E.00000000.2187422221.00007FF71ED77000.00000002.00000001.01000000.00000018.sdmp, nsxF7D6.tmp.0.drString found in binary or memory: https://filezilla-project.org/Build
            Source: filezilla.exe, 0000000E.00000000.2187422221.00007FF71ED77000.00000002.00000001.01000000.00000018.sdmp, nsxF7D6.tmp.0.drString found in binary or memory: https://filezilla-project.org/ID_WEBSITE_LINKA
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2211034292.00000000006E4000.00000004.00000020.00020000.00000000.sdmp, nsxF7D6.tmp.0.drString found in binary or memory: https://filezilla-project.org/URLUpdateInfoHelpLinkPublisherTim
            Source: filezilla.exe, 0000000E.00000000.2187422221.00007FF71ED77000.00000002.00000001.01000000.00000018.sdmp, nsxF7D6.tmp.0.drString found in binary or memory: https://filezilla-project.org/privacy.phpPrivacy
            Source: filezilla.mo5.0.dr, nsxF7D6.tmp.0.drString found in binary or memory: https://filezilla-project.org/probe.php
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://filezilla-project.org/probe.php-en
            Source: filezilla.exe, 0000000E.00000000.2187422221.00007FF71ED77000.00000002.00000001.01000000.00000018.sdmp, nsxF7D6.tmp.0.drString found in binary or memory: https://filezilla-project.org/support.php?type=client&mode=helpbugreport&version=ID_VIEW_QUICKCONNEC
            Source: WebCompanion.exe, 00000028.00000002.2590522947.0000000006AC2000.00000002.00000001.01000000.0000003F.sdmp, Lavasoft.Search.exe, 00000034.00000000.3702181456.0000000000C62000.00000002.00000001.01000000.00000054.sdmpString found in binary or memory: https://flow.lavasoft.com/v1/event-stat
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmp, filezilla.mo5.0.drString found in binary or memory: https://github.com/Patriccollu/Lingua_Corsa-Infurmatica/#readme
            Source: WebCompanion.exe, 00000028.00000002.2589134775.00000000065A2000.00000002.00000001.01000000.0000003D.sdmpString found in binary or memory: https://incoming.telemetry.moz-info.org
            Source: WebCompanion.exe, 00000028.00000002.2590279307.0000000006A72000.00000002.00000001.01000000.0000003E.sdmpString found in binary or memory: https://indonesianadblockrules.googlecode.com/hg/subscriptions/abpindo.txtxhttps://easylist-download
            Source: nsxF7D6.tmp.0.drString found in binary or memory: https://lib.filezilla-project.org/)
            Source: nsxF7D6.tmp.0.drString found in binary or memory: https://lib.filezilla-project.org/).
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: https://media.adaware.com/moviesextension/thankyou.php?partnerID=BT151101&sourceTraffic=WCU1908
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: https://media.adaware.com/waterfox/onboarding/?utm_source=WebCompanion&utm_medium=Notifications&utm_
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: https://mysearchengine.co/?q=
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: https://mysearchengine.co/favicon.ico
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: https://mysearchengine.co/homepage?hp=1&pId=
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: https://mysearchengine.co?q=
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmp, WebCompanion.exe, 00000028.00000002.2589134775.00000000065A2000.00000002.00000001.01000000.0000003D.sdmpString found in binary or memory: https://notiftrigger.adaware.com/notification-trigger-service/api/v1?partner=
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2211628615.000000000077E000.00000004.00000020.00020000.00000000.sdmp, FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000003.2208888820.000000000077E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://offers.filezilla-project.org/
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2214412258.0000000005580000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://offers.filezilla-project.org/get.php?offer=2021a
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2214412258.0000000005580000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://offers.filezilla-project.org/get.php?offer=2021aA
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2211628615.000000000077E000.00000004.00000020.00020000.00000000.sdmp, FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000003.2208888820.000000000077E000.00000004.00000020.00020000.00000000.sdmp, FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000003.1744674899.0000000000786000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://offers.filezilla-project.org/offer.php?v=1&c=2021a
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2211034292.00000000006E4000.00000004.00000020.00020000.00000000.sdmp, nsxF7D6.tmp.0.drString found in binary or memory: https://offers.filezilla-project.org/offer.php?v=1&c=2021a/SILENTgetOK
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: https://privado.com/
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: https://privado.com/?gd=
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: https://privado.com/search
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: https://privado.com/search?gd=
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: https://privatesearch.adaware.com/
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: https://privatesearch.adaware.com/?gd=
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: https://privatesearch.adaware.com/search
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: https://privatesearch.adaware.com/search?gd=
            Source: WcInstaller.exe, 00000002.00000003.1865082701.00000000021C2000.00000004.00000020.00020000.00000000.sdmp, WcInstaller.exe, 00000002.00000003.1867085226.00000000005D0000.00000004.00001000.00020000.00000000.sdmp, WcInstaller.exe, 00000002.00000003.1866843878.00000000021C3000.00000004.00000020.00020000.00000000.sdmp, WebCompanionInstaller.exe, 00000003.00000000.1867314648.0000000000782000.00000002.00000001.01000000.0000000F.sdmpString found in binary or memory: https://rt.webcompanion.com/notifications/download/rt/dci/latest/Webprotection.zip
            Source: WcInstaller.exe, 00000002.00000003.1867085226.00000000005D0000.00000004.00001000.00020000.00000000.sdmp, WcInstaller.exe, 00000002.00000003.1866843878.00000000021C3000.00000004.00000020.00020000.00000000.sdmp, WebCompanionInstaller.exe, 00000003.00000000.1867314648.0000000000782000.00000002.00000001.01000000.0000000F.sdmpString found in binary or memory: https://rt.webcompanion.com/notifications/download/rt/fallback/WebCompanion.zip
            Source: WebCompanion.exe, 00000028.00000002.2590279307.0000000006A72000.00000002.00000001.01000000.0000003E.sdmpString found in binary or memory: https://ruadlist.googlecode.com/hg/advblock.txt(AdBlockAcceptableAds
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: https://sdl.adaware.com/?bundleid=WCU001&savename=WCUpdater.exe
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: https://sdl.adaware.com/cdn/BrowserExtensionInstaller.exe
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, libpng16-16.dll.0.dr, nsxF7D6.tmp.0.drString found in binary or memory: https://sectigo.com/CPS0
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: https://securesearch.org
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: https://securesearch.org/?q=
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: https://securesearch.org/homepage?hp=2&pId=
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: https://securesearch.org?q=
            Source: WebCompanion.exe, 00000028.00000002.2589134775.00000000065A2000.00000002.00000001.01000000.0000003D.sdmpString found in binary or memory: https://sg-bitmask.adaware.com/bitmask/allmaskvalues
            Source: WcInstaller.exe, 00000002.00000003.1867085226.00000000005D0000.00000004.00001000.00020000.00000000.sdmp, WcInstaller.exe, 00000002.00000003.1866843878.00000000021C3000.00000004.00000020.00020000.00000000.sdmp, WebCompanionInstaller.exe, 00000003.00000000.1867314648.0000000000782000.00000002.00000001.01000000.0000000F.sdmp, WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: https://staging-featureflags-api.lavasoft.net/api/Update/WC
            Source: WcInstaller.exe, 00000002.00000003.1865082701.00000000021C2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://staging-webcompanion.lavasoft.net/dci/3.0.1.9/Webprotection.zip
            Source: WcInstaller.exe, 00000002.00000003.1867085226.00000000005D0000.00000004.00001000.00020000.00000000.sdmp, WcInstaller.exe, 00000002.00000003.1866843878.00000000021C3000.00000004.00000020.00020000.00000000.sdmp, WebCompanionInstaller.exe, 00000003.00000000.1867314648.0000000000782000.00000002.00000001.01000000.0000000F.sdmpString found in binary or memory: https://staging-webcompanion.lavasoft.net/dci/3.0.2.12/Webprotection.zip
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: https://suggest.finditnowonline.com/suggestionfeed/suggestion?format=json
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: https://suggest.finditnowonline.com/suggestionfeed/suggestion?format=json&gd=
            Source: WebCompanion.exe, 00000028.00000002.2586149184.000000000608C000.00000002.00000001.01000000.0000003C.sdmp, WebCompanion.exe, 00000028.00000002.2585618453.0000000006042000.00000002.00000001.01000000.0000003C.sdmpString found in binary or memory: https://svn.apache.org/repos/asf/logging/log4net/tags/1.2.13RC3
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmp, filezilla.mo34.0.dr, libfilezilla.mo45.0.dr, libfilezilla.mo38.0.dr, filezilla.mo32.0.dr, libfilezilla.mo48.0.dr, filezilla.mo5.0.dr, libfilezilla.mo21.0.drString found in binary or memory: https://trac.filezilla-project.org/
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: https://twitter.com/lavasoft
            Source: nsxF7D6.tmp.0.drString found in binary or memory: https://update.filezilla-project.org/update.php
            Source: nsxF7D6.tmp.0.drString found in binary or memory: https://update.filezilla-project.org/update.phpunknown%u.%u64Software
            Source: WcInstaller.exe, 00000002.00000003.1865082701.00000000021C2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wcdownloader-qa.lavasoft.com/9.1.0.993/WebCompanion-9.1.0.993-internal.zip
            Source: WcInstaller.exe, 00000002.00000003.1865082701.00000000021C2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wcdownloader-qa.lavasoft.com/9.1.0.993/WebCompanionInstaller-9.1.0.993-internal.exe
            Source: WcInstaller.exe, 00000002.00000003.1865082701.00000000021C2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wcdownloadercdn.lavasoft.com/9.1.0.993/WebCompanionInstaller-9.1.0.993-prod.exe
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2214412258.0000000005580000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://webcompanion.com/6
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: https://webcompanion.com/ab/index.php?partnerId=
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: https://webcompanion.com/download_extensions.php?partnerID=
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: https://webcompanion.com/en/
            Source: WcInstaller.exe, 00000002.00000003.1867085226.00000000005D0000.00000004.00001000.00020000.00000000.sdmp, WcInstaller.exe, 00000002.00000003.1866843878.00000000021C3000.00000004.00000020.00020000.00000000.sdmp, WebCompanionInstaller.exe, 00000003.00000000.1867314648.0000000000782000.00000002.00000001.01000000.0000000F.sdmp, WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: https://webcompanion.com/en/help.php
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2214412258.0000000005580000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://webcompanion.com/f
            Source: WcInstaller.exe, 00000002.00000003.1867085226.00000000005D0000.00000004.00001000.00020000.00000000.sdmp, WcInstaller.exe, 00000002.00000003.1866843878.00000000021C3000.00000004.00000020.00020000.00000000.sdmp, WebCompanionInstaller.exe, 00000003.00000000.1867314648.0000000000782000.00000002.00000001.01000000.0000000F.sdmpString found in binary or memory: https://webcompanion.com/nano_download.php?partner=AG160601&Silent&SkipAg&homepage=12&search=2cCheck
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2214412258.0000000005580000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://webcompanion.com/nano_download.php?partner=FZ210427
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000003.1744674899.0000000000791000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://webcompanion.com/privacy
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000003.1744674899.0000000000791000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://webcompanion.com/terms
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2209775656.000000000042F000.00000004.00000001.01000000.00000003.sdmpString found in binary or memory: https://webcompanion.com/terms1004ogram
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: https://webcompanion.com/termsAhttps://webcompanion.com/privacy
            Source: WcInstaller.exe, 00000002.00000003.1867085226.00000000005D0000.00000004.00001000.00020000.00000000.sdmp, WcInstaller.exe, 00000002.00000003.1866843878.00000000021C3000.00000004.00000020.00020000.00000000.sdmp, WebCompanionInstaller.exe, 00000003.00000000.1867314648.0000000000782000.00000002.00000001.01000000.0000000F.sdmpString found in binary or memory: https://webcompanion.com/unsafe.php?utm_source=WCghttp://pp.webcompanion.com/unsafe.php?utm_source=W
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: https://webcompanion.com/wp/index.php?partnerId=
            Source: filezilla.exe, 0000000E.00000000.2187422221.00007FF71ED77000.00000002.00000001.01000000.00000018.sdmp, nsxF7D6.tmp.0.drString found in binary or memory: https://welcome.filezilla-project.org/welcome?type=client&category=%s&version=What
            Source: filezilla.exe, 0000000E.00000000.2187422221.00007FF71ED77000.00000002.00000001.01000000.00000018.sdmp, nsxF7D6.tmp.0.drString found in binary or memory: https://wiki.filezilla-project.org/Date_and_Time_formattingShow
            Source: filezilla.mo5.0.dr, nsxF7D6.tmp.0.drString found in binary or memory: https://wiki.filezilla-project.org/Network_Configuration
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wiki.filezilla-project.org/Network_Configuration&Dewis
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wiki.filezilla-project.org/Network_Configuration&Server
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wiki.filezilla-project.org/Network_Configuration&Vali
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wiki.filezilla-project.org/Network_Configuration&Valitse
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wiki.filezilla-project.org/Network_Configuration&Velg
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wiki.filezilla-project.org/Network_Configuration&Vybra
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wiki.filezilla-project.org/Network_Configuration&Vybrat
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wiki.filezilla-project.org/Network_ConfigurationAle&gere
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wiki.filezilla-project.org/Network_ConfigurationFren
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wiki.filezilla-project.org/Network_ConfigurationHa&utatu
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wiki.filezilla-project.org/Network_ConfigurationIz&berite
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wiki.filezilla-project.org/Network_ConfigurationIzv
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wiki.filezilla-project.org/Network_ConfigurationOdabe&rite
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmp, filezilla.mo34.0.drString found in binary or memory: https://wiki.filezilla-project.org/Network_ConfigurationPasirin&kite
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wiki.filezilla-project.org/Network_ConfigurationPil&ih
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wiki.filezilla-project.org/Network_ConfigurationS
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wiki.filezilla-project.org/Network_ConfigurationSele&cciona
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wiki.filezilla-project.org/Network_ConfigurationSele&ccionar
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wiki.filezilla-project.org/Network_ConfigurationSele&cione
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmp, filezilla.mo34.0.dr, filezilla.mo5.0.drString found in binary or memory: https://wiki.filezilla-project.org/Network_ConfigurationSele&ct
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wiki.filezilla-project.org/Network_ConfigurationSele&ziona
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmp, filezilla.mo5.0.drString found in binary or memory: https://wiki.filezilla-project.org/Network_ConfigurationSele&zziun
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wiki.filezilla-project.org/Network_ConfigurationSelec&cionar
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wiki.filezilla-project.org/Network_ConfigurationSeleccione
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wiki.filezilla-project.org/Network_ConfigurationV
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wiki.filezilla-project.org/Network_ConfigurationV&
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wiki.filezilla-project.org/Network_ConfigurationVel&ja
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: https://www.adaware.com/favicon.ico
            Source: WcInstaller.exe, 00000002.00000003.1867085226.00000000005D0000.00000004.00001000.00020000.00000000.sdmp, WcInstaller.exe, 00000002.00000003.1866843878.00000000021C3000.00000004.00000020.00020000.00000000.sdmp, WebCompanionInstaller.exe, 00000003.00000000.1867314648.0000000000782000.00000002.00000001.01000000.0000000F.sdmp, WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: https://www.adaware.com/privacy-policy
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: https://www.adaware.com/sites/default/files/installers/H2OAutoUpdate/WCU005.exe
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: https://www.adaware.com/sites/default/files/installers/H2OAutoUpdate/WCU006_s.exe
            Source: WcInstaller.exe, 00000002.00000003.1867085226.00000000005D0000.00000004.00001000.00020000.00000000.sdmp, WcInstaller.exe, 00000002.00000003.1866843878.00000000021C3000.00000004.00000020.00020000.00000000.sdmp, WebCompanionInstaller.exe, 00000003.00000000.1867314648.0000000000782000.00000002.00000001.01000000.0000000F.sdmp, WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: https://www.adaware.com/terms-of-use
            Source: WcInstaller.exe, 00000002.00000003.1867085226.00000000005D0000.00000004.00001000.00020000.00000000.sdmp, WcInstaller.exe, 00000002.00000003.1866843878.00000000021C3000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000028.00000002.2580296945.0000000001BFF000.00000004.00000020.00020000.00000000.sdmp, WebCompanionInstaller.resources.dll0.3.dr, Lavasoft.WCAssistant.Service.Logger.dll.3.drString found in binary or memory: https://www.entrust.net/rpa0
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: https://www.google.com
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: https://www.google.com/
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: https://www.google.com/complete/search?client=firefox&amp;q=
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: https://www.google.com/search
            Source: DCIService.exe, 0000001C.00000000.2321641309.00007FF7EB15A000.00000002.00000001.01000000.0000002B.sdmpString found in binary or memory: https://www.google.comDCISafetyPageDCIEnabledDCILearningDCIDefAcceptDCILearnTimeoutDCINotifyTimeoutN
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: https://www.serci.info
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: https://www.serci.info/?gd=
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.transifex.com/yaron/teams/109068/he/)
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: https://www.waterfoxproject.org/en-US/about/legal/terms/waterfox/
            Source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpString found in binary or memory: https://www.waterfoxproject.org/en-US/privacy
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: https://www.wisesearches.com/Results.aspx
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: https://www.wisesearches.com/Results.aspx?gd=
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: https://yandex.com.tr/yandsearch?text=
            Source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: https://yandex.com/yandsearch?text=
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49986
            Source: unknownNetwork traffic detected: HTTP traffic on port 49817 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49985
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49983
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49982
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49981
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49980
            Source: unknownNetwork traffic detected: HTTP traffic on port 50131 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 50211 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 50498 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 50177 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 50257 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 50532 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49738
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49979
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49978
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49735
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49976
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49733
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49975
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50502
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49974
            Source: unknownNetwork traffic detected: HTTP traffic on port 50085 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50501
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49973
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49972
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50503
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49971
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50506
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49970
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50505
            Source: unknownNetwork traffic detected: HTTP traffic on port 50165 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49784 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49749 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50500
            Source: unknownNetwork traffic detected: HTTP traffic on port 50486 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49909 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 50292 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50509
            Source: unknownNetwork traffic detected: HTTP traffic on port 49978 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49886 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49967
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49966
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49965
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49964
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49963
            Source: unknownNetwork traffic detected: HTTP traffic on port 50359 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50512
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49962
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49961
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50514
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49960
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50517
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50516
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50519
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50518
            Source: unknownNetwork traffic detected: HTTP traffic on port 49966 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 50189 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 50464 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49760 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50511
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50510
            Source: unknownNetwork traffic detected: HTTP traffic on port 50108 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 50073 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 50028 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 50303 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 50269 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 50544 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49959
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49958
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49957
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49956
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50524
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49952
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50523
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49951
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50526
            Source: unknownNetwork traffic detected: HTTP traffic on port 49839 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49864 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49950
            Source: unknownNetwork traffic detected: HTTP traffic on port 50280 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50525
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50528
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50527
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50529
            Source: unknownNetwork traffic detected: HTTP traffic on port 49910 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50521
            Source: unknownNetwork traffic detected: HTTP traffic on port 49796 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 50396 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 50153 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 50405 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49949
            Source: unknownNetwork traffic detected: HTTP traffic on port 50235 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 50510 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49947
            Source: unknownNetwork traffic detected: HTTP traffic on port 50382 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49945
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49943
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49787
            Source: unknownNetwork traffic detected: HTTP traffic on port 50061 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49785
            Source: unknownNetwork traffic detected: HTTP traffic on port 49922 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49784
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49783
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49782
            Source: unknownNetwork traffic detected: HTTP traffic on port 50556 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49781
            Source: unknownNetwork traffic detected: HTTP traffic on port 50187 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 50462 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 50221 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 50026 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 50270 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49759 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49778
            Source: unknownNetwork traffic detected: HTTP traffic on port 50347 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49776
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49774
            Source: unknownNetwork traffic detected: HTTP traffic on port 49862 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49770
            Source: unknownNetwork traffic detected: HTTP traffic on port 50247 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 50095 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 50370 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 50407 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49830 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 50155 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 50568 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49769
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49768
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49767
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49766
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49765
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49764
            Source: unknownNetwork traffic detected: HTTP traffic on port 50313 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 50038 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49762
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49761
            Source: unknownNetwork traffic detected: HTTP traffic on port 50143 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49760
            Source: unknownNetwork traffic detected: HTTP traffic on port 49840 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 50208 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49896 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49770 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49956 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 50259 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 50534 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49759
            Source: unknownNetwork traffic detected: HTTP traffic on port 50496 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49757
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49998
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49755
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49997
            Source: unknownNetwork traffic detected: HTTP traffic on port 50121 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49996
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49752
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49751
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49750
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49990
            Source: unknownNetwork traffic detected: HTTP traffic on port 49874 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49747 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49829 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49934 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 50199 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 50474 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49749
            Source: unknownNetwork traffic detected: HTTP traffic on port 50369 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49747
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49989
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49745
            Source: unknownNetwork traffic detected: HTTP traffic on port 50277 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50336
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50339
            Source: unknownNetwork traffic detected: HTTP traffic on port 50386 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50338
            Source: unknownNetwork traffic detected: HTTP traffic on port 50546 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50571
            Source: unknownNetwork traffic detected: HTTP traffic on port 50392 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50570
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50573
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50330
            Source: unknownNetwork traffic detected: HTTP traffic on port 50225 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50333
            Source: unknownNetwork traffic detected: HTTP traffic on port 49769 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49803 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 50071 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 50305 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49849 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49900 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50106
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50105
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50347
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50108
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50107
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50349
            Source: unknownNetwork traffic detected: HTTP traffic on port 50505 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50109
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50340
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50100
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50342
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50341
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50102
            Source: unknownNetwork traffic detected: HTTP traffic on port 50339 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50344
            Source: unknownNetwork traffic detected: HTTP traffic on port 50352 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50101
            Source: unknownNetwork traffic detected: HTTP traffic on port 50243 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50343
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50104
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50103
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50345
            Source: unknownNetwork traffic detected: HTTP traffic on port 50289 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49964 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 50128 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 50197 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 50512 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49735 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50117
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50359
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50358
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50119
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50118
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50351
            Source: unknownNetwork traffic detected: HTTP traffic on port 50317 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 50558 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50111
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50110
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50352
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50113
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50355
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50112
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50354
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50115
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50357
            Source: unknownNetwork traffic detected: HTTP traffic on port 50374 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49745 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49986 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49850 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 50175 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49757 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49799
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50128
            Source: unknownNetwork traffic detected: HTTP traffic on port 50419 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 50012 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50127
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50369
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49797
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49796
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50129
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49795
            Source: unknownNetwork traffic detected: HTTP traffic on port 49952 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 50524 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49794
            Source: unknownNetwork traffic detected: HTTP traffic on port 50442 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49793
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50120
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49791
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50362
            Source: unknownNetwork traffic detected: HTTP traffic on port 50093 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49790
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50122
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50121
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50363
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50124
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50366
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50123
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50365
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50126
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50368
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50367
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50370
            Source: unknownNetwork traffic detected: HTTP traffic on port 49884 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49907 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 50340 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49789
            Source: unknownNetwork traffic detected: HTTP traffic on port 50478 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49733 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50535
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50534
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50537
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50539
            Source: unknownNetwork traffic detected: HTTP traffic on port 50571 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49894 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50533
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50532
            Source: unknownNetwork traffic detected: HTTP traffic on port 50106 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 50267 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 50410 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49942 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 50081 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 50362 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50304
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50546
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50303
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50545
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50306
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50305
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50547
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50308
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50307
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50549
            Source: unknownNetwork traffic detected: HTTP traffic on port 49919 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50309
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50540
            Source: unknownNetwork traffic detected: HTTP traffic on port 50201 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50300
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50542
            Source: unknownNetwork traffic detected: HTTP traffic on port 49767 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50541
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50302
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50544
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50543
            Source: unknownNetwork traffic detected: HTTP traffic on port 49827 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 50046 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49882 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 50141 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 50233 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50314
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50556
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50317
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50559
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50558
            Source: unknownNetwork traffic detected: HTTP traffic on port 49976 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50319
            Source: unknownNetwork traffic detected: HTTP traffic on port 50118 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50318
            Source: unknownNetwork traffic detected: HTTP traffic on port 49815 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 50279 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50551
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50550
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50310
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50313
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50555
            Source: unknownNetwork traffic detected: HTTP traffic on port 50223 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50312
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50554
            Source: unknownNetwork traffic detected: HTTP traffic on port 50024 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 50163 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49860 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 50349 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49755 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50326
            Source: unknownNetwork traffic detected: HTTP traffic on port 50503 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50568
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50567
            Source: unknownNetwork traffic detected: HTTP traffic on port 49998 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50328
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50327
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50329
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50560
            Source: unknownNetwork traffic detected: HTTP traffic on port 50245 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50320
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50562
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50561
            Source: unknownNetwork traffic detected: HTTP traffic on port 50058 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50322
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50564
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50321
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50563
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50324
            Source: unknownNetwork traffic detected: HTTP traffic on port 50488 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50323
            Source: unknownNetwork traffic detected: HTTP traffic on port 50372 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50565
            Source: unknownNetwork traffic detected: HTTP traffic on port 50432 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 50002 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 50514 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 50185 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 50409 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49920 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 50327 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50054
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50296
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50053
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50295
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50056
            Source: unknownNetwork traffic detected: HTTP traffic on port 49789 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50298
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50055
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50297
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50058
            Source: unknownNetwork traffic detected: HTTP traffic on port 49766 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50057
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50299
            Source: unknownNetwork traffic detected: HTTP traffic on port 49961 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50061
            Source: unknownNetwork traffic detected: HTTP traffic on port 50286 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50060
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50063
            Source: unknownNetwork traffic detected: HTTP traffic on port 50102 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 50343 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 50045 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 50389 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 50400 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 50148 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 50274 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50065
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50064
            Source: unknownNetwork traffic detected: HTTP traffic on port 50377 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50066
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50069
            Source: unknownNetwork traffic detected: HTTP traffic on port 50205 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 50240 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 50183 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50070
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50072
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50071
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50074
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50073
            Source: unknownNetwork traffic detected: HTTP traffic on port 49823 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 50537 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 50308 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49869 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49790 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 50252 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 50502 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 50550 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50076
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50078
            Source: unknownNetwork traffic detected: HTTP traffic on port 50057 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50077
            Source: unknownNetwork traffic detected: HTTP traffic on port 49892 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50079
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50081
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50082
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50085
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50084
            Source: unknownNetwork traffic detected: HTTP traffic on port 49904 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49847 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 50549 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50087
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50086
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50089
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50088
            Source: unknownNetwork traffic detected: HTTP traffic on port 50079 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50092
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50091
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50094
            Source: unknownNetwork traffic detected: HTTP traffic on port 50136 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49983 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50093
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50096
            Source: unknownNetwork traffic detected: HTTP traffic on port 49938 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 50023 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50095
            Source: unknownNetwork traffic detected: HTTP traffic on port 49811 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 50365 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 50527 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50017
            Source: unknownNetwork traffic detected: HTTP traffic on port 50193 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50259
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50019
            Source: unknownNetwork traffic detected: HTTP traffic on port 49951 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50252
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50494
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50493
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50012
            Source: unknownNetwork traffic detected: HTTP traffic on port 49916 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50254
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50496
            Source: unknownNetwork traffic detected: HTTP traffic on port 50055 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50011
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50253
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50495
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50256
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50498
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50013
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50258
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50015
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50257
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50261
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50260
            Source: unknownNetwork traffic detected: HTTP traffic on port 49776 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 50230 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50028
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50021
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50020
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50262
            Source: unknownNetwork traffic detected: HTTP traffic on port 50318 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50023
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50265
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50022
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50264
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50025
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50267
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50024
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50266
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50027
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50269
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50026
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50268
            Source: unknownNetwork traffic detected: HTTP traffic on port 49985 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 50264 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50270
            Source: unknownNetwork traffic detected: HTTP traffic on port 50021 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50030
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50272
            Source: unknownNetwork traffic detected: HTTP traffic on port 50138 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50271
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50039
            Source: unknownNetwork traffic detected: HTTP traffic on port 50298 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 50011 -> 443
            Source: unknownHTTPS traffic detected: 49.12.121.47:443 -> 192.168.2.4:49733 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.19.159.224:443 -> 192.168.2.4:49738 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.19.208.152:443 -> 192.168.2.4:49745 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:49749 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49750 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:49757 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:49755 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:49760 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49762 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49759 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:49761 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:49764 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:49766 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49768 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49767 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49765 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:49770 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:49774 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49778 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49776 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:49781 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:49783 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49785 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49791 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49789 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49790 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49782 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49794 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49803 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:49809 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49812 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49811 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:49815 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:49814 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49817 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49828 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49829 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:49827 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49822 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:49835 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49833 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49832 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49831 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49830 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49834 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49840 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49841 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49839 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49842 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49847 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:49851 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:49850 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49854 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49857 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49869 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:49871 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:49873 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49874 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49875 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:49876 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49880 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49881 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49884 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:49882 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:49878 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49888 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49887 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49891 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49892 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49901 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49905 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49906 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49907 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:49910 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49912 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49913 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:49919 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49922 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49923 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49934 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49935 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49979 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49996 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49997 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50003 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50009 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50011 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50024 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50026 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50025 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:50041 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50049 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50159 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50185 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50187 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50191 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50194 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:50205 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50203 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:50211 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:50212 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:50218 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:50221 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50224 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50225 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:50233 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:50226 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:50231 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:50232 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:50228 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:50234 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50236 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:50235 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50240 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50239 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50241 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50243 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:50242 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:50245 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50246 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50249 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50248 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50247 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50252 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50253 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50254 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50256 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50257 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50258 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50259 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50261 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50264 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50265 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50267 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50266 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50271 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50268 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50270 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50269 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50272 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50274 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50275 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50273 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50276 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50277 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50278 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50280 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50279 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50281 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50284 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50285 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50286 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50287 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50288 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50289 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50292 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50295 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50294 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50293 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50297 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50296 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50296 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50299 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50298 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50300 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50302 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50303 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50304 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50305 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50309 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50308 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50306 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50307 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50310 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50314 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50313 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50312 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50317 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50319 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50318 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50320 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50321 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50322 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50323 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50324 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50326 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50327 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50328 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50329 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50330 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50333 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50336 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50338 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50341 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50340 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50339 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50342 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50343 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50344 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50345 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50347 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50349 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50351 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50351 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50352 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50354 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50355 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50357 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50358 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50359 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50363 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50362 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50365 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50367 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50366 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50369 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50368 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50370 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50372 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50373 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50376 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50374 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50375 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50378 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50377 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50382 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50383 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50386 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50385 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50389 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50392 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50393 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50391 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50396 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50397 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50398 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50400 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50402 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50401 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50404 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50406 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50405 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50407 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50409 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50410 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50412 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50413 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50414 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50419 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50418 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50425 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50432 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50442 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50461 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50462 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50463 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50464 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50471 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50474 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50473 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50475 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50477 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50478 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50479 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50480 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50482 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50483 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50486 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50487 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50488 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50489 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50490 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50498 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50491 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50492 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50494 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50493 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50501 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50500 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50503 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50502 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50505 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50506 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50509 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50510 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50511 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50512 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50519 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50514 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50516 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50518 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50521 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50523 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50517 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50525 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50524 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50528 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50526 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50532 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50529 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50534 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50533 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50527 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50539 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50537 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50541 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50542 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50540 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50546 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50547 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50544 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50543 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50549 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50550 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50551 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50535 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50554 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50555 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50545 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50556 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50559 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50558 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50560 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50563 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50562 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50564 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50568 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50565 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50570 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50571 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:50573 version: TLS 1.2
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeFile created: C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\026A86A161D256DBB33076EDF20C0E5E_86AB612B21DEDF3B8CD155ED2E4114FFJump to dropped file
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeFile created: C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AF360AACB1570042DEFBC833317997D0_684EE07DA693FF51901FCCD35B88A7C0Jump to dropped file
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeFile created: C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F599B66E34645915D6CE3B9990A2673FJump to dropped file
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeFile created: C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A37B8BA80004D3266CB4D93B2052DC10_EBDB5A7037F08CDFB408DBFC0D44B43DJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bddci.catJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\bddci.catJump to dropped file

            Spam, unwanted Advertisements and Ransom Demands

            barindex
            Writes a notice file (html or txt) to demand a ransom
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile dropped: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\bllist.txt -> encryptedconnection.net,mncig.org,valvol.xyz,summonerswarskyarenaguides.com,readonlinefreebook.com,vestbooks.website,bg4nxu2u5t.com,sgkaa.com,bt4gprx.com,wwgnpwus.top,hypnosisdampers.shop,llama2.space,mp3king.cc,freesofthere.com,d2ze9scn6abmic.cloudfront.net,steam-gift.com,soap2day.ph,milligestion.fr,stecmcommunnity.com,air-evasion.fr,xn--80akoaetjlq5g.xn--p1ai,ssoapgate.com,rojatv.tv,9ut1.shop,mstatik.com,harjjshit.xyz,movierulzfree.co,boldnarrow.com,portlstrou.ru,acache32.com,gotta.gleeze.com,funnycamss.cc,streamcomplet.top,123-movies.boats,yourbrowser.cc,cumtube.xyz,simem.co,xn--90aqok.xn--p1ai,ffcrystals.club,cafinancialmatters.com,powvideo.net,dmovie.fun,amavoideric.com,onlinefotoshop.ru,spiritstore.co.uk,putlocker.onl,fullmatchtv.com,digi-tcg.online,k1a5p4c6h2a9r7g3e.com,cracksoftwareguru.com,latestcache.com,tradingnano.com,qawsedrftgyhujik66.shop,unblocktorrent.com,slmcdn18.shop,blcdccdn20.shop,hlsvideocdn180.shop,yify2.com,slmcdnseriea34.shop,katespadecanadaonline.ca,katespadeoutletscanada.ca,grauglakJump to dropped file

            System Summary

            barindex
            Detected potential unwanted application
            Source: FileZilla_3.67.1_win64_sponsored-setup.exePE Siganture Subject Chain: CN=Tim Kosse, O=Tim Kosse, S=Nordrhein-Westfalen, C=DE
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess Stats: CPU usage > 49%
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\bddci.sysJump to behavior
            Source: C:\Windows\System32\rundll32.exeFile created: C:\Windows\system32\DRIVERS\SETF07D.tmp
            Source: C:\Windows\System32\rundll32.exeFile created: C:\Windows\system32\DRIVERS\SETF07D.tmp
            Source: C:\Windows\System32\rundll32.exeFile created: C:\Windows\system32\DRIVERS\SETF07D.tmp
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeFile created: C:\Windows\assembly\Desktop.ini
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeFile created: C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A37B8BA80004D3266CB4D93B2052DC10_EBDB5A7037F08CDFB408DBFC0D44B43D
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeFile created: C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A37B8BA80004D3266CB4D93B2052DC10_EBDB5A7037F08CDFB408DBFC0D44B43D
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeFile created: C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\026A86A161D256DBB33076EDF20C0E5E_86AB612B21DEDF3B8CD155ED2E4114FF
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeFile created: C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\026A86A161D256DBB33076EDF20C0E5E_86AB612B21DEDF3B8CD155ED2E4114FF
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeFile created: C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AF360AACB1570042DEFBC833317997D0_684EE07DA693FF51901FCCD35B88A7C0
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeFile created: C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AF360AACB1570042DEFBC833317997D0_684EE07DA693FF51901FCCD35B88A7C0
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeFile created: C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F599B66E34645915D6CE3B9990A2673F
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeFile created: C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F599B66E34645915D6CE3B9990A2673F
            Source: C:\Windows\System32\netsh.exeFile created: C:\Windows\system32\config\systemprofile\AppData\Local\PeerDistRepub
            Source: C:\Windows\System32\rundll32.exeFile deleted: C:\Windows\System32\drivers\SETF07D.tmp
            Source: wxmsw32u_aui_gcc_custom.dll.0.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
            Source: wxmsw32u_xrc_gcc_custom.dll.0.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
            Source: libnettle-8.dll.0.drStatic PE information: Number of sections : 12 > 10
            Source: fzputtygen.exe.0.drStatic PE information: Number of sections : 12 > 10
            Source: zlib1.dll.0.drStatic PE information: Number of sections : 12 > 10
            Source: libfzclient-commonui-private-3-67-1.dll.0.drStatic PE information: Number of sections : 11 > 10
            Source: wxmsw32u_core_gcc_custom.dll.0.drStatic PE information: Number of sections : 12 > 10
            Source: fzsftp.exe.0.drStatic PE information: Number of sections : 12 > 10
            Source: libfzclient-private-3-67-1.dll.0.drStatic PE information: Number of sections : 11 > 10
            Source: libgcc_s_seh-1.dll.0.drStatic PE information: Number of sections : 11 > 10
            Source: wxbase32u_gcc_custom.dll.0.drStatic PE information: Number of sections : 12 > 10
            Source: filezilla.exe.0.drStatic PE information: Number of sections : 12 > 10
            Source: fzshellext.dll.0.drStatic PE information: Number of sections : 11 > 10
            Source: libhogweed-6.dll.0.drStatic PE information: Number of sections : 11 > 10
            Source: fzshellext_64.dll.0.drStatic PE information: Number of sections : 12 > 10
            Source: libstdc++-6.dll.0.drStatic PE information: Number of sections : 11 > 10
            Source: wxbase32u_xml_gcc_custom.dll.0.drStatic PE information: Number of sections : 12 > 10
            Source: libpng16-16.dll.0.drStatic PE information: Number of sections : 11 > 10
            Source: wxmsw32u_aui_gcc_custom.dll.0.drStatic PE information: Number of sections : 12 > 10
            Source: libgmp-10.dll.0.drStatic PE information: Number of sections : 11 > 10
            Source: wxmsw32u_xrc_gcc_custom.dll.0.drStatic PE information: Number of sections : 12 > 10
            Source: libfilezilla-45.dll.0.drStatic PE information: Number of sections : 12 > 10
            Source: libsqlite3-0.dll.0.drStatic PE information: Number of sections : 11 > 10
            Source: libgnutls-30.dll.0.drStatic PE information: Number of sections : 11 > 10
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamefzshellext.dllb! vs FileZilla_3.67.1_win64_sponsored-setup.exe
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000003.2080053264.00000000055D7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameInstaller.exe5 vs FileZilla_3.67.1_win64_sponsored-setup.exe
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000003.1961222518.00000000055D7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameInstaller.e vs FileZilla_3.67.1_win64_sponsored-setup.exe
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000003.1961222518.00000000055D7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameInstaller.exe5 vs FileZilla_3.67.1_win64_sponsored-setup.exe
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2209775656.000000000040A000.00000004.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenamefzshellext.dllb! vs FileZilla_3.67.1_win64_sponsored-setup.exe
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000000.1670072338.000000000046A000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameFileZilla_3.67.1_win32-setup.exe4 vs FileZilla_3.67.1_win64_sponsored-setup.exe
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2214412258.00000000055D7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameInstaller.exe5 vs FileZilla_3.67.1_win64_sponsored-setup.exe
            Source: FileZilla_3.67.1_win64_sponsored-setup.exeBinary or memory string: OriginalFilenameFileZilla_3.67.1_win32-setup.exe4 vs FileZilla_3.67.1_win64_sponsored-setup.exe
            Source: FileZilla_3.67.1_win64_sponsored-setup.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
            Source: ICSharpCode.SharpZipLib.dll.2.dr, InflaterInputBuffer.csCryptographic APIs: 'TransformBlock'
            Source: ICSharpCode.SharpZipLib.dll.2.dr, DeflaterOutputStream.csCryptographic APIs: 'TransformBlock'
            Source: ICSharpCode.SharpZipLib.dll.2.dr, ZipAESTransform.csCryptographic APIs: 'TransformBlock'
            Source: classification engineClassification label: mal56.rans.phis.troj.spyw.expl.evad.winEXE@74/1350@17/9
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeFile created: C:\Program Files\FileZilla FTP ClientJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\WcInstaller[1].exeJump to behavior
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Search.exeMutant created: NULL
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6044:120:WilError_03
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeMutant created: \BaseNamedObjects\Global\.net clr networking
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeMutant created: \BaseNamedObjects\Global\servicemodelservice 3.0.0.0
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6048:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5764:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4336:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6712:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2492:120:WilError_03
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeMutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeMutant created: \Sessions\1\BaseNamedObjects\FileZilla 3 Mutex Type 1
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5548:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:796:120:WilError_03
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeMutant created: \Sessions\1\BaseNamedObjects\FileZilla 3 Mutex Type 9
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2112:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6304:120:WilError_03
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeMutant created: \Sessions\1\BaseNamedObjects\FileZilla 3 Mutex Type 5
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6332:120:WilError_03
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeMutant created: \Sessions\1\BaseNamedObjects\FileZilla 3 Mutex Type 4
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeMutant created: \Sessions\1\BaseNamedObjects\Global\servicemodelservice 3.0.0.0
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeMutant created: \Sessions\1\BaseNamedObjects\FileZilla 3 Mutex Type 6
            Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:6568:120:WilError_03
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeMutant created: \Sessions\1\BaseNamedObjects\AdAwareWebCompanionuser
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeFile created: C:\Users\user\AppData\Local\Temp\nscF7A6.tmpJump to behavior
            Source: FileZilla_3.67.1_win64_sponsored-setup.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeFile read: C:\Users\desktop.iniJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess created: C:\Windows\System32\rundll32.exe "C:\Windows\sysnative\RunDLL32.Exe" syssetup,SetupInfObjectInstallAction BootInstall 128 C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bddci.inf
            Source: DCIService.exe, 0000001C.00000000.2321641309.00007FF7EB15A000.00000002.00000001.01000000.0000002B.sdmpBinary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
            Source: DCIService.exe, 0000001C.00000000.2321641309.00007FF7EB15A000.00000002.00000001.01000000.0000002B.sdmpBinary or memory string: CREATE TABLE IF NOT EXISTS applications_stats(Application TEXT, Total_safe INTEGER, Total_unsafe INTEGER); CREATE UNIQUE INDEX IF NOT EXISTS applications_stats_idx ON applications_stats(Application, Total_safe, Total_unsafe);
            Source: DCIService.exe, 0000001C.00000000.2321641309.00007FF7EB15A000.00000002.00000001.01000000.0000002B.sdmpBinary or memory string: CREATE TABLE IF NOT EXISTS daily_stats(Date Date, Total_safe INTEGER, Total_unsafe INTEGER); CREATE UNIQUE INDEX IF NOT EXISTS daily_stats_idx ON daily_stats(Date, Total_safe, Total_unsafe);
            Source: DCIService.exe, 0000001C.00000000.2321641309.00007FF7EB15A000.00000002.00000001.01000000.0000002B.sdmpBinary or memory string: CREATE TABLE IF NOT EXISTS bwl_stats(Date Date primary key, found_in_whitelist INTEGER, found_in_blacklist INTEGER, not_checked INTEGER); CREATE UNIQUE INDEX IF NOT EXISTS daily_stats_idx ON daily_stats(Date, found_in_blacklist, found_in_whitelist, not_checked);
            Source: DCIService.exe, 0000001C.00000000.2321641309.00007FF7EB15A000.00000002.00000001.01000000.0000002B.sdmpBinary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
            Source: DCIService.exe, 0000001C.00000000.2321641309.00007FF7EB15A000.00000002.00000001.01000000.0000002B.sdmpBinary or memory string: CREATE TABLE IF NOT EXISTS total_capture(Total_sites INTEGER, Total_unsafe INTEGER, Total_typosquatted INTEGER); CREATE UNIQUE INDEX IF NOT EXISTS total_capture_idx ON total_capture(Total_sites, Total_unsafe, Total_typosquatted);
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeFile read: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeJump to behavior
            Source: unknownProcess created: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe "C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe"
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeProcess created: C:\Users\user\AppData\Local\Temp\nsnF7E7.tmp\WcInstaller.exe "C:\Users\user\AppData\Local\Temp\nsnF7E7.tmp\WcInstaller.exe" --silent --partner=FZ210427 --searchenbl
            Source: C:\Users\user\AppData\Local\Temp\nsnF7E7.tmp\WcInstaller.exeProcess created: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe .\WebCompanionInstaller.exe --partner=FZ210427 --version=9.1.0.993 --silent --partner=FZ210427 --searchenbl
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess created: C:\Windows\SysWOW64\sc.exe "sc.exe" Create "WCAssistantService" binPath= "C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe" DisplayName= "WC Assistant" start= auto
            Source: C:\Windows\SysWOW64\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess created: C:\Windows\SysWOW64\sc.exe "sc.exe" failure WCAssistantService reset= 30 actions= restart/60000
            Source: C:\Windows\SysWOW64\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess created: C:\Windows\SysWOW64\sc.exe "sc.exe" description "WCAssistantService" "Ad-Aware Web Companion Internet security service"
            Source: C:\Windows\SysWOW64\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeProcess created: C:\Windows\System32\regsvr32.exe "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\FileZilla FTP Client\fzshellext_64.dll"
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeProcess created: C:\Program Files\FileZilla FTP Client\filezilla.exe "C:\Program Files\FileZilla FTP Client\filezilla.exe"
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess created: C:\Windows\System32\rundll32.exe "C:\Windows\sysnative\RunDLL32.Exe" syssetup,SetupInfObjectInstallAction BootInstall 128 C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bddci.inf
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess created: C:\Windows\System32\net.exe "C:\Windows\sysnative\net.exe" start bddci
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess created: C:\Windows\SysWOW64\sc.exe "sc.exe" Create "DCIService" binPath= "C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\DCIService.exe" DisplayName= "DCIService" start= auto
            Source: C:\Windows\System32\net.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\SysWOW64\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\System32\rundll32.exeProcess created: C:\Windows\System32\runonce.exe "C:\Windows\system32\runonce.exe" -r
            Source: C:\Windows\System32\net.exeProcess created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 start bddci
            Source: C:\Windows\System32\runonce.exeProcess created: C:\Windows\System32\grpconv.exe "C:\Windows\System32\grpconv.exe" -o
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess created: C:\Windows\SysWOW64\sc.exe "sc.exe" description "DCIService" "Webprotection Bridge service"
            Source: C:\Windows\SysWOW64\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bridge_start.cmd"
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\sc.exe sc start DCIService
            Source: unknownProcess created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\DCIService.exe "C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\DCIService.exe"
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C netsh http add urlacl url=http://+:9007/ user=Everyone
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\netsh.exe netsh http add urlacl url=http://+:9007/ user=Everyone
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe "C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe" --silent --install --geo= --searchenbl
            Source: unknownProcess created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe "C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe"
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C netsh http add urlacl url=http://+:9007/ user=Everyone
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\netsh.exe netsh http add urlacl url=http://+:9007/ user=Everyone
            Source: unknownProcess created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe "C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe" --minimize
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\rsvnd5a7.cmdline"
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES71F3.tmp" "c:\Users\user\AppData\Local\Temp\CSC7165.tmp"
            Source: unknownProcess created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe "C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe" --minimize
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\fr_px-r0.cmdline"
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\xsc65psb.cmdline"
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES822F.tmp" "c:\Users\user\AppData\Local\Temp\CSC821F.tmp"
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES827D.tmp" "c:\Users\user\AppData\Local\Temp\CSC826D.tmp"
            Source: unknownProcess created: C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Search.exe "C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Search.exe" --searchConfigPath="C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Options\SearchMetadata.txt" --eventConfigPath="C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Options\EventMetadata.txt"
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Search.exe "C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Search.exe" --searchConfigPath="C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Options\SearchMetadata.txt" --eventConfigPath="C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Options\EventMetadata.txt"
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeProcess created: C:\Users\user\AppData\Local\Temp\nsnF7E7.tmp\WcInstaller.exe "C:\Users\user\AppData\Local\Temp\nsnF7E7.tmp\WcInstaller.exe" --silent --partner=FZ210427 --searchenblJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeProcess created: C:\Windows\System32\regsvr32.exe "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\FileZilla FTP Client\fzshellext_64.dll"Jump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeProcess created: C:\Program Files\FileZilla FTP Client\filezilla.exe "C:\Program Files\FileZilla FTP Client\filezilla.exe" Jump to behavior
            Source: C:\Users\user\AppData\Local\Temp\nsnF7E7.tmp\WcInstaller.exeProcess created: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe .\WebCompanionInstaller.exe --partner=FZ210427 --version=9.1.0.993 --silent --partner=FZ210427 --searchenblJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess created: C:\Windows\SysWOW64\sc.exe "sc.exe" Create "WCAssistantService" binPath= "C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe" DisplayName= "WC Assistant" start= autoJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess created: C:\Windows\SysWOW64\sc.exe "sc.exe" failure WCAssistantService reset= 30 actions= restart/60000Jump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess created: C:\Windows\SysWOW64\sc.exe "sc.exe" description "WCAssistantService" "Ad-Aware Web Companion Internet security service"Jump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess created: C:\Windows\System32\rundll32.exe "C:\Windows\sysnative\RunDLL32.Exe" syssetup,SetupInfObjectInstallAction BootInstall 128 C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bddci.infJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess created: C:\Windows\System32\net.exe "C:\Windows\sysnative\net.exe" start bddciJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess created: C:\Windows\SysWOW64\sc.exe "sc.exe" Create "DCIService" binPath= "C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\DCIService.exe" DisplayName= "DCIService" start= autoJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess created: C:\Windows\SysWOW64\sc.exe "sc.exe" description "DCIService" "Webprotection Bridge service"Jump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bridge_start.cmd" Jump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C netsh http add urlacl url=http://+:9007/ user=EveryoneJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe "C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe" --silent --install --geo= --searchenbl Jump to behavior
            Source: C:\Windows\System32\rundll32.exeProcess created: C:\Windows\System32\runonce.exe "C:\Windows\system32\runonce.exe" -r
            Source: C:\Windows\System32\net.exeProcess created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 start bddci
            Source: C:\Windows\System32\runonce.exeProcess created: C:\Windows\System32\grpconv.exe "C:\Windows\System32\grpconv.exe" -o
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\sc.exe sc start DCIService
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\netsh.exe netsh http add urlacl url=http://+:9007/ user=Everyone
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\rsvnd5a7.cmdline"
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C netsh http add urlacl url=http://+:9007/ user=Everyone
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\netsh.exe netsh http add urlacl url=http://+:9007/ user=Everyone
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES71F3.tmp" "c:\Users\user\AppData\Local\Temp\CSC7165.tmp"
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\fr_px-r0.cmdline"
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\xsc65psb.cmdline"
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES822F.tmp" "c:\Users\user\AppData\Local\Temp\CSC821F.tmp"
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES827D.tmp" "c:\Users\user\AppData\Local\Temp\CSC826D.tmp"
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeSection loaded: apphelp.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeSection loaded: propsys.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeSection loaded: dwmapi.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeSection loaded: oleacc.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeSection loaded: ntmarta.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeSection loaded: version.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeSection loaded: shfolder.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeSection loaded: secur32.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeSection loaded: riched20.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeSection loaded: usp10.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeSection loaded: msls31.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeSection loaded: textinputframework.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeSection loaded: coreuicomponents.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeSection loaded: coremessaging.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeSection loaded: wintypes.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeSection loaded: wintypes.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeSection loaded: wintypes.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeSection loaded: textshaping.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeSection loaded: wininet.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeSection loaded: iertutil.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeSection loaded: winhttp.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeSection loaded: mswsock.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeSection loaded: iphlpapi.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeSection loaded: winnsi.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeSection loaded: urlmon.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeSection loaded: srvcli.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeSection loaded: netutils.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeSection loaded: dnsapi.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeSection loaded: rasadhlp.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeSection loaded: fwpuclnt.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeSection loaded: schannel.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeSection loaded: mskeyprotect.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeSection loaded: ntasn1.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeSection loaded: msasn1.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeSection loaded: dpapi.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeSection loaded: rsaenh.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeSection loaded: gpapi.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeSection loaded: ncrypt.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeSection loaded: ncryptsslp.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeSection loaded: iconcodecservice.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeSection loaded: windowscodecs.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeSection loaded: edputil.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeSection loaded: windows.staterepositoryps.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeSection loaded: appresolver.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeSection loaded: bcp47langs.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeSection loaded: slc.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeSection loaded: sppc.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeSection loaded: onecorecommonproxystub.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeSection loaded: linkinfo.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeSection loaded: ntshrui.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeSection loaded: cscapi.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeSection loaded: libgcc_s_dw2-1.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\nsnF7E7.tmp\WcInstaller.exeSection loaded: apphelp.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeSection loaded: mscoree.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeSection loaded: version.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeSection loaded: msasn1.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeSection loaded: riched20.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeSection loaded: usp10.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeSection loaded: msls31.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeSection loaded: rsaenh.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeSection loaded: gpapi.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeSection loaded: httpapi.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeSection loaded: mswsock.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeSection loaded: dnsapi.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeSection loaded: iphlpapi.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeSection loaded: rasadhlp.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeSection loaded: fwpuclnt.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeSection loaded: shfolder.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeSection loaded: ntmarta.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeSection loaded: amsi.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeSection loaded: rasapi32.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeSection loaded: rasman.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeSection loaded: rtutils.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeSection loaded: winhttp.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeSection loaded: dhcpcsvc6.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeSection loaded: dhcpcsvc.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeSection loaded: winnsi.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeSection loaded: security.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeSection loaded: secur32.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeSection loaded: schannel.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeSection loaded: mskeyprotect.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeSection loaded: ntasn1.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeSection loaded: ncrypt.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeSection loaded: ncryptsslp.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeSection loaded: propsys.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeSection loaded: edputil.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeSection loaded: urlmon.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeSection loaded: iertutil.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeSection loaded: srvcli.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeSection loaded: netutils.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeSection loaded: windows.staterepositoryps.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeSection loaded: wintypes.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeSection loaded: appresolver.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeSection loaded: bcp47langs.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeSection loaded: slc.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeSection loaded: sppc.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeSection loaded: onecorecommonproxystub.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeSection loaded: apphelp.dllJump to behavior
            Source: C:\Windows\System32\regsvr32.exeSection loaded: apphelp.dll
            Source: C:\Windows\System32\regsvr32.exeSection loaded: aclayers.dll
            Source: C:\Windows\System32\regsvr32.exeSection loaded: sfc.dll
            Source: C:\Windows\System32\regsvr32.exeSection loaded: sfc_os.dll
            Source: C:\Windows\System32\regsvr32.exeSection loaded: kernel.appcore.dll
            Source: C:\Windows\System32\regsvr32.exeSection loaded: uxtheme.dll
            Source: C:\Windows\System32\regsvr32.exeSection loaded: windows.storage.dll
            Source: C:\Windows\System32\regsvr32.exeSection loaded: wldp.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: libfzclient-commonui-private-3-67-1.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: libfzclient-private-3-67-1.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: libfilezilla-45.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: wxbase32u_gcc_custom.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: wxmsw32u_aui_gcc_custom.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: wxmsw32u_core_gcc_custom.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: wxmsw32u_xrc_gcc_custom.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: libsqlite3-0.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: mpr.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: netapi32.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: powrprof.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: libgcc_s_seh-1.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: libstdc++-6.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: libfzclient-private-3-67-1.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: libfilezilla-45.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: libgcc_s_seh-1.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: libstdc++-6.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: libfilezilla-45.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: libgcc_s_seh-1.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: libstdc++-6.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: libgmp-10.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: libgnutls-30.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: libhogweed-6.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: libnettle-8.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: iphlpapi.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: libgcc_s_seh-1.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: libstdc++-6.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: zlib1.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: version.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: libgcc_s_seh-1.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: libstdc++-6.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: wxmsw32u_core_gcc_custom.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: uxtheme.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: libgcc_s_seh-1.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: libstdc++-6.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: libpng16-16.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: oleacc.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: uxtheme.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: winmm.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: libgcc_s_seh-1.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: libstdc++-6.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: wxbase32u_xml_gcc_custom.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: libgcc_s_seh-1.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: libstdc++-6.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: libhogweed-6.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: libnettle-8.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: ncrypt.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: libnettle-8.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: netutils.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: srvcli.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: ntasn1.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: umpdc.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: kernel.appcore.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: windows.storage.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: wldp.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: msasn1.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: textshaping.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: msimg32.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: dataexchange.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: d3d11.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: dcomp.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: dxgi.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: twinapi.appcore.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: windowscodecs.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: profapi.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: msftedit.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: windows.globalization.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: bcp47langs.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: bcp47mrm.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: globinputhost.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: propsys.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: thumbcache.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: policymanager.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: msvcp110_win.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: apphelp.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: secur32.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: wininet.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: wtsapi32.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: userenv.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: sspicli.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: cryptbase.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: ehstorshell.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: cscui.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: textinputframework.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: coreuicomponents.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: coremessaging.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: ntmarta.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: coremessaging.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: wintypes.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: wintypes.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: wintypes.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: mswsock.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: dnsapi.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: rasadhlp.dll
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeSection loaded: fwpuclnt.dll
            Source: C:\Windows\System32\net.exeSection loaded: mpr.dll
            Source: C:\Windows\System32\net.exeSection loaded: wkscli.dll
            Source: C:\Windows\System32\net.exeSection loaded: netutils.dll
            Source: C:\Windows\System32\net.exeSection loaded: samcli.dll
            Source: C:\Windows\System32\net.exeSection loaded: srvcli.dll
            Source: C:\Windows\System32\net.exeSection loaded: iphlpapi.dll
            Source: C:\Windows\System32\runonce.exeSection loaded: windows.storage.dll
            Source: C:\Windows\System32\runonce.exeSection loaded: wldp.dll
            Source: C:\Windows\System32\runonce.exeSection loaded: kernel.appcore.dll
            Source: C:\Windows\System32\runonce.exeSection loaded: uxtheme.dll
            Source: C:\Windows\System32\runonce.exeSection loaded: propsys.dll
            Source: C:\Windows\System32\runonce.exeSection loaded: profapi.dll
            Source: C:\Windows\System32\runonce.exeSection loaded: windows.staterepositoryps.dll
            Source: C:\Windows\System32\runonce.exeSection loaded: edputil.dll
            Source: C:\Windows\System32\runonce.exeSection loaded: urlmon.dll
            Source: C:\Windows\System32\runonce.exeSection loaded: iertutil.dll
            Source: C:\Windows\System32\runonce.exeSection loaded: srvcli.dll
            Source: C:\Windows\System32\runonce.exeSection loaded: netutils.dll
            Source: C:\Windows\System32\runonce.exeSection loaded: sspicli.dll
            Source: C:\Windows\System32\runonce.exeSection loaded: wintypes.dll
            Source: C:\Windows\System32\runonce.exeSection loaded: appresolver.dll
            Source: C:\Windows\System32\runonce.exeSection loaded: bcp47langs.dll
            Source: C:\Windows\System32\runonce.exeSection loaded: slc.dll
            Source: C:\Windows\System32\runonce.exeSection loaded: userenv.dll
            Source: C:\Windows\System32\runonce.exeSection loaded: sppc.dll
            Source: C:\Windows\System32\runonce.exeSection loaded: onecorecommonproxystub.dll
            Source: C:\Windows\System32\runonce.exeSection loaded: onecoreuapcommonproxystub.dll
            Source: C:\Windows\System32\net1.exeSection loaded: samcli.dll
            Source: C:\Windows\System32\net1.exeSection loaded: netutils.dll
            Source: C:\Windows\System32\net1.exeSection loaded: dsrole.dll
            Source: C:\Windows\System32\net1.exeSection loaded: srvcli.dll
            Source: C:\Windows\System32\net1.exeSection loaded: wkscli.dll
            Source: C:\Windows\System32\net1.exeSection loaded: logoncli.dll
            Source: C:\Windows\System32\net1.exeSection loaded: cryptbase.dll
            Source: C:\Windows\System32\grpconv.exeSection loaded: kernel.appcore.dll
            Source: C:\Windows\System32\grpconv.exeSection loaded: uxtheme.dll
            Source: C:\Windows\SysWOW64\cmd.exeSection loaded: cmdext.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\DCIService.exeSection loaded: apphelp.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\DCIService.exeSection loaded: msvcp140.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\DCIService.exeSection loaded: vcruntime140.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\DCIService.exeSection loaded: vcruntime140_1.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\DCIService.exeSection loaded: vcruntime140_1.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\DCIService.exeSection loaded: kernel.appcore.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\DCIService.exeSection loaded: windows.storage.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\DCIService.exeSection loaded: wldp.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\DCIService.exeSection loaded: version.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\DCIService.exeSection loaded: ntmarta.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\DCIService.exeSection loaded: iphlpapi.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\DCIService.exeSection loaded: mswsock.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\DCIService.exeSection loaded: dhcpcsvc6.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\DCIService.exeSection loaded: dhcpcsvc.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\DCIService.exeSection loaded: dnsapi.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\DCIService.exeSection loaded: cryptbase.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: kernel.appcore.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: ifmon.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: iphlpapi.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: mprapi.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: rasmontr.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: rasapi32.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: fwpuclnt.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: rasman.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: mfc42u.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: rasman.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: authfwcfg.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: fwpolicyiomgr.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: firewallapi.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: dnsapi.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: fwbase.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: dhcpcmonitor.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: dot3cfg.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: dot3api.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: onex.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: eappcfg.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: ncrypt.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: eappprxy.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: ntasn1.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: fwcfg.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: hnetmon.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: netshell.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: nlaapi.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: netsetupapi.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: netiohlp.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: dhcpcsvc.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: winnsi.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: nshhttp.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: httpapi.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: nshipsec.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: userenv.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: activeds.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: polstore.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: winipsec.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: adsldpc.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: adsldpc.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: nshwfp.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: cabinet.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: p2pnetsh.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: p2p.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: profapi.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: cryptbase.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: rpcnsh.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: whhelper.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: winhttp.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: wlancfg.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: cryptsp.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: wlanapi.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: wshelper.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: wevtapi.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: mswsock.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: peerdistsh.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: uxtheme.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: wcmapi.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: rmclient.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: mobilenetworking.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: slc.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: sppc.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: gpapi.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: ktmw32.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: mprmsg.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: windows.storage.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: wldp.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: msasn1.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeSection loaded: mscoree.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeSection loaded: kernel.appcore.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeSection loaded: version.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeSection loaded: windows.storage.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeSection loaded: wldp.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeSection loaded: profapi.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeSection loaded: msasn1.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeSection loaded: riched20.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeSection loaded: usp10.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeSection loaded: msls31.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeSection loaded: cryptsp.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeSection loaded: rsaenh.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeSection loaded: cryptbase.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeSection loaded: gpapi.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeSection loaded: uxtheme.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeSection loaded: shfolder.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeSection loaded: rasapi32.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeSection loaded: rasman.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeSection loaded: rtutils.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeSection loaded: mswsock.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeSection loaded: winhttp.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeSection loaded: ondemandconnroutehelper.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeSection loaded: iphlpapi.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeSection loaded: dhcpcsvc6.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeSection loaded: dhcpcsvc.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeSection loaded: dnsapi.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeSection loaded: winnsi.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeSection loaded: rasadhlp.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeSection loaded: fwpuclnt.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeSection loaded: ntmarta.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeSection loaded: wbemcomn.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeSection loaded: amsi.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeSection loaded: userenv.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeSection loaded: security.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeSection loaded: secur32.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeSection loaded: sspicli.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeSection loaded: schannel.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeSection loaded: vcruntime140d.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeSection loaded: ucrtbased.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeSection loaded: liblz4.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeSection loaded: vcruntime140_clr0400.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeSection loaded: ucrtbase_clr0400.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeSection loaded: ucrtbase_clr0400.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeSection loaded: mskeyprotect.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeSection loaded: ntasn1.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeSection loaded: ncrypt.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeSection loaded: ncryptsslp.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeSection loaded: mpr.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeSection loaded: scrrun.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeSection loaded: propsys.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeSection loaded: sxs.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeSection loaded: linkinfo.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeSection loaded: ntshrui.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeSection loaded: srvcli.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeSection loaded: cscapi.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeSection loaded: httpapi.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeSection loaded: mscoree.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeSection loaded: apphelp.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeSection loaded: kernel.appcore.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeSection loaded: version.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeSection loaded: windows.storage.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeSection loaded: wldp.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeSection loaded: profapi.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeSection loaded: msasn1.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeSection loaded: riched20.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeSection loaded: usp10.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeSection loaded: msls31.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeSection loaded: cryptsp.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeSection loaded: rsaenh.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeSection loaded: cryptbase.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeSection loaded: gpapi.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeSection loaded: cryptnet.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeSection loaded: iphlpapi.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeSection loaded: winnsi.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeSection loaded: winhttp.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeSection loaded: ondemandconnroutehelper.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeSection loaded: mswsock.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeSection loaded: dhcpcsvc6.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeSection loaded: dhcpcsvc.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeSection loaded: webio.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeSection loaded: sspicli.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeSection loaded: dnsapi.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeSection loaded: rasadhlp.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeSection loaded: fwpuclnt.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeSection loaded: ondemandconnroutehelper.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeSection loaded: ondemandconnroutehelper.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeSection loaded: shfolder.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeSection loaded: netfxperf.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeSection loaded: napinsp.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeSection loaded: pnrpnsp.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeSection loaded: wshbth.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeSection loaded: nlaapi.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeSection loaded: winrnr.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeSection loaded: wbemcomn.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeSection loaded: amsi.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeSection loaded: userenv.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeSection loaded: propsys.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeSection loaded: edputil.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeSection loaded: urlmon.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeSection loaded: iertutil.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeSection loaded: srvcli.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeSection loaded: netutils.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeSection loaded: windows.staterepositoryps.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeSection loaded: wintypes.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeSection loaded: appresolver.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeSection loaded: bcp47langs.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeSection loaded: slc.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeSection loaded: sppc.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeSection loaded: onecorecommonproxystub.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeSection loaded: onecoreuapcommonproxystub.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeSection loaded: security.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeSection loaded: secur32.dll
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeSection loaded: httpapi.dll
            Source: C:\Windows\System32\netsh.exeSection loaded: kernel.appcore.dll
            Source: C:\Windows\System32\netsh.exeSection loaded: ifmon.dll
            Source: C:\Windows\System32\netsh.exeSection loaded: iphlpapi.dll
            Source: C:\Windows\System32\netsh.exeSection loaded: mprapi.dll
            Source: C:\Windows\System32\netsh.exeSection loaded: rasmontr.dll
            Source: C:\Windows\System32\netsh.exeSection loaded: rasapi32.dll
            Source: C:\Windows\System32\netsh.exeSection loaded: fwpuclnt.dll
            Source: C:\Windows\System32\netsh.exeSection loaded: rasman.dll
            Source: C:\Windows\System32\netsh.exeSection loaded: mfc42u.dll
            Source: C:\Windows\System32\netsh.exeSection loaded: rasman.dll
            Source: C:\Windows\System32\netsh.exeSection loaded: authfwcfg.dll
            Source: C:\Windows\System32\netsh.exeSection loaded: fwpolicyiomgr.dll
            Source: C:\Windows\System32\netsh.exeSection loaded: firewallapi.dll
            Source: C:\Windows\System32\netsh.exeSection loaded: dnsapi.dll
            Source: C:\Windows\System32\netsh.exeSection loaded: fwbase.dll
            Source: C:\Windows\System32\netsh.exeSection loaded: dhcpcmonitor.dll
            Source: C:\Windows\System32\netsh.exeSection loaded: dot3cfg.dll
            Source: C:\Windows\System32\netsh.exeSection loaded: dot3api.dll
            Source: C:\Windows\System32\netsh.exeSection loaded: onex.dll
            Source: C:\Windows\System32\netsh.exeSection loaded: eappcfg.dll
            Source: C:\Windows\System32\netsh.exeSection loaded: ncrypt.dll
            Source: C:\Windows\System32\netsh.exeSection loaded: eappprxy.dll
            Source: C:\Windows\System32\netsh.exeSection loaded: ntasn1.dll
            Source: C:\Windows\System32\netsh.exeSection loaded: fwcfg.dll
            Source: C:\Windows\System32\netsh.exeSection loaded: hnetmon.dll
            Source: C:\Windows\System32\netsh.exeSection loaded: netshell.dll
            Source: C:\Windows\System32\netsh.exeSection loaded: nlaapi.dll
            Source: C:\Windows\System32\netsh.exeSection loaded: netsetupapi.dll
            Source: C:\Windows\System32\netsh.exeSection loaded: netiohlp.dll
            Source: C:\Windows\System32\netsh.exeSection loaded: dhcpcsvc.dll
            Source: C:\Windows\System32\netsh.exeSection loaded: winnsi.dll
            Source: C:\Windows\System32\netsh.exeSection loaded: nettrace.dll
            Source: C:\Windows\System32\netsh.exeSection loaded: sspicli.dll
            Source: C:\Windows\System32\netsh.exeSection loaded: nshhttp.dll
            Source: C:\Windows\System32\netsh.exeSection loaded: httpapi.dll
            Source: C:\Windows\System32\netsh.exeSection loaded: nshipsec.dll
            Source: C:\Windows\System32\netsh.exeSection loaded: userenv.dll
            Source: C:\Windows\System32\netsh.exeSection loaded: activeds.dll
            Source: C:\Windows\System32\netsh.exeSection loaded: polstore.dll
            Source: C:\Windows\System32\netsh.exeSection loaded: winipsec.dll
            Source: C:\Windows\System32\netsh.exeSection loaded: adsldpc.dll
            Source: C:\Windows\System32\netsh.exeSection loaded: adsldpc.dll
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32Jump to behavior
            Source: Uninstall.lnk.0.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\FileZilla FTP Client\uninstall.exe
            Source: FileZilla.lnk.0.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\FileZilla FTP Client\filezilla.exe
            Source: ~ileZilla.tmp.0.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\FileZilla FTP Client\filezilla.exe
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeAutomated click: I Agree
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeAutomated click: Next >
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeAutomated click: Accept
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeAutomated click: Next >
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeAutomated click: Accept
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeAutomated click: Next >
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeAutomated click: Next >
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeAutomated click: Next >
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeAutomated click: Install
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeAutomated click: OK
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeFile opened: C:\Windows\SYSTEM32\msftedit.DLL
            Source: Window RecorderWindow detected: More than 3 window changes detected
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeWindow detected: I &AgreeCancelNullsoft Install System v3.09 Nullsoft Install System v3.09License AgreementPlease review the license terms before installing FileZilla Client 3.67.1.Press Page Down to see the rest of the agreement. GNU GENERAL PUBLIC LICENSE Version 2 June 1991 Copyright (C) 1989 1991 Free Software Foundation Inc. 59 Temple Place Suite 330 Boston MA 02111-1307 USA Everyone is permitted to copy and distribute verbatim copies of this license document but changing it is not allowed. Preamble The licenses for most software are designed to take away yourfreedom to share and change it. By contrast the GNU General PublicLicense is intended to guarantee your freedom to share and change freesoftware--to make sure the software is free for all its users. ThisGeneral Public License applies to most of the Free SoftwareFoundation's software and to any other program whose authors commit tousing it. (Some other Free Software Foundation software is covered bythe GNU Library General Public License instead.) You can apply it toyour programs too. When we speak of free software we are referring to freedom notprice. Our General Public Licenses are designed to make sure that youhave the freedom to distribute copies of free software (and charge forthis service if you wish) that you receive source code or can get itif you want it that you can change the software or use pieces of itin new free programs; and that you know you can do these things. To protect your rights we need to make restrictions that forbidanyone to deny you these rights or to ask you to surrender the rights.These restrictions translate to certain responsibilities for you if youdistribute copies of the software or if you modify it. For example if you distribute copies of such a program whethergratis or for a fee you must give the recipients all the rights thatyou have. You must make sure that they too receive or can get thesource code. And you must show them these terms so they know theirrights. We protect your rights with two steps: (1) copyright the software and(2) offer you this license which gives you legal permission to copydistribute and/or modify the software. Also for each author's protection and ours we want to make certainthat everyone understands that there is no warranty for this freesoftware. If the software is modified by someone else and passed on wewant its recipients to know that what they have is not the original sothat any problems introduced by others will not reflect on the originalauthors' reputations. Finally any free program is threatened constantly by softwarepatents. We wish to avoid the danger that redistributors of a freeprogram will individually obtain patent licenses in effect making theprogram proprietary. To prevent this we have made it clear that anypatent must be licensed for everyone's free use or not licensed at all. The precise terms and conditions for copying distribution andmodification follow. GNU GENERAL PUBLIC LICEN
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeWindow detected: Number of UI elements: 19
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP ClientJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\filezilla.exeJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\fzsftp.exeJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\fzputtygen.exeJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\fzstorj.exeJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\GPL.htmlJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\NEWSJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\AUTHORSJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\libgmp-10.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\libnettle-8.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\libhogweed-6.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\libgcc_s_seh-1.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\libgnutls-30.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\libstdc++-6.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\libfilezilla-45.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\libfzclient-private-3-67-1.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\libfzclient-commonui-private-3-67-1.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\zlib1.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\wxbase32u_gcc_custom.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\libpng16-16.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\wxmsw32u_core_gcc_custom.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\wxmsw32u_aui_gcc_custom.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\wxbase32u_xml_gcc_custom.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\wxmsw32u_xrc_gcc_custom.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\libsqlite3-0.dllJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resourcesJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\defaultfilters.xmlJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\finished.wavJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\16x16Jump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\16x16\filezilla.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\16x16\unknown.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\16x16\throbber.gifJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\20x20Jump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\20x20\unknown.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\24x24Jump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\24x24\unknown.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\32x32Jump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\32x32\filezilla.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\48x48Jump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\48x48\filezilla.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\480x480Jump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\480x480\filezilla.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\defaultJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\theme.xmlJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480Jump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\ascii.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\auto.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\binary.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\bookmark.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\bookmarks.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\cancel.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\close.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\compare.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\disconnect.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\download.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\downloadadd.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\dropdown.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\file.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\filter.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\find.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\folder.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\folderback.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\folderclosed.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\folderup.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\help.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\leds.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\localtreeview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\lock.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\logview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\processqueue.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\queueview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\reconnect.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\refresh.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\remotetreeview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\server.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\showhidden.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\sitemanager.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\sort_down_dark.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\sort_down_light.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\sort_up_dark.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\sort_up_light.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\speedlimits.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\symlink.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\synchronize.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\synctransfer.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\treeitem_collapsed_dark.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\treeitem_collapsed_light.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\treeitem_expanded_dark.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\treeitem_expanded_light.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\upload.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\default\480x480\uploadadd.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\docsJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\docs\fzdefaults.xml.exampleJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\uninstall.exeJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukisJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\theme.xmlJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\16x16Jump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\ascii.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\auto.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\binary.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\bookmark.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\bookmarks.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\cancel.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\compare.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\disconnect.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\download.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\downloadadd.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\file.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\filter.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\find.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\folder.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\folderback.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\folderclosed.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\folderup.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\help.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\localtreeview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\lock.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\logview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\processqueue.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\queueview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\reconnect.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\refresh.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\remotetreeview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\server.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\showhidden.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\sitemanager.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\speedlimits.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\symlink.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\synchronize.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\upload.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\uploadadd.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\32x32Jump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\ascii.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\auto.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\binary.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\bookmark.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\bookmarks.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\cancel.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\compare.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\disconnect.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\download.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\downloadadd.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\file.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\filter.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\find.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\folder.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\folderback.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\folderclosed.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\folderup.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\help.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\localtreeview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\lock.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\logview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\processqueue.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\queueview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\reconnect.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\refresh.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\remotetreeview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\server.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\showhidden.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\sitemanager.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\speedlimits.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\symlink.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\synchronize.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\upload.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\uploadadd.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\48x48Jump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\ascii.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\auto.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\binary.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\bookmark.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\bookmarks.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\cancel.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\compare.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\disconnect.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\download.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\downloadadd.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\file.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\filter.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\find.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\folder.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\folderback.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\folderclosed.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\folderup.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\help.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\localtreeview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\lock.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\logview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\processqueue.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\queueview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\reconnect.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\refresh.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\remotetreeview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\server.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\showhidden.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\sitemanager.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\speedlimits.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\symlink.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\synchronize.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\upload.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\uploadadd.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\classicJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\classic\theme.xmlJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\classic\16x16Jump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\classic\16x16\ascii.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\classic\16x16\auto.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\classic\16x16\binary.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\classic\16x16\bookmark.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\classic\16x16\cancel.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\classic\16x16\compare.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\classic\16x16\disconnect.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\classic\16x16\download.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\classic\16x16\downloadadd.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\classic\16x16\file.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\classic\16x16\filter.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\classic\16x16\find.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\classic\16x16\folder.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\classic\16x16\folderclosed.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\classic\16x16\localtreeview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\classic\16x16\lock.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\classic\16x16\logview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\classic\16x16\processqueue.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\classic\16x16\queueview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\classic\16x16\reconnect.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\classic\16x16\refresh.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\classic\16x16\remotetreeview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\classic\16x16\server.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\classic\16x16\sitemanager.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\classic\16x16\speedlimits.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\classic\16x16\symlink.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\classic\16x16\synchronize.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\classic\16x16\upload.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\classic\16x16\uploadadd.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\cyrilJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\cyril\theme.xmlJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\cyril\16x16Jump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\ascii.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\auto.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\binary.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\bookmark.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\cancel.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\compare.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\disconnect.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\download.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\downloadadd.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\file.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\folder.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\folderback.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\folderclosed.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\folderup.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\help.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\localtreeview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\logview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\processqueue.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\queueview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\reconnect.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\refresh.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\remotetreeview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\server.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\showhidden.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\sitemanager.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\speedlimits.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\synchronize.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\upload.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\uploadadd.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzillaJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\theme.xmlJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16Jump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\ascii.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\auto.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\binary.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\bookmark.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\cancel.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\compare.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\disconnect.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\download.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\downloadadd.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\file.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\filter.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\find.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\folder.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\folderclosed.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\help.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\leds.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\localtreeview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\lock.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\logview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\processqueue.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\queueview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\reconnect.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\refresh.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\remotetreeview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\server.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\sitemanager.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\speedlimits.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\synchronize.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\upload.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\uploadadd.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24Jump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\ascii.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\auto.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\binary.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\bookmark.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\cancel.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\compare.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\disconnect.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\download.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\downloadadd.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\file.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\filter.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\find.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\folder.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\folderclosed.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\help.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\leds.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\localtreeview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\lock.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\logview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\processqueue.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\queueview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\reconnect.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\refresh.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\remotetreeview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\server.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\sitemanager.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\speedlimits.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\synchronize.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\upload.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\uploadadd.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32Jump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\ascii.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\auto.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\binary.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\bookmark.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\cancel.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\compare.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\disconnect.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\download.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\downloadadd.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\file.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\filter.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\find.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\folder.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\folderclosed.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\help.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\leds.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\localtreeview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\lock.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\logview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\processqueue.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\queueview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\reconnect.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\refresh.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\remotetreeview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\server.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\sitemanager.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\speedlimits.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\synchronize.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\upload.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\uploadadd.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48Jump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\ascii.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\auto.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\binary.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\bookmark.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\cancel.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\compare.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\disconnect.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\download.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\downloadadd.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\file.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\filter.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\find.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\folder.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\folderclosed.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\help.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\leds.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\localtreeview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\lock.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\logview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\processqueue.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\queueview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\reconnect.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\refresh.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\remotetreeview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\server.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\sitemanager.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\speedlimits.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\synchronize.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\upload.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\uploadadd.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\loneJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\theme.xmlJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\16x16Jump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\16x16\ascii.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\16x16\auto.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\16x16\binary.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\16x16\bookmark.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\16x16\cancel.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\16x16\compare.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\16x16\disconnect.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\16x16\download.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\16x16\downloadadd.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\16x16\file.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\16x16\filter.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\16x16\folder.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\16x16\folderback.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\16x16\folderclosed.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\16x16\folderup.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\16x16\help.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\16x16\localtreeview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\16x16\lock.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\16x16\logview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\16x16\processqueue.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\16x16\queueview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\16x16\reconnect.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\16x16\refresh.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\16x16\remotetreeview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\16x16\server.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\16x16\showhidden.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\16x16\sitemanager.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\16x16\speedlimits.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\16x16\synchronize.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\16x16\upload.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\16x16\uploadadd.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\32x32Jump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\32x32\ascii.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\32x32\auto.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\32x32\binary.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\32x32\bookmark.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\32x32\cancel.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\32x32\compare.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\32x32\disconnect.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\32x32\download.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\32x32\downloadadd.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\32x32\file.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\32x32\filter.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\32x32\folder.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\32x32\folderback.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\32x32\folderclosed.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\32x32\folderup.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\32x32\help.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\32x32\localtreeview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\32x32\lock.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\32x32\logview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\32x32\processqueue.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\32x32\queueview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\32x32\reconnect.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\32x32\refresh.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\32x32\remotetreeview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\32x32\showhidden.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\32x32\sitemanager.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\32x32\speedlimits.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\32x32\synchronize.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\32x32\upload.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\32x32\uploadadd.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\48x48Jump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\48x48\ascii.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\48x48\auto.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\48x48\binary.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\48x48\bookmark.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\48x48\cancel.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\48x48\compare.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\48x48\disconnect.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\48x48\download.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\48x48\downloadadd.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\48x48\file.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\48x48\filter.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\48x48\folder.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\48x48\folderback.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\48x48\folderclosed.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\48x48\folderup.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\48x48\help.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\48x48\localtreeview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\48x48\lock.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\48x48\logview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\48x48\processqueue.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\48x48\queueview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\48x48\reconnect.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\48x48\refresh.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\48x48\remotetreeview.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\48x48\showhidden.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\48x48\sitemanager.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\48x48\speedlimits.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\48x48\synchronize.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\48x48\upload.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\lone\48x48\uploadadd.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\minimalJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\minimal\theme.xmlJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\minimal\16x16Jump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\minimal\16x16\ascii.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\minimal\16x16\auto.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\minimal\16x16\binary.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\minimal\16x16\bookmark.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\minimal\16x16\bookmarks.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\minimal\16x16\cancel.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\minimal\16x16\compare.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\minimal\16x16\disconnect.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\minimal\16x16\download.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDirectory created: C:\Program Files\FileZilla FTP Client\resources\minimal\16x16\downloadadd.pngJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeRegistry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FileZilla ClientJump to behavior
            Source: FileZilla_3.67.1_win64_sponsored-setup.exeStatic PE information: certificate valid
            Source: FileZilla_3.67.1_win64_sponsored-setup.exeStatic file information: File size 12417936 > 1048576
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dllJump to behavior
            Source: FileZilla_3.67.1_win64_sponsored-setup.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
            Source: Binary string: c:\Projects\WebCompanion\Common\SearchProtect.Service.Logger\obj\Debug\Lavasoft.WCAssistant.Service.Logger.pdb source: Lavasoft.WCAssistant.Service.Logger.dll.3.dr
            Source: Binary string: crypto\stack\stack.ccompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PICcrypto\ex_data.c source: DCIService.exe, 0000001C.00000000.2321641309.00007FF7EB15A000.00000002.00000001.01000000.0000002B.sdmp
            Source: Binary string: api-ms-win-crt-utility-l1-1-0.pdb source: api-ms-win-crt-utility-l1-1-0.dll.3.dr
            Source: Binary string: d:\agent\_work\2\s\\binaries\amd64ret\bin\amd64\\msvcp140_codecvt_ids.amd64.pdb source: msvcp140_codecvt_ids.dll0.3.dr
            Source: Binary string: api-ms-win-core-string-l1-1-0.pdb source: api-ms-win-core-string-l1-1-0.dll.3.dr
            Source: Binary string: c:\Windows\Temp\drone-ITnqm7dmUCKa46Dt\drone\src\WebCompanion\Companion.UI\obj\x86\Debug\WebCompanion.pdb source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmp
            Source: Binary string: api-ms-win-core-console-l1-1-0.pdb source: api-ms-win-core-console-l1-1-0.dll.3.dr
            Source: Binary string: C:\Windows\TEMP\drone-kwRqivJrrmmjgcRp\drone\src\DCIService\x64\Release\DCIService.pdb source: DCIService.exe, 0000001C.00000000.2321641309.00007FF7EB15A000.00000002.00000001.01000000.0000002B.sdmp
            Source: Binary string: c:\Temp\Release\Working\Newtonsoft.Json\Src\Newtonsoft.Json\obj\Release\Newtonsoft.Json.pdb source: WcInstaller.exe, 00000002.00000003.1866843878.00000000021C3000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000028.00000002.2591364130.0000000006C62000.00000002.00000001.01000000.00000040.sdmp
            Source: Binary string: c:\Windows\Temp\drone-ITnqm7dmUCKa46Dt\drone\src\WebCompanion\Installer\WebCompanionInstaller\obj\Release\WebCompanionInstaller.pdb source: WcInstaller.exe, 00000002.00000003.1867085226.00000000005D0000.00000004.00001000.00020000.00000000.sdmp, WcInstaller.exe, 00000002.00000003.1866843878.00000000021C3000.00000004.00000020.00020000.00000000.sdmp, WebCompanionInstaller.exe, 00000003.00000000.1867314648.0000000000782000.00000002.00000001.01000000.0000000F.sdmp
            Source: Binary string: E:\builds\DCI-BDDCI345-ISV_new\bin\x64\Release\bddci.pdb source: rundll32.exe, 0000000F.00000003.2309637269.000001B0C8176000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: c:\Windows\Temp\drone-ITnqm7dmUCKa46Dt\drone\src\WebCompanion\Companion.UI\obj\x86\Debug\WebCompanion.pdb` source: WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmp
            Source: Binary string: C:\Projects\WebCompanion\Common\SearchProtect.WinService\obj\Debug\Lavasoft.WCAssistant.WinService.pdb source: Lavasoft.WCAssistant.WinService.exe, 00000022.00000000.2458759751.00000000006F2000.00000002.00000001.01000000.0000004B.sdmp
            Source: Binary string: D:\Projects\Adaware\webcompanion\Common\SearchProtect.Business\obj\x86\Debug\Lavasoft.SearchProtect.Business.pdb source: WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmp
            Source: Binary string: D:\Projects\Adaware\webcompanion\Common\Lavasoft.Utils\obj\x86\Debug\Lavasoft.Utils.pdb source: WebCompanion.exe, 00000028.00000002.2590279307.0000000006A72000.00000002.00000001.01000000.0000003E.sdmp
            Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC source: DCIService.exe, 0000001C.00000000.2321641309.00007FF7EB15A000.00000002.00000001.01000000.0000002B.sdmp
            Source: Binary string: D:\Projects\Adaware\webcompanion\Common\Lavasoft.Events\obj\x86\Debug\Lavasoft.Events.pdb source: WebCompanion.exe, 00000028.00000002.2590522947.0000000006AC2000.00000002.00000001.01000000.0000003F.sdmp
            Source: Binary string: c:\Windows\Temp\drone-ITnqm7dmUCKa46Dt\drone\src\WebCompanion\Lavasoft.AppCore\obj\Debug\Lavasoft.AppCore.pdb source: WebCompanion.exe, 00000028.00000002.2589134775.00000000065A2000.00000002.00000001.01000000.0000003D.sdmp
            Source: Binary string: api-ms-win-crt-string-l1-1-0.pdb source: api-ms-win-crt-string-l1-1-0.dll0.3.dr
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\rsvnd5a7.cmdline"
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\fr_px-r0.cmdline"
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\xsc65psb.cmdline"
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\rsvnd5a7.cmdline"
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\fr_px-r0.cmdline"
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\xsc65psb.cmdline"
            Source: WebCompanionInstaller.resources.dll4.2.drStatic PE information: real checksum: 0x0 should be: 0x66d4
            Source: nsy38DB.tmp.0.drStatic PE information: real checksum: 0x9007d should be: 0x95408
            Source: System.dll.0.drStatic PE information: real checksum: 0x0 should be: 0x67cd
            Source: WebCompanionInstaller.resources.dll6.2.drStatic PE information: real checksum: 0x0 should be: 0x4ad5
            Source: WebCompanionInstaller.resources.dll1.2.drStatic PE information: real checksum: 0x0 should be: 0xa303
            Source: INetC.dll.0.drStatic PE information: real checksum: 0x0 should be: 0x8b4c
            Source: WcInstaller[1].exe.0.drStatic PE information: real checksum: 0x9007d should be: 0x95408
            Source: UserInfo.dll.0.drStatic PE information: real checksum: 0x0 should be: 0xba48
            Source: WebCompanionInstaller.resources.dll2.2.drStatic PE information: real checksum: 0x0 should be: 0x10e13
            Source: WebCompanionInstaller.resources.dll5.2.drStatic PE information: real checksum: 0x0 should be: 0xf12e
            Source: uninstall.exe.0.drStatic PE information: real checksum: 0xbdea56 should be: 0x2611d
            Source: WebCompanionInstaller.resources.dll.2.drStatic PE information: real checksum: 0x0 should be: 0x6035
            Source: WebCompanionInstaller.resources.dll0.2.drStatic PE information: real checksum: 0x0 should be: 0xb694
            Source: WebCompanionInstaller.resources.dll3.2.drStatic PE information: real checksum: 0x0 should be: 0x47cd
            Source: WebCompanionInstaller.resources.dll7.2.drStatic PE information: real checksum: 0x0 should be: 0xaf4e
            Source: StartMenu.dll.0.drStatic PE information: real checksum: 0x0 should be: 0xb3cd
            Source: nsDialogs.dll.0.drStatic PE information: real checksum: 0x0 should be: 0x3e52
            Source: UAC.dll.0.drStatic PE information: real checksum: 0x0 should be: 0xde12
            Source: fzshellext.dll.0.drStatic PE information: section name: /4
            Source: fzshellext_64.dll.0.drStatic PE information: section name: .xdata
            Source: libsqlite3-0.dll.0.drStatic PE information: section name: .xdata
            Source: WcInstaller[1].exe.0.drStatic PE information: section name: .sxdata
            Source: filezilla.exe.0.drStatic PE information: section name: .xdata
            Source: fzsftp.exe.0.drStatic PE information: section name: .xdata
            Source: fzputtygen.exe.0.drStatic PE information: section name: .xdata
            Source: fzstorj.exe.0.drStatic PE information: section name: .xdata
            Source: libgmp-10.dll.0.drStatic PE information: section name: .xdata
            Source: libnettle-8.dll.0.drStatic PE information: section name: .rodata
            Source: libnettle-8.dll.0.drStatic PE information: section name: .xdata
            Source: libhogweed-6.dll.0.drStatic PE information: section name: .xdata
            Source: libgcc_s_seh-1.dll.0.drStatic PE information: section name: .xdata
            Source: libgnutls-30.dll.0.drStatic PE information: section name: .xdata
            Source: libstdc++-6.dll.0.drStatic PE information: section name: .xdata
            Source: libfilezilla-45.dll.0.drStatic PE information: section name: .xdata
            Source: libfzclient-private-3-67-1.dll.0.drStatic PE information: section name: .xdata
            Source: libfzclient-commonui-private-3-67-1.dll.0.drStatic PE information: section name: .xdata
            Source: zlib1.dll.0.drStatic PE information: section name: .xdata
            Source: wxbase32u_gcc_custom.dll.0.drStatic PE information: section name: .xdata
            Source: libpng16-16.dll.0.drStatic PE information: section name: .xdata
            Source: wxmsw32u_core_gcc_custom.dll.0.drStatic PE information: section name: .xdata
            Source: wxmsw32u_aui_gcc_custom.dll.0.drStatic PE information: section name: .xdata
            Source: wxbase32u_xml_gcc_custom.dll.0.drStatic PE information: section name: .xdata
            Source: wxmsw32u_xrc_gcc_custom.dll.0.drStatic PE information: section name: .xdata
            Source: nsy38DB.tmp.0.drStatic PE information: section name: .sxdata
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeProcess created: C:\Windows\System32\regsvr32.exe "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\FileZilla FTP Client\fzshellext_64.dll"

            Persistence and Installation Behavior

            barindex
            Creates files in the system32 config directory
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeFile created: C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A37B8BA80004D3266CB4D93B2052DC10_EBDB5A7037F08CDFB408DBFC0D44B43D
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeFile created: C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A37B8BA80004D3266CB4D93B2052DC10_EBDB5A7037F08CDFB408DBFC0D44B43D
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeFile created: C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\026A86A161D256DBB33076EDF20C0E5E_86AB612B21DEDF3B8CD155ED2E4114FF
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeFile created: C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\026A86A161D256DBB33076EDF20C0E5E_86AB612B21DEDF3B8CD155ED2E4114FF
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeFile created: C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AF360AACB1570042DEFBC833317997D0_684EE07DA693FF51901FCCD35B88A7C0
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeFile created: C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AF360AACB1570042DEFBC833317997D0_684EE07DA693FF51901FCCD35B88A7C0
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeFile created: C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F599B66E34645915D6CE3B9990A2673F
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeFile created: C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F599B66E34645915D6CE3B9990A2673F
            Source: C:\Windows\System32\netsh.exeFile created: C:\Windows\system32\config\systemprofile\AppData\Local\PeerDistRepub
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-processthreads-l1-1-1.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\sav.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\smb.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Automation.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bddci_core.dllJump to dropped file
            Source: C:\Windows\System32\rundll32.exeFile created: C:\Windows\System32\drivers\SETF07D.tmpJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\tr-TR\WebCompanion.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\ucrtbased.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\ssl.dllJump to dropped file
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeFile created: C:\Program Files\FileZilla FTP Client\libhogweed-6.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-namedpipe-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-crt-process-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\ru-RU\WebCompanion.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-crt-time-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-rtlsupport-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\liblz4.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Microsoft.mshtml.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-datetime-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-crt-conio-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\nsnF7E7.tmp\WcInstaller.exeFile created: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\tr-TR\WebCompanionInstaller.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-crt-filesystem-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-sysinfo-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-crt-conio-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeFile created: C:\Program Files\FileZilla FTP Client\wxbase32u_xml_gcc_custom.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-string-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\es-ES\WebCompanionInstaller.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Interop.SHDocVw.dllJump to dropped file
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeFile created: C:\Program Files\FileZilla FTP Client\zlib1.dllJump to dropped file
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeFile created: C:\Program Files\FileZilla FTP Client\uninstall.exeJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\ftp.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\it-IT\WebCompanionInstaller.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-processthreads-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\vcruntime140d.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\pt-BR\WebCompanionInstaller.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-file-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeFile created: C:\Program Files\FileZilla FTP Client\libgmp-10.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\log4net.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\bddci_core.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Ionic.Zip.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\ucrtbase.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Extension.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-crt-convert-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-crt-multibyte-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeFile created: C:\Program Files\FileZilla FTP Client\fzsftp.exeJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\x86\SQLite.Interop.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\de-DE\WebCompanionInstaller.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\http.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.Service.Logger.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\msvcp140_1.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-handle-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Interop.LavasoftTcpServiceLib.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-profile-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Newtonsoft.Json.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\DotNetZip.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-sysinfo-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\nsnF7E7.tmp\WcInstaller.exeFile created: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\es-ES\WebCompanionInstaller.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\nsnF7E7.tmp\WcInstaller.exeFile created: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\en-US\WebCompanionInstaller.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\bddci.sysJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\rpc.dllJump to dropped file
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeFile created: C:\Users\user\AppData\Local\Temp\nsnF7E7.tmp\UserInfo.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-handle-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\System.Data.SQLite.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\lsa.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\LZ4.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Interop.WUApiLib.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-profile-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeFile created: C:\Program Files\FileZilla FTP Client\libgnutls-30.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-debug-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\en-US\WebCompanionInstaller.resources.dllJump to dropped file
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeFile created: C:\Program Files\FileZilla FTP Client\wxmsw32u_aui_gcc_custom.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.CSharp.Utilities.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-localization-l1-2-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-crt-multibyte-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Events.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-heap-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-file-l1-2-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-crt-time-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-synch-l1-2-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-crt-string-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.adblocker.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\vccorlib140.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SysInfo.dllJump to dropped file
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeFile created: C:\Program Files\FileZilla FTP Client\libnettle-8.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-crt-string-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Utils.SqlLite.dllJump to dropped file
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeFile created: C:\Users\user\AppData\Local\Temp\nsnF7E7.tmp\nsDialogs.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\pop3.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\bddcihttp.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-errorhandling-l1-1-0.dllJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exeFile created: C:\Users\user\AppData\Local\Temp\rsvnd5a7.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-crt-convert-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\WcInstaller[1].exeJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-synch-l1-2-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\de-DE\WebCompanion.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\tr-TR\WebCompanionInstaller.resources.dllJump to dropped file
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeFile created: C:\Program Files\FileZilla FTP Client\fzputtygen.exeJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\fr-CA\WebCompanionInstaller.resources.dllJump to dropped file
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeFile created: C:\Program Files\FileZilla FTP Client\wxmsw32u_core_gcc_custom.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\ICSharpCode.SharpZipLib.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-processenvironment-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeFile created: C:\Users\user\AppData\Local\Temp\nsnF7E7.tmp\UAC.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-synch-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-crt-filesystem-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\bdnc.dllJump to dropped file
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeFile created: C:\Program Files\FileZilla FTP Client\libsqlite3-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeFile created: C:\Program Files\FileZilla FTP Client\libpng16-16.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\nsnF7E7.tmp\WcInstaller.exeFile created: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\it-IT\WebCompanionInstaller.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-crt-heap-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\it-IT\WebCompanion.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\ucrtbase.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\msvcp140.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Omni.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-libraryloader-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\msvcp140_2.dllJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exeFile created: C:\Users\user\AppData\Local\Temp\fr_px-r0.dllJump to dropped file
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeFile created: C:\Program Files\FileZilla FTP Client\libfzclient-commonui-private-3-67-1.dllJump to dropped file
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeFile created: C:\Users\user\AppData\Local\Temp\nsnF7E7.tmp\System.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\ru-RU\WebCompanionInstaller.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\BCUEngineS.dllJump to dropped file
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeFile created: C:\Program Files\FileZilla FTP Client\libgcc_s_seh-1.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\ja-JP\WebCompanionInstaller.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\nsnF7E7.tmp\WcInstaller.exeFile created: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-file-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanionInstaller.exeJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-crt-math-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Search.exeJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\smb.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\sav.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WcfService.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\zh-Hans\WebCompanion.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Esent.Interop.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-file-l2-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\ssl.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\OnlineThreatsSimple.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-console-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\pop3.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\vcruntime140.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-synch-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\concrt140.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-timezone-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-namedpipe-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-crt-runtime-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\msvcp140_codecvt_ids.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-crt-environment-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-localization-l1-2-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Compression.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Utils.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-rtlsupport-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\http.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\msvcp140_2.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-file-l2-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-crt-private-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\nsnF7E7.tmp\WcInstaller.exeFile created: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\fr-CA\WebCompanionInstaller.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-crt-utility-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\vccorlib140.dllJump to dropped file
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeFile created: C:\Program Files\FileZilla FTP Client\libstdc++-6.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\WebFilteringSimple.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\en-US\WebCompanion.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\rpc.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\OnlineThreatsSimple.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-crt-locale-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\zh-CHS\WebCompanionInstaller.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.AppCore.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-errorhandling-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-timezone-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-crt-private-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\WebFilteringSimple.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Interop.IWshRuntimeLibrary.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\NCalc.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\smtp.dllJump to dropped file
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeFile created: C:\Users\user\AppData\Local\Temp\nsy38DB.tmpJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-crt-heap-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-crt-stdio-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\scan.dllJump to dropped file
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeFile created: C:\Program Files\FileZilla FTP Client\libfzclient-private-3-67-1.dllJump to dropped file
            Source: C:\Windows\System32\rundll32.exeFile created: C:\Windows\system32\DRIVERS\bddci.sys (copy)Jump to dropped file
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeFile created: C:\Users\user\AppData\Local\Temp\nsnF7E7.tmp\WcInstaller.exe (copy)Jump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Interop.Shell32.dllJump to dropped file
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeFile created: C:\Users\user\AppData\Local\Temp\nsnF7E7.tmp\StartMenu.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\DCIService.exeJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-interlocked-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-interlocked-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\acs17.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-crt-locale-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeFile created: C:\Program Files\FileZilla FTP Client\fzshellext.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-crt-runtime-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.Repositories.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-util-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\MozCompressor.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-crt-math-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-console-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\msvcp140_codecvt_ids.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\ftp.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\smtp.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bddcihttp.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-heap-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\scan.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.IEController.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-string-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Ad-Aware Web Companion.exeJump to dropped file
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeFile created: C:\Program Files\FileZilla FTP Client\fzshellext_64.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-processthreads-l1-1-1.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\pt-BR\WebCompanion.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-processthreads-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-crt-process-l1-1-0.dllJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exeFile created: C:\Users\user\AppData\Local\Temp\xsc65psb.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-processenvironment-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\BDUpdateServiceCom.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-libraryloader-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\x64\SQLite.Interop.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\nsnF7E7.tmp\WcInstaller.exeFile created: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\pt-BR\WebCompanionInstaller.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\msvcp140_1.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.Loader.exeJump to dropped file
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeFile created: C:\Users\user\AppData\Local\Temp\nsnF7E7.tmp\nsis_appid.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bddci.sysJump to dropped file
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeFile created: C:\Program Files\FileZilla FTP Client\fzstorj.exeJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\msvcp140.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\nsnF7E7.tmp\WcInstaller.exeFile created: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\ru-RU\WebCompanionInstaller.resources.dllJump to dropped file
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeFile created: C:\Program Files\FileZilla FTP Client\libfilezilla-45.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\DCIService.exeJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\bittorrent.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\nsnF7E7.tmp\WcInstaller.exeFile created: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\ICSharpCode.SharpZipLib.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\nsnF7E7.tmp\WcInstaller.exeFile created: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\zh-CHS\WebCompanionInstaller.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\lsa.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-datetime-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-debug-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\es-ES\WebCompanion.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\fr-CA\WebCompanion.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\ja-JP\WebCompanion.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\nsnF7E7.tmp\WcInstaller.exeFile created: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\de-DE\WebCompanionInstaller.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-crt-utility-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-memory-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-util-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.Business.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\BDUpdateServiceCom.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\7za.exeJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanionExtensionIE.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-crt-stdio-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WcCommunication.exeJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\nsnF7E7.tmp\WcInstaller.exeFile created: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\Newtonsoft.Json.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-memory-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\BCUSDK.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-file-l1-2-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeFile created: C:\Program Files\FileZilla FTP Client\filezilla.exeJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-crt-environment-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bdnc.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\vcruntime140_1.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Settings.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\vcruntime140.dllJump to dropped file
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeFile created: C:\Program Files\FileZilla FTP Client\wxbase32u_gcc_custom.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\concrt140.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\nsnF7E7.tmp\WcInstaller.exeFile created: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\ja-JP\WebCompanionInstaller.resources.dllJump to dropped file
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeFile created: C:\Program Files\FileZilla FTP Client\wxmsw32u_xrc_gcc_custom.dllJump to dropped file
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeFile created: C:\Users\user\AppData\Local\Temp\nsnF7E7.tmp\INetC.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bittorrent.dllJump to dropped file
            Source: C:\Windows\System32\rundll32.exeFile created: C:\Windows\system32\DRIVERS\bddci.sys (copy)Jump to dropped file
            Source: C:\Windows\System32\rundll32.exeFile created: C:\Windows\System32\drivers\SETF07D.tmpJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\Users\user\AppData\Local\Temp\WcInstaller.logJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeFile created: C:\ProgramData\Lavasoft\Web Companion\Options\install.txtJump to behavior

            Boot Survival

            barindex
            Creates an autostart registry key pointing to binary in C:\Windows
            Source: C:\Windows\System32\rundll32.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce GrpConv
            Creates an undocumented autostart registry key
            Source: C:\Windows\System32\regsvr32.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\CopyHookHandlers\FileZilla3CopyHook NULL
            Source: C:\Windows\System32\regsvr32.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\CopyHookHandlers\FileZilla3CopyHook NULL
            Creates multiple autostart registry keys
            Source: C:\Windows\System32\rundll32.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce GrpConv
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Web Companion
            Source: C:\Windows\System32\rundll32.exeRegistry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\BdDci
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FileZilla FTP ClientJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client\Uninstall.lnkJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client\FileZilla.lnkJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client\~ileZilla.tmpJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client\FileZilla.lnk~RF6297bf.TMPJump to behavior
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft\WebCompanion
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft\WebCompanion\Frequently Asked Questions.url
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft\WebCompanion\Web Companion.lnk
            Source: C:\Windows\System32\rundll32.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce GrpConv
            Source: C:\Windows\System32\rundll32.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce GrpConv
            Source: C:\Windows\System32\rundll32.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce GrpConv
            Source: C:\Windows\System32\rundll32.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce GrpConv
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Web Companion
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Web Companion
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess created: C:\Windows\SysWOW64\sc.exe "sc.exe" Create "WCAssistantService" binPath= "C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe" DisplayName= "WC Assistant" start= auto
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdateJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRootJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRootJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRootJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\runonce.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\runonce.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\runonce.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\runonce.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\runonce.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\runonce.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\runonce.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\runonce.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\runonce.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\runonce.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\runonce.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\grpconv.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\grpconv.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\grpconv.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\grpconv.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\netsh.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\netsh.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\netsh.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\netsh.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess information set: NOOPENFILEERRORBOX

            Malware Analysis System Evasion

            barindex
            Tries to delay execution (extensive OutputDebugStringW loop)
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeSection loaded: OutputDebugStringW count: 120
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeMemory allocated: E60000 memory reserve | memory write watch
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeMemory allocated: 2FF0000 memory reserve | memory write watch
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeMemory allocated: FA0000 memory commit | memory reserve | memory write watch
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeMemory allocated: 1BD0000 memory reserve | memory write watch
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeMemory allocated: 3560000 memory reserve | memory write watch
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeMemory allocated: 5560000 memory commit | memory reserve | memory write watch
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeMemory allocated: 9A20000 memory reserve | memory write watch
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeMemory allocated: 9BE0000 memory reserve | memory write watch
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeMemory allocated: BBE0000 memory reserve | memory write watch
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeMemory allocated: C30000 memory reserve | memory write watch
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeMemory allocated: 1990000 memory reserve | memory write watch
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeMemory allocated: 19990000 memory commit | memory reserve | memory write watch
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeMemory allocated: 1BA0000 memory reserve | memory write watch
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeMemory allocated: 3BE0000 memory reserve | memory write watch
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeMemory allocated: 1E30000 memory commit | memory reserve | memory write watch
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeMemory allocated: 1C90000 memory reserve | memory write watch
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeMemory allocated: 37F0000 memory reserve | memory write watch
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeMemory allocated: 57F0000 memory commit | memory reserve | memory write watch
            Source: C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exeMemory allocated: 8E0000 memory reserve | memory write watch
            Source: C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exeMemory allocated: 1390000 memory reserve | memory write watch
            Source: C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exeMemory allocated: 19390000 memory commit | memory reserve | memory write watch
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Search.exeMemory allocated: 13E0000 memory reserve | memory write watch
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Search.exeMemory allocated: 3110000 memory reserve | memory write watch
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Search.exeMemory allocated: 1B110000 memory commit | memory reserve | memory write watch
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Search.exeMemory allocated: AC0000 memory reserve | memory write watch
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Search.exeMemory allocated: 27B0000 memory reserve | memory write watch
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Search.exeMemory allocated: 1A7B0000 memory commit | memory reserve | memory write watch
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 922337203685477
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 300000
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86099922
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 300078
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86099922
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86309984
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86280094
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86190297
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 209703
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86070516
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 299578
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85980531
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 389454
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 480000
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85920656
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86400000
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86400000
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86370078
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86370093
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85890203
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 509797
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85890172
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 419906
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85980078
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 419922
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85950187
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 449860
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85380375
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86310000
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85800219
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 599781
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86310015
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86310046
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86310063
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86339875
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86339890
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86399906
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85440547
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 630203
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85709953
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 690031
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85709922
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 690078
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85709907
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85709906
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 690063
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85709890
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 690094
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86220016
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86399953
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86399859
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86310062
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86220093
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86249953
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86249968
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86249859
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 84690219
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 1709703
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 84690297
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 1709656
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 84690344
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 1709485
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 84660531
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 1739344
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 84660546
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 1739375
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 84660563
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 1739391
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 84660578
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 1739328
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 84570750
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 1829187
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 84570766
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 1829219
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86340109
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86340125
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86340140
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86340141
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86340187
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86340156
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86340110
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86340219
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86340250
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86340218
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86340157
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86100172
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 299734
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86100203
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 299735
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86100093
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 299688
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86099953
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 299797
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86100141
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 299671
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86100297
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 299657
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86100234
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 299719
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86100125
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 299984
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86099969
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 299890
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86100000
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 300110
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85770344
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 629609
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85770328
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 629578
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85770375
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 629625
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 629547
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85770438
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 629531
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86399641
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86399734
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86399516
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86399313
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86399157
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86279391
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86279343
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86369015
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86368937
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86308766
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86308625
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86308875
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86308531
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86397984
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86399937
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86190187
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86399531
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86399938
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86399735
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85590469
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 809562
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85590360
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 809547
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85589968
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 809953
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85590032
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 809922
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85589531
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 810406
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85589516
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 810078
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85589875
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 810109
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85589828
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 809719
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85590203
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 809688
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85589797
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 810156
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85589422
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 810500
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 810094
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85589469
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 810484
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85589484
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 810125
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85589860
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 809656
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86399891
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86369906
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86369328
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86369281
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86369625
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86369297
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86369266
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86369688
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86370250
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86369859
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86369437
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86369454
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86369890
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86369422
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86369828
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86369375
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86369344
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86369734
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86369312
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86399469
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86399984
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86399437
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85919766
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85919453
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 480563
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85919109
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 84959938
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 1439609
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 83040016
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 84959500
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 480515
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85439329
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 959640
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86399625
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85919860
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 480031
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85919969
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 480015
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85919969
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 922337203685477
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 300000
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 922337203685477
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 922337203685477
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 300000
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 300000
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85800093
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 599875
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85800094
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86280062
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86309984
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86400000
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 480000
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86400000
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86399875
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86399938
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86399969
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86399921
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86369547
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86369578
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86369750
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86369781
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86369813
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86369859
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86369828
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86399906
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86399844
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86399937
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86399953
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86309969
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86220078
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 180032
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86219922
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86249796
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86249844
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86249875
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86249812
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86249828
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86399828
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86399843
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86399829
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86399797
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86190078
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 209828
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86190125
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 209750
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86040516
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 359469
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86040515
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 359453
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85950500
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 449453
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85950532
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 449437
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85950360
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 449593
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85950344
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 449500
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85950188
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 449687
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85950234
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 449563
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85950250
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 449562
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85950391
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 449578
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85950422
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85950156
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 449797
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85800516
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 599422
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85800515
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 599282
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85800687
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 599281
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 599406
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85800485
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 599172
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85800796
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 599079
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85800890
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 598875
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85801078
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 598907
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85801078
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 598937
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85800703
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 599250
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85800688
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 599062
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85889875
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 420219
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85979718
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 420032
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85979937
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 420000
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85979985
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 419781
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85980187
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 419766
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85980000
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 419922
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85980031
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 419938
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85980046
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85979719
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 420187
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85979516
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 420125
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86190125
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 209766
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86189937
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 210000
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86189938
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 210046
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86189594
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 210219
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86189703
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 210266
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86189390
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 210547
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86189344
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 210375
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86189594
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 210390
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86189547
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86189719
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 210125
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86189828
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 209875
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86190062
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 209782
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86190187
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 209547
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86190422
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86190156
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86190406
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 209578
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86190360
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 209312
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86190641
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 209328
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 209046
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86190922
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 209063
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86190906
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 208797
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86191172
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 208687
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86190953
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 208985
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86190937
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 208719
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86191266
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 208718
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86191282
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 208406
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86191516
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 208453
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86191250
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86191188
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 208516
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86191437
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86221250
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86191765
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 208157
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86191500
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 208437
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86191422
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 208172
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86191797
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86281375
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86281484
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86281828
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86281594
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86280078
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86280079
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86280422
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86280406
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86280672
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86281047
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86281000
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86281328
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86281234
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86281609
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86281859
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86161922
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 237593
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86162391
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 237516
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86162093
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 237891
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86162047
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 237531
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86162453
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 237500
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86162313
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 237234
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86162641
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 237156
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86162406
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 237547
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 237157
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86162781
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 237187
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86161687
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 238000
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86399813
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86399750
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86219766
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86399922
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86399329
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 84900282
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 539765
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86250172
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86250531
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 480000
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-processthreads-l1-1-1.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\smb.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\sav.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Automation.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bddci_core.dllJump to dropped file
            Source: C:\Windows\System32\rundll32.exeDropped PE file which has not been started: C:\Windows\System32\drivers\SETF07D.tmpJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Application\tr-TR\WebCompanion.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\ssl.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-namedpipe-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-crt-process-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Application\ru-RU\WebCompanion.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-rtlsupport-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-crt-time-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Microsoft.mshtml.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-crt-conio-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-datetime-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\nsnF7E7.tmp\WcInstaller.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\tr-TR\WebCompanionInstaller.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-crt-filesystem-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-sysinfo-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-crt-conio-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-string-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Application\es-ES\WebCompanionInstaller.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Interop.SHDocVw.dllJump to dropped file
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDropped PE file which has not been started: C:\Program Files\FileZilla FTP Client\uninstall.exeJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\ftp.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Application\it-IT\WebCompanionInstaller.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-processthreads-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Application\pt-BR\WebCompanionInstaller.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-file-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Application\log4net.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\bddci_core.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Ionic.Zip.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Extension.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-crt-convert-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-crt-multibyte-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDropped PE file which has not been started: C:\Program Files\FileZilla FTP Client\fzsftp.exeJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Application\de-DE\WebCompanionInstaller.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Application\x86\SQLite.Interop.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\http.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.Service.Logger.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\msvcp140_1.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-handle-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Interop.LavasoftTcpServiceLib.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-profile-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Newtonsoft.Json.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Application\DotNetZip.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-sysinfo-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\nsnF7E7.tmp\WcInstaller.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\es-ES\WebCompanionInstaller.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\nsnF7E7.tmp\WcInstaller.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\en-US\WebCompanionInstaller.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\bddci.sysJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\rpc.dllJump to dropped file
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsnF7E7.tmp\UserInfo.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-handle-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Application\System.Data.SQLite.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\lsa.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Application\LZ4.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Interop.WUApiLib.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-profile-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Application\en-US\WebCompanionInstaller.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-debug-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.CSharp.Utilities.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-localization-l1-2-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-crt-multibyte-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Events.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-heap-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-file-l1-2-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-synch-l1-2-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-crt-time-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-crt-string-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.adblocker.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\vccorlib140.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SysInfo.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Utils.SqlLite.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-crt-string-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsnF7E7.tmp\nsDialogs.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\pop3.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\bddcihttp.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-errorhandling-l1-1-0.dllJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\rsvnd5a7.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-crt-convert-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-synch-l1-2-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Application\de-DE\WebCompanion.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Application\tr-TR\WebCompanionInstaller.resources.dllJump to dropped file
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDropped PE file which has not been started: C:\Program Files\FileZilla FTP Client\fzputtygen.exeJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Application\fr-CA\WebCompanionInstaller.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Application\ICSharpCode.SharpZipLib.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-processenvironment-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsnF7E7.tmp\UAC.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-synch-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-crt-filesystem-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\bdnc.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-crt-heap-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\nsnF7E7.tmp\WcInstaller.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\it-IT\WebCompanionInstaller.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Application\it-IT\WebCompanion.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Omni.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\msvcp140_2.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-libraryloader-l1-1-0.dllJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\fr_px-r0.dllJump to dropped file
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsnF7E7.tmp\System.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Application\ru-RU\WebCompanionInstaller.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Application\BCUEngineS.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Application\ja-JP\WebCompanionInstaller.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-file-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanionInstaller.exeJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-crt-math-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WcfService.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\smb.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\sav.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Application\zh-Hans\WebCompanion.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Esent.Interop.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-file-l2-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\ssl.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\OnlineThreatsSimple.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-console-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\pop3.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-synch-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\concrt140.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-namedpipe-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-timezone-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-crt-runtime-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\msvcp140_codecvt_ids.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-crt-environment-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-localization-l1-2-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Compression.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Utils.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\http.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-rtlsupport-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\msvcp140_2.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-file-l2-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-crt-private-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\nsnF7E7.tmp\WcInstaller.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\fr-CA\WebCompanionInstaller.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-crt-utility-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\vccorlib140.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\WebFilteringSimple.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Application\en-US\WebCompanion.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\rpc.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Application\zh-CHS\WebCompanionInstaller.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\OnlineThreatsSimple.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-crt-locale-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.AppCore.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-errorhandling-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-timezone-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-crt-private-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\WebFilteringSimple.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Interop.IWshRuntimeLibrary.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Application\NCalc.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\smtp.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-crt-heap-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-crt-stdio-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\scan.dllJump to dropped file
            Source: C:\Windows\System32\rundll32.exeDropped PE file which has not been started: C:\Windows\system32\DRIVERS\bddci.sys (copy)Jump to dropped file
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsnF7E7.tmp\StartMenu.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\DCIService.exeJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-interlocked-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-interlocked-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Application\acs17.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-crt-locale-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDropped PE file which has not been started: C:\Program Files\FileZilla FTP Client\fzshellext.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-crt-runtime-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.Repositories.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-util-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-crt-math-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-console-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\msvcp140_codecvt_ids.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\ftp.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\smtp.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bddcihttp.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-heap-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.IEController.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\scan.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-string-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Ad-Aware Web Companion.exeJump to dropped file
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDropped PE file which has not been started: C:\Program Files\FileZilla FTP Client\fzshellext_64.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-processthreads-l1-1-1.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Application\pt-BR\WebCompanion.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-processthreads-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-crt-process-l1-1-0.dllJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsc65psb.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-processenvironment-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\BDUpdateServiceCom.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-libraryloader-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Application\x64\SQLite.Interop.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\nsnF7E7.tmp\WcInstaller.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\pt-BR\WebCompanionInstaller.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\msvcp140_1.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.Loader.exeJump to dropped file
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsnF7E7.tmp\nsis_appid.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bddci.sysJump to dropped file
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDropped PE file which has not been started: C:\Program Files\FileZilla FTP Client\fzstorj.exeJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\nsnF7E7.tmp\WcInstaller.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\ru-RU\WebCompanionInstaller.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\bittorrent.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\nsnF7E7.tmp\WcInstaller.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\ICSharpCode.SharpZipLib.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\nsnF7E7.tmp\WcInstaller.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\zh-CHS\WebCompanionInstaller.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\lsa.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-datetime-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-debug-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Application\es-ES\WebCompanion.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Application\ja-JP\WebCompanion.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Application\fr-CA\WebCompanion.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\nsnF7E7.tmp\WcInstaller.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\de-DE\WebCompanionInstaller.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-crt-utility-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-memory-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-util-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.Business.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\BDUpdateServiceCom.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Application\7za.exeJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanionExtensionIE.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-crt-stdio-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WcCommunication.exeJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-memory-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\nsnF7E7.tmp\WcInstaller.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\Newtonsoft.Json.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Application\BCUSDK.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-file-l1-2-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-crt-environment-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bdnc.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Settings.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\concrt140.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\nsnF7E7.tmp\WcInstaller.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\ja-JP\WebCompanionInstaller.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeDropped PE file which has not been started: C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bittorrent.dllJump to dropped file
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsnF7E7.tmp\INetC.dllJump to dropped file
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeRegistry key enumerated: More than 799 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe TID: 6904Thread sleep count: 43 > 30Jump to behavior
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -922337203685477s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 6888Thread sleep count: 90 > 30
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 6888Thread sleep time: -45000s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -600000s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -86099922s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -300078s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 3260Thread sleep time: -450000s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -86099922s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 3260Thread sleep time: -90000s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -86309984s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -60125s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -86280094s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -119906s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -86190297s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -209703s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -86070516s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -299578s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -85980531s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -389454s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 3260Thread sleep count: 48 > 30
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 3260Thread sleep time: -23040000s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -85920656s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -1814400000s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -1036800000s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -172740156s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -59814s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -86370093s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -85890203s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -509797s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -85890172s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -419906s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -85980078s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -419922s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -85950187s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -449860s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -85380375s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -172620000s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -1080000s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -85800219s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -599781s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -86310015s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -89954s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -86310046s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -89922s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -86310063s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -60015s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -86339875s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -60110s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -86339890s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -86399906s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -85440547s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -630203s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -85709953s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -690031s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -171419844s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -690078s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -85709907s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -85709906s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -690063s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -85709890s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -690094s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -86220016s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -172799906s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -86399859s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -179876s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -86310062s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -86220093s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -149985s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -86249953s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -299938s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -86249968s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -86249859s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -150250s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -84690219s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -1709703s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -84690297s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -1709656s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -84690344s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -1709485s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -84660531s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -1739344s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -84660546s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -1739375s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -84660563s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -1739391s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -84660578s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -1739328s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -84570750s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -1829187s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -84570766s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -1829219s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -86340109s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -119688s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -172680250s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -59860s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -172680280s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -59828s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -86340141s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 1712Thread sleep count: 105 > 30
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -59797s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -259020561s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -59813s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -172680312s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -59812s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -86340110s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -59781s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -59766s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -59688s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -86340219s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -59656s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -59641s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -86340250s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -59672s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -59704s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -86340218s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -59750s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -86340157s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -59750s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -86100172s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -299734s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -86100203s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -299735s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -86100093s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -299688s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -86099953s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -299797s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -86100141s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -299671s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -86100297s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -299657s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -86100234s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -299719s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -86100125s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -299984s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -86099969s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -299890s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -86100000s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -300110s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -85770344s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -629609s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -85770328s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -629578s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -171540750s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -629625s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -629547s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -85770438s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -629531s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -86399641s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -86399734s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -86399516s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -86399313s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -86399157s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -86279391s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -120547s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -86279343s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -30735s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -86369015s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -30938s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -86368937s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -31125s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -172617532s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -91125s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -258925875s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -182156s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -86308875s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -91360s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -91218s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -91203s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -86308531s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -86397984s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -86399937s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -86190187s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -86399531s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -172799876s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -86399735s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -85590469s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -809562s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -85590360s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -809547s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -85589968s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -809953s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -85590032s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -809922s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -85589531s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -810406s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -85589516s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -1620156s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -171179750s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -810109s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -171179656s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -809719s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -85590203s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -809688s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -85589797s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -810156s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -171178844s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -810500s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -1620188s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -85589469s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -810484s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -85589484s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -810125s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -85589860s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -809656s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -86399891s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -86369906s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -30047s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -86369328s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -30656s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -86369281s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -30266s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -86369625s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -30250s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -86369297s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -30687s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -86369266s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -30281s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -86369688s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -86370250s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -86369859s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -30094s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -86369437s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -30500s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -86369454s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -60156s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -86369890s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -86369422s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -30563s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -30140s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -86369828s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -30172s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -172738750s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -30578s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -86369344s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -30219s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -86369734s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -30235s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -86369312s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -30625s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -30516s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -86399469s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -86399984s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -86399437s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -85919766s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -85919453s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -480563s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -85919109s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -84959938s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -1439609s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -83040016s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -84959500s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -480515s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -85439329s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -959640s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -86399625s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -85919860s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -960062s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -171839938s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -480015s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5016Thread sleep time: -85919969s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe TID: 3496Thread sleep time: -90000s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe TID: 7012Thread sleep count: 322 > 30
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe TID: 7012Thread sleep time: -161000s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 3084Thread sleep time: -922337203685477s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 3084Thread sleep time: -300000s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 6308Thread sleep time: -922337203685477s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -1844674407370954s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 6352Thread sleep time: -38000s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -300000s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -300000s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -85800093s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -599875s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 3524Thread sleep time: -2790000s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -85800094s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 3524Thread sleep time: -840000s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86280062s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -119907s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86309984s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -60078s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -172800000s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 3888Thread sleep time: -11040000s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -518400000s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86399875s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86399938s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -172799938s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86399921s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86369547s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -30406s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86369578s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -30188s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86369750s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -30219s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -172739562s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -30156s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -259109439s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -30171s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -30109s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -30125s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86369859s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -60282s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86369828s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86399906s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86399844s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86399937s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86399953s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86309969s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -89984s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86220078s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -180032s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86219922s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -150125s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86249796s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -149969s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86249844s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -150078s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86249875s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -150094s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86249812s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -150110s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86249828s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -120125s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86399828s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86399843s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86399829s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86399797s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86190078s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -209828s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86190125s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -209750s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86040516s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -359469s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86040515s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -359453s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -85950500s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -449453s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -85950532s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -449437s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -85950360s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -449593s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -85950344s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -449500s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -85950188s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -449687s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -85950234s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -449563s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -85950250s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -449562s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -85950391s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -899156s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -85950422s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -85950156s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -449797s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -171601032s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -599422s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -85800515s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -599282s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -85800687s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -599281s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -599406s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -85800485s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -599172s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -85800796s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -599079s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -85800890s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -598875s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -85801078s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -598907s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -85801078s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -598937s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -85800703s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -599250s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -85800688s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -599062s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -85889875s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -420219s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -85979718s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -420032s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -85979937s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -420000s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -85979985s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -419781s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -85980187s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -419766s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -85980000s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -419922s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -85980031s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -419938s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -85980046s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -85979719s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -420187s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -85979516s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -420125s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86190125s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -419532s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86189937s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -210000s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86189938s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -210046s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86189594s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -420438s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86189703s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -210266s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86189390s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -210547s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86189344s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -210375s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86189594s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -210390s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86189547s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86189719s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -210125s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86189828s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -209875s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86190062s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -209782s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -172380374s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -209547s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86190422s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86190156s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86190406s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -209578s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86190360s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -209312s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86190641s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -209328s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -209046s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86190922s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -209063s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86190906s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -208797s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86191172s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -208687s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86190953s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -208985s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86190937s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -208719s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86191266s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -417436s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86191282s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -208406s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86191516s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -208453s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86191250s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86191188s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -208516s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86191437s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -178641s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86221250s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -178328s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86191765s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -208157s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86191500s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -208437s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86191422s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -208172s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86191797s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -118297s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86281375s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -118500s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86281484s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -118125s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86281828s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -118078s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86281594s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -118344s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86280078s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -119859s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86280079s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -119531s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86280422s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -119562s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86280406s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -119235s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86280672s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -118906s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86281047s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -118922s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86281000s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -118625s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86281328s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -118656s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86281234s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -118266s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86281609s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -117938s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86281859s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -118188s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86161922s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -237593s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -172324782s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -475032s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86162093s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -237891s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86162047s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -237531s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86162453s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -237500s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -86162313s >= -30000s
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2024Thread sleep time: -237234s >= -30000s
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT UserName FROM Win32_ComputerSystem
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Search.exeLast function: Thread delayed
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeFile Volume queried: C:\Program Files FullSizeInformationJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeFile Volume queried: C:\Program Files FullSizeInformationJump to behavior
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 922337203685477
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 300000
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86099922
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 300078
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 90000
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86099922
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 30000
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86309984
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 60125
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86280094
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 119906
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86190297
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 209703
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86070516
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 299578
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85980531
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 389454
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 480000
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85920656
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86400000
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86400000
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86370078
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86370093
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85890203
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 509797
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85890172
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 419906
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85980078
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 419922
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85950187
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 449860
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85380375
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86310000
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 90000
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85800219
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 599781
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86310015
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 89954
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86310046
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 89922
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86310063
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 60015
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86339875
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 60110
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86339890
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86399906
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85440547
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 630203
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85709953
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 690031
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85709922
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 690078
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85709907
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85709906
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 690063
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85709890
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 690094
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86220016
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86399953
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86399859
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 89938
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86310062
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86220093
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 149985
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86249953
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 149969
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86249968
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86249859
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 150250
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 84690219
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 1709703
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 84690297
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 1709656
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 84690344
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 1709485
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 84660531
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 1739344
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 84660546
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 1739375
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 84660563
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 1739391
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 84660578
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 1739328
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 84570750
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 1829187
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 84570766
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 1829219
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86340109
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 59844
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86340125
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 59860
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86340140
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 59828
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86340141
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 59797
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86340187
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 59813
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86340156
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 59812
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86340110
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 59781
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 59766
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 59688
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86340219
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 59656
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 59641
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86340250
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 59672
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 59704
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86340218
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 59750
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86340157
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 59750
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86100172
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 299734
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86100203
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 299735
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86100093
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 299688
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86099953
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 299797
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86100141
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 299671
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86100297
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 299657
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86100234
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 299719
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86100125
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 299984
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86099969
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 299890
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86100000
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 300110
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85770344
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 629609
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85770328
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 629578
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85770375
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 629625
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 629547
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85770438
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 629531
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86399641
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86399734
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86399516
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86399313
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86399157
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86279391
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 120547
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86279343
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 30735
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86369015
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 30938
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86368937
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 31125
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86308766
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 91125
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86308625
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 91078
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86308875
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 91360
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 91218
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 91203
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86308531
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86397984
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86399937
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86190187
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86399531
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86399938
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86399735
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85590469
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 809562
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85590360
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 809547
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85589968
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 809953
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85590032
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 809922
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85589531
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 810406
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85589516
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 810078
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85589875
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 810109
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85589828
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 809719
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85590203
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 809688
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85589797
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 810156
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85589422
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 810500
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 810094
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85589469
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 810484
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85589484
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 810125
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85589860
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 809656
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86399891
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86369906
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 30047
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86369328
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 30656
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86369281
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 30266
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86369625
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 30250
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86369297
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 30687
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86369266
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 30281
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86369688
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86370250
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86369859
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 30094
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86369437
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 30500
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86369454
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 30078
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86369890
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86369422
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 30563
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 30140
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86369828
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 30172
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86369375
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 30578
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86369344
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 30219
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86369734
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 30235
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86369312
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 30625
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 30516
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86399469
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86399984
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86399437
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85919766
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85919453
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 480563
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85919109
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 84959938
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 1439609
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 83040016
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 84959500
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 480515
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85439329
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 959640
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86399625
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85919860
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 480031
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85919969
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 480015
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85919969
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 922337203685477
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 300000
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 922337203685477
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 922337203685477
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 300000
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 300000
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85800093
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 599875
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 90000
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85800094
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 30000
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86280062
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 119907
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86309984
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 60078
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86400000
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 480000
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86400000
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86399875
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86399938
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86399969
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86399921
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86369547
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 30406
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86369578
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 30188
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86369750
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 30219
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86369781
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 30156
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86369813
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 30171
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 30109
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 30125
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86369859
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 30141
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86369828
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86399906
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86399844
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86399937
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86399953
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86309969
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 89984
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86220078
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 180032
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86219922
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 150125
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86249796
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 149969
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86249844
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 150078
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86249875
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 150094
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86249812
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 150110
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86249828
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 120125
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86399828
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86399843
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86399829
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86399797
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86190078
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 209828
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86190125
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 209750
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86040516
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 359469
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86040515
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 359453
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85950500
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 449453
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85950532
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 449437
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85950360
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 449593
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85950344
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 449500
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85950188
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 449687
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85950234
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 449563
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85950250
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 449562
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85950391
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 449578
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85950422
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85950156
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 449797
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85800516
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 599422
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85800515
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 599282
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85800687
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 599281
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 599406
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85800485
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 599172
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85800796
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 599079
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85800890
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 598875
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85801078
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 598907
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85801078
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 598937
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85800703
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 599250
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85800688
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 599062
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85889875
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 420219
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85979718
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 420032
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85979937
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 420000
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85979985
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 419781
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85980187
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 419766
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85980000
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 419922
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85980031
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 419938
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85980046
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85979719
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 420187
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 85979516
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 420125
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86190125
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 209766
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86189937
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 210000
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86189938
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 210046
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86189594
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 210219
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86189703
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 210266
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86189390
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 210547
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86189344
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 210375
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86189594
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 210390
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86189547
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86189719
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 210125
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86189828
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 209875
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86190062
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 209782
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86190187
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 209547
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86190422
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86190156
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86190406
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 209578
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86190360
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 209312
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86190641
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 209328
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 209046
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86190922
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 209063
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86190906
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 208797
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86191172
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 208687
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86190953
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 208985
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86190937
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 208719
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86191266
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 208718
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86191282
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 208406
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86191516
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 208453
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86191250
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86191188
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 208516
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86191437
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 178641
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86221250
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 178328
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86191765
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 208157
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86191500
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 208437
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86191422
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 208172
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86191797
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 118297
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86281375
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 118500
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86281484
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 118125
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86281828
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 118078
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86281594
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 118344
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86280078
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 119859
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86280079
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 119531
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86280422
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 119562
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86280406
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 119235
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86280672
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 118906
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86281047
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 118922
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86281000
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 118625
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86281328
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 118656
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86281234
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 118266
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86281609
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 117938
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86281859
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 118188
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86161922
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 237593
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86162391
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 237516
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86162093
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 237891
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86162047
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 237531
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86162453
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 237500
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86162313
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 237234
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86162641
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 237156
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86162406
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 237547
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 237157
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86162781
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 237187
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86161687
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 238000
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeThread delayed: delay time: 86399813
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeFile opened: C:\Users\user\AppData\RoamingJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.iniJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeFile opened: C:\Users\userJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeFile opened: C:\Users\user\AppData\Roaming\MicrosoftJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeFile opened: C:\Users\user\AppDataJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\WindowsJump to behavior
            Source: WebCompanionInstaller.exe, 00000003.00000000.1867314648.0000000000782000.00000002.00000001.01000000.0000000F.sdmpBinary or memory string: vmware
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2211628615.0000000000791000.00000004.00000020.00020000.00000000.sdmp, FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000003.2208888820.0000000000791000.00000004.00000020.00020000.00000000.sdmp, FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000003.1744674899.0000000000791000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWR
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2211628615.0000000000791000.00000004.00000020.00020000.00000000.sdmp, FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000003.2208888820.0000000000791000.00000004.00000020.00020000.00000000.sdmp, FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000003.1744674899.0000000000791000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
            Source: FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000003.2209173919.0000000000748000.00000004.00000020.00020000.00000000.sdmp, FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000003.2208888820.000000000073B000.00000004.00000020.00020000.00000000.sdmp, FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2211628615.0000000000749000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWH
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeProcess information queried: ProcessInformationJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess token adjusted: Debug
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess token adjusted: Debug
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeProcess token adjusted: Debug
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeMemory allocated: page read and write | page guard

            HIPS / PFW / Operating System Protection Evasion

            barindex
            Yara detected Powershell download and execute
            Source: Yara matchFile source: C:\ProgramData\Lavasoft\Web Companion\Logs\Webcompanion\webcompanion.log, type: DROPPED
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeProcess created: C:\Users\user\AppData\Local\Temp\nsnF7E7.tmp\WcInstaller.exe "C:\Users\user\AppData\Local\Temp\nsnF7E7.tmp\WcInstaller.exe" --silent --partner=FZ210427 --searchenblJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeProcess created: C:\Program Files\FileZilla FTP Client\filezilla.exe "C:\Program Files\FileZilla FTP Client\filezilla.exe" Jump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess created: C:\Windows\SysWOW64\sc.exe "sc.exe" Create "WCAssistantService" binPath= "C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe" DisplayName= "WC Assistant" start= autoJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess created: C:\Windows\SysWOW64\sc.exe "sc.exe" failure WCAssistantService reset= 30 actions= restart/60000Jump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess created: C:\Windows\SysWOW64\sc.exe "sc.exe" description "WCAssistantService" "Ad-Aware Web Companion Internet security service"Jump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess created: C:\Windows\System32\rundll32.exe "C:\Windows\sysnative\RunDLL32.Exe" syssetup,SetupInfObjectInstallAction BootInstall 128 C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bddci.infJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess created: C:\Windows\System32\net.exe "C:\Windows\sysnative\net.exe" start bddciJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess created: C:\Windows\SysWOW64\sc.exe "sc.exe" Create "DCIService" binPath= "C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\DCIService.exe" DisplayName= "DCIService" start= autoJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess created: C:\Windows\SysWOW64\sc.exe "sc.exe" description "DCIService" "Webprotection Bridge service"Jump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bridge_start.cmd" Jump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C netsh http add urlacl url=http://+:9007/ user=EveryoneJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeProcess created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe "C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe" --silent --install --geo= --searchenbl Jump to behavior
            Source: C:\Windows\System32\net.exeProcess created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 start bddci
            Source: C:\Windows\System32\runonce.exeProcess created: C:\Windows\System32\grpconv.exe "C:\Windows\System32\grpconv.exe" -o
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\sc.exe sc start DCIService
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\netsh.exe netsh http add urlacl url=http://+:9007/ user=Everyone
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\rsvnd5a7.cmdline"
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C netsh http add urlacl url=http://+:9007/ user=Everyone
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\netsh.exe netsh http add urlacl url=http://+:9007/ user=Everyone
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES71F3.tmp" "c:\Users\user\AppData\Local\Temp\CSC7165.tmp"
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\fr_px-r0.cmdline"
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\xsc65psb.cmdline"
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES822F.tmp" "c:\Users\user\AppData\Local\Temp\CSC821F.tmp"
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES827D.tmp" "c:\Users\user\AppData\Local\Temp\CSC826D.tmp"
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Search.exe "c:\program files (x86)\lavasoft\web companion\application\lavasoft.search.exe" --searchconfigpath="c:\users\user\appdata\roaming\lavasoft\web companion\options\searchmetadata.txt" --eventconfigpath="c:\users\user\appdata\roaming\lavasoft\web companion\options\eventmetadata.txt"
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeProcess created: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Search.exe "c:\program files (x86)\lavasoft\web companion\application\lavasoft.search.exe" --searchconfigpath="c:\users\user\appdata\roaming\lavasoft\web companion\options\searchmetadata.txt" --eventconfigpath="c:\users\user\appdata\roaming\lavasoft\web companion\options\eventmetadata.txt"
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeQueries volume information: C:\ VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exeQueries volume information: C:\ VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.ServiceModel\3.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.ServiceModel\3.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.ServiceModel.Web\3.5.0.0__31bf3856ad364e35\System.ServiceModel.Web.dll VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.ServiceModel.Web\3.5.0.0__31bf3856ad364e35\System.ServiceModel.Web.dll VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\SMDiagnostics\3.0.0.0__b77a5c561934e089\SMdiagnostics.dll VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\SMDiagnostics\3.0.0.0__b77a5c561934e089\SMdiagnostics.dll VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeQueries volume information: C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeQueries volume information: C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.Runtime.Serialization\3.0.0.0__b77a5c561934e089\System.Runtime.Serialization.dll VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.Runtime.Serialization\3.0.0.0__b77a5c561934e089\System.Runtime.Serialization.dll VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.IdentityModel\3.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.IdentityModel\3.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeQueries volume information: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\Newtonsoft.Json.dll VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeQueries volume information: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\Newtonsoft.Json.dll VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.ComponentModel.DataAnnotations\3.5.0.0__31bf3856ad364e35\System.ComponentModel.DataAnnotations.dll VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.ComponentModel.DataAnnotations\3.5.0.0__31bf3856ad364e35\System.ComponentModel.DataAnnotations.dll VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.Xml.Linq\3.5.0.0__b77a5c561934e089\System.Xml.Linq.dll VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.Xml.Linq\3.5.0.0__b77a5c561934e089\System.Xml.Linq.dll VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeQueries volume information: C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeQueries volume information: C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.WorkflowServices\3.5.0.0__31bf3856ad364e35\System.WorkflowServices.dll VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.WorkflowServices\3.5.0.0__31bf3856ad364e35\System.WorkflowServices.dll VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeQueries volume information: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\ICSharpCode.SharpZipLib.dll VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeQueries volume information: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\ICSharpCode.SharpZipLib.dll VolumeInformationJump to behavior
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeQueries volume information: C:\ VolumeInformation
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeQueries volume information: \Device\CdRom0\ VolumeInformation
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeQueries volume information: C:\Users VolumeInformation
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeQueries volume information: C:\ProgramData VolumeInformation
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeQueries volume information: C:\ProgramData VolumeInformation
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeQueries volume information: C:\ProgramData VolumeInformation
            Source: C:\Program Files\FileZilla FTP Client\filezilla.exeQueries volume information: C:\Users\user\AppData\Roaming VolumeInformation
            Source: C:\Windows\SysWOW64\cmd.exeQueries volume information: C:\ VolumeInformation
            Source: C:\Windows\SysWOW64\netsh.exeQueries volume information: C:\ VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\log4net.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\log4net.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.AppCore.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.AppCore.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Events.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Events.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Newtonsoft.Json.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Newtonsoft.Json.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Interop.LavasoftTcpServiceLib.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Interop.LavasoftTcpServiceLib.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.ServiceModel\3.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.ServiceModel\3.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.Runtime.Serialization\3.0.0.0__b77a5c561934e089\System.Runtime.Serialization.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.Runtime.Serialization\3.0.0.0__b77a5c561934e089\System.Runtime.Serialization.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.Business.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.Business.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\ICSharpCode.SharpZipLib.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\ICSharpCode.SharpZipLib.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.ComponentModel.DataAnnotations\3.5.0.0__31bf3856ad364e35\System.ComponentModel.DataAnnotations.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.ComponentModel.DataAnnotations\3.5.0.0__31bf3856ad364e35\System.ComponentModel.DataAnnotations.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.Xml.Linq\3.5.0.0__b77a5c561934e089\System.Xml.Linq.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.Xml.Linq\3.5.0.0__b77a5c561934e089\System.Xml.Linq.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SysInfo.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SysInfo.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Compression.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Compression.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\MozCompressor.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Interop.IWshRuntimeLibrary.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Interop.IWshRuntimeLibrary.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\ VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.Service.Logger.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.Service.Logger.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\log4net.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\log4net.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.ServiceModel\3.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.ServiceModel\3.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WcfService.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WcfService.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\SMDiagnostics\3.0.0.0__b77a5c561934e089\SMdiagnostics.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\SMDiagnostics\3.0.0.0__b77a5c561934e089\SMdiagnostics.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.Runtime.Serialization\3.0.0.0__b77a5c561934e089\System.Runtime.Serialization.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.Runtime.Serialization\3.0.0.0__b77a5c561934e089\System.Runtime.Serialization.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.IdentityModel\3.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.IdentityModel\3.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.WorkflowServices\3.5.0.0__31bf3856ad364e35\System.WorkflowServices.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.WorkflowServices\3.5.0.0__31bf3856ad364e35\System.WorkflowServices.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.ServiceModel.Web\3.5.0.0__31bf3856ad364e35\System.ServiceModel.Web.dll VolumeInformation
            Source: C:\Windows\System32\netsh.exeQueries volume information: C:\ VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\log4net.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\log4net.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.AppCore.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.AppCore.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Events.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Events.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Newtonsoft.Json.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Newtonsoft.Json.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Interop.LavasoftTcpServiceLib.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Interop.LavasoftTcpServiceLib.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.ServiceModel\3.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.ServiceModel\3.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.Runtime.Serialization\3.0.0.0__b77a5c561934e089\System.Runtime.Serialization.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.Runtime.Serialization\3.0.0.0__b77a5c561934e089\System.Runtime.Serialization.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.Business.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.Business.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\ICSharpCode.SharpZipLib.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\ICSharpCode.SharpZipLib.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.ComponentModel.DataAnnotations\3.5.0.0__31bf3856ad364e35\System.ComponentModel.DataAnnotations.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.ComponentModel.DataAnnotations\3.5.0.0__31bf3856ad364e35\System.ComponentModel.DataAnnotations.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.Xml.Linq\3.5.0.0__b77a5c561934e089\System.Xml.Linq.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.Xml.Linq\3.5.0.0__b77a5c561934e089\System.Xml.Linq.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\log4net.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\log4net.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.AppCore.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.AppCore.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Events.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Events.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Newtonsoft.Json.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Newtonsoft.Json.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Interop.LavasoftTcpServiceLib.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Interop.LavasoftTcpServiceLib.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.ServiceModel\3.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.ServiceModel\3.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.Runtime.Serialization\3.0.0.0__b77a5c561934e089\System.Runtime.Serialization.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.Business.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.Business.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\ICSharpCode.SharpZipLib.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\ICSharpCode.SharpZipLib.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.ComponentModel.DataAnnotations\3.5.0.0__31bf3856ad364e35\System.ComponentModel.DataAnnotations.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.ComponentModel.DataAnnotations\3.5.0.0__31bf3856ad364e35\System.ComponentModel.DataAnnotations.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.Xml.Linq\3.5.0.0__b77a5c561934e089\System.Xml.Linq.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.Xml.Linq\3.5.0.0__b77a5c561934e089\System.Xml.Linq.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.ServiceModel.Web\3.5.0.0__31bf3856ad364e35\System.ServiceModel.Web.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.ServiceModel.Web\3.5.0.0__31bf3856ad364e35\System.ServiceModel.Web.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\SMDiagnostics\3.0.0.0__b77a5c561934e089\SMdiagnostics.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\SMDiagnostics\3.0.0.0__b77a5c561934e089\SMdiagnostics.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.IdentityModel\3.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.IdentityModel\3.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.WorkflowServices\3.5.0.0__31bf3856ad364e35\System.WorkflowServices.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.WorkflowServices\3.5.0.0__31bf3856ad364e35\System.WorkflowServices.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Compression.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Compression.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\MozCompressor.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Utils.SqlLite.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Utils.SqlLite.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\System.Data.SQLite.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\System.Data.SQLite.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SysInfo.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SysInfo.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Search.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\log4net.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Search.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\log4net.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Search.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Newtonsoft.Json.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Search.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Newtonsoft.Json.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Search.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.ComponentModel.DataAnnotations\3.5.0.0__31bf3856ad364e35\System.ComponentModel.DataAnnotations.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Search.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.ComponentModel.DataAnnotations\3.5.0.0__31bf3856ad364e35\System.ComponentModel.DataAnnotations.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Search.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.Runtime.Serialization\3.0.0.0__b77a5c561934e089\System.Runtime.Serialization.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Search.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.Runtime.Serialization\3.0.0.0__b77a5c561934e089\System.Runtime.Serialization.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Search.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.Xml.Linq\3.5.0.0__b77a5c561934e089\System.Xml.Linq.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Search.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.Xml.Linq\3.5.0.0__b77a5c561934e089\System.Xml.Linq.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Search.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\LZ4.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Search.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\LZ4.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Search.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\log4net.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Search.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\log4net.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Search.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Newtonsoft.Json.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Search.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Newtonsoft.Json.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Search.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.ComponentModel.DataAnnotations\3.5.0.0__31bf3856ad364e35\System.ComponentModel.DataAnnotations.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Search.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.ComponentModel.DataAnnotations\3.5.0.0__31bf3856ad364e35\System.ComponentModel.DataAnnotations.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Search.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.Runtime.Serialization\3.0.0.0__b77a5c561934e089\System.Runtime.Serialization.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Search.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.Runtime.Serialization\3.0.0.0__b77a5c561934e089\System.Runtime.Serialization.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Search.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.Xml.Linq\3.5.0.0__b77a5c561934e089\System.Xml.Linq.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Search.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.Xml.Linq\3.5.0.0__b77a5c561934e089\System.Xml.Linq.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Search.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\LZ4.dll VolumeInformation
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Search.exeQueries volume information: C:\Program Files (x86)\Lavasoft\Web Companion\Application\LZ4.dll VolumeInformation
            Source: C:\Windows\System32\runonce.exeKey value queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\TimeZoneInformation Bias
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

            Lowering of HIPS / PFW / Operating System Security Settings

            barindex
            Modifies Internet Explorer zone settings
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeRegistry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2 2301Jump to behavior
            Modifies Internet Explorer zonemap settings
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeRegistry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\localhost *Jump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeRegistry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\webcompanion.com httpJump to behavior
            Overwrites Mozilla Firefox settings
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\prefs.js
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\prefs.js
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js
            Uses netsh to modify the Windows network and firewall settings
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\netsh.exe netsh http add urlacl url=http://+:9007/ user=Everyone
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeRegistry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8CF427FD790C3AD166068DE81E57EFBB932272D4 BlobJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter : SELECT * FROM AntivirusProduct

            Stealing of Sensitive Information

            barindex
            Tries to harvest and steal browser information (history, passwords, etc)
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Search.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\search.json.mozlz4
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Preferences
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Search.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Search.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\prefs.js
            Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

            Mitre Att&ck Matrix

            ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
            Gather Victim Identity InformationAcquire InfrastructureValid Accounts2
            Windows Management Instrumentation            		1
            DLL Side-Loading            		1
            DLL Side-Loading            		311
            Disable or Modify Tools            		1
            OS Credential Dumping            		1
            System Time Discovery            		Remote Services2
            Archive Collected Data            		2
            Ingress Tool Transfer            		Exfiltration Over Other Network Medium1
            Data Encrypted for Impact
            CredentialsDomainsDefault Accounts1
            Command and Scripting Interpreter            		22
            Windows Service            		22
            Windows Service            		1
            Deobfuscate/Decode Files or Information            		LSASS Memory2
            File and Directory Discovery            		Remote Desktop Protocol3
            Browser Session Hijacking            		1
            Encrypted Channel            		Exfiltration Over BluetoothNetwork Denial of Service
            Email AddressesDNS ServerDomain Accounts1
            Service Execution            		311
            Registry Run Keys / Startup Folder            		11
            Process Injection            		1
            DLL Side-Loading            		Security Account Manager33
            System Information Discovery            		SMB/Windows Admin Shares1
            Data from Local System            		4
            Non-Application Layer Protocol            		Automated ExfiltrationData Encrypted for Impact
            Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook311
            Registry Run Keys / Startup Folder            		1
            File Deletion            		NTDS1
            Query Registry            		Distributed Component Object ModelInput Capture5
            Application Layer Protocol            		Traffic DuplicationData Destruction
            Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script133
            Masquerading            		LSA Secrets121
            Security Software Discovery            		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
            Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts141
            Virtualization/Sandbox Evasion            		Cached Domain Credentials11
            Process Discovery            		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
            DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items11
            Process Injection            		DCSync141
            Virtualization/Sandbox Evasion            		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
            Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
            Regsvr32            		Proc FilesystemSystem Owner/User DiscoveryCloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
            Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt1
            Rundll32            		/etc/passwd and /etc/shadowNetwork SniffingDirect Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

            Behavior Graph

            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Is Windows Process
            • Number of created Registry Values
            • Number of created Files
            • Visual Basic
            • Delphi
            • Java
            • .Net C# or VB.NET
            • C, C++ or other language
            • Is malicious
            • Internet
            behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1478260 Sample: FileZilla_3.67.1_win64_spon... Startdate: 22/07/2024 Architecture: WINDOWS Score: 56 133 webcompanion.com 2->133 135 www.google.com 2->135 137 13 other IPs or domains 2->137 155 Multi AV Scanner detection for dropped file 2->155 157 Yara detected Powershell download and execute 2->157 159 Detected potential unwanted application 2->159 161 3 other signatures 2->161 11 FileZilla_3.67.1_win64_sponsored-setup.exe 27 1013 2->11         started        15 WebCompanion.exe 2->15         started        18 Lavasoft.WCAssistant.WinService.exe 2->18         started        20 3 other processes 2->20 signatures3 process4 dnsIp5 145 webcompanion.com 104.19.159.224 CLOUDFLARENETUS United States 11->145 147 filezilla-project.org 49.12.121.47 HETZNER-ASDE Germany 11->147 121 C:\Users\user\AppData\Local\...\nsy38DB.tmp, PE32 11->121 dropped 123 C:\Users\user\AppData\Local\...\nsDialogs.dll, PE32 11->123 dropped 125 C:\Users\user\...\WcInstaller.exe (copy), PE32 11->125 dropped 131 31 other files (28 malicious) 11->131 dropped 22 WcInstaller.exe 36 11->22         started        25 regsvr32.exe 11->25         started        28 filezilla.exe 11->28         started        149 www.google.com 142.250.186.164 GOOGLEUS United States 15->149 127 C:\Users\user\AppData\Roaming\...\prefs.js, CSV 15->127 dropped 129 C:\Users\user\AppData\Roaming\...\prefs.js, ASCII 15->129 dropped 181 Overwrites Mozilla Firefox settings 15->181 183 Tries to harvest and steal browser information (history, passwords, etc) 15->183 30 Lavasoft.Search.exe 15->30         started        32 csc.exe 15->32         started        34 csc.exe 15->34         started        36 Lavasoft.Search.exe 15->36         started        185 Creates files in the system32 config directory 18->185 38 cmd.exe 18->38         started        file6 signatures7 process8 file9 91 C:\...\WebCompanionInstaller.resources.dll, PE32 22->91 dropped 93 C:\...\WebCompanionInstaller.resources.dll, PE32 22->93 dropped 95 C:\...\WebCompanionInstaller.resources.dll, PE32 22->95 dropped 101 11 other malicious files 22->101 dropped 40 WebCompanionInstaller.exe 55 282 22->40         started        163 Creates an undocumented autostart registry key 25->163 165 Tries to harvest and steal browser information (history, passwords, etc) 30->165 97 C:\Users\user\AppData\Local\...\fr_px-r0.dll, PE32 32->97 dropped 45 conhost.exe 32->45         started        47 cvtres.exe 32->47         started        99 C:\Users\user\AppData\Local\...\xsc65psb.dll, PE32 34->99 dropped 49 conhost.exe 34->49         started        51 cvtres.exe 34->51         started        53 netsh.exe 38->53         started        55 conhost.exe 38->55         started        signatures10 process11 dnsIp12 139 wc-update-service.lavasoft.com 64.18.87.81 MTOCA Canada 40->139 141 acs.lavasoft.com 104.16.148.130 CLOUDFLARENETUS United States 40->141 143 2 other IPs or domains 40->143 105 C:\Program Files (x86)\Lavasoft\...\ssl.dll, PE32+ 40->105 dropped 107 C:\Program Files (x86)\Lavasoft\...\smtp.dll, PE32+ 40->107 dropped 109 C:\Program Files (x86)\Lavasoft\...\smb.dll, PE32+ 40->109 dropped 111 203 other files (69 malicious) 40->111 dropped 167 Writes a notice file (html or txt) to demand a ransom 40->167 169 Modifies Internet Explorer zone settings 40->169 171 Modifies Internet Explorer zonemap settings 40->171 57 rundll32.exe 40->57         started        61 WebCompanion.exe 40->61         started        64 cmd.exe 40->64         started        66 7 other processes 40->66 173 Creates files in the system32 config directory 53->173 file13 signatures14 process15 dnsIp16 113 C:\Windows\system32\...\bddci.sys (copy), PE32+ 57->113 dropped 115 C:\Windows\System32\drivers\SETF07D.tmp, PE32+ 57->115 dropped 175 Creates multiple autostart registry keys 57->175 177 Creates an autostart registry key pointing to binary in C:\Windows 57->177 68 runonce.exe 57->68         started        151 wsgeoip.lavasoft.com 64.18.87.4 MTOCA Canada 61->151 153 wc-partners.lavasoft.com 64.18.87.82 MTOCA Canada 61->153 117 C:\Users\user\AppData\...\rsvnd5a7.cmdline, Unicode 61->117 dropped 119 C:\ProgramData\Lavasoft\...\webcompanion.log, ASCII 61->119 dropped 70 csc.exe 61->70         started        179 Uses netsh to modify the Windows network and firewall settings 64->179 73 conhost.exe 64->73         started        75 sc.exe 64->75         started        77 conhost.exe 66->77         started        79 conhost.exe 66->79         started        81 conhost.exe 66->81         started        83 6 other processes 66->83 file17 signatures18 process19 file20 85 grpconv.exe 68->85         started        103 C:\Users\user\AppData\Local\...\rsvnd5a7.dll, PE32 70->103 dropped 87 conhost.exe 70->87         started        89 cvtres.exe 70->89         started        process21

            Screenshots

            Thumbnails

            This section contains all screenshots as thumbnails, including those not shown in the slideshow.


            windows-stand

            Antivirus, Machine Learning and Genetic Malware Detection

            Initial Sample

            SourceDetectionScannerLabelLink
            FileZilla_3.67.1_win64_sponsored-setup.exe4%ReversingLabsWin32.Malware.FileZillaBundleInstaller

            Dropped Files

            SourceDetectionScannerLabelLink
            C:\Program Files (x86)\Lavasoft\Web Companion\Application\7za.exe3%ReversingLabs
            C:\Program Files (x86)\Lavasoft\Web Companion\Application\Ad-Aware Web Companion.exe3%ReversingLabs
            C:\Program Files (x86)\Lavasoft\Web Companion\Application\BCUEngineS.dll4%ReversingLabs
            C:\Program Files (x86)\Lavasoft\Web Companion\Application\BCUSDK.dll3%ReversingLabs
            C:\Program Files (x86)\Lavasoft\Web Companion\Application\DotNetZip.dll3%ReversingLabs
            C:\Program Files (x86)\Lavasoft\Web Companion\Application\Esent.Interop.dll3%ReversingLabs
            C:\Program Files (x86)\Lavasoft\Web Companion\Application\ICSharpCode.SharpZipLib.dll3%ReversingLabs
            C:\Program Files (x86)\Lavasoft\Web Companion\Application\Interop.IWshRuntimeLibrary.dll3%ReversingLabs
            C:\Program Files (x86)\Lavasoft\Web Companion\Application\Interop.LavasoftTcpServiceLib.dll3%ReversingLabs
            C:\Program Files (x86)\Lavasoft\Web Companion\Application\Interop.SHDocVw.dll3%ReversingLabs
            C:\Program Files (x86)\Lavasoft\Web Companion\Application\Interop.Shell32.dll3%ReversingLabs
            C:\Program Files (x86)\Lavasoft\Web Companion\Application\Interop.WUApiLib.dll3%ReversingLabs
            C:\Program Files (x86)\Lavasoft\Web Companion\Application\Ionic.Zip.dll4%ReversingLabs
            C:\Program Files (x86)\Lavasoft\Web Companion\Application\LZ4.dll3%ReversingLabs
            C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.AppCore.dll4%ReversingLabs
            C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Automation.dll3%ReversingLabs
            C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.CSharp.Utilities.dll3%ReversingLabs
            C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Compression.dll4%ReversingLabs
            C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Events.dll3%ReversingLabs
            C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Extension.dll3%ReversingLabs
            C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.IEController.dll3%ReversingLabs
            C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Omni.dll3%ReversingLabs
            C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Search.exe5%ReversingLabs
            C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.Business.dll5%ReversingLabs
            C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.Repositories.dll3%ReversingLabs
            C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Settings.dll3%ReversingLabs
            C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SysInfo.dll4%ReversingLabs
            C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Utils.SqlLite.dll4%ReversingLabs
            C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll4%ReversingLabs
            C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.Service.Logger.dll3%ReversingLabs
            C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WcfService.dll3%ReversingLabs
            C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe4%ReversingLabs
            C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.adblocker.dll3%ReversingLabs
            C:\Program Files (x86)\Lavasoft\Web Companion\Application\Microsoft.mshtml.dll3%ReversingLabs
            C:\Program Files (x86)\Lavasoft\Web Companion\Application\MozCompressor.dll3%ReversingLabs
            C:\Program Files (x86)\Lavasoft\Web Companion\Application\NCalc.dll3%ReversingLabs
            C:\Program Files (x86)\Lavasoft\Web Companion\Application\Newtonsoft.Json.dll3%ReversingLabs
            C:\Program Files (x86)\Lavasoft\Web Companion\Application\System.Data.SQLite.dll0%ReversingLabs
            C:\Program Files (x86)\Lavasoft\Web Companion\Application\WcCommunication.exe3%ReversingLabs
            C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.Loader.exe3%ReversingLabs
            C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe4%ReversingLabs
            C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanionExtensionIE.dll3%ReversingLabs
            C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanionInstaller.exe13%ReversingLabs
            C:\Program Files (x86)\Lavasoft\Web Companion\Application\acs17.dll3%ReversingLabs
            C:\Program Files (x86)\Lavasoft\Web Companion\Application\de-DE\WebCompanion.resources.dll3%ReversingLabs
            C:\Program Files (x86)\Lavasoft\Web Companion\Application\de-DE\WebCompanionInstaller.resources.dll3%ReversingLabs
            C:\Program Files (x86)\Lavasoft\Web Companion\Application\en-US\WebCompanion.resources.dll3%ReversingLabs
            C:\Program Files (x86)\Lavasoft\Web Companion\Application\en-US\WebCompanionInstaller.resources.dll3%ReversingLabs
            C:\Program Files (x86)\Lavasoft\Web Companion\Application\es-ES\WebCompanion.resources.dll3%ReversingLabs
            C:\Program Files (x86)\Lavasoft\Web Companion\Application\es-ES\WebCompanionInstaller.resources.dll3%ReversingLabs
            C:\Program Files (x86)\Lavasoft\Web Companion\Application\fr-CA\WebCompanion.resources.dll3%ReversingLabs
            C:\Program Files (x86)\Lavasoft\Web Companion\Application\fr-CA\WebCompanionInstaller.resources.dll5%ReversingLabs
            C:\Program Files (x86)\Lavasoft\Web Companion\Application\it-IT\WebCompanion.resources.dll3%ReversingLabs
            C:\Program Files (x86)\Lavasoft\Web Companion\Application\it-IT\WebCompanionInstaller.resources.dll3%ReversingLabs
            C:\Program Files (x86)\Lavasoft\Web Companion\Application\ja-JP\WebCompanion.resources.dll3%ReversingLabs
            C:\Program Files (x86)\Lavasoft\Web Companion\Application\ja-JP\WebCompanionInstaller.resources.dll3%ReversingLabs
            C:\Program Files (x86)\Lavasoft\Web Companion\Application\liblz4.dll3%ReversingLabs
            C:\Program Files (x86)\Lavasoft\Web Companion\Application\log4net.dll3%ReversingLabs
            C:\Program Files (x86)\Lavasoft\Web Companion\Application\pt-BR\WebCompanion.resources.dll4%ReversingLabs
            C:\Program Files (x86)\Lavasoft\Web Companion\Application\pt-BR\WebCompanionInstaller.resources.dll3%ReversingLabs
            C:\Program Files (x86)\Lavasoft\Web Companion\Application\ru-RU\WebCompanion.resources.dll3%ReversingLabs
            C:\Program Files (x86)\Lavasoft\Web Companion\Application\ru-RU\WebCompanionInstaller.resources.dll3%ReversingLabs
            C:\Program Files (x86)\Lavasoft\Web Companion\Application\tr-TR\WebCompanion.resources.dll3%ReversingLabs
            C:\Program Files (x86)\Lavasoft\Web Companion\Application\tr-TR\WebCompanionInstaller.resources.dll3%ReversingLabs
            C:\Program Files (x86)\Lavasoft\Web Companion\Application\ucrtbased.dll4%ReversingLabs
            C:\Program Files (x86)\Lavasoft\Web Companion\Application\vcruntime140d.dll3%ReversingLabs
            C:\Program Files (x86)\Lavasoft\Web Companion\Application\x64\SQLite.Interop.dll3%ReversingLabs
            C:\Program Files (x86)\Lavasoft\Web Companion\Application\x86\SQLite.Interop.dll3%ReversingLabs
            C:\Program Files (x86)\Lavasoft\Web Companion\Application\zh-CHS\WebCompanionInstaller.resources.dll3%ReversingLabs
            C:\Program Files (x86)\Lavasoft\Web Companion\Application\zh-Hans\WebCompanion.resources.dll3%ReversingLabs
            C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\BDUpdateServiceCom.dll0%ReversingLabs
            C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\DCIService.exe3%ReversingLabs
            C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\OnlineThreatsSimple.dll0%ReversingLabs

            Unpacked PE Files

            ⊘No Antivirus matches

            Domains

            ⊘No Antivirus matches

            URLs

            SourceDetectionScannerLabelLink
            http://tempuri.org/0%URL Reputationsafe
            http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#0%URL Reputationsafe
            http://securedsearch.lavasoft.com/templates/home/adaware_securesearch/favicon.ico0%Avira URL Cloudsafe
            https://webcompanion.com/terms0%Avira URL Cloudsafe
            http://ip.filezilla-project.org/ip.phpAizkavei0%Avira URL Cloudsafe
            https://wiki.filezilla-project.org/Network_Configuration&Vali0%Avira URL Cloudsafe
            http://rt.webcompanion.com/notifications/download/rt/IEBhoHelperTest.exe0%Avira URL Cloudsafe
            http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#0%URL Reputationsafe
            http://wc-partners.lavasoft.com/Partner.svc/GetPartnerInfo?partner=FZ2104270%Avira URL Cloudsafe
            http://rt.webcompanion.com/notifications/download/rt/postrun/prod/v1/FeatureActions.zip0%Avira URL Cloudsafe
            https://offers.filezilla-project.org/0%Avira URL Cloudsafe
            http://ip.filezilla-project.org/ip.phpIl0%Avira URL Cloudsafe
            http://www.codeproject.com/Articles/28093/Using-RoutedCommands-with-a-ViewModel-in-WPF0%Avira URL Cloudsafe
            https://github.com/Patriccollu/Lingua_Corsa-Infurmatica/#readme0%Avira URL Cloudsafe
            https://flow.lavasoft.com/v1/event-stat?Type=FeatureActionInfo&ProductID=wc&EventVersion=10%Avira URL Cloudsafe
            https://ca.search.yahoo.com/favicon.ico0%Avira URL Cloudsafe
            https://media.adaware.com/moviesextension/thankyou.php?partnerID=BT151101&sourceTraffic=WCU19080%Avira URL Cloudsafe
            http://webcompanion.com/1http://www.lavasoft.com/Ghttp://webcompanion.com/unsafe?url=Qhttps://appdow0%Avira URL Cloudsafe
            http://webcompanion.com/ff_extension/ffLanguages.json0%Avira URL Cloudsafe
            http://tempuri.org/SendWCFeedbackT0%Avira URL Cloudsafe
            https://www.wisesearches.com/Results.aspx?gd=0%Avira URL Cloudsafe
            http://www.transifex.com/zeron/filezilla/language/tr_TR/)0%Avira URL Cloudsafe
            http://search.yahoo.com/search?ei=0%Avira URL Cloudsafe
            http://wsgeoip.lulusoft.com/IPService.asmx0%Avira URL Cloudsafe
            http://ip.filezilla-project.org/ip.phpLe0%Avira URL Cloudsafe
            http://lavasoft.com/GetIpLocation_2_0T0%Avira URL Cloudsafe
            http://upclick.com/GetCountryNameByISO2T0%Avira URL Cloudsafe
            https://webcompanion.com/nano_download.php?partner=FZ2104270%Avira URL Cloudsafe
            https://mysearchengine.co/homepage?hp=1&pId=0%Avira URL Cloudsafe
            https://securesearch.org?q=0%Avira URL Cloudsafe
            http://ip.filezilla-project.org/ip.phpHuts0%Avira URL Cloudsafe
            https://offers.filezilla-project.org/get.php?offer=2021aA0%Avira URL Cloudsafe
            https://webcompanion.com/f0%Avira URL Cloudsafe
            http://lavasoft.com/:GetIpLocation_2_0Response0%Avira URL Cloudsafe
            http://rt.webcompanion.com/notifications/download/rt/ActiveFeatures.zipH0%Avira URL Cloudsafe
            http://webcompanion.com/version_logs?json=true&version=0%Avira URL Cloudsafe
            http://lavasoft.com/0%Avira URL Cloudsafe
            https://www.adaware.com/sites/default/files/installers/H2OAutoUpdate/WCU006_s.exe0%Avira URL Cloudsafe
            http://tempuri.org/WcSendAutoResponseEmailT0%Avira URL Cloudsafe
            https://webcompanion.com/download_extensions.php?partnerID=0%Avira URL Cloudsafe
            https://wiki.filezilla-project.org/Network_ConfigurationOdabe&rite0%Avira URL Cloudsafe
            https://wiki.filezilla-project.org/Network_ConfigurationSele&ccionar0%Avira URL Cloudsafe
            https://webcompanion.com/60%Avira URL Cloudsafe
            http://crl.entrust.net/g2ca.crl00%Avira URL Cloudsafe
            https://eventstaging.lavasoft.com/v1/event-stat0%Avira URL Cloudsafe
            http://ip.filezilla-project.org/ip.phpIntervalul0%Avira URL Cloudsafe
            https://docs.storj.io/how-tos/set-up-filezilla-for-decentralized-file-transferDocsID_DOCShttps://sto0%Avira URL Cloudsafe
            http://ip.filezilla-project.org/ip.phpEy0%Avira URL Cloudsafe
            https://svn.apache.org/repos/asf/logging/log4net/tags/1.2.13RC30%Avira URL Cloudsafe
            https://filezilla-project.org/privacy.phpPrivacy0%Avira URL Cloudsafe
            https://acs.lavasoft.com/api/v2/url/permanentwhitelist0%Avira URL Cloudsafe
            http://ip.filezilla-project.org/ip.phpEl0%Avira URL Cloudsafe
            http://webcompanion.com/feedback?utm_source=wc&utm_medium=wc&utm_campaign=wc~http://lavasoft.com?utm0%Avira URL Cloudsafe
            https://sdl.adaware.com/?bundleid=WCU001&savename=WCUpdater.exe0%Avira URL Cloudsafe
            https://aw.gosearchresults.com/?pid=5ac784309091147a162b4431&pr=vmn&id=webcompa&ent=ch_0%Avira URL Cloudsafe
            https://filezilla-project.org/support.php?type=client&mode=helpbugreport&version=ID_VIEW_QUICKCONNEC0%Avira URL Cloudsafe
            http://ip.filezilla-project.org/ip.phpEp0%Avira URL Cloudsafe
            http://www.apache.org/).0%Avira URL Cloudsafe
            https://offers.filezilla-project.org/offer.php?v=1&c=2021a/SILENTgetOK0%Avira URL Cloudsafe
            http://tempuri.org/IWCAssistantService/CopyFilesT0%Avira URL Cloudsafe
            http://webcompanion.com/google_chrome_incompatibility0%Avira URL Cloudsafe
            http://tempuri.org/IWCAssistantService/SetSearchEngineIET0%Avira URL Cloudsafe
            http://webcompanion.com/images/email/tw-icon.png0%Avira URL Cloudsafe
            https://privatesearch.adaware.com/search?gd=0%Avira URL Cloudsafe
            http://wc-partners.lavasoft.com/Partner.svc/GetPartnerInfo0%Avira URL Cloudsafe
            https://sg-bitmask.adaware.com/bitmask/allmaskvalues0%Avira URL Cloudsafe
            http://sdl.adaware.com/?bundleid=WCUN001&savename=WCUN001.exe0%Avira URL Cloudsafe
            https://wiki.filezilla-project.org/Network_ConfigurationV&0%Avira URL Cloudsafe
            http://www.yandex.com.tr/?clid=0%Avira URL Cloudsafe
            http://crl3.digicert.c0%Avira URL Cloudsafe
            http://schemas.datacontract.org/2004/07/SearchProtect.WcfService60%Avira URL Cloudsafe
            https://suggest.finditnowonline.com/suggestionfeed/suggestion?format=json0%Avira URL Cloudsafe
            https://offers.filezilla-project.org/get.php?offer=2021a0%Avira URL Cloudsafe
            https://webcompanion.com/termsAhttps://webcompanion.com/privacy0%Avira URL Cloudsafe
            http://webcompanion.com/terms?http://webcompanion.com/privacy;RecoverSE0%Avira URL Cloudsafe
            http://tempuri.org/SendFeedbackT0%Avira URL Cloudsafe
            http://pp.webcompanion.com/notifications/download/rt/chbrowser.exe0%Avira URL Cloudsafe
            http://rt.webcompanion.com/notifications/download/rt/IESPHelper.exe0%Avira URL Cloudsafe
            https://acscdn.lavasoft.com/permanentUrlWhitelist.json0%Avira URL Cloudsafe
            http://staging-cloudflow.lavasoft.net/v1/event-stat-wc0%Avira URL Cloudsafe
            http://extservice.adaware.com/extension5Inside0%Avira URL Cloudsafe
            https://wiki.filezilla-project.org/Network_ConfigurationSele&ziona0%Avira URL Cloudsafe
            https://filezilla-project.org/Build0%Avira URL Cloudsafe
            http://schemas.datacontract.org/2004/07/SearchProtect.WcfServicef0%Avira URL Cloudsafe
            http://ip.filezilla-project.org/ip.phpDelay0%Avira URL Cloudsafe
            http://securedsearch.lavasoft.com/results.php?pr=vmn&id=webcompa&ent=ch_0%Avira URL Cloudsafe
            http://lavasoft.com/GetCountryISO2ByNameT0%Avira URL Cloudsafe
            https://defaultsearch.co?q=0%Avira URL Cloudsafe
            https://update.filezilla-project.org/update.phpunknown%u.%u64Software0%Avira URL Cloudsafe
            http://tempuri.org/IWCAssistantService/SetSearchEngineIEResponse0%Avira URL Cloudsafe
            http://webcompanion.com/installed.php?extinstall=10%Avira URL Cloudsafe
            http://openapi.naver.com/)0%Avira URL Cloudsafe
            https://privado.com/?gd=0%Avira URL Cloudsafe
            http://tempuri.org/GetComponentsVersionInfoT0%Avira URL Cloudsafe
            https://wiki.filezilla-project.org/Network_ConfigurationIzv0%Avira URL Cloudsafe
            https://chrome.google.com/webstore/detail/adaware-secure-search/mcecnfofnfjclaifchnaodlamfjlofkp0%Avira URL Cloudsafe
            https://privatesearch.adaware.com/search0%Avira URL Cloudsafe
            http://rt.webcompanion.com/notifications/download/rt/extension.txt;http://webcompanion.com/check0%Avira URL Cloudsafe
            http://securedsearch.lavasoft.com0%Avira URL Cloudsafe
            http://webcompanion.com/unsafe0%Avira URL Cloudsafe

            Domains and IPs

            Contacted Domains

            NameIPActiveMaliciousAntivirus DetectionReputation
            wc-update-service.lavasoft.com
            		64.18.87.81
            		truefalse
              		unknown
              rt.webcompanion.com
              		104.19.208.152
              		truefalse
                		unknown
                wcdownloadercdn.lavasoft.com
                		104.16.148.130
                		truefalse
                  		unknown
                  acs.lavasoft.com
                  		104.16.148.130
                  		truefalse
                    		unknown
                    update.filezilla-project.org
                    		49.12.121.47
                    		truefalse
                      		unknown
                      www.google.com
                      		142.250.186.164
                      		truefalse
                        		unknown
                        filezilla-project.org
                        		49.12.121.47
                        		truefalse
                          		unknown
                          webcompanion.com
                          		104.19.159.224
                          		truetrue
                            		unknown
                            acscdn.lavasoft.com
                            		104.16.149.130
                            		truefalse
                              		unknown
                              wc-partners.lavasoft.com
                              		64.18.87.82
                              		truefalse
                                		unknown
                                flow.lavasoft.com
                                		104.16.149.130
                                		truefalse
                                  		unknown
                                  wsgeoip.lavasoft.com
                                  		64.18.87.4
                                  		truefalse
                                    		unknown
                                    offers.filezilla-project.org
                                    		unknown
                                    		unknownfalse
                                      		unknown
                                      ocsp.entrust.net
                                      		unknown
                                      		unknownfalse
                                        		unknown
                                        crl.entrust.net
                                        		unknown
                                        		unknownfalse
                                          		unknown

                                          Contacted URLs

                                          NameMaliciousAntivirus DetectionReputation
                                          http://rt.webcompanion.com/notifications/download/rt/postrun/prod/v1/FeatureActions.zipfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://wc-partners.lavasoft.com/Partner.svc/GetPartnerInfo?partner=FZ210427false
                                          • Avira URL Cloud: safe
                                          		unknown
                                          https://flow.lavasoft.com/v1/event-stat?Type=FeatureActionInfo&ProductID=wc&EventVersion=1false
                                          • Avira URL Cloud: safe
                                          		unknown
                                          https://webcompanion.com/nano_download.php?partner=FZ210427false
                                          • Avira URL Cloud: safe
                                          		unknown
                                          https://acs.lavasoft.com/api/v2/url/permanentwhitelistfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          https://offers.filezilla-project.org/get.php?offer=2021afalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          https://acscdn.lavasoft.com/permanentUrlWhitelist.jsonfalse
                                          • Avira URL Cloud: safe
                                          		unknown

                                          URLs from Memory and Binaries

                                          NameSourceMaliciousAntivirus DetectionReputation
                                          https://webcompanion.com/termsFileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000003.1744674899.0000000000791000.00000004.00000020.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          https://wiki.filezilla-project.org/Network_Configuration&ValiFileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://securedsearch.lavasoft.com/templates/home/adaware_securesearch/favicon.icoWebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://www.codeproject.com/Articles/28093/Using-RoutedCommands-with-a-ViewModel-in-WPFWebCompanion.exe, 00000021.00000000.2413579033.0000000000CE4000.00000002.00000001.01000000.0000003B.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://tempuri.org/WcInstaller.exe, 00000002.00000003.1867085226.00000000005D0000.00000004.00001000.00020000.00000000.sdmp, WcInstaller.exe, 00000002.00000003.1866843878.00000000021C3000.00000004.00000020.00020000.00000000.sdmp, WebCompanionInstaller.exe, 00000003.00000000.1867314648.0000000000782000.00000002.00000001.01000000.0000000F.sdmp, WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmp, csc.exe, 0000002D.00000002.2688210015.00000000006C2000.00000004.00000020.00020000.00000000.sdmpfalse
                                          • URL Reputation: safe
                                          		unknown
                                          http://ip.filezilla-project.org/ip.phpIlFileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://ip.filezilla-project.org/ip.phpAizkaveiFileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          https://offers.filezilla-project.org/FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2211628615.000000000077E000.00000004.00000020.00020000.00000000.sdmp, FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000003.2208888820.000000000077E000.00000004.00000020.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://rt.webcompanion.com/notifications/download/rt/IEBhoHelperTest.exeWebCompanion.exe, 00000028.00000002.2589134775.00000000065A2000.00000002.00000001.01000000.0000003D.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          https://ca.search.yahoo.com/favicon.icoWebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          https://github.com/Patriccollu/Lingua_Corsa-Infurmatica/#readmeFileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmp, filezilla.mo5.0.drfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://tempuri.org/SendWCFeedbackTWebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          https://media.adaware.com/moviesextension/thankyou.php?partnerID=BT151101&sourceTraffic=WCU1908WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://webcompanion.com/ff_extension/ffLanguages.jsonWebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          https://www.wisesearches.com/Results.aspx?gd=WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://webcompanion.com/1http://www.lavasoft.com/Ghttp://webcompanion.com/unsafe?url=Qhttps://appdowWebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://www.transifex.com/zeron/filezilla/language/tr_TR/)FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmp, libfilezilla.mo48.0.drfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://search.yahoo.com/search?ei=WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://wsgeoip.lulusoft.com/IPService.asmxWebCompanion.exe, 00000028.00000002.2581040314.0000000003CB9000.00000004.00000800.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://upclick.com/GetCountryNameByISO2TWebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://ip.filezilla-project.org/ip.phpHutsFileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://ip.filezilla-project.org/ip.phpLeFileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://lavasoft.com/GetIpLocation_2_0TWcInstaller.exe, 00000002.00000003.1867085226.00000000005D0000.00000004.00001000.00020000.00000000.sdmp, WcInstaller.exe, 00000002.00000003.1866843878.00000000021C3000.00000004.00000020.00020000.00000000.sdmp, WebCompanionInstaller.exe, 00000003.00000000.1867314648.0000000000782000.00000002.00000001.01000000.0000000F.sdmp, WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          https://offers.filezilla-project.org/get.php?offer=2021aAFileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2214412258.0000000005580000.00000004.00000020.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          https://mysearchengine.co/homepage?hp=1&pId=WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          https://securesearch.org?q=WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          https://webcompanion.com/fFileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2214412258.0000000005580000.00000004.00000020.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://rt.webcompanion.com/notifications/download/rt/ActiveFeatures.zipHWebCompanion.exe, 00000028.00000002.2581040314.0000000003BE1000.00000004.00000800.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://lavasoft.com/:GetIpLocation_2_0Responsecsc.exe, 00000029.00000002.2643482070.0000000000465000.00000004.00000020.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          https://www.adaware.com/sites/default/files/installers/H2OAutoUpdate/WCU006_s.exeWebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://lavasoft.com/csc.exe, 0000002F.00000002.2689512097.0000000000541000.00000004.00000020.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://webcompanion.com/version_logs?json=true&version=WebCompanion.exe, 00000028.00000002.2589134775.00000000065A2000.00000002.00000001.01000000.0000003D.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          https://webcompanion.com/download_extensions.php?partnerID=WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://tempuri.org/WcSendAutoResponseEmailTWebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          https://wiki.filezilla-project.org/Network_ConfigurationOdabe&riteFileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          https://wiki.filezilla-project.org/Network_ConfigurationSele&ccionarFileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          https://webcompanion.com/6FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2214412258.0000000005580000.00000004.00000020.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://crl.entrust.net/g2ca.crl0WcInstaller.exe, 00000002.00000003.1867085226.00000000005D0000.00000004.00001000.00020000.00000000.sdmp, WcInstaller.exe, 00000002.00000003.1866843878.00000000021C3000.00000004.00000020.00020000.00000000.sdmp, WebCompanionInstaller.resources.dll0.3.dr, Lavasoft.WCAssistant.Service.Logger.dll.3.drfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://ip.filezilla-project.org/ip.phpEyFileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://ip.filezilla-project.org/ip.phpIntervalulFileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          https://docs.storj.io/how-tos/set-up-filezilla-for-decentralized-file-transferDocsID_DOCShttps://stofilezilla.exe, 0000000E.00000000.2187422221.00007FF71ED77000.00000002.00000001.01000000.00000018.sdmp, nsxF7D6.tmp.0.drfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          https://eventstaging.lavasoft.com/v1/event-statLavasoft.Search.exe, 00000034.00000000.3702181456.0000000000C62000.00000002.00000001.01000000.00000054.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          https://svn.apache.org/repos/asf/logging/log4net/tags/1.2.13RC3WebCompanion.exe, 00000028.00000002.2586149184.000000000608C000.00000002.00000001.01000000.0000003C.sdmp, WebCompanion.exe, 00000028.00000002.2585618453.0000000006042000.00000002.00000001.01000000.0000003C.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          https://filezilla-project.org/privacy.phpPrivacyfilezilla.exe, 0000000E.00000000.2187422221.00007FF71ED77000.00000002.00000001.01000000.00000018.sdmp, nsxF7D6.tmp.0.drfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://ip.filezilla-project.org/ip.phpElFileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#FileZilla_3.67.1_win64_sponsored-setup.exe, libpng16-16.dll.0.dr, nsxF7D6.tmp.0.drfalse
                                          • URL Reputation: safe
                                          		unknown
                                          http://webcompanion.com/feedback?utm_source=wc&utm_medium=wc&utm_campaign=wc~http://lavasoft.com?utmWebCompanion.exe, 00000028.00000002.2589134775.00000000065A2000.00000002.00000001.01000000.0000003D.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          https://sdl.adaware.com/?bundleid=WCU001&savename=WCUpdater.exeWebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          https://filezilla-project.org/support.php?type=client&mode=helpbugreport&version=ID_VIEW_QUICKCONNECfilezilla.exe, 0000000E.00000000.2187422221.00007FF71ED77000.00000002.00000001.01000000.00000018.sdmp, nsxF7D6.tmp.0.drfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://ip.filezilla-project.org/ip.phpEpFileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          https://offers.filezilla-project.org/offer.php?v=1&c=2021a/SILENTgetOKFileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2211034292.00000000006E4000.00000004.00000020.00020000.00000000.sdmp, nsxF7D6.tmp.0.drfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          https://aw.gosearchresults.com/?pid=5ac784309091147a162b4431&pr=vmn&id=webcompa&ent=ch_WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://www.apache.org/).WebCompanion.exe, 00000028.00000002.2585618453.0000000006042000.00000002.00000001.01000000.0000003C.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://tempuri.org/IWCAssistantService/CopyFilesTWebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmp, WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://webcompanion.com/google_chrome_incompatibilityWebCompanion.exe, 00000028.00000002.2589134775.00000000065A2000.00000002.00000001.01000000.0000003D.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://tempuri.org/IWCAssistantService/SetSearchEngineIETWebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmp, WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://webcompanion.com/images/email/tw-icon.pngWebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          https://sg-bitmask.adaware.com/bitmask/allmaskvaluesWebCompanion.exe, 00000028.00000002.2589134775.00000000065A2000.00000002.00000001.01000000.0000003D.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          https://privatesearch.adaware.com/search?gd=WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://wc-partners.lavasoft.com/Partner.svc/GetPartnerInfoWebCompanion.exe, 00000028.00000002.2589134775.00000000065A2000.00000002.00000001.01000000.0000003D.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://www.yandex.com.tr/?clid=WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          https://suggest.finditnowonline.com/suggestionfeed/suggestion?format=jsonWebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://sdl.adaware.com/?bundleid=WCUN001&savename=WCUN001.exeWcInstaller.exe, 00000002.00000003.1867085226.00000000005D0000.00000004.00001000.00020000.00000000.sdmp, WcInstaller.exe, 00000002.00000003.1866843878.00000000021C3000.00000004.00000020.00020000.00000000.sdmp, WebCompanionInstaller.exe, 00000003.00000000.1867314648.0000000000782000.00000002.00000001.01000000.0000000F.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          https://wiki.filezilla-project.org/Network_ConfigurationV&FileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://crl3.digicert.cWebCompanion.exe, 00000028.00000002.2588730057.0000000006420000.00000004.00000020.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://schemas.datacontract.org/2004/07/SearchProtect.WcfService6WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          https://webcompanion.com/termsAhttps://webcompanion.com/privacyWebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://pp.webcompanion.com/notifications/download/rt/chbrowser.exeWebCompanion.exe, 00000028.00000002.2589134775.00000000065A2000.00000002.00000001.01000000.0000003D.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://tempuri.org/SendFeedbackTWebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#FileZilla_3.67.1_win64_sponsored-setup.exe, libpng16-16.dll.0.dr, nsxF7D6.tmp.0.drfalse
                                          • URL Reputation: safe
                                          		unknown
                                          http://rt.webcompanion.com/notifications/download/rt/IESPHelper.exeWebCompanion.exe, 00000028.00000002.2589134775.00000000065A2000.00000002.00000001.01000000.0000003D.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://webcompanion.com/terms?http://webcompanion.com/privacy;RecoverSEWebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://staging-cloudflow.lavasoft.net/v1/event-stat-wcWcInstaller.exe, 00000002.00000003.1867085226.00000000005D0000.00000004.00001000.00020000.00000000.sdmp, WcInstaller.exe, 00000002.00000003.1866843878.00000000021C3000.00000004.00000020.00020000.00000000.sdmp, WebCompanionInstaller.exe, 00000003.00000000.1867314648.0000000000782000.00000002.00000001.01000000.0000000F.sdmp, WebCompanion.exe, 00000028.00000002.2590522947.0000000006AC2000.00000002.00000001.01000000.0000003F.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          https://wiki.filezilla-project.org/Network_ConfigurationSele&zionaFileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://extservice.adaware.com/extension5InsideWebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          https://filezilla-project.org/Buildfilezilla.exe, 0000000E.00000000.2187422221.00007FF71ED77000.00000002.00000001.01000000.00000018.sdmp, nsxF7D6.tmp.0.drfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://schemas.datacontract.org/2004/07/SearchProtect.WcfServicefWebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://ip.filezilla-project.org/ip.phpDelayFileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmp, filezilla.mo5.0.drfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://securedsearch.lavasoft.com/results.php?pr=vmn&id=webcompa&ent=ch_WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          https://update.filezilla-project.org/update.phpunknown%u.%u64SoftwarensxF7D6.tmp.0.drfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          https://defaultsearch.co?q=WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://tempuri.org/IWCAssistantService/SetSearchEngineIEResponseWebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmp, WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://lavasoft.com/GetCountryISO2ByNameTWcInstaller.exe, 00000002.00000003.1867085226.00000000005D0000.00000004.00001000.00020000.00000000.sdmp, WcInstaller.exe, 00000002.00000003.1866843878.00000000021C3000.00000004.00000020.00020000.00000000.sdmp, WebCompanionInstaller.exe, 00000003.00000000.1867314648.0000000000782000.00000002.00000001.01000000.0000000F.sdmp, WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://openapi.naver.com/)WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://webcompanion.com/installed.php?extinstall=1WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://tempuri.org/GetComponentsVersionInfoTWcInstaller.exe, 00000002.00000003.1867085226.00000000005D0000.00000004.00001000.00020000.00000000.sdmp, WcInstaller.exe, 00000002.00000003.1866843878.00000000021C3000.00000004.00000020.00020000.00000000.sdmp, WebCompanionInstaller.exe, 00000003.00000000.1867314648.0000000000782000.00000002.00000001.01000000.0000000F.sdmp, WebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          https://privado.com/?gd=WebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          https://chrome.google.com/webstore/detail/adaware-secure-search/mcecnfofnfjclaifchnaodlamfjlofkpWebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmp, WebCompanion.exe, 00000028.00000002.2581040314.0000000003CB9000.00000004.00000800.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          https://wiki.filezilla-project.org/Network_ConfigurationIzvFileZilla_3.67.1_win64_sponsored-setup.exe, 00000000.00000002.2212349304.0000000002840000.00000004.00000020.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          https://privatesearch.adaware.com/searchWebCompanion.exe, 00000028.00000002.2592256801.0000000007192000.00000002.00000001.01000000.00000042.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://rt.webcompanion.com/notifications/download/rt/extension.txt;http://webcompanion.com/checkWebCompanion.exe, 00000028.00000002.2589134775.00000000065A2000.00000002.00000001.01000000.0000003D.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://securedsearch.lavasoft.comWebCompanion.exe, 00000021.00000000.2413579033.0000000000EB9000.00000002.00000001.01000000.0000003B.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://webcompanion.com/unsafeWebCompanion.exe, 00000028.00000002.2589134775.00000000065A2000.00000002.00000001.01000000.0000003D.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown

                                          World Map of Contacted IPs

                                          • No. of IPs < 25%
                                          • 25% < No. of IPs < 50%
                                          • 50% < No. of IPs < 75%
                                          • 75% < No. of IPs

                                          Public IPs

                                          IPDomainCountryFlagASNASN NameMalicious
                                          104.19.159.224
                                          		webcompanion.comUnited States
                                          		13335CLOUDFLARENETUStrue
                                          64.18.87.4
                                          		wsgeoip.lavasoft.comCanada
                                          		21548MTOCAfalse
                                          104.19.208.152
                                          		rt.webcompanion.comUnited States
                                          		13335CLOUDFLARENETUSfalse
                                          142.250.186.164
                                          		www.google.comUnited States
                                          		15169GOOGLEUSfalse
                                          64.18.87.81
                                          		wc-update-service.lavasoft.comCanada
                                          		21548MTOCAfalse
                                          104.16.149.130
                                          		acscdn.lavasoft.comUnited States
                                          		13335CLOUDFLARENETUSfalse
                                          64.18.87.82
                                          		wc-partners.lavasoft.comCanada
                                          		21548MTOCAfalse
                                          104.16.148.130
                                          		wcdownloadercdn.lavasoft.comUnited States
                                          		13335CLOUDFLARENETUSfalse
                                          49.12.121.47
                                          		update.filezilla-project.orgGermany
                                          		24940HETZNER-ASDEfalse

                                          General Information

                                          Joe Sandbox version:40.0.0 Tourmaline
                                          Analysis ID:1478260
                                          Start date and time:2024-07-22 12:32:03 +02:00
                                          Joe Sandbox product:CloudBasic
                                          Overall analysis duration:0h 15m 23s
                                          Hypervisor based Inspection enabled:false
                                          Report type:full
                                          Cookbook file name:default.jbs
                                          Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                          Number of analysed new started processes analysed:54
                                          Number of new started drivers analysed:0
                                          Number of existing processes analysed:0
                                          Number of existing drivers analysed:0
                                          Number of injected processes analysed:0
                                          Technologies:
                                          • EGA enabled
                                          • AMSI enabled
                                          Analysis Mode:default
                                          Sample name:FileZilla_3.67.1_win64_sponsored-setup.exe
                                          Detection:MAL
                                          Classification:mal56.rans.phis.troj.spyw.expl.evad.winEXE@74/1350@17/9
                                          Cookbook Comments:
                                          • Found application associated with file extension: .exe
                                          • Override analysis time to 240000 for current running targets taking high CPU consumption

                                          Warnings

                                          • Connection to analysis system has been lost, crash info: Unknown
                                          • Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
                                          • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
                                          • Excluded IPs from analysis (whitelisted): 2.23.198.32, 2.19.126.151, 2.19.126.141
                                          • Excluded domains from analysis (whitelisted): ocsp.entrust.net.edgekey.net, a1516.d.akamai.net, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, e6913.dscx.akamaiedge.net, crl.entrust.net.edgesuite.net, fe3cr.delivery.mp.microsoft.com
                                          • HTTP sessions have been limited to 150. Please view the PCAPs for the complete data.
                                          • HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
                                          • Not all processes where analyzed, report is missing behavior information
                                          • Report size exceeded maximum capacity and may have missing behavior information.
                                          • Report size exceeded maximum capacity and may have missing network information.
                                          • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                          • Report size getting too big, too many NtCreateFile calls found.
                                          • Report size getting too big, too many NtCreateKey calls found.
                                          • Report size getting too big, too many NtDeviceIoControlFile calls found.
                                          • Report size getting too big, too many NtEnumerateKey calls found.
                                          • Report size getting too big, too many NtOpenFile calls found.
                                          • Report size getting too big, too many NtOpenKeyEx calls found.
                                          • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                          • Report size getting too big, too many NtQueryAttributesFile calls found.
                                          • Report size getting too big, too many NtQueryValueKey calls found.
                                          • Report size getting too big, too many NtQueryVolumeInformationFile calls found.
                                          • Report size getting too big, too many NtReadFile calls found.
                                          • Report size getting too big, too many NtReadVirtualMemory calls found.
                                          • Report size getting too big, too many NtSetInformationFile calls found.
                                          • Report size getting too big, too many NtWriteFile calls found.
                                          • Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                          • Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                          • VT rate limit hit for: FileZilla_3.67.1_win64_sponsored-setup.exe

                                          Simulations

                                          Behavior and APIs

                                          TimeTypeDescription
                                          06:33:45API Interceptor2x Sleep call for process: filezilla.exe modified
                                          06:33:50API Interceptor86x Sleep call for process: WebCompanionInstaller.exe modified
                                          06:34:09API Interceptor2980x Sleep call for process: WebCompanion.exe modified
                                          06:34:14API Interceptor272x Sleep call for process: Lavasoft.WCAssistant.WinService.exe modified
                                          11:34:14AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Web Companion C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe --minimize
                                          11:34:22AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Web Companion C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe --minimize

                                          Joe Sandbox View / Context

                                          IPs

                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                          104.19.159.224Setup.exeGet hashmaliciousUnknownBrowse
                                          • webcompanion.com/version_logs?json=true&version=13.900.0.1080
                                          Setup.exeGet hashmaliciousUnknownBrowse
                                          • webcompanion.com/version_logs?json=true&version=12.901.4.1003
                                          64.18.87.4SecuriteInfo.com.Program.Unwanted.4662.20461.1147.exeGet hashmaliciousUnknownBrowse
                                          • avsdklicenseservice.lavasoft.com/licenses.asmx
                                          SecuriteInfo.com.Program.Unwanted.4662.20461.1147.exeGet hashmaliciousUnknownBrowse
                                          • avsdklicenseservice.lavasoft.com/licenses.asmx
                                          https://filezilla-project.org/download.php?type=clientGet hashmaliciousUnknownBrowse
                                          • wsgeoip.lavasoft.com/ipservice.asmx
                                          Setup.exeGet hashmaliciousUnknownBrowse
                                          • wsgeoip.lavasoft.com/ipservice.asmx
                                          f_038023.exeGet hashmaliciousUnknownBrowse
                                          • wsgeoip.lavasoft.com/ipservice.asmx
                                          f_000aab.exeGet hashmaliciousUnknownBrowse
                                          • wsgeoip.lavasoft.com/ipservice.asmx
                                          f_000aab.exeGet hashmaliciousUnknownBrowse
                                          • wsgeoip.lavasoft.com/ipservice.asmx
                                          f_000aab.exeGet hashmaliciousUnknownBrowse
                                          • wsgeoip.lavasoft.com/ipservice.asmx
                                          Setup.exeGet hashmaliciousUnknownBrowse
                                          • wsgeoip.lavasoft.com/ipservice.asmx
                                          Setup.exeGet hashmaliciousUnknownBrowse
                                          • wsgeoip.lavasoft.com/ipservice.asmx
                                          104.19.208.152Setup.exeGet hashmaliciousUnknownBrowse
                                          • webcompanion.com/version_logs?json=true&version=13.900.0.1080
                                          64.18.87.81Setup.exeGet hashmaliciousUnknownBrowse
                                          • wc-partners.lavasoft.com/Partner.svc/GetPartnerInfo?partner=IN240402_ac
                                          Setup.exeGet hashmaliciousUnknownBrowse
                                          • wc-partners.lavasoft.com/Partner.svc/GetPartnerInfo?partner=IN240402_ac
                                          https://filezilla-project.org/download.php?type=clientGet hashmaliciousUnknownBrowse
                                          • wc-partners.lavasoft.com/Partner.svc/GetPartnerInfo?partner=FZ210427_ac
                                          Setup.exeGet hashmaliciousUnknownBrowse
                                          • wc-partners.lavasoft.com/Partner.svc/GetPartnerInfo?partner=IN220101_ac
                                          Setup.exeGet hashmaliciousUnknownBrowse
                                          • wc-partners.lavasoft.com/Partner.svc/GetPartnerInfo?partner=IN220101_ac
                                          f_038023.exeGet hashmaliciousUnknownBrowse
                                          • wc-partners.lavasoft.com/Partner.svc/GetPartnerInfo?partner=IN220101_ac
                                          f_000aab.exeGet hashmaliciousUnknownBrowse
                                          • wc-partners.lavasoft.com/Partner.svc/GetPartnerInfo?partner=IN220101_ac
                                          f_000aab.exeGet hashmaliciousUnknownBrowse
                                          • wc-partners.lavasoft.com/Partner.svc/GetPartnerInfo?partner=IN220101_ac
                                          f_000aab.exeGet hashmaliciousUnknownBrowse
                                          • wc-partners.lavasoft.com/Partner.svc/GetPartnerInfo?partner=IN220101_ac
                                          f_000aab.exeGet hashmaliciousUnknownBrowse
                                          • wc-partners.lavasoft.com/Partner.svc/GetPartnerInfo?partner=IN220101_ac

                                          Domains

                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                          wc-update-service.lavasoft.comhttps://filezilla-project.org/download.php?type=clientGet hashmaliciousUnknownBrowse
                                          • 64.18.87.81
                                          FileZilla_3.65.0_win64_sponsored-setup.exeGet hashmaliciousCobaltStrikeBrowse
                                          • 64.18.87.81
                                          FileZilla_3.65.0_win64_sponsored-setup.exeGet hashmaliciousCobaltStrikeBrowse
                                          • 64.18.87.81
                                          FileZilla_3.65.0_win64_sponsored-setup.exeGet hashmaliciousCobaltStrikeBrowse
                                          • 64.18.87.81
                                          FileZilla_3.65.0_win64_sponsored-setup.exeGet hashmaliciousCobaltStrikeBrowse
                                          • 64.18.87.82
                                          FileZilla_3.65.0_win64_sponsored-setup.exeGet hashmaliciousUnknownBrowse
                                          • 64.18.87.82
                                          FileZilla_3.65.0_win64_sponsored-setup.exeGet hashmaliciousUnknownBrowse
                                          • 64.18.87.82
                                          run_206fc.exeGet hashmaliciousUnknownBrowse
                                          • 64.18.87.81
                                          run_206fc.exeGet hashmaliciousUnknownBrowse
                                          • 64.18.87.81
                                          Windows_10_Pro_Anniversary_Update_PT-BR_3265_Bits.exeGet hashmaliciousUnknownBrowse
                                          • 64.18.87.81
                                          wcdownloadercdn.lavasoft.comSetup.exeGet hashmaliciousUnknownBrowse
                                          • 104.16.149.130
                                          Setup.exeGet hashmaliciousUnknownBrowse
                                          • 104.16.149.130
                                          Setup.exeGet hashmaliciousUnknownBrowse
                                          • 104.16.148.130
                                          Setup.exeGet hashmaliciousUnknownBrowse
                                          • 104.16.148.130
                                          Setup.exeGet hashmaliciousUnknownBrowse
                                          • 104.16.149.130
                                          Setup.exeGet hashmaliciousUnknownBrowse
                                          • 104.16.148.130
                                          Setup (1).exeGet hashmaliciousUnknownBrowse
                                          • 104.16.149.130
                                          Setup (1).exeGet hashmaliciousUnknownBrowse
                                          • 104.16.149.130
                                          Setup.exeGet hashmaliciousUnknownBrowse
                                          • 104.17.9.52
                                          Setup.exeGet hashmaliciousUnknownBrowse
                                          • 104.17.8.52
                                          acs.lavasoft.comhttps://filezilla-project.org/download.php?type=clientGet hashmaliciousUnknownBrowse
                                          • 104.17.9.52
                                          FileZilla_3.65.0_win64_sponsored-setup.exeGet hashmaliciousCobaltStrikeBrowse
                                          • 104.17.9.52
                                          FileZilla_3.65.0_win64_sponsored-setup.exeGet hashmaliciousCobaltStrikeBrowse
                                          • 104.17.8.52
                                          FileZilla_3.65.0_win64_sponsored-setup.exeGet hashmaliciousCobaltStrikeBrowse
                                          • 104.17.9.52
                                          FileZilla_3.65.0_win64_sponsored-setup.exeGet hashmaliciousCobaltStrikeBrowse
                                          • 104.17.9.52
                                          FileZilla_3.65.0_win64_sponsored-setup.exeGet hashmaliciousUnknownBrowse
                                          • 104.17.9.52
                                          FileZilla_3.65.0_win64_sponsored-setup.exeGet hashmaliciousUnknownBrowse
                                          • 104.17.8.52
                                          Hide_My_IP_7.1.371_Multilingual_Premium_VPN_+_Key.exeGet hashmaliciousUnknownBrowse
                                          • 104.17.8.52
                                          Hide_My_IP_7.1.371_Multilingual_Premium_VPN_+_Key.exeGet hashmaliciousUnknownBrowse
                                          • 104.17.9.52
                                          gW6JYs1BTZ.exeGet hashmaliciousUnknownBrowse
                                          • 104.17.8.52
                                          rt.webcompanion.comhttps://filezilla-project.org/download.php?type=clientGet hashmaliciousUnknownBrowse
                                          • 104.18.212.25
                                          Setup.exeGet hashmaliciousUnknownBrowse
                                          • 104.18.211.25
                                          FileZilla_3.65.0_win64_sponsored-setup.exeGet hashmaliciousCobaltStrikeBrowse
                                          • 104.18.212.25
                                          FileZilla_3.65.0_win64_sponsored-setup.exeGet hashmaliciousCobaltStrikeBrowse
                                          • 104.18.212.25
                                          FileZilla_3.65.0_win64_sponsored-setup.exeGet hashmaliciousCobaltStrikeBrowse
                                          • 104.18.212.25
                                          FileZilla_3.65.0_win64_sponsored-setup.exeGet hashmaliciousCobaltStrikeBrowse
                                          • 104.18.211.25
                                          f_00226b.exeGet hashmaliciousUnknownBrowse
                                          • 104.18.212.25
                                          FileZilla_3.65.0_win64_sponsored-setup.exeGet hashmaliciousUnknownBrowse
                                          • 104.18.212.25
                                          FileZilla_3.65.0_win64_sponsored-setup.exeGet hashmaliciousUnknownBrowse
                                          • 104.18.212.25
                                          run_206fc.exeGet hashmaliciousUnknownBrowse
                                          • 104.18.211.25

                                          ASNs

                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                          MTOCASetup.exeGet hashmaliciousUnknownBrowse
                                          • 64.18.87.81
                                          Setup.exeGet hashmaliciousUnknownBrowse
                                          • 64.18.87.81
                                          Setup.exeGet hashmaliciousUnknownBrowse
                                          • 64.18.87.82
                                          SecuriteInfo.com.Program.Unwanted.4662.20461.1147.exeGet hashmaliciousUnknownBrowse
                                          • 64.18.87.4
                                          SecuriteInfo.com.Program.Unwanted.4662.20461.1147.exeGet hashmaliciousUnknownBrowse
                                          • 64.18.87.4
                                          ffff6f6.msiGet hashmaliciousUnknownBrowse
                                          • 64.18.87.10
                                          uXUrccWxXO.elfGet hashmaliciousUnknownBrowse
                                          • 67.22.231.120
                                          https://filezilla-project.org/download.php?type=clientGet hashmaliciousUnknownBrowse
                                          • 64.18.87.81
                                          dagQSRLYsB.elfGet hashmaliciousUnknownBrowse
                                          • 206.55.88.228
                                          huhu.mpsl.elfGet hashmaliciousMirai, OkiruBrowse
                                          • 206.55.88.205
                                          CLOUDFLARENETUSDRAFT DOCUMENTS.jsGet hashmaliciousAgentTeslaBrowse
                                          • 172.67.207.214
                                          http://nys-ns.com/Get hashmaliciousUnknownBrowse
                                          • 104.19.229.21
                                          http://nys-ns.com/Get hashmaliciousUnknownBrowse
                                          • 104.16.51.111
                                          PG_320_MPI STEELPROCESS SRL_20240607_100526.xlsGet hashmaliciousRemcosBrowse
                                          • 188.114.96.3
                                          http://www.choeshop.comGet hashmaliciousUnknownBrowse
                                          • 1.1.1.1
                                          http://beonlineboo.comGet hashmaliciousUnknownBrowse
                                          • 1.1.1.1
                                          Transaction_Ref_000067_AC_4090_pdf.jsGet hashmaliciousWSHRATBrowse
                                          • 188.114.96.3
                                          file.exeGet hashmaliciousAmadey, Babadeda, Stealc, VidarBrowse
                                          • 172.64.41.3
                                          SecuriteInfo.com.Win64.Malware-gen.8656.30833.exeGet hashmaliciousLummaCBrowse
                                          • 188.114.96.3
                                          https://polr.netgroup.de/hKs-JSK99Get hashmaliciousUnknownBrowse
                                          • 172.67.70.133
                                          MTOCASetup.exeGet hashmaliciousUnknownBrowse
                                          • 64.18.87.81
                                          Setup.exeGet hashmaliciousUnknownBrowse
                                          • 64.18.87.81
                                          Setup.exeGet hashmaliciousUnknownBrowse
                                          • 64.18.87.82
                                          SecuriteInfo.com.Program.Unwanted.4662.20461.1147.exeGet hashmaliciousUnknownBrowse
                                          • 64.18.87.4
                                          SecuriteInfo.com.Program.Unwanted.4662.20461.1147.exeGet hashmaliciousUnknownBrowse
                                          • 64.18.87.4
                                          ffff6f6.msiGet hashmaliciousUnknownBrowse
                                          • 64.18.87.10
                                          uXUrccWxXO.elfGet hashmaliciousUnknownBrowse
                                          • 67.22.231.120
                                          https://filezilla-project.org/download.php?type=clientGet hashmaliciousUnknownBrowse
                                          • 64.18.87.81
                                          dagQSRLYsB.elfGet hashmaliciousUnknownBrowse
                                          • 206.55.88.228
                                          huhu.mpsl.elfGet hashmaliciousMirai, OkiruBrowse
                                          • 206.55.88.205
                                          CLOUDFLARENETUSDRAFT DOCUMENTS.jsGet hashmaliciousAgentTeslaBrowse
                                          • 172.67.207.214
                                          http://nys-ns.com/Get hashmaliciousUnknownBrowse
                                          • 104.19.229.21
                                          http://nys-ns.com/Get hashmaliciousUnknownBrowse
                                          • 104.16.51.111
                                          PG_320_MPI STEELPROCESS SRL_20240607_100526.xlsGet hashmaliciousRemcosBrowse
                                          • 188.114.96.3
                                          http://www.choeshop.comGet hashmaliciousUnknownBrowse
                                          • 1.1.1.1
                                          http://beonlineboo.comGet hashmaliciousUnknownBrowse
                                          • 1.1.1.1
                                          Transaction_Ref_000067_AC_4090_pdf.jsGet hashmaliciousWSHRATBrowse
                                          • 188.114.96.3
                                          file.exeGet hashmaliciousAmadey, Babadeda, Stealc, VidarBrowse
                                          • 172.64.41.3
                                          SecuriteInfo.com.Win64.Malware-gen.8656.30833.exeGet hashmaliciousLummaCBrowse
                                          • 188.114.96.3
                                          https://polr.netgroup.de/hKs-JSK99Get hashmaliciousUnknownBrowse
                                          • 172.67.70.133

                                          JA3 Fingerprints

                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                          3b5074b1b5d032e5620f69f9f700ff0eDRAFT DOCUMENTS.jsGet hashmaliciousAgentTeslaBrowse
                                          • 104.16.149.130
                                          • 104.19.208.152
                                          • 104.16.148.130
                                          http://beonlineboo.comGet hashmaliciousUnknownBrowse
                                          • 104.16.149.130
                                          • 104.19.208.152
                                          • 104.16.148.130
                                          Banco_BPM__Copia_del_Pagamento.pdf.batGet hashmaliciousRemcosBrowse
                                          • 104.16.149.130
                                          • 104.19.208.152
                                          • 104.16.148.130
                                          QvS0a5bvCMM8EUj.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                          • 104.16.149.130
                                          • 104.19.208.152
                                          • 104.16.148.130
                                          DeqcE30sLb.exeGet hashmaliciousDCRatBrowse
                                          • 104.16.149.130
                                          • 104.19.208.152
                                          • 104.16.148.130
                                          http://mbcxwo.comGet hashmaliciousUnknownBrowse
                                          • 104.16.149.130
                                          • 104.19.208.152
                                          • 104.16.148.130
                                          SecuriteInfo.com.Win32.Malware-gen.28268.20656.exeGet hashmaliciousUnknownBrowse
                                          • 104.16.149.130
                                          • 104.19.208.152
                                          • 104.16.148.130
                                          SecuriteInfo.com.Win32.Malware-gen.28268.20656.exeGet hashmaliciousUnknownBrowse
                                          • 104.16.149.130
                                          • 104.19.208.152
                                          • 104.16.148.130
                                          qqMLbietPf.exeGet hashmaliciousDCRatBrowse
                                          • 104.16.149.130
                                          • 104.19.208.152
                                          • 104.16.148.130
                                          SecuriteInfo.com.Trojan.AutoIt.1413.12984.723.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                          • 104.16.149.130
                                          • 104.19.208.152
                                          • 104.16.148.130
                                          37f463bf4616ecd445d4a1937da06e19Transaction_Ref_000067_AC_4090_pdf.jsGet hashmaliciousWSHRATBrowse
                                          • 104.19.159.224
                                          • 49.12.121.47
                                          Revised PI_2024.exeGet hashmaliciousGuLoader, Snake KeyloggerBrowse
                                          • 104.19.159.224
                                          • 49.12.121.47
                                          file.exeGet hashmaliciousBabuk, DjvuBrowse
                                          • 104.19.159.224
                                          • 49.12.121.47
                                          MN3OAv98T9.exeGet hashmaliciousLummaC, VidarBrowse
                                          • 104.19.159.224
                                          • 49.12.121.47
                                          file.exeGet hashmaliciousAmadey, Babadeda, Stealc, VidarBrowse
                                          • 104.19.159.224
                                          • 49.12.121.47
                                          SecuriteInfo.com.Win32.SpywareX-gen.5627.25731.dllGet hashmaliciousUnknownBrowse
                                          • 104.19.159.224
                                          • 49.12.121.47
                                          SecuriteInfo.com.Win32.SpywareX-gen.20276.19222.dllGet hashmaliciousUnknownBrowse
                                          • 104.19.159.224
                                          • 49.12.121.47
                                          SecuriteInfo.com.Win32.SpywareX-gen.5627.25731.dllGet hashmaliciousUnknownBrowse
                                          • 104.19.159.224
                                          • 49.12.121.47
                                          dfssjjj.exeGet hashmaliciousGhostRat, Mimikatz, NitolBrowse
                                          • 104.19.159.224
                                          • 49.12.121.47
                                          file.exeGet hashmaliciousVidarBrowse
                                          • 104.19.159.224
                                          • 49.12.121.47

                                          Dropped Files

                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                          C:\Program Files (x86)\Lavasoft\Web Companion\Application\7za.exehttps://filezilla-project.org/download.php?type=clientGet hashmaliciousUnknownBrowse
                                            C:\Program Files (x86)\Lavasoft\Web Companion\Application\Ad-Aware Web Companion.exehttps://filezilla-project.org/download.php?type=clientGet hashmaliciousUnknownBrowse
                                              C:\Program Files (x86)\Lavasoft\Web Companion\Application\BCUSDK.dllhttps://filezilla-project.org/download.php?type=clientGet hashmaliciousUnknownBrowse
                                                C:\Program Files (x86)\Lavasoft\Web Companion\Application\BCUEngineS.dllhttps://filezilla-project.org/download.php?type=clientGet hashmaliciousUnknownBrowse

                                                  Created / dropped Files

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\7za.exe

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32+ executable (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):468184
                                                  Entropy (8bit):6.230723685020727
                                                  Encrypted:false
                                                  SSDEEP:6144:8511bCALveDe7tEw0IN3q1If9wZfgomh8wuAf4CBxrzBOVzZNkcI1FPjTI6e36b4:q11bCALveK7ddN3cEBfXBxBOVzwbmb
                                                  MD5:E68227603D05EA88F1E669177F9BEFE8
                                                  SHA1:3A0FE67C5AE771DB6C35CD14C7EA8212587A7458
                                                  SHA-256:03F819347899300796C7D8BEC97D754D29E47A246FECD98F606F73526F82234D
                                                  SHA-512:B759D2AA6B75CB310B7B953C19B25A67282BF1EA17A8C0C214CAF5C4E2E07CA32447FC195D1D214B13A799FFC310FFF4E2DB93FC916282CAA398458F5D103CB7
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 3%
                                                  Joe Sandbox View:
                                                  • Filename: , Detection: malicious, Browse
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........j.[...[...[...-.y.Z...-...P...[.......-.j.....-.i.T...@.Z...-.x.Z...-.|.Z...Rich[...................PE..d...p.mZ..........#..........N................@..............................@......y.......................................................D...x....0..........X_.......2...........................................................................................text............................... ..`.rdata..............................@..@.data....,..........................@....pdata..X_.......`..................@..@.rsrc........0......................@..@................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\Ad-Aware Web Companion.exe

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):640216
                                                  Entropy (8bit):5.64654328257623
                                                  Encrypted:false
                                                  SSDEEP:12288:v8xS5Nrs9XMMYUfgps5ErCbOt8d/847cHIK:v8kTRMYog65KWCIK
                                                  MD5:EAC4717887788400A0F7236CAB8800DE
                                                  SHA1:E4AAFD6A58167B158BE798A0DB209D49A303D182
                                                  SHA-256:5E8DB9C0CAB2ACD9192F0E28991D109B0A9F46E3492264EDC8A659E507D40A9B
                                                  SHA-512:D1FFFF3FBFB27D52E417C0FAB9D4F65A504F0618F85F35584FAC63AFC51802C23E9E050BC16A20C97EF467B054050B668B84D9C5E78F16FC856469A08E36B84A
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 3%
                                                  Joe Sandbox View:
                                                  • Filename: , Detection: malicious, Browse
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......D..E..............[.......e.<.....d.....F.e.........................f....+e......._..............+Z.....Rich....................PE..L....}`e................."...l......z.............@.................................d.....@.....................................d........h...............2... ..hE.. ...8...........................@...@............................................textbssaV...............................text.... ...p...".................. ..`.rdata..\............&..............@..@.data....n...0......................@....idata..............................@..@.rsrc....h.......j..................@..@.reloc...P... ...R...@..............@..B........................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\BCUEngineS.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):3327776
                                                  Entropy (8bit):6.604049420317364
                                                  Encrypted:false
                                                  SSDEEP:49152:xy9jC5327LeAyDW06K6mBzsITo59wpGlU+2StoJrtf5inkE:xyjO32fyDW0Gm5sIToTwYTgh+
                                                  MD5:285F2AD79F10ED7F6C8C91C534744BB9
                                                  SHA1:A28E8E08B08A30F7768B4059730B4629832C6A84
                                                  SHA-256:4BD8DDDA775A10ECB5E57FC7ADA99D2C551B285E15609796667DA8CA6F999C7E
                                                  SHA-512:BD3E92DF412FA080D1C009BF0D0299F035D21382EF19C691EDF2F883E41542186C7670075FC44E2F874F96C071D8A48EE8A6DFB160F52D93F08B847E4B14C7CE
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 4%
                                                  Joe Sandbox View:
                                                  • Filename: , Detection: malicious, Browse
                                                  Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.........M..#...#...#.......#..l..#.."..#.kD..#.kD...#.kD..#.......#..l..#...#...#.......#..."...#..l..b.#..l..#..l..#.......#..l..#.Rich..#.................PE..L....r.U...........!......&.........y.........&.............................. 3.......2...@.........................../.f.......T.... 0.............H.2..2...00.......&.8....................8,.....H8,.@.............&.`............................text...7.&.......&................. ..`.rdata..6=....&..>....&.............@..@.data...d.... /......./.............@....tls..........0......./.............@....rsrc........ 0......./.............@..@.reloc..,....00......./.............@..B........................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\BCUSDK.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):727768
                                                  Entropy (8bit):6.43017428874408
                                                  Encrypted:false
                                                  SSDEEP:12288:sOtZcbZXzrsk548VyK8SbMAfQBM6LDkzOZYv3JSGeizoyDaH:sOrcbZT8AYBpLMO8SGHoyeH
                                                  MD5:E2D9615B09A39C15C6277C5E5D36C3B8
                                                  SHA1:E4A815235319E19CB02F06DAEE2FECB6F2B5753A
                                                  SHA-256:D27B1533E12176518E3C5545BFC15B951C0341F124FD8E9E00BC7CCCA26B57F8
                                                  SHA-512:5C9FA21FD10608E1C3FE46C985A31E10A8C4C27198D53605BE86257D9160E477CDF40DB1ADC2E0B05AD0EB300A5C5F8E57E1029AF1C60B8466DD50683DE3405F
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 3%
                                                  Joe Sandbox View:
                                                  • Filename: , Detection: malicious, Browse
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........P...>...>...>.mG....>..!....>..!..t.>..!....>.......>...>...>.......>...?.*.>.1.....>.1.....>.1.....>......>.1.....>.Rich..>.........................PE..L.....U...........!.....J..........`........`...............................`......j.....@..........................:.......-..x....0...................2...@...f...b..8........................... z..@............`..,............................text...LI.......J.................. ..`.rdata.......`.......N..............@..@.data........@.......,..............@....rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\DotNetZip.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):470744
                                                  Entropy (8bit):6.847665009137063
                                                  Encrypted:false
                                                  SSDEEP:6144:cRYYIiJaeEWfTXQyu8+yi4ZiwAEsFdnQ6uw2lQc2RGtSV41OJDsTDDr1LUe6GNxM:cF9agBr6ilLS4msT1oe6kf+Pj
                                                  MD5:909C4F5B405A99D81D7707D8F2A5337B
                                                  SHA1:CAAE2D201AC336D85A54AA4CDA0641B88E36D3F3
                                                  SHA-256:4E193D41F12F1CB2EABCE6DAA3AA4AFBC71FD4DCF5ED62200E1638FD6A16EA72
                                                  SHA-512:8A76272C5DEA0BCC856021A7B36A99251C3EF347E1F876538E4ECCC375337B743F51662E11F9747E1CACB268DC37AB808B32137A1AFCFD7B23ECD10F28ABF884
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 3%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...q..Z.........." ..0.................. ... ....... .......................`............@.....................................O.... ...................2...@......d................................................ ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H.......@.................../............................................{....*"..}....*.*..(....*..0..F.......s....%r...po.....{.........(<...o....r...po.....|....( ...o....&o!...*...0...........s"......o#...(....*.0.............{......E............,.......8...D...+Q..{..........+M..{.......+A..{..........+2..{.......+&..{.......+...{..........+.r...ps$...z.*6..oh...(....*..(....*....0..a.......s....%.|..........o!...o....r...po.....{.........(<...o....r...po.....|....r#..p

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\Esent.Interop.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):407768
                                                  Entropy (8bit):5.969604490047909
                                                  Encrypted:false
                                                  SSDEEP:6144:S8ASBEKZNe2+6QfeFlrd+jkg3yX285iS/377gckFMW1zU72JlHwt8p30Heqh:cqlR/xTim3IcI/Lqh
                                                  MD5:830058E9E557406BB4F8DA46B4274F96
                                                  SHA1:5987EDF4D00A6FAC6E57D6CB7EE157010EA1E515
                                                  SHA-256:D1AB0858F9795C0D89CEBD2881E0AD99A7C922AB1C89ED11F2CC738CCA4E615F
                                                  SHA-512:469348817B276F3296AD38B1A5D50F2D8B426025EFDE70C7CCF90A7161E4E0D31C9E0173E831D7B80E04DC98AF6CF810B6E7AC05EED543629C1F73D112349C85
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 3%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....RhW.........." ..0.................. ... ....... .......................`............@.................................\...O.... ...................2...@......$................................................ ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H...........<6..........................................................&.(......**..( .....*....(!.....*f..s".........sH...(.....*..0..'.......~.........(#...t............(...+...3.*..0..'.......~.........(%...t............(...+...3.*.~....*.......*R.(......o....(....&*Z.(........o....(....&*N.(.....o....(....&*...0...........(......o....(.....+..*R.(......o....(....&*N.(.....o....(....&*N.(.....o....(....&*N.(.....o....(....&*R.(......o....(....&*....0.. ........(........s&

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\Extension\@wcextensionff.xpi

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                  Category:dropped
                                                  Size (bytes):59316
                                                  Entropy (8bit):7.880293608811765
                                                  Encrypted:false
                                                  SSDEEP:1536:+HPkHMRS54xpdWi9qHkDcTYPkvPkMPkY6qh:GPksRgkdWi9q6cTYPkvPkMPkY6E
                                                  MD5:8DA01C7329C1AF3202D93C8631E0DF35
                                                  SHA1:38F1E5DD6CBB577249C676127BC9565B70F78760
                                                  SHA-256:A30D0AA074214F7C6D8E82FE36E6EA4FC17C95F6C772C11D03667911C0475A03
                                                  SHA-512:2103ECB37B02C74D51C6C85CBE05A073FFD5860F8644AD54ADB212C690EDF8FE732EA784BA7CECB93DA2022A93B135DDC9E2BBC8DF26AE798CB6F28E2AAE4F7C
                                                  Malicious:false
                                                  Preview:PK........hq'H.|b.....K.......META-INF/mozilla.rsa.WgT.k.&..B3H/.Ho_.Mz..........A..A...H...R.H.D@P..).T...^.]..w..={....o..w...<s. .i.(..:.]j..8.@'...$. ........@...$..o.(.........$#.....0..'bc......:r.....b..!...hv...P"..x.g....:....n......c+.......!.;...sL@.;;.q.Hc{wog.=....;@.....D<~.D06.6vvx..(.W4Q..#Z...3E..#..P."xW.._._.*.xa.X....-....q......#(s.....74....;..|.....1 CP..p.6.8.........~..L....x.#..h&...+2..`.}=............."%....$G.)..0.d.=.O?....%.....1@m.7.5...a..KX.z..s.}..g.......4.K..N.*....*..%t.....'..-...._$....W.1X'.X.........OF.`]P.'._...S.t}G....kv.o...kEj.^.)gf.p*.Dn9u ....M.>...x..u...`.*P$xb}~)....k6..o:......j..k....Si.!.D.\.SF....<.d.'..,..Vf...<@M...M<.FEv...l......$U&|YwF.'s1..\W..Il5+./.#.......Bk..&||v~../.Jd..W1.j:c.:..s....-..V.*...?.?.q+.2...N......el.J.5.......='..C.@...W..>gX...k....6.w.4{.2<..W%.Zq-..f.?+d...3.}..#%L.{.P.|.qXk..d.*...hf..Z.{.y=w..l..-.f..M...G.5..N.=m..Mb.....?..1......H@..G.qa(.........g..0.

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\ICSharpCode.SharpZipLib.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):213720
                                                  Entropy (8bit):5.7590701476394095
                                                  Encrypted:false
                                                  SSDEEP:3072:3K1c/KCOAUXk31Vv91GOtJJKuE1iA5mGPB8qd9OTymIpn+64kRAclDwRNG95ZI4Y:ae9OAQsFtJrGPBnmIRZX6
                                                  MD5:D21039264AB947303E03FA56FF1011FD
                                                  SHA1:DF804447358CD6293BCD6FEAACD70E2FBC53F4B9
                                                  SHA-256:9BA3F901D532CA29C99BB113D0370597E8A7AB1E3EAF3FA059DF495A5769C9E6
                                                  SHA-512:413603086F990622E312F1DA44DCCFD6A05CBA0DE933AAD31FE861760C2B1261B140F9075BEF9C96F7955A75A5FEDEC5DFDB562FEFEA483D6478ACC34D75A206
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 3%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...........!......... ........... ........@.. .......................@............@.................................d...W........................2... ....................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\Interop.IWshRuntimeLibrary.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):62168
                                                  Entropy (8bit):5.456421345249905
                                                  Encrypted:false
                                                  SSDEEP:1536:9L9nVJEetVDUxSp1K2z9IDd3gzqgKxnB3lxf:9RVJEMVDqMK2z9IDdQzHKj
                                                  MD5:A671375100C522CF998A9A9BD09F9C42
                                                  SHA1:84FE648E7E8DA96877FE7AE2AD56C4E802354274
                                                  SHA-256:7A9307D6DCDE91368195126BEAEF51CCC0D81F2AEB149F30BCA099A0C7FF856E
                                                  SHA-512:BB57D29F32CD75E0F07E6F6D8BDB1620ED2B39048CD1A8E53E15C625BA7EF9F8C1ABB40EEF2EF53765D0171ADFFD9B94BB336CB8268C5F4B1D8C7FAE6821BA7D
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 3%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...3%DY...........!......... ......>.... ........@.. ....................................@....................................O........................2........................................................... ............... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\Interop.LavasoftTcpServiceLib.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):58072
                                                  Entropy (8bit):5.518951314312486
                                                  Encrypted:false
                                                  SSDEEP:768:0dKVoSyxH33PyGaEVDTOsNpgw3wIcAlJCP5ymDgKxnVbDLmaoyAMxkEe:uD/y9E1TOsR3lJ6DgKxnBroQxy
                                                  MD5:8A5DA49FDD083CBED40465E495407FE3
                                                  SHA1:C6DA721FE6B48D7DBEB5556A1F7277B8B0593104
                                                  SHA-256:6DAAAEE64C0C3EF60459EC48D50184ECA341ABD4C6E8063F6A6111625FD5F14D
                                                  SHA-512:5BAA14594AA32D39EF8A70AB88263CA8EEDA5C954C5EEEE518B5CF68647AFCD6A4E4DBC02EA057AA2BB5DBDE1D6D4DD4D11C59E996389F33CD8DC9B0A1169430
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 3%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....FpU...........!......... ........... ........@.. ..............................A.....@.................................H...S........................2........................................................... ............... ..H............text....|... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\Interop.SHDocVw.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):168664
                                                  Entropy (8bit):5.541813032526921
                                                  Encrypted:false
                                                  SSDEEP:3072:jadMZC3fkpOTItC3MhmLwF62I5IfO9cjSBgn2FUraJYv+NMzCRw3mVE7KZo/ud8T:jadMZC3fkpOTItC3MhmLwF6n5IfO9cj/
                                                  MD5:1B1E377C14B6B80FC67AF70029878D97
                                                  SHA1:097610DA37F680B88D31AFAA707387DF21169F0B
                                                  SHA-256:DC4C9D0D86B498217DBEC2DAC5AEF675453121678B9BF0AB175697799DED8E97
                                                  SHA-512:19725BE02D5BCF330EAFFDAF0DBBDB7D47FB3EA22DE6830AC4CDCDFD86AF08EF6C9361F998B0B097CF8EEC578EFF59887F7943112D7F8B587A480A45BEF32ACF
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 3%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....`S...........!.....0... .......C... ...`....@.. ....................................@.................................dC..W....`..h............`...2........................................................... ............... ..H............text....#... ...0.................. ..`.rsrc...h....`.......@..............@..@.reloc...............P..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\Interop.Shell32.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):62168
                                                  Entropy (8bit):5.3820510912657875
                                                  Encrypted:false
                                                  SSDEEP:768:0exl81nX6ZxlvUAa7KoBv7epginbCe7AXjuw9tL0Duxj7tr+BrIxFSsAgKxnVbDa:0exl81nK34PJepgqcVzAsAgKxnBr/Xxk
                                                  MD5:BE798A27BC3AC7D44407EAB37ED9DE4D
                                                  SHA1:884FB70977178C4ED2FA4B64C7F2EAAE48EDB9E6
                                                  SHA-256:B6BE1F8EC341C302972A11D618F9BA1A69321EEEE1557A91B2ACC6BD63ABEDB3
                                                  SHA-512:72E7D81C4A99E8C28D3F8425008C36D981E393304B2D6309CC0114006BC6C134F10B5FE2D51E4D129FDDCA7BEADF5D971381B827E6679A80932596729A5BA043
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 3%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A.ST...........!......... ........... ........@.. ....................................@....................................O.......h................2........................................................... ............... ..H............text...$.... ...................... ..`.rsrc...h...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\Interop.WUApiLib.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):99032
                                                  Entropy (8bit):5.705246523074101
                                                  Encrypted:false
                                                  SSDEEP:1536:PfutksUQDy4qJgax0L4zP+YuqLSTL/SiEDx4l3Ow6OhNgKxnBrgxN:uQw3ax0L4D+YZLS3/SiEq+wjhqK4
                                                  MD5:0588CB68935DB123DE5E666016916319
                                                  SHA1:DCC13840D28CBE9BA2EDB7BE1BF5F98F1FCFE072
                                                  SHA-256:2DA6786744548E5E881DD5321DF5B53D4D5352E304A0959A7193D85EF8699F5A
                                                  SHA-512:DD9D5D50247C31BF4A4D0A6A294AF48DDB4165D759BCC1502693D2E44C4F0283F2F74337609CD9A2FC435155B2D4CF0730423CBF9D85BA0301E868E3CE9776E7
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 3%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...r..O...........!..... ... ......^7... ...@....@.. ..............................{.....@..................................7..K....@..p............P...2...`....................................................... ............... ..H............text...d.... ... .................. ..`.rsrc...p....@.......0..............@..@.reloc.......`.......@..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\Ionic.Zip.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):475352
                                                  Entropy (8bit):6.839186472041566
                                                  Encrypted:false
                                                  SSDEEP:6144:DeSYvQAd10GtSV41OJDsTDDVUMle6ZjxLV/rHo0Oaaz2R9IYJF:CJBdBS4msNUCe65frHMnz2R9jF
                                                  MD5:5346BA51D28B0179A23617145FB427D0
                                                  SHA1:82381BA437474638F011149A9A680DE4EF1AEF04
                                                  SHA-256:999D262EA1F3687C7FAECD50738F60B46D027D38D318ED805B9CC08A249CF2C9
                                                  SHA-512:2A58558CA6088AA99445CFA42585DB2D40A54AACD71DDE1B19ECB69E8C0152976163F7E093CC065F9096B62A9776416132D6D3045E22CA1136D5C4F72DA0DA47
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 4%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....=N...........!................N#... ...@....@.. ...............................\....@.................................."..O....@..P................2...`......."............................................... ............... ..H............text...T.... ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B................0#......H.......0U..l...........P%.../..P ......................................6..`N.?O...%.C.k_..d...I......5a.......9x......R...gg8...JM...`.[. .o..eE1$_.M.h.q.oz..1..........@....s.c/J..wk.D.....t..&...(....*...0..2........r...p(....}.......}"....(........(.........(....*..r...p(....}.......}"....(........(....*..0..j.........o....-..s#...+..}......(......(......}.....(....s....}......}......}......(......%-.&r...p}......j(#...*rr!..p.{.....{.....B...(....*..0..A........{..

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\LZ4.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):52440
                                                  Entropy (8bit):6.314760277569025
                                                  Encrypted:false
                                                  SSDEEP:768:t4JxKxYIP7NGp4mbOLfjz+xEqDAXjIXaugKxnVbDLmWXAMxkETm:hxY67NYofjzr6QyaugKxnB3Xx/m
                                                  MD5:46756DE60BAD1ECBCF578B722961C99F
                                                  SHA1:D033043AD74674F2F55CC0AD84B145E8A26CE953
                                                  SHA-256:79ED7F8CDE3B3F68F9B96468253F2AC96DD013660758A8B10AA47D4EBCC41B07
                                                  SHA-512:2ECC584AA66EAD046CFEBA8014D910760E38EE18F2F546795F66CA1C6AC5D35BB0FFBCE1A3D9472482CD6D3661799E8BCCB6F7C7918A129F6340C6B12A9E6412
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 3%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......V...........!..................... ........... ....................................@....................................S........................2........................................................... ............... ..H............text...4.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........f...H..........................................................6.. ....[X..X*...0..t........J./....i.YT.J-....T*.-.r...ps....z..2...JX..i1.r...ps....z..J./.....i..YT.-.r}..ps....z...2.....JX..i1.r...ps....z*..-..s....z*>.......X..c.*6......X..b`.*z......X..b`...X...b`...X...b`*....0..@.............X..b`...X...b`...X...b`.......X..b`...X...b`...X...b`...a*.0.............n...X.n.b`...X.n..b`...X.n..b`...X.n. b`...X.n.(b`...X.n.0b`...X.n.8b`....n...X.n.b`...X.n..b`...

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.AppCore.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):204504
                                                  Entropy (8bit):5.774649637058115
                                                  Encrypted:false
                                                  SSDEEP:3072:bdt47pwdW6rTF0TQZh03WdWJDqVb4nSG7inS9NJGhlpjKUYsqbiAtH81hBmKX5:Zze0r03vwEnF7inS9rA1Tp
                                                  MD5:357E1A39CDE97D24FA3D64FB860AD39D
                                                  SHA1:CEE5106C8DFCFB9AA047CF9D4817AC21CCB9252A
                                                  SHA-256:94480874ED4A8CF8D06DB16178259F129DBD300A994397010EA3EB18B1F75259
                                                  SHA-512:CF4A21103E2145BE6B5AE461B26539BDE0D8871F5057E4794011ACB330748730EF06802C9EDD061C4AECE215981FBD5B33BFB4247F71EAE6060D9A3A7803AB7F
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 4%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....}`e...........!..................... ... ....... .......................`......*.....@.....................................O.... ..H................2...@....................................................... ............... ..H............text........ ...................... ..`.rsrc...H.... ......................@..@.reloc.......@......................@..B........................H.......4...P............................................................0..........r...p.....r+..p.....r[..p.....r...p.....r...p.....r...p.....r...p.....r...p.....r3..p.....r_..p.....r...p.....r...p.....r...p.....r...p.....*....0..C.......r...p.....r7..p.....rS..p.....rs..p.....r...p.....r...p.....r...p.....r...p.....rA..p.....ra..p.....r...p.....r...p.....r...p.....r...p.....r...p.....r7..p.....rO..p.....rm..p. ...r...p.!...r...p."...r...p.#...r...p.$...r...p.%...r9..p.&...

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Automation.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):44248
                                                  Entropy (8bit):6.286203097197047
                                                  Encrypted:false
                                                  SSDEEP:768:TyQ2zMDR4SpdC/LNJIvv5KSvtvRU3TIMd5ZwvashgKxnVbDLmaBaAMxkEHU:TyQ2zMDRZRU3MMd5ZSnhgKxnBrKx4
                                                  MD5:7B2DEDFB2940A1E07DF44221F0B7C154
                                                  SHA1:5A56976F6E134E2D746FEEA9F7B7A3A3A516911D
                                                  SHA-256:F5D9B0981BF04FD32B26B6C5E9D6C6FF2834F84156E0CC12D328A85850AC3637
                                                  SHA-512:12C3C213EF530FA4BAC35922425BC4B4FA9484E993473CCD83D326C2D722F4C487D5C0B746764305AA82F507483A3F60372D5B5B8A6F800CD374FB0C8A680AE2
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 3%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....r^...........!.....r............... ........... ....................................@.................................\...O.......H............z...2..........$................................................ ............... ..H............text....p... ...r.................. ..`.rsrc...H............t..............@..@.reloc...............x..............@..B........................H.......4H...F...........................................................0............{.....+..*r.~....}.....(........}.....*....0............{.....+..*&...}....*r.~....}.....(........}.....*..0............{......o.....+..*..0............(...+........-%..o.....(...+.o.....(...+.s.....8.....(...+........:.....s.......o......+7..(.........(......(......(....u&...-..+...s....o........( .....-...........o!.........-..o"...s#....+..o"...s$....+...+..*........Y.F........0..........

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.CSharp.Utilities.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):59096
                                                  Entropy (8bit):6.275529461974405
                                                  Encrypted:false
                                                  SSDEEP:1536:HAyZatnUAEwhoms0lpfq+EJgKxnBr9HxE:ytnU/Qo0pS9WKU
                                                  MD5:9C09F1310368DC71AA30B3B93377930D
                                                  SHA1:55CC656074F5C9B8B3CEA5807E97CEAD8E9FB134
                                                  SHA-256:C65737504DEC4639FE20292CE2F38112712A3156274291C5BFF91AF23ECC0FAC
                                                  SHA-512:1A528ACB83C0A1322D4FBD614038461E8F01E32E5AD039D6078BB1432916082E37A8E8E369ADE29657548107AB18B376BFD109DCCCFA2303B57C765D870D04CB
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 3%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....r^...........!..................... ........... ....................... ...........@.................................D...W........................2........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......hc...e...........................................................0..2.........{....%.(........}.....{......o.........(.......*...........(.......0..*.........{....%.(.......{.....o........(........*...................0............{....%.(.......{....o....(...+....(........*...........#.......0..=.........{....%.(.......{.....o...........-....}..........(........*...........#2.......0..+.........{....%.(.......{......o .......(........*.......... .......0............{.

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Compression.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):22232
                                                  Entropy (8bit):6.755934277909707
                                                  Encrypted:false
                                                  SSDEEP:384:EpE0gG53WPmd0EFP27xWkVbDWRpUmWWJmxKaAM+o/8E9VF0NyAS:m8u0gKxnVbDLmWuaAMxkEz
                                                  MD5:83BEE632454B24D70EFCC90820F697C9
                                                  SHA1:7D0BE587D7D54E95F7B0171DEB6A1ADC49AFED6F
                                                  SHA-256:5DE57DE660065003286BFA85D8620BEFBC14054CCDCDB042F24E67DA1E770AC7
                                                  SHA-512:965CF849F4969DEF42EA3292B9B6B2B6343419BDD6AF5832F0730E4ADF7153B24BA8CD56B6F25F15C743F294858A27E0007A133EEEF62BB585E655901EE9BE17
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 4%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....r^...........!.................:... ...@....... ..............................dw....@..................................9..K....@..h............$...2...`.......8............................................... ............... ..H............text...$.... ...................... ..`.rsrc...h....@......................@..@.reloc.......`......."..............@..B.................:......H........%...............................................................0...........{.....+..*"..}....*.0...........{.....+..*"..}....*.0............(........+..*j.(........(.......(......*j.(........(.......(......*~.(.............(.......(......*.s..........~.....s....o.....~.....s....o......*....0...........~.....o.....+..*..(....*....0...........{.....+..*"..}....*.0...........{.....+..*"..}....*.0............(........+..*j.(........(.......(......*j.(........(.......(..

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Events.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):133848
                                                  Entropy (8bit):6.03296808579481
                                                  Encrypted:false
                                                  SSDEEP:3072:XSCLdd7ysQJRPqvOHs6gf32SwJkRSekXbnTEJjLiQybZ3fi/Kt:XrLdd7j1mMbPwiRSekXbLRt
                                                  MD5:94EBF4CEA94E30F1CAD777FA5DF25DAD
                                                  SHA1:BF96A7624540311324667BA3A550CBEE2F7DE35A
                                                  SHA-256:A39B13F38FE126CE586556652A4F8B05D7879E059E65E62C2B9A12E69DA57E8A
                                                  SHA-512:8D2D0B6BC29F7DE587C35459B6D8FFBA51E0A82752C12267A184C03618ED489C507F921F8930BC38BC6F75871148C240DD9F5BA501E255C662184E2C9310F2C3
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 3%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....fa...........!..0.................. ........... .......................@.......F....@.................................t...O........................2... ......<................................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................H...........<c...........................................................0..=........(....-..#(....r...p(....+...(....r...p(......rA..p(.....+..*....0...........(....rg..p(.....+..*....0..'.........(.......rq..p.(....(.......(.....+..*..0.............(.......(......(...........(...........+..*...................0..5.........(....(......,.(....(....(...........o....(........*..........."#.......0..<.........(....(....-.(....(....+....,.(....(..........ru..p.s....z*........,-..

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Extension.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):117464
                                                  Entropy (8bit):5.8509293496889825
                                                  Encrypted:false
                                                  SSDEEP:1536:RCMxMNMIG2NiC8/Srwwb2A49qIut99b6QSVCOZaagKxnB3wxVE:Rnu6uNiOrwS2AsYt99bkYX3Kh
                                                  MD5:780626CB4A95A28D7A17C9288D617E71
                                                  SHA1:70F80D9131BC6D78B4F8B28CEFF834EBCF403CFE
                                                  SHA-256:25EA8110BD2ED6C660F5CC2BB2C8DBCB521222F84334C91E897E54DF3C060F3B
                                                  SHA-512:8B5CE07298B1F63B3019308FED5E4D87F8AFA99EBD1667527A783A2F5AA50B10FE2F6F1852CEF7D413C1AF5ACE04A77FC52F8A15D5DC3E7EAA9576690F2EDEBB
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 3%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....r^...........!.................... ........... ....................................@.................................x...S.......X................2..........@................................................ ............... ..H............text....... ...................... ..`.rsrc...X...........................@..@.reloc..............................@..B........................H....... ... ...........................................................&..(.....*...0..Z.........(....o.....+-.o.......,..o....+.....-..+..o.........-..+...o......-.........-..o.......*..........;H........(....*..(C...oI...&.(......(......(......(.....*...0...........(C...o)...(...........-...*.0..,........(C...o)...(.........-..+.(.....sU...(V....*N.(C...oH...&(.....*.0..Z.........(....o.....+-.o.......,..o....+.....-..+..o.........-..+...o......-.........-..o.......*......

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.IEController.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):139480
                                                  Entropy (8bit):5.470974175748931
                                                  Encrypted:false
                                                  SSDEEP:1536:eF7p5cLpHWeHwgRDbYybNNAQdOUho0YpWv9nGJh4cgKxnBr0xLe:eK1HfBR3YybNkUho0YpWv9nGCKoe
                                                  MD5:3C5BF1898B6685A9A835C5BABD3A7BFF
                                                  SHA1:A5D0E4E3ED1F84CAF7CEB8E430D7393B6AF84012
                                                  SHA-256:2D08E6022BDC6C3C62DA025BDCD387E8138226CCC473521386214898FE6AAB9B
                                                  SHA-512:C6A8BA074866C258A331D84D118A3F4BF56FBA51CA18DD920AE42FBDEE94266A2542038072AD993FA18D9A6D30D3B74D785CA5674B9378E06E46E69F239C3CDD
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 3%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j.eS..6S..6S..6.ZP6Q..6^Yl6W..6^Yn6P..6^YQ6X..6^YP6Z..6Zs26U..6Zs"6X..6S..68..6.P6P..6.m6R..6^Yj6R..6.o6R..6RichS..6........PE..L....}`e...........!.....2..........~........................................P......k.....@.............................V...(........0..<................2...@.......X..8...............................@...............(............................textbss.................................text....0.......2.................. ..`.rdata..6....P.......6..............@..@.data..../..........................@....idata..~...........................@..@.rsrc...<....0......................@..@.reloc..^....@......................@..B........................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Omni.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):26840
                                                  Entropy (8bit):6.566697638301364
                                                  Encrypted:false
                                                  SSDEEP:384:Cs50VUWNm/2EHaqcCuEulswVoEFP27xWkVbDWRpUmWWv0AM+o/8E9VF0Ny+gWU:D2dBJqwVogKxnVbDLmWPAMxkE4U
                                                  MD5:CE905FCE54DCD1E1BF4B7CB58B71A94C
                                                  SHA1:94AB818D4AAA68B5E5E5511F90B6BE487E1D3546
                                                  SHA-256:818905673392BFA50A4346D43CA734850814A3C6B46F09F9DEE20FBEFB10BDF7
                                                  SHA-512:3BCE799866AAF2EC1DAB9AE5B357F83F600F52867287566F1196D5F73D64D991629FFCD0D8D12E1EFF7F235AB44D302BFF2A6731BC5BEF214A3BA0342A39F3D7
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 3%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....r^...........!.................L... ...`....... ....................................@..................................K..K....`..0............6...2...........J............................................... ............... ..H............text...$,... ...................... ..`.rsrc...0....`.......0..............@..@.reloc...............4..............@..B.................L......H........+...............................................................0..<........(........(.....s....}.........(......o....r...po..........*.................0..G.........{....,7.{....o....r!..po....,..{....o....r!..po....(....+...+....+..*..0..N.........{....,..{....o....r!..po.......+.....-$..{....o....r!..p..(....o....o......*...0..G.........{....,7.{....o....rA..po....,..{....o....rA..po....(....+...+....+..*..0..N.........{....,..{....o....rA..po.......+.....-$..{....

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Search.exe

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):208600
                                                  Entropy (8bit):6.216410078337049
                                                  Encrypted:false
                                                  SSDEEP:3072:8Qc7jMFlaJi024ao1DN7aEdArxCISAK9Zme4tpbWOgrsvU3gIabrddeQeMyUzgKj:8B7j0aMaI4Zz4byOgV2br6U1j
                                                  MD5:1A6E64A89F37623232F7A79A91042012
                                                  SHA1:7A7046677DC762233752897BF872A4D4539650BC
                                                  SHA-256:E99D41C2BEAE503C1CD19CA56CE6CF9CD7B1701E3743CDBBBAFA5005A9440D23
                                                  SHA-512:A1626AEF6366F90D5C23567E8DA178F79870A826CAC29A2617CB72782C05D73147C02D70863F05331A8EF391B2D1AF62740A819C57E2A8538866ECAD3C0874AC
                                                  Malicious:true
                                                  Yara Hits:
                                                  • Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Search.exe, Author: Joe Security
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 5%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...y7`e................................. ... ....@.. .......................`............@.....................................J.... ..b................2...@....................................................... ............... ..H............text........ ...................... ..`.rsrc...b.... ......................@..@.reloc.......@......................@..B........................H.......................t...P!...........................................0..D...........Q...8!...8"...8'....~....~.... ..f.8....8....8....8..........8....8....-.~....~.... ..f.()...o .....o!.....(...+..,:(......~.... b.f.()...o#..........-..~.... q.f.()...o$......k()...8m...o ...8h....8g....8f.....8j.....8h......~......o%.....o&....(........o'...~.... H.f.()...o..........o(.....+...*.8....s)...8.....8...............=.....0..............Q...8....8....8.....~*...~.... ..f.8....

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Search.exe.config

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):1971
                                                  Entropy (8bit):5.13661332037052
                                                  Encrypted:false
                                                  SSDEEP:48:c5paXDJmkxHCm1L5xm1dOvF2qfZibFLzfsxkA:JXDE4iAYo09bFYB
                                                  MD5:A7C1E1B23999EB3068D6357CBA828211
                                                  SHA1:17EDB3471E1D0CEABF360ABA444CBF4146A82C1E
                                                  SHA-256:11240B9B314D463DBF65A5BFD1CE9A4AF40888FCA25E7841E8B63D31B82D820E
                                                  SHA-512:044791148DF6563254EEDB1BF177FAAD4F79B5E596B4DDD04E1DDE5C3FF831BEB011B15B77016B37CB3D91CFC98A7CE71D74F0E709B2C28EFCE1AE83A318DC1D
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="log4net" type="log4net.Config.Log4NetConfigurationSectionHandler, log4net" />.. </configSections>.. <startup>.. Run on all versions of NET 3.5 and 4 See http://msdn.microsoft.com/en-us/library/jj152935(v=vs.110).aspx -->.. <supportedRuntime version="v2.0.50727" />.. <supportedRuntime version="v4.0" />.. </startup>.. Log4Net configuration settings-->.. <log4net>.. <appender name="SearchLogger" type="log4net.Appender.RollingFileAppender">.. <param name="File" value="${LOCALAPPDATA}\Lavasoft\Web Companion\Logs\Webcompanion\webcompanion.log"/>.. -->.. WinXP path to webcompanion.log-->.. .. <param name="File" value="${userprofile}\Local Settings\Application Data\Lavasoft\Web Companion\Logs\Webcompanion\webcompanion.log"/>-->.. <param name="File" value="${LOCALAPPDATA}\Lavasoft\Search\Logs\search.log" />.. WinXP path to w

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.Business.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):544472
                                                  Entropy (8bit):6.141661937290546
                                                  Encrypted:false
                                                  SSDEEP:6144:tpeOhwJdxGtrxxDOPEy2QxNbFtLdPNxlZjLQWjF:taxE1Ucy2QxhJPTlZfpjF
                                                  MD5:0E01900E60BCE3B1013F93CD973D2E0E
                                                  SHA1:8C07D811EE814D8C743652EEF7CBBC4043444156
                                                  SHA-256:8D432AF281EAD056BE4FEA7FEC8903AA8C97C9335B67472B2E1F815C4AD0D0A1
                                                  SHA-512:652881AD47E84D99453D6BAF65C0C873BD929D06220E0FF093B52901B1E510FA5D3C13F3CB031C0C7B882F4DC16317474CD7E5A5EB8F683B8A6C5F567EDBA3F4
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 5%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......c...........!..0..............1... ...@....... ....................................@..................................1..O....@...................2...`......l0............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................1......H........+..............d....$...........................................0..l..........s$.....o%...o&.........%..w.o'.........%....o'.......-&..o&.........%..w.o'.........%....o'..........+..*........89.-.....0...............((...()........s*...%r...p(.....o+....%r-..p(.....o+....%rW..p(.....o+....%r...p(.....o+....%r...p(......o+....%r...p(.....o+....%r...p(.....o+....%rE..p(......o+....%ro..p(......o+....%r...p(......o+....%r...p(......o+.........s,........s-...%r-..po....&

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.Repositories.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):41688
                                                  Entropy (8bit):6.279144500339965
                                                  Encrypted:false
                                                  SSDEEP:768:EhJWxWrnFT06StUREICDS/lH/cRF6IgKxnVbDLmWwAMxkEXPf:EhJjzR0ZpICDS/lH/cj6IgKxnB3exTf
                                                  MD5:B45C9A055A257C79AEA879F232AAC413
                                                  SHA1:925079FA935781C917D9CE309AD4194D1F07901D
                                                  SHA-256:9EAA23D2F4B7297E46170A6973B19329C5A4B9BAB16262F5B8F19C59EDCD7B18
                                                  SHA-512:49EF957B5C96391ABC5FF550EFCEC58D751B6085C44575DEC2842A36017B65F7887FA2F65A527E34FE86F3E8E8D475D9451920A637530726F4E74676C744EE1F
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 3%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....r^...........!.....h..........N.... ........... ....................................@....................................W....................p...2........................................................... ............... ..H............text...Tf... ...h.................. ..`.rsrc................j..............@..@.reloc...............n..............@..B................0.......H.......D8..xL...........................................................0...........{.....+..*"..}....*.0...........{.....+..*"..}....*.0...........{.....+..*"..}....*.0...........{.....+..*"..}....*.0...........{.....+..*"..}....*.0...........{.....+..*"..}....*.0...........{.....+..*"..}....*.0...........{.....+..*"..}....*.0...........{.....+..*"..}....*.0...........{.....+..*"..}....*.0...........{.....+..*"..}....*.0...........{.....+..*"..}....*.0...........{.....+..*"

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Settings.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):22232
                                                  Entropy (8bit):6.788320274330726
                                                  Encrypted:false
                                                  SSDEEP:384:KRfHo/5GU8vEFP27xWkVbDWRpUmWWApxAM+o/8E9VF0Nyw+thXi:KSBZ8vgKxnVbDLmWTxAMxkEPhS
                                                  MD5:ECC17969BA3BA2588F958FBB74D31832
                                                  SHA1:507C4EC05A47DAEE872CEF1B9CB899DB9CD5E267
                                                  SHA-256:24EA5BC7AA5C9159D3EEA2D9D2C0B67761F2C60689425A7E51C3813A404218B8
                                                  SHA-512:01F6A5735967DD2F29635CF54CE550A3C00A46159BEF56D02599C6FB81B87AD061F528AED224D8C284C952F773D1C0097645B85BD9D68EEF21EFE01B5C828356
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 3%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....r^...........!.................:... ...@....... ....................................@..................................:..O....@..H............$...2...`......t9............................................... ............... ..H............text........ ...................... ..`.rsrc...H....@......................@..@.reloc.......`......."..............@..B.................:......H.......`$...............................................................0...........{.....+..*"..}....*.0...........{.....+..*"..}....*.0...........{.....+..*"..}....*..(....*>.r...p(.......*...(.......*B.r...p.(.......*2...(.......*2...(.......*..0..R........(........(.......(.......(.......(.......(.......(......ri..p(......r...p(......*...0..O........(........(.......(.......(........(........(........(........(........(......*..0...........{.....+..*"..}....*.0..........

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SysInfo.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):85720
                                                  Entropy (8bit):6.104915138626695
                                                  Encrypted:false
                                                  SSDEEP:1536:d0Od8MEo3d9KHJ8CIbBsx1tST5WaS6i2lRsnTC4B7gKxnB3kxsY:d0O7d9CuCINKtg/SpNTLUKi
                                                  MD5:85E0306FE5A6D39C7F453EC1F9AEED9C
                                                  SHA1:31581CAA1160B686A161C296C461182F14E303A4
                                                  SHA-256:35230E1F488252A91FBD0C8D797775CB6F5FB5CA78F9C396AC955F83B14A22AF
                                                  SHA-512:78B3972FDB5C56069B3E5BF9BAD09474911CC47764B055EE1EE7D58E05BBD06B2C912E92FDED41B8CB58DA4391D19EE022B0B4844F8903C43A8C5269634C5845
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 4%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....r^...........!.................2... ...@....... ....................................@..................................2..S....@..H................2...`......p1............................................... ............... ..H............text........ ...................... ..`.rsrc...H....@......................@..@.reloc.......`......................@..B.................2......H...........|............................................................0...........~.......o.....+..*..0..&................s.......s.......s!..........*"..}....*..0...........{.....+..*"..}....*.0...........{.....+..*"..}....*.0...........{.....+..*..(....*"..}....*.0...........{.....+..*"..}....*.0...........{.....+..*..(....*"..}....*.0...........{.....+..*..0............(...+.+..*..(....*"..}....*....0...........{.....+..*"..}....*.0...........{.....+..*..(....*"..}....*

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Utils.SqlLite.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):22744
                                                  Entropy (8bit):6.710292162480259
                                                  Encrypted:false
                                                  SSDEEP:384:MdF99O4KtMO1MAKEFP27xWkVbDWRpUmWWfaAM+o/8E9VF0Nygq:M99ZgdKgKxnVbDLmWdAMxkED
                                                  MD5:B8F7AA3D442D8A6A9267107C9BF56AB8
                                                  SHA1:85CC69E2EBFC875158222F6DD9E74EFBD5FF8F93
                                                  SHA-256:AD2B7A8D731AEF0E1ECFF183CBB011B06DAFE8AB4E6E1375F2FA740B98A87FCE
                                                  SHA-512:6F092D5A30D581152244B5502D7251BB4C2CF62EE278FD16125DB8B35D3D3954832220258A2CD14B91210F8ACB4BC26FC59D2FF40F466C62D51E7F5F48CB6048
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 4%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....r^...........!................N<... ...@....... ...............................7....@..................................;..S....@..P............&...2...`.......:............................................... ............... ..H............text...T.... ...................... ..`.rsrc...P....@....... ..............@..@.reloc.......`.......$..............@..B................0<......H.......p(..P.............................................................~....}.....(.......r...p}.....*..~....}.....(.......r...p.(....}.....*..~....}.....(.........(....}.....*..0...........~....}.....(......re..p...o.....+)..(.......rg..p..(......(....(....(........(......-...........o........o......o.....Yo.......}.....*.......!.8Y.......0...........s.......{....s........s ......o!.....o".......o#...............-..o..................-..o..................-..o........."..

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):108248
                                                  Entropy (8bit):6.046656929478169
                                                  Encrypted:false
                                                  SSDEEP:1536:qfYo/4Aayv+LzzHvfB8xO+pbkbBC70LYsxR42TdgTRWHV8OZkgKxnBr5xn:qQk4AayUfHvUO04bAMYsxfdg415ZNK7
                                                  MD5:77E4FC3552EFD1D3BB39B5DF14180E48
                                                  SHA1:072CA987F73F5D10E8575B40DA433242B1DD46DF
                                                  SHA-256:6F7D247D2EECDBD2ACFD29AE85802C84FBF6CACC3DA6B5B84D4B8FF3BDE74606
                                                  SHA-512:C8EE1D3187BEE0DDE3589AA5987069FD42DE9B0AC7BA95471447F3F3313E6C03F61056E5FC092EA30C676CA2296A9AD909F0EB8C61D0AB5994E30D131178C46D
                                                  Malicious:true
                                                  Yara Hits:
                                                  • Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll, Author: Joe Security
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 4%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...x.wa...........!..0..l..........2.... ........... ....................................@.....................................O....................t...2........................................................... ............... ..H............text...8j... ...l.................. ..`.rsrc................n..............@..@.reloc...............r..............@..B........................H.........................................................................{....*..{....*V.( .....}......}....*...0..<........u......,0(!....{.....{....o"...,.(#....{.....{....o$...+..*. ..'. )UU.Z(!....{....o%...X )UU.Z(#....{....o&...X*....0...........r...p......%..{.....................-.q.............-.&.+.......o'....%..{.....................-.q.............-.&.+.......o'....((...*..{)...*..{*...*V.( .....}).....}*...*...0..<........u......,0(!....{)....{)...o"...,.(#....

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.Service.Logger.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):19160
                                                  Entropy (8bit):6.893535069138558
                                                  Encrypted:false
                                                  SSDEEP:384:T956KoMpkEHEFP27xWkVbDWRpUmWWq7/AM+o/8E9VF0NyZh:T95oX6gKxnVbDLmWj/AMxkEh
                                                  MD5:DBF84E036422C0DC38C2554EEAC2C563
                                                  SHA1:1DC421966B3B84521F487C471E4CF40E796FC74F
                                                  SHA-256:C66FB962D49715DE895840E4CD4A57064E9E868EF37A67936C2C09195093A574
                                                  SHA-512:C41AB9E907D787B84EB2FD4B25043A1AA01690F683D506E895FB24A1451C2B8CD358BC9DDF96091327616228558B6F3DE3DB6649DBC7A2F7683ADFBF10170F13
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 3%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....r^...........!.................-... ...@....... ...............................t....@..................................-..O....@...................2...`......t,............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................-......H........!..|............................................................0............#(....r...p(.....(....t.....s......r...po......o.....s.......o.......o.......o.......o......r...po.......o.......o......o......o.....o ....s!.......o......o......o .....o....~"...o#......o$....*.0............#(....r...p(.....(....t.....s......r...po......o.....s.......o.......o.......o.......o......r...po.......o.......o......o......o.....o ....s!.......o......o......o .....o....~"...o#.....

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WcfService.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):51928
                                                  Entropy (8bit):6.015567831076375
                                                  Encrypted:false
                                                  SSDEEP:768:fzrzeuQ66+qbjHrXAh4RcveQLTilyKEkHgKxnVbDLma7AMxkEL:fQ66+ajj+XeQLTilyKfHgKxnBr7xn
                                                  MD5:FBB243F179EBBE8193891C5E0DE86FF9
                                                  SHA1:00F50696DC69454A13652F15E5B1095D0F23E36E
                                                  SHA-256:B7F9D190E1F58C8B09D98C056F292D4C14A5EF88AB8D69268DCB08B53B374743
                                                  SHA-512:63CE35D951DE1DE94B81500C79D171475504095DAD754CCB948B6AEB494AFA11C679391B87773A9C841BAB098DBA9E19CA5993B13734FB9637D36625002E1BD7
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 3%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....q^.........." ..0.............~.... ........... ....................................@.................................,...O........................2........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................`.......H.......$P...]...........................................................0..@.......r...p.......(..........(....(..............~....ri..p.o........*.........).......0..b..........~.....{.....sT.......o]......@..~....r...p.o....(....o....... ..~....r...p.o....(....o........*.......... !. ........ A. .....0............sx...%.o'...od....%.o)...of....%.o+...oh....%.o-...oj....%.o/...ol....%.o1...on....%.o3...op....%.o5...or...........~....r...p.(....o..........+..*...........st..

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):27864
                                                  Entropy (8bit):6.482265738945267
                                                  Encrypted:false
                                                  SSDEEP:768:2ruIAfU0dOKwbfvXoCugKxnVbDLmW5xAMxkEh5:6xZb3TugKxnB35Zxv
                                                  MD5:3442D7F43B57552DB02DD69C13F6E682
                                                  SHA1:337797E4E458A6BE2B13DD3A8AC4F4B587A28B6B
                                                  SHA-256:3716FFC0F59070BE83C73BC403EFAC9F64BB359144A4278EE027F288DA4962BE
                                                  SHA-512:A5DE3F440B47C256A10A3BF6997955B3510AFF6025C234D216ED7312D1E2AF82B8B613578C8DEC45517D7A4ABB7A8DF33368F10DBAF5C7320A6C9212BE5BD98D
                                                  Malicious:true
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 4%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......^.........."...0.............BL... ...`....@.. ...............................m....@..................................K..O....`..$............:...2...........J............................................... ............... ..H............text...H,... ...................... ..`.rsrc...$....`.......0..............@..@.reloc...............8..............@..B................$L......H........)..4 ...........J...............................................0..k.........}.....(.......~....r...po......(.....~....r?..po....... ..~....rw..p.o....(....o........~....r...po.....*.........+:. ....r.(..........(....(.........*....0..v........~....r...po......~....%-.&~..........s....%.....s....(......{.........,5.~....rE..po......{....o.....~....rm..po.......}.......2...(..........s....}....~....r...po.....r...ps.....~....r...p.o....r)..p( ...o.....s!....~....r=..p

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe.config

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):2379
                                                  Entropy (8bit):4.811294024220937
                                                  Encrypted:false
                                                  SSDEEP:48:cjkJnVUn1YNfN+QscuysXDXgFT05hh1A5Xw:7JVUn1YNfN+QscuFXDwFTa1ug
                                                  MD5:AED25C4BB45D63F367AC309DA2D91716
                                                  SHA1:295F9441CE64D87BC5489F2D5609E7704E302827
                                                  SHA-256:534FF170605C383FA723B662E49DAF7683C560727FD71211B28799C5A6AF11AF
                                                  SHA-512:AD144C6152BD8FABCC89FF502595281298C3857A8F2193F6B391ED7E137FA4B2A9E0FFCCD17C9C4FD5A691407D32339B4348B5FAF260DCDB5D2D0E6A63B5FDDD
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <system.serviceModel>.. <services>.. <service behaviorConfiguration="SearchProtectServiceBehavior".. name="Lavasoft.SearchProtect.WcfService.SerchProtectSearvice1">.. <endpoint address="" binding="wsHttpBinding" contract="Lavasoft.SearchProtect.WcfService.IWCAssistantService" />.. <endpoint address="mex" binding="mexHttpBinding" contract="IMetadataExchange" />.. <host>.. <baseAddresses>.. <add baseAddress="http://localhost:8733/SPServiceLibrary" />.. </baseAddresses>.. </host>.. </service>.. </services>.. <behaviors>.. <serviceBehaviors>.. <behavior name="SearchProtectServiceBehavior">.. <serviceMetadata httpGetEnabled="true" httpsGetEnabled="True"/>.. <serviceDebug includeExceptionDetailInFaults="False"/>.. </behavior>.. </serviceBehaviors>.. </behaviors>.. <diagnostics wmiProviderEnabled="true">..

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.adblocker.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):64216
                                                  Entropy (8bit):6.165713563424136
                                                  Encrypted:false
                                                  SSDEEP:1536:HfYD/0cxUJ1Xu1BDQAMVuPNGTQbgKxnBrRxam:HfYD/05J1XTuPaQ0Kb
                                                  MD5:FC023BB2DC51EE410A64E8F8ED6E38EE
                                                  SHA1:A33BB8361B86083D79EEE5C861DF24CBB7CC3697
                                                  SHA-256:24BC639908655F304AF49512058EA9D77043E9326E3FB88EC5CBA98496FA03FE
                                                  SHA-512:12B5C3D08472BEF5B69BF1724AB1792BA8FB705490F1CCB94F802EFDFC2CDEAE14CC215A1B76CBB572690F66A45C122396BB2C800E3E553AD0179559EA45AA51
                                                  Malicious:true
                                                  Yara Hits:
                                                  • Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.adblocker.dll, Author: Joe Security
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 3%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....}`e...........!..................... ........... ....................... .......-....@.................................H...S.......X................2........................................................... ............... ..H............text........ ...................... ..`.rsrc...X...........................@..@.reloc..............................@..B........................H....... ^...............................................................0...........r...p(.....rK..p.r...p..(......(......r...po......r'..po.......o.....(.....o........ijo......o............io.......o.............s.....o....&r1..p(.....*...0............rU..p(......o ...u:....o!...u<.....o".....s#.... .....>....... ....o$.....r...p(.....+$.....s%.......(&....... ....o$...............-..o......o'.....o(............o)...(.........*...............@.....(*...*.0..0........{......

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\Microsoft.mshtml.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):8020696
                                                  Entropy (8bit):5.079618604604248
                                                  Encrypted:false
                                                  SSDEEP:98304:xpkg8hn8KiyAB84gPjKVuH62NhND7BMe8Ali:xpkg8hn8hStD7BMe8Ali
                                                  MD5:0874CC36EA5EF61AA77C1646B2395364
                                                  SHA1:444D277B3001E7734B2025B78DAD2FD5FC118367
                                                  SHA-256:3B8DAAEA57D531427E97D0D49676C55DD3740D37909F9333C1CAEDB53CF7AEC3
                                                  SHA-512:73FBDE59FA64FF5EA390743A7DE41E2D6560A4D924BCF8DCEB2FB43C721F6BEEBB85BB8BA26A2AF38C968653135537ECBFEA2CB7007B4C52FD762DD2F8771EB7
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 3%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....OR...........!......z.. ........z.. ... z....@. .......................`z.......z...@...................................z.S.... z.x............0z..2...@z...................................................... ............... ..H............text...4.y.. ....z................. ..`.rsrc...x.... z.......z.............@..@.reloc.......@z...... z.............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\MozCompressor.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):67288
                                                  Entropy (8bit):6.502338153383933
                                                  Encrypted:false
                                                  SSDEEP:768:5rBX7I72YM1scqDAntonP1ZlojsSQobxMkgKxnVbDLmW9AMxkE4i:5rd7IkYd3onrgKxnB3VxMi
                                                  MD5:EE10C9257BBBF8EE7D5F33AA1C1993EA
                                                  SHA1:D4B4B791D54A91B11FB56FC8F861FDB083D4DD97
                                                  SHA-256:FF35427ED0FAF0B8DEEEEFAEEABF1969676CF2E511C43CE950A943070CF665DE
                                                  SHA-512:7A9283A8EF556DEFEE301D09C1B7788356612D39DDBBBF612679E2D33755DA876C29494E2DF7378615BBD470E3FFD10B9E2E191693C8650AD6EBF8786D5FDB52
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 3%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........,z..B)..B)..B)z.C(..B)...)..B)z.G(..B)z.F(..B)..B)..B).C(..B)..C)..B)O.G(..B)O.B(..B)O..)..B)O.@(..B)Rich..B)................PE..L...F.KZ...........!.....4..........{B.......P............................... ......0.....@.........................0...d.......x........................2...........Q..T............................R..@............P...............Q..H............text....2.......4.................. ..`.rdata..$....P.......8..............@..@.data...$...........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\NCalc.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):207576
                                                  Entropy (8bit):5.670327506897038
                                                  Encrypted:false
                                                  SSDEEP:3072:22iAvFOaMDARsHHAgJo2MXfFPM5aLo9CRNxbOnDPAtK2:22fgkRaHAgi2Cfu5aLo9CRNVO2
                                                  MD5:D9318ACE386C0701A1FE50D8274D432E
                                                  SHA1:40BDBE1B88160CF7322A47EAD7E94303FCBF70F2
                                                  SHA-256:9CF4C64C4D9DA5B85BCFE84678F4B2C5EBA179C751DD795051B0188136447C59
                                                  SHA-512:6AD5C9D42AE16F7E1F39CF3A2C560A6B3B3BDBD93FA6CB3B544837D74C750B8EF21EBEF8D656749527E9F2254EB6D483E436E0E491A9A7B99ECA8255B42DCE93
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 3%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....bxN........... ................j.... ... ....@.. .......................`......)...........................................L.... ...................2...@......................................................x................ ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................H.......8....f............................................................(....*.0../........(.......s....(......s......r...po......}.....*......0...........{.....8.....*......"..}....*...2.r...ps....z....0..K..........o=...(......(....r]..po....&..o?...(......(....rc..po....&..oA...(.....*......0-............o....(......o......E....................s.......]...G...............1.......9...#...O...e...{...8.....(....ri..po....&8v....(....rs..po....&8`....(....r{..po....&8J....(....r...

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\Newtonsoft.Json.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):438488
                                                  Entropy (8bit):6.099132549128608
                                                  Encrypted:false
                                                  SSDEEP:6144:dHerwzLkqCG3uKWf4g6tUwoOkErUx5/Rsnaszr0tZDPEaN+YB5+GonzM:dHerIacuKUtOkESbKQrvB5+VM
                                                  MD5:A7EF69C6E31C33EDA111374F47D248EE
                                                  SHA1:E20E2B9663D6B92771A915CC09DECAFE661FEDEB
                                                  SHA-256:9A1EDD05B0BC9ACBBFB4A288ACB0D1A64F2D21AC4255CF4818CC079F03F0FAA1
                                                  SHA-512:B5D6025025FB34AE0576C0D6EADDD3557829064FDD8927FDD36C360FB17F1AA1356FB107E7A10D67F2D8FF1BB82932857185EE1CFE156D0C5BC5A0D97A883454
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 3%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....L.R...........!.....t............... ........... ....................................@.....................................K.......8............~...2..........x................................................ ............... ..H............text....s... ...t.................. ..`.rsrc...8............v..............@..@.reloc...............|..............@..B........................H.......h...................X...P ......................................yK.N...f....i5.#I..xV. ..%BR..^.....t0"..z.%./.G'.j....{...2...k)w...'>.c..P..X.......n...h....E...ex..X/H].R.e.{..;&.-.'....{....*"..}....*V.(x.....(......}....*2.{....oy...*2.{....oz...*B..(....&..(....*...0...........oo........YE....}...............}...n...............n.......I...I...I...I...3...I...X...8D....t......{.....or...o{....ow.....+U..o|.....{.....o....oo...o}.....o....o....t.....o....o..

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\System.Data.SQLite.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):291544
                                                  Entropy (8bit):5.943890750111035
                                                  Encrypted:false
                                                  SSDEEP:6144:cjM6Mb15iJrFxrFPs2FNFaFeFOFwcGF6cmFWc0FWc8cIcKcUFJFpcNcHc7cbchFE:cj0h56rtFNFaFeFOFwcGF6cmFWc0FWcw
                                                  MD5:07F66AF9C9C3196BD1CE45EFD2A86829
                                                  SHA1:A3FBDF825E7C2EFAC10F92A7221F2FDC84272327
                                                  SHA-256:17690A9F602B17320D0F2ED9275FD91B56729F9CC5E21A5ECE467E0CD1F2ABF5
                                                  SHA-512:3318D72E778151341CA23AAA4A0990E464BDAF7E16A1244A6E7C453AB6B1C086529DBD48600DBE81FEF481C2AE2760A1973ACE967B16B49749D4B24236D8C9A2
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....*S...........!......... ......~.... ...@....@.. ...............................r....@.................................0...K....@.. ............@...2...`.......-............................................... ............... ..H............text........ ...................... ..`.rsrc... ....@....... ..............@..@.reloc.......`.......0..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\WcCommunication.exe

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):28376
                                                  Entropy (8bit):6.586484312943769
                                                  Encrypted:false
                                                  SSDEEP:384:IEc64QLLoHj/v+r3QL2qLjr3EFP27xWkVbDWRpUmWW8sOAM+o/8E9VF0NyuF:tLLoHj/v+3q/r3gKxnVbDLmW5AMxkE6
                                                  MD5:863811F273175823D7AAFE994611776A
                                                  SHA1:DF1FE42B0CA3B5D3DAC002C99E8E24F73A0DF7A1
                                                  SHA-256:6C860595B29DC88AC3E172A69772415151821CB6BC4562A17E282877CC2F13E7
                                                  SHA-512:1AC339C4B374CFEAB3140F9F0D10CCBC9280079CAC3706A3FF0D9A5DF1AC8A828E52962B52F27EDA1AAB7783A42AE732A8F7C4822D24FF97A75BD0D79C030B24
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 3%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....}`e.................2...........P... ...`....@.. ...............................Q....@..................................O..K....`...............<...2...........N............................................... ............... ..H............text...$0... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............:..............@..B.................P......H........,...!......?....................................................0..n........~......r...pr#..pr5..p(.....~.....o..............-...rQ..po....t.................-..o...................+...*........).!J..........Y`.......0..7........(.........-...(....rg..p(.....+..#(....rg..p(.....+..*..0...........(....r...p(.....+..*....0...........(....r...p(.....+..*....0...........(....r...p(.....+..*....0...........(....r...p(.....+..*....0..t........~......~....r...p.o............

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\WcCommunication.exe.config

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):191
                                                  Entropy (8bit):4.913784939054981
                                                  Encrypted:false
                                                  SSDEEP:3:JLWMNHU8LdgCQcIMOoIRuQVK/FNURAmIRMNHNQAolFNURAmIRMNHjKbo5KWREBAI:JiMVBd1IffVKNC7VNQAofC7V2bopuAWj
                                                  MD5:E0D39F8E6C43896219E316B93EE705EB
                                                  SHA1:B564EA6A5AF48553990D645BF97508D99241B606
                                                  SHA-256:821164AEBAFECD5619DEDF42DA25BD8BA5354E4B9A959FE7002F7289C8D5D4E6
                                                  SHA-512:16DD522A12CDE214F699FA52CD1B19D22BF28078CAFD887B17F42983317CFA8CFEB2241669DC89EEBD1E5FA6E7D7332710BF1B02D5E9C23BAF918A16BBF17BF6
                                                  Malicious:false
                                                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup>.. <supportedRuntime version="v2.0.50727"/>.. <supportedRuntime version="v4.0"/>.. </startup>..</configuration>..

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.Loader.exe

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):19672
                                                  Entropy (8bit):6.943633909963355
                                                  Encrypted:false
                                                  SSDEEP:384:aLXJWcC0/2EFP27xWkVbDWRpUmaWRSe2kAM+o/8E9VF0NyTT8:UXfn/2gKxnVbDLmaWjAMxkEC
                                                  MD5:4C8B24EB611C17039D7E182E66019535
                                                  SHA1:E559BD83C260256C26D7E8147C7D99E47DF56CD1
                                                  SHA-256:AE74D7A96DF99AA8817BAB0261DDA521DDF3D7FD1E1679C0412A6A64F1EF0CBF
                                                  SHA-512:E79BAF611D12E78C47B8CEC151671ACC9B1BBA93C947E98879B92C9420D88D2A1A86B6C17823C6DB6C5DBB15AE62E1F099F2487D12FD32BFE437B078907985B8
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 3%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....}`e............................n/... ...@....@.. ..............................5w....@................................../..S....@...................2...`.......-............................................... ............... ..H............text...t.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................P/......H........"..T............................................................0...........r...p.+..*..0..x.........(....o....s........o.......o.......o.......o......o................-..o..............(......o....r...po...........+..*........+=..........RS........(....*.0...........rS..p.+..*..0..x.........(....o....s........o.......o.......o.......o......o................-..o..............(......o....r...po...........+..*........+=..........RS........(....*.0..b.........~....o....

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):9332952
                                                  Entropy (8bit):4.301063556727778
                                                  Encrypted:false
                                                  SSDEEP:49152:aGPKPkE2TndsAV9hZXzIqaMOFdBrlsmyCkCKiBZ8:aGyd2LdsU/kLMOFnhsfvAa
                                                  MD5:11CE0FC17BFCDCCF929515BD90455BAF
                                                  SHA1:9526E6671F5436CC8A8F7FD3CF053BFFAF6678A1
                                                  SHA-256:CA41975E7FE1AD77957EE0978DB32F9D132305E0A2D8985F9D0AFFA0F425A5C0
                                                  SHA-512:1A2A0BC6BCE933D1A8BDB247A12AFC9389EC4DF787907F221C7F8106423F287CCA67E98CD11563C0F8A9D600355C478A6B8DA1C356400DE74DD7FB738B15A2D3
                                                  Malicious:true
                                                  Yara Hits:
                                                  • Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe, Author: Joe Security
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 4%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....}`e.....................t.......... ........@.. ..............................!.....@.................................8..S........p...........6...2...`...................................................... ............... ..H............text........ ...................... ..`.rsrc....p.......r.................@..@.reloc.......`.......4..............@..B................p......H.......$...........U.........z..........................................0..=..........(......(......-...(.......(.........-...r...p(........+..*....0..r........~....r...p......(....o ......(!........-..(.......~"...o#...s$.......(%......!..~....rQ..p.o&...('....o(........*..........3O.!....V.....()...(*........*..(+...*...0...........(+......~....r...po ....~,....(....oS........-...(......+...(....(......(.......(!.....-....(...+}.......!..~....r...p......(.....o(.........*.

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe.config

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):19299
                                                  Entropy (8bit):4.7882380797092114
                                                  Encrypted:false
                                                  SSDEEP:192:TrBHn854AbwOVpLywKDcZXuK9BcrEPLUv0OUyr+so:T9HKDbwWKgwKz
                                                  MD5:FEED0F743DB90FBC95E33F081B50ACB0
                                                  SHA1:A2CC752167B06ED562C6EC00A4F994D8A59AD7F4
                                                  SHA-256:A1F55FB8A5E389B7727A683B2265C678D903A4F9CB08272AFBD922F41F18D7D2
                                                  SHA-512:5D627768DB6CE3D1A100A6A72E40CA477687E9785EFA9F78C23D375889CA8C748E432F5C25323D22F600768490DA25E7803E804B5B62D2F89696A5C1DB972241
                                                  Malicious:false
                                                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <sectionGroup name="userSettings" type="System.Configuration.UserSettingsGroup, System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089">.. <section name="WebCompanion.UI.Properties.Settings" type="System.Configuration.ClientSettingsSection, System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" allowExeDefinition="MachineToLocalUser" requirePermission="false" />.. <section name="Companion.UI.Properties.Settings" type="System.Configuration.ClientSettingsSection, System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" allowExeDefinition="MachineToLocalUser" requirePermission="false" />.. </sectionGroup>.. <section name="log4net" type="log4net.Config.Log4NetConfigurationSectionHandler, log4net" />.. </configSections>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="Theme" serializeAs="String">..

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanionExtensionIE.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):2142936
                                                  Entropy (8bit):5.676585013396631
                                                  Encrypted:false
                                                  SSDEEP:24576:whSNSyjdKyijXu8i7WS1tZDDNFm/8u8dPDNYk5xIUu98KOsqADu:k0riNCWS1tlNFmmeSq99NfqAi
                                                  MD5:C323846407764C741B23987E7D6FCC46
                                                  SHA1:9AE2F11FEE6AA8EEFA6DDCF73A81995FF17CF920
                                                  SHA-256:50304E2429A42CB70D8D899BA6412221A9B91741443AE36191660CC645CF301D
                                                  SHA-512:C4069C298D64D45FA680DAABB8BAACB858F6328CEAD18A402AB357E8EAC9D7953623ECD1161BF7EF1759A054D46952159F6DEF27DAE51A7397504AA7D36BFDD1
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 3%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................-.#....,...5l....5l......r....,....].,....].-...]............Z...].....Rich..........PE..L....}`e...........!.................P.......................................P-.....O.!...@...........................*......+.......+.Lm............ ..2...@,.h....D&.8...................L/).....@").@.............+..............................textbssy................................text........@...................... ..`.rdata.......0&.....................@..@.data.........*..h..................@....idata..F.....+.....................@..@.tls..........+.....................@....rsrc...Lm....+..n..................@..@.reloc..o....@,......v..............@..B........................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanionIcon.ico

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:MS Windows icon resource - 5 icons, 16x16, 32 bits/pixel, 24x24, 32 bits/pixel
                                                  Category:dropped
                                                  Size (bytes):24337
                                                  Entropy (8bit):4.401590449138391
                                                  Encrypted:false
                                                  SSDEEP:384:Zw3ziy+PnXdyyyyyyTOh3axqTS1mH3dS4w:Zw3zeG3DSG3m
                                                  MD5:1DD04466644E96E0AD308D1E637E9621
                                                  SHA1:0C7F688CA482FCD1FC9AA7D7518A5BC844875CFF
                                                  SHA-256:9733ED5E1E2CAEB0986F1D46A052B2D4BD8CD6B041B9F57216F12410605E8455
                                                  SHA-512:A92FF0A1B92B5B689BFC36A807F02D79B8DC3DD99971B3528AAFCEB8C1FC2DBC67BD170990723B34B26AC4EE7516EFA6B218C2ED1D422A422EDE7CF5FB9A3DA1
                                                  Malicious:false
                                                  Preview:............ .h...V......... ......... .... .....F...00.... ..%............ .{....D..(....... ..... ..........................................................................................................................................................................q...q...p...p...............................................s...o...p.`.p...h.............P.................................r...u...p...p...n.9...A...............................................~.w...o...r.................k...............................0.........p...x.....................#.....................................}...~.............................................K...........................................:...............................................................................h...................................................V.......'...............................................................................................................................W...^...^...^...^...^...^...^...^...^..

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanionIcon_Pro.ico

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:MS Windows icon resource - 5 icons, 16x16, 32 bits/pixel, 24x24, 32 bits/pixel
                                                  Category:dropped
                                                  Size (bytes):25507
                                                  Entropy (8bit):4.77281362097441
                                                  Encrypted:false
                                                  SSDEEP:384:1oj8TMvkKFye5lBIt3ZH6X5HT8hfbzuX98q1Kk:9MM0s3hGHqzueqMk
                                                  MD5:BBD842A6E91D908141DE6FA59D3A9868
                                                  SHA1:3F387A45C09CC3894A6475C711C943EA3F70ED6F
                                                  SHA-256:D5A8246EF2075DAD3B3D582477CF757FE673A3A793EF3DE60DE82BF8581DA19F
                                                  SHA-512:F130188D69710DEBB2BBFB122C0BBBCF21F7356820226B0D8A668BF965B909C8F24DCEB2E75FF98E70ED02115903AC461D10BD3835632BF9D7A325C9610F0A13
                                                  Malicious:false
                                                  Preview:............ .h...V......... ......... .... .....F...00.... ..%............ ......D..(....... ..... ................................................................................................................................................................................................................................................\.....|.........\...5...................................................9...+.........................................T.....y...........................?...............................-...............................y...................................................................O.......................F...........................................!...............................................................`...............c...................................................0.......#.......................................................o...................................................................K...U...^...^...^...^...^...^...^...^...^..

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanionInstaller.exe

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):468184
                                                  Entropy (8bit):6.484197232128888
                                                  Encrypted:false
                                                  SSDEEP:12288:v9FvkzVw/c/gYwx2b619WA1ENpdscZlnzY:XgVw/c/gZAscZlnE
                                                  MD5:4A54D7A825C126DF7F909DFCBAFFD9EA
                                                  SHA1:B0EC3785A9E027B4636469CE7DE9CFC0364D93A5
                                                  SHA-256:224DD756633F4D52D9284639FC73ED0DCEFA92DF857BBD65CA922DA66D7F39C8
                                                  SHA-512:38068ADBD0727CFD873E9F7B17D3BF0459124CBAD6A80372DC5C53EDCEA525EC5DE16168FDD0AAD5BB0F5B4C076917E1765EECAC96F0C4296F6B01A942B32C11
                                                  Malicious:true
                                                  Yara Hits:
                                                  • Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanionInstaller.exe, Author: Joe Security
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 13%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....}`e.................|...t........... ........@.. .......................@............@.....................................S........q...............2... ......p................................................ ............... ..H............text....z... ...|.................. ..`.rsrc....q.......r...~..............@..@.reloc....... ......................@..B........................H.......h....j...........g................................................~....}.....(......s....}......(....}....*br...p.{....(......(9...*.0..j..........{....rk..po....,.(.....+.(......r}..p(......(......r...p.{....o....o.......(........s.........oP.....z*..........UU......6r...p..(9...*.r...p.....*..{....*"..}....*..{....*"..}....*V.(......(......(....*6r...p..(9...*.0..3........(....( ...,..(.....(.....(!.......s^......oP....z*.........!!......6re..p..(9...*...0..M.......

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanionInstaller.exe.config

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):2720
                                                  Entropy (8bit):4.98742519627159
                                                  Encrypted:false
                                                  SSDEEP:48:c5+qM3DmNwAGDo2cCSIn6la86Vr6R841docr7S36Ek+HEkHQB:jV3gUka8arAN3r7s6Ek+HEkH6
                                                  MD5:1103E1618F5BB75851E0F0C753EC8EC5
                                                  SHA1:CBECB3538CAD8585A4B1962098F1B427DC6984B3
                                                  SHA-256:133F4FCE3A299387263F849250CCEE387B137EE3FF36C6B44B4C02328EDFAAF3
                                                  SHA-512:C005F7873896B8B28C228CFC8CB51BF8A0F9BFEF917A6AF5F0FE32DCC7E818FFB48026FD00A13BF30E82A3383765F2500DD709A25806DAA199829991A9FC9725
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ProdSettings" type="System.Configuration.NameValueSectionHandler"/>.. <section name="StagingSettings" type="System.Configuration.NameValueSectionHandler"/>.. </configSections>.. <ProdSettings>.. <add key="Installer" value="https://wcdownloadercdn.lavasoft.com/9.1.0.993/WebCompanionInstaller-9.1.0.993-prod.exe"/>.. <add key="WebProtectionZip" value="https://rt.webcompanion.com/notifications/download/rt/dci/latest/Webprotection.zip"/>.. <add key="InstallerZip" value="http://wcdownloadercdn.lavasoft.com/9.1.0.993/WebCompanion-9.1.0.993-prod.zip"/>.. </ProdSettings>.. <StagingSettings>.. <add key="Installer" value="https://wcdownloader-qa.lavasoft.com/9.1.0.993/WebCompanionInstaller-9.1.0.993-internal.exe"/>.. <add key="WebProtectionZip" value="https://staging-webcompanion.lavasoft.net/dci/3.0.1.9/Webprotection.zip"/>.. <add key="InstallerZip" value="https://wcdownloader

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanionInstaller.pdb

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:MSVC program database ver 7.00, 512*1591 bytes
                                                  Category:dropped
                                                  Size (bytes):814592
                                                  Entropy (8bit):4.528490708053113
                                                  Encrypted:false
                                                  SSDEEP:6144:2LGcw7ZXbXEdW7FxIwp7ZwCkYCp7CMT9sWHdQEPPkdId+lMrwIx1tU:Dcw9XbXEERb6PCHkQaPkw8
                                                  MD5:1AD3305BEF3506CDF611B27FF3EC466E
                                                  SHA1:7CDF154A799CF1B5031E7A6794A5D3E5D73BCAFA
                                                  SHA-256:AD16E6C8EF7F53A94CC5715A9020BB1370D47AB19B3F056E80807E3CEF504CBA
                                                  SHA-512:24409A2FC124F08FAC656FE10138D0BA98134256A3ACE62F648F9611C858DABBB86ADCA0A887479C7E01205942597CF9A1D8120C179FF91C2243D046461DE061
                                                  Malicious:false
                                                  Preview:Microsoft C/C++ MSF 7.00...DS...........7...\.......6...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................8.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebcompaionReimageIcon.ico

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:MS Windows icon resource - 4 icons, 16x16, 32 bits/pixel, 24x24, 32 bits/pixel
                                                  Category:dropped
                                                  Size (bytes):17542
                                                  Entropy (8bit):5.487981305511366
                                                  Encrypted:false
                                                  SSDEEP:384:BdYS3Ocd/mFBeSpTKgxiL6+6W7rdfiV8lER:BS5cdIgSML5gqla
                                                  MD5:9932F44F84F0693AD7D3B7F5E41B5C3F
                                                  SHA1:681EDED9A3F513FE1BC067817A3A5C7CE9277624
                                                  SHA-256:8E10EDC1E341C0B89232811BF8B71CA1A1EEDC8CA78B79432C4AD702591B2DE5
                                                  SHA-512:3E522306ADB5ED30C2E448329B9952AACACA29543CF8152435E2B8ABC85F9E546EE3D7BC96C6EAD9EDC99686102FD6B1488A5C5C2104A7D838EAE47F2AB6912E
                                                  Malicious:false
                                                  Preview:............ .h...F......... ......... .... .....6...00.... ..%......(....... ..... ......................................................4Of.a...Qz..?`..9YC.]...1L...................................%f.i...x..."6...$...3..*F/(u.B3...:....................8W..2N#.)A..........|....&..:Q.....J...M..x.....................{...f.T.Hl..........J_......>O.(...Y...T...........................[.j.u...........L]..EV.+z..&...V...P.............................m........BfL.Tm;.\v>.dp!.Fe=.I...J..FS.......................9..,...2...\~H.nd...|......uq..6..U7...7...ml6...........>..X`..!...-...N{Y.ul..............of./sk............$...p..........3v..v.........Q...:... .~..qh.8yq............@...m..|....FHH._g\......................K;5..`[........}...j......w5>POI.UUQ.r...`...3.......U.........R..a...b.............LA..M?..571.L...W...-...8....Rn./....?SH..h..}H...N.............qa..n^...-$.2...U...;...;...3... `u..2I7.5L.............................&"..&DM.F...X...T...k...H[i%.#A.:Rg.......

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\acs17.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):1155800
                                                  Entropy (8bit):4.990801168164284
                                                  Encrypted:false
                                                  SSDEEP:12288:rcLFGWXuQlDlaMqzegia2lKF2Y52eDzl1DoDzmbPL3:rOGWXu6oMqzeu2l452eDzl1DoDKLL3
                                                  MD5:0FFE4FFD766FFA9D3B0C133D2988AE1E
                                                  SHA1:FD8F4697ED0436C25430A30D08F43E55B21A7AE5
                                                  SHA-256:BDF972AD8CBDF9C001DC625078DD1C9856A77FDBF1C67E4D4298FA4FB74503A4
                                                  SHA-512:5FE879FFB12B9F780EAB22F147719391A008EFAB35C74447425FF220FB7C88EE0C4F25CEF70A40DB755414790EF55C927CAA8814DD63D5D66ABAC674ED84B9A8
                                                  Malicious:true
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 3%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........v...%...%...%...$...%...$...%...$...%...$...%...$...%...%D..%...$...%...$...%..d%...%...$...%Rich...%........PE..d...{.p].........." ................X.....................................................`....................................................d.......<.......D....p...2..........0...8...........................p................................................textbssMH...............................text...1....`...................... ..`.rdata.............................@..@.data................D..............@....pdata...............R..............@..@.idata.../.......0..................@..@.msvcjmcr............N..............@....00cfg...............P..............@..@.rsrc...<............R..............@..@.reloc..W............X..............@..B................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\de-DE\WebCompanion.resources.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):70360
                                                  Entropy (8bit):5.434395456562737
                                                  Encrypted:false
                                                  SSDEEP:1536:tMcLJFVnQNIlEe3AkolQ+c1iJ0ZF3U1gKxnB3xxv:5lEcAkOQ+cAykCKP
                                                  MD5:0D00AEA1A0C99CAFAFCB5089363E3815
                                                  SHA1:31416137CAB4A7AD069CE941CA22BD834C6D1422
                                                  SHA-256:958C4C97914A40378936DD11000D0706D2BBC92623790A05E80B715C53E7D8A2
                                                  SHA-512:661BF1661A7802175B529C3AEE032B2A4A6B68EF3D28F97A2743245F0D5080F20BD0D1E968F9207568FE36FA47A0FFD0908E135957A4557C361E5869F6C4FF23
                                                  Malicious:true
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 3%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....}`e...........!......... ........... ........@.. ....................... .......q....@.................................P...K........................2........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\de-DE\WebCompanionInstaller.resources.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):23256
                                                  Entropy (8bit):6.81617229357187
                                                  Encrypted:false
                                                  SSDEEP:384:VV4qrRdcVt8f2wpLS5wvdVCkLpljoBeRKMukBEFP27xWkVbDWRpUmWWkNAM+o/8y:VaqrLat8f2wpLS5wvdVCwplU88MukBgo
                                                  MD5:622A3812AB9D2C9F433C5FAF01292074
                                                  SHA1:8812F890204B616436C2D1832397923EC935F80E
                                                  SHA-256:57E207661A0A3FDE7D85D692697CC7E42F279A2828EB10C5EE198BCF29681070
                                                  SHA-512:56F1F54A0631918625FD387D04B8222353D5CE63BA5D29C73E76A916574356D67663AF4A6D7AAFC4EA25BB63D0D13827190A0EF69ADDA17BD6A843594330B6E3
                                                  Malicious:true
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 3%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....}`e...........!..... ..........N?... ...@....@.. ..............................~.....@..................................>..S....@...............(...2...`....................................................... ............... ..H............text...T.... ... .................. ..`.rsrc........@......."..............@..@.reloc.......`.......&..............@..B................0?......H........;..d...........P ..C...........................................?..............lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....E.......PADPADPP)6..).......n.....V ..(`5.........]....}........E(/...-.C.... ...#..S.n....xv.|.-.D...................w#(..X:..o.......V...h...................v..-../.x.EZ....1.N...D|-..... ...?.!..v"..v"..v"..v"..."...'vAw(...2c$Q:

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\en-US\WebCompanion.resources.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):70360
                                                  Entropy (8bit):5.396990834833947
                                                  Encrypted:false
                                                  SSDEEP:768:ZwA5BhdiFMxs54sun8CoJOjrdPh27a6ocsTcqom7nQ51KolYLY7rukYM81i/v0Ro:qcJjoXz4VRPFjUegKxnB3Yxv
                                                  MD5:F4914DF42F6FA61CAE2A5F5B28ADC5C8
                                                  SHA1:6066B27701E56BD1352568A00D97D38FEF151DB0
                                                  SHA-256:0EF0DF9424BF4A7B61C04EF946B229DE34D84FA718202CA26D50844D41BFC7B2
                                                  SHA-512:220363849BE32D58FBEC90D08ACF9A3576DF858B220A1CA6A86A8C9736027A2CE0758015DF11B5DC476806B111D466B535D17B76C68391C3BB5C210D23DC307D
                                                  Malicious:true
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 3%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....}`e...........!......... ......n.... ........@.. ....................... ......6.....@................................. ...K........................2........................................................... ............... ..H............text...t.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\en-US\WebCompanionInstaller.resources.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):22232
                                                  Entropy (8bit):6.855853585833314
                                                  Encrypted:false
                                                  SSDEEP:384:V4yy+cVgVxrQlCRLw4FvgVKRTuE4EFP27xWkVbDWRpUmWWWDAM+o/8E9VF0NyIYC:ayy+agVxrQlCRLw4FIyuE4gKxnVbDLmJ
                                                  MD5:EBD2CE82EAB1F14153ED0CAF715B9FAB
                                                  SHA1:3445025CEC9AC428B08C4762115E9888D4E0D640
                                                  SHA-256:2BCEF6B867471FE88D4FD0896E523AECE6DEDB02781B352247A684965D56796B
                                                  SHA-512:201BB1538860099525E5F1EDBFC0A253D9552CEE99F858EFAB418A072495D8D911104AF046B121A508BEC37A5C2CB7FAA9EC1C7AE51BB7256747211E58C0A3EE
                                                  Malicious:true
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 3%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....}`e...........!.................;... ...@....@.. ..............................O.....@.................................T;..W....@...............$...2...`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................;......H........7..d...........P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....C.......PADPADPP)6..).......n.....V ..(`5.........]....}........E(/...-.C.... ...#..S.n....xv.|.-.D...................w#(..X:..o.......V...h...............v..-../.x.EZ..N...D|-..... ...?.!..v"..v"..v"..v"..."...'vAw(...2c$Q:#Uv=..C?

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\es-ES\WebCompanion.resources.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):70360
                                                  Entropy (8bit):5.3736485691944065
                                                  Encrypted:false
                                                  SSDEEP:1536:iFNsX1Irj+9zewWdYzydz+ChJ1b7HO6mmCY2mF4FbUAgKxnB3Ux2:cyCKIpKB
                                                  MD5:82D351ABB86B4BF1850125175BA1EB94
                                                  SHA1:9622FF593DBAE95FD2B6E783719812577C7238A8
                                                  SHA-256:330B7D3D849EA4BAE8E52392B3A90B78482C508DEE1950600FA8DEED89B9EF5A
                                                  SHA-512:54A657872DB5C6B377B143C8DD6FE0EC1FB9A89F15C736F9A5D802C13571D110E1022802D14E1701B66BDBAD385295BAE2E8076D455FA7249993575703C11107
                                                  Malicious:true
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 3%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....}`e...........!......... ......^.... ........@.. ....................... ......].....@.....................................S........................2........................................................... ............... ..H............text...d.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\es-ES\WebCompanionInstaller.resources.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):23256
                                                  Entropy (8bit):6.774373547894112
                                                  Encrypted:false
                                                  SSDEEP:384:y4qrRdcVkvZYS7hKMwa8XUAzPpY5uxHEFP27xWkVbDWRpUmaWcSkqmAM+o/8E9V6:PqrLakvZYS7hKMwa8XUuPpwuxHgKxnVc
                                                  MD5:8EBE467D4D518913B034C167DACB9ABA
                                                  SHA1:A10B923D6B470E01C71738E534BDDA1D9EEE69F1
                                                  SHA-256:72A2D107F0AE1D58DABB097C332E1DC17747ADF395A4EBBB1BA0A592E8B5658C
                                                  SHA-512:FBB37E0F4EC82F82BD2880F726505AEE6C857186C872D906E9A9E3B8608BBB2DC22786222CACAAFD3F298D0E0A739D3D87746076FE1956485C4185AA8D6FACEB
                                                  Malicious:true
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 3%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....}`e...........!..... ..........>>... ...@....@.. ..............................#t....@..................................=..K....@...............(...2...`....................................................... ............... ..H............text...D.... ... .................. ..`.rsrc........@......."..............@..@.reloc.......`.......&..............@..B................ >......H........:..d...........P ..<...........................................8..............lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....E.......PADPADPP)6..).......n.....V ..(`5.........]....}........E(/...-.C.... ...#..S.n....xv.|.-.D...................w#(..X:..o.......V...h...................v..-../.x.EZ....1.N...D|-..... ...?.!..v"..v"..v"..v"..."...'vAw(...2c$Q:

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\fr-CA\WebCompanion.resources.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):70360
                                                  Entropy (8bit):5.476784824510849
                                                  Encrypted:false
                                                  SSDEEP:1536:/UewfIiZCYrZq+YNFMoFdUEgKxnBry0xY+:KBZCYrMnNF9WtKE+
                                                  MD5:2E35ED9C32267E24A567E1B2AC4D6700
                                                  SHA1:4E6266E4CA52B5D8BBCB24377A01F5B0D054DEB6
                                                  SHA-256:3C23520AB1A50303435F94512B1C1CAE9757090C876C00BE3D675B3CE75F8602
                                                  SHA-512:9CB068E18C55EC3E35FEDF1257E0A91750C05B3814541A920029DC7141BAC7C94833911C492B0FF911D83F07A29213930131D74993DAC978A1C769E43D777AFA
                                                  Malicious:true
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 3%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....}`e...........!......... ......n.... ........@.. ....................... ......x:....@.....................................W........................2........................................................... ............... ..H............text...t.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\fr-CA\WebCompanionInstaller.resources.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):23256
                                                  Entropy (8bit):6.815121956939367
                                                  Encrypted:false
                                                  SSDEEP:384:C4qrRdcVRVQBHQX7SwUHZg6sj0uVREFP27xWkVbDWRpUmWWFRLjAM+o/8E9VF0N/:/qrLaRVQBHQX7SwUHvi0uVRgKxnVbDLj
                                                  MD5:6E6CF3659F8160778F7FDBE7E691B77C
                                                  SHA1:1D31E6A389486F13DDB9BDBA4C7B2E7E3EECBD8C
                                                  SHA-256:D396249B26D957F81A67640A94DCF3EC38B1567EC3F856717BF952AF5ED61234
                                                  SHA-512:E66243D30E33ABD533741B21F44FD238F5D2C28C978136440E746D5639A8B60414240E13B807A5775FC826CAC48067A1482F7C400B5973DBB5DB5CE2C54CAB2A
                                                  Malicious:true
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 5%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....}`e...........!..... ...........?... ...@....@.. ..............................+[....@..................................>..W....@...............(...2...`....................................................... ............... ..H............text...4.... ... .................. ..`.rsrc........@......."..............@..@.reloc.......`.......&..............@..B.................?......H.......p;..d...........P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....E.......PADPADPP)6..).......n.....V ..(`5.........]....}........E(/...-.C.... ...#..S.n....xv.|.-.D...................w#(..X:..o.......V...h...................v..-../.x.EZ....1.N...D|-..... ...?.!..v"..v"..v"..v"..."...'vAw(...2c$Q:

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\it-IT\WebCompanion.resources.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):53976
                                                  Entropy (8bit):5.289237421777621
                                                  Encrypted:false
                                                  SSDEEP:1536:r2lxNleRvZwZsUUUHNxpF8Un5KgKxnBrVoxc:yeRvysNeNFN5KX
                                                  MD5:6ED2F9C7B51A5118BCF0B40B378F7F57
                                                  SHA1:9D2ABF1B8D26E5547B3FDC332043285C5993498C
                                                  SHA-256:15B388B7B17706593D796A9DF7C963A0935CCA79FE91477A6E9F57E79EB9017B
                                                  SHA-512:6A1FF450F677B0291B9AF1C0DB8DB7785490BF8688F7211E405F82AE0E40DE3B6B68B5870140B0BD272B270A03A4ADE90071820EF9E04DDDDFD311A7F245484B
                                                  Malicious:true
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 3%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....}`e...........!.....p... ........... ........@.. ...................................@.................................T...W........................2........................................................... ............... ..H............text....e... ...p.................. ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\it-IT\WebCompanionInstaller.resources.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):20696
                                                  Entropy (8bit):6.876306618838897
                                                  Encrypted:false
                                                  SSDEEP:384:DipngXcq9ePTTuHsEFP27xWkVbDWRpUmaW71WXTAM+o/8E9VF0Ny+NJk:DipngXcq9ePTTuHsgKxnVbDLma3DAMxB
                                                  MD5:F8F1730D80211E96BD0C3538DE34900A
                                                  SHA1:B36F016065478A42CD9AFFB125E9497A645CCBF8
                                                  SHA-256:C07EEECC8EF58D7E11BBB6CAD8D89F5BF17B54A4DAABAC3544CDB139B43B1B93
                                                  SHA-512:E5A0F3C182FD144462305EB0BE4EB05AD682482AAD729119925E9A8877C6F478E577128CE3185D3BCEAE5C899C87B973AF58D1CB91DA9A14935C3C6E838226BC
                                                  Malicious:true
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 3%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....}`e...........!................^4... ...@....@.. ...............................h....@..................................4..W....@...................2...`....................................................... ............... ..H............text...d.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................@4......H........0..d...........P ..O...........................................K..............lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....+.......PADPADPP)6..).........V ......]....}..........-.C.... ...#..S.n....xv.|.-..X:.....V...h...................v..-....1.D|-.. ...?.!..."vAw(...2..C?.9.W.F.^:1;j...p..cv..~...~[...............7...L...2.......................".......

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\ja-JP\WebCompanion.resources.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):53976
                                                  Entropy (8bit):5.4331917192917745
                                                  Encrypted:false
                                                  SSDEEP:768:C34u+ZyqauI647SbFIlBv5v2xAoq7HHj8XnGZqHnamyr1MhuFn6RbFJDw8M9uiqH:CIsWxOGo8MqjN3LFLUXgKxnB39Nxw
                                                  MD5:C31118E85C2B1013CA9D308D568B6530
                                                  SHA1:73A78DBAE4FECFACA3A9FC71CD4F83944FA2E4D1
                                                  SHA-256:2562BA5BACFC45DEE92A6EF7CC59C2B1E5E32F2FB9A0BFEFCE74F059332E4168
                                                  SHA-512:1AA5D614F149B0D75EC5753DB711F0A5E9F89D1D44F23C5D9056B60F44D1FFF22313195B059232A54926B0FD7D3E62354D2A52A6BE5DEC12E8AEEEF9468AB655
                                                  Malicious:true
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 3%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....}`e...........!.....p... ........... ........@.. ...............................\....@....................................W........................2........................................................... ............... ..H............text...$a... ...p.................. ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\ja-JP\WebCompanionInstaller.resources.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):21208
                                                  Entropy (8bit):6.997260664550426
                                                  Encrypted:false
                                                  SSDEEP:384:ji04koE4Z3v5suBtEFP27xWkVbDWRpUmaWIz3AM+o/8E9VF0Nyyw0:ji04koE4v5suBtgKxnVbDLma5zAMxkEk
                                                  MD5:A0D5255B69DFEB6F0097088A6A848DB9
                                                  SHA1:D8945A27708FECD1704B9D6CDD952E9F1BC931CF
                                                  SHA-256:01BE9779D059621E00D2B1BF58735309F63000A9F87544F55165090DF9712B7D
                                                  SHA-512:498E899451E7232E68CFE1092E93B96AFC311F903DE759B7CDF35FB1B0A918007A041933047FEBBEE95F6155972C67E27B7057CABB0D8CDDB21B767A5EF64FC4
                                                  Malicious:true
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 3%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....}`e...........!.................6... ...@....@.. ..............................#.....@.................................86..S....@............... ...2...`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................p6......H........2..d...........P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....+.......PADPADPP)6..).........V ......]....}..........-.C.... ...#..S.n....xv.|.-..X:.....V...h...................v..-....1.D|-.. ...?.!..."vAw(...2..C?.9.W.F.^:1;j...p..cv..~...~[...............7...L...2.......................".......

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\liblz4.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
                                                  Category:dropped
                                                  Size (bytes):136928
                                                  Entropy (8bit):6.4414869302047135
                                                  Encrypted:false
                                                  SSDEEP:3072:VcAPIq7L/iB8HVC4Gom8luKyldZsKI4jiK/:+APIq7Lc8By88Hfj7/
                                                  MD5:30E66E2CBD4BDC29CBCFB45945E79603
                                                  SHA1:2F6109603A7A78074CF7DD6E87DFD90FEA8A39E1
                                                  SHA-256:901F2A3A4F3A1FB18F9DAECD6CE0FC5528B5CD1365BAFB1E5BCB2B8A5D1AD398
                                                  SHA-512:847DBFAEB547D43B711B1067661A646A145D052A0D48BC04B38DD80E8CE0329830CA50464D0C488CB1783F9FF2B5168B78DA28CDCA1473B728B790DC1A59BB4B
                                                  Malicious:true
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 3%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..../.Y...........#.....l..........`..............f......................... ................ ..........................................................2..............................................................l............................text....k.......l..................`.P`.data................p..............@.0..rdata..D............r..............@.`@.eh_fram<........ ...x..............@.0@.bss....t.............................0..edata..............................@.0@.idata..............................@.0..CRT................................@.0..tls.... ...........................@.0..reloc..............................@.0B................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\log4net.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):324312
                                                  Entropy (8bit):5.630837028313251
                                                  Encrypted:false
                                                  SSDEEP:3072:Uqc3k4mtsi40XigRvjAIg8J911rTJZq4+wYxEwKbEAfKQPL5ds6vOn7GGkXnEc1c:g3CX1AIg8JRfJYmYxEwna5dY5xr
                                                  MD5:B16A26AE4D964B555BFD602DF4B23185
                                                  SHA1:F062C42736C349032292732906847E348B665DD4
                                                  SHA-256:87253E71732F747E3B44744AFA087669B9BAA851DA88CA637994B905E0A02AB1
                                                  SHA-512:2E1A9983E92FAC56AE81CC3911E7499AB56989DF01B0D32A5DA92251B3136F09EECE23029E294FC5D27B435B25D32066C3600F5D4767FA6EA3BA8658B93E847B
                                                  Malicious:true
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 3%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....R...........!......... ......>.... ........@.. ...............................q....@....................................W........................2........................................................... ............... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\pt-BR\WebCompanion.resources.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):58072
                                                  Entropy (8bit):5.389809749618498
                                                  Encrypted:false
                                                  SSDEEP:768:qwSqPFFDWXWp48MttaDLllroVyutp5hpu0YjVjTZHixA23CFIjYnWM0Eq4olPTO7:qRJ5XRpnC8UoFyUAgKxnB3wxCRl
                                                  MD5:B48559F2350F2D9622F90709D3960BAD
                                                  SHA1:2E7CB0413C2E029BA22B06EEDA1A3601F14AD96D
                                                  SHA-256:222CF9A2720E9FC6B3CA6B121848780B0C38A9BB4DBF28FDF0A0532E67BED186
                                                  SHA-512:6B6D12EAD284849A3F42981494D83AEED0215740E9981FBFD45A1673A9FAAC7EC2D2B6F72F3EDF2825F8796D338BE0A3A6BB330CE71C6F29A77ECE691DA52576
                                                  Malicious:true
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 4%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....}`e...........!......... ........... ........@.. ....................................@.................................h...S........................2........................................................... ............... ..H............text....w... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\pt-BR\WebCompanionInstaller.resources.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):21720
                                                  Entropy (8bit):6.868930787686632
                                                  Encrypted:false
                                                  SSDEEP:384:8lmcDiBsX8inGf6o8uTsKEFP27xWkVbDWRpUmWW9aZoyAM+o/8E9VF0Ny15:omcDiBsX8inGf6o8uTtgKxnVbDLmWdAC
                                                  MD5:E20AAE5D6632F939642BEE19B1E0EC77
                                                  SHA1:7F8B0C5041D61D89E2FD753B4FDD01450729D90C
                                                  SHA-256:E0CC89AA6CEF04E2DABA10DA4E08876C7605A770C1F0B49424A7106FA433C945
                                                  SHA-512:08495090398956D3C89E5481DD6FBFD91D25F712B50D0DDF1EE293EEFBBCA474038FD501ACADB12770ED017FC2C4DA212CCD0652BB3909D6E6E6E05CCDBE77EA
                                                  Malicious:true
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 3%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....}`e...........!.................8... ...@....@.. ....................................@..................................8..W....@..............."...2...`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`....... ..............@..B.................8......H.......05..d...........P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....7.......PADPADPP)6..).......n.....V ..(`5.....]....}........E(/...-.C.... ...#..S.n....xv.|.-..X:..o.....V...h...................v..-../.x...1.D|-..... ...?.!..."...'vAw(...2c$Q:..C?.9.W*..Y`..[.F.^:1;j...pg.Jq..cv...w..~...~u.......

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\ru-RU\WebCompanion.resources.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):70360
                                                  Entropy (8bit):5.386484108115269
                                                  Encrypted:false
                                                  SSDEEP:768:HOa9m+kM04KCP4MN94KTl524mkx+Mo+NKpvqkuoeZ60CTKWfdH2Jxq+CAsP95DzB:HPcexNGPnB1j12UAbPFGUVgKxnBre4xq
                                                  MD5:85D1458464D66E91FA3F80468B0CED56
                                                  SHA1:3487228A1D6A56661FD21719495DE7E28F15FE9E
                                                  SHA-256:AFAAA9F8E925E97C5795AA23E356EC34F342EB5C5078FFE398A737AE03E51874
                                                  SHA-512:8E81D0E3E324DE263CC8BBEE411607539C5F8BC0440ADEE059A994A52615CE051918DCD3E62C5F51064789B4EA7DEB6FF374C9E10BDB613D43AE542C0E095F7A
                                                  Malicious:true
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 3%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....}`e...........!......... ........... ........@.. ....................... ............@.................................P...K........................2........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\ru-RU\WebCompanionInstaller.resources.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):23256
                                                  Entropy (8bit):6.920099084869181
                                                  Encrypted:false
                                                  SSDEEP:384:UlmcDiBGp+oLfntalaIip8j1g48u8JEFP27xWkVbDWRpUmWWu06AM+o/8E9VF0Nn:gmcDiBGp+oLfnt6aIig1gzu8JgKxnVbi
                                                  MD5:E7BB5A05AC635B9E619242E46E8E95B6
                                                  SHA1:FD45D0AC04EE7F313FABD7F7765FC008FED9A151
                                                  SHA-256:FF516EED3FCF0FA3AA01DFF426B325B2196E5EE29B82732730AC5ED3DF88D99E
                                                  SHA-512:9780BF4B834C7B86E77D69346B89B9FE08CBA98F5D3C963D4A881ED20B240E1419BB190295453D2ED9CA55A9E85DFA336BB6A69AC02BE40B71086A4D15296538
                                                  Malicious:true
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 3%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....}`e...........!..... ...........?... ...@....@.. ...............................>....@.................................`?..K....@...............(...2...`....................................................... ............... ..H............text........ ... .................. ..`.rsrc........@......."..............@..@.reloc.......`.......&..............@..B.................?......H........;..d...........P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....7.......PADPADPP)6..).......n.....V ..(`5.....]....}........E(/...-.C.... ...#..S.n....xv.|.-..X:..o.....V...h...................v..-../.x...1.D|-..... ...?.!..."...'vAw(...2c$Q:..C?.9.W*..Y`..[.F.^:1;j...pg.Jq..cv...w..~...~u.......

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\tr-TR\WebCompanion.resources.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):49880
                                                  Entropy (8bit):5.3964457200947
                                                  Encrypted:false
                                                  SSDEEP:768:934u+2zdcH4J4cbLkfbFvalCQkcvvpGghZmE7E4YPiIl1P1jv1dx7lQGARKRnQJB:9IZYkvsKqReFBUqgKxnBr6xNn
                                                  MD5:068E3CAD96A0A22BC41DB2A359E78011
                                                  SHA1:7690F6D5A3321EAFA1B3F23EB480518E0B47627E
                                                  SHA-256:62D28766204A2E6F6CCEAA2EE60F3490FECFDA84EF2D083FAAA2A80260B65154
                                                  SHA-512:8EBF48C1A85137C9E86C902956225B185F0616E6B31E3C796B8AF065D48FFFE81AA3D400180EA360B390C18E89F6541FF0292D1ACC1607017878649D4B4212E1
                                                  Malicious:true
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 3%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....}`e...........!.....`... .......w... ........@.. ....................................@..................................v..W........................2........................................................... ............... ..H............text....W... ...`.................. ..`.rsrc................p..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\tr-TR\WebCompanionInstaller.resources.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):20696
                                                  Entropy (8bit):6.974305548496526
                                                  Encrypted:false
                                                  SSDEEP:384:+iAta8UHpTuuOEFP27xWkVbDWRpUmWWZTAM+o/8E9VF0Nyv7:+iAtahHduuOgKxnVbDLmWmAMxkEt
                                                  MD5:868A04E480DCB4EC86BC4C0E2F4DA91B
                                                  SHA1:E02BF86E0F58E34BACAF9711BE0DE64E40E061B8
                                                  SHA-256:A2701DEDFDB54D5DDA841E9E65E4CD65DE04719FC9B2EB18022D3001636079A9
                                                  SHA-512:4C1EA6D0AD6B1CA73B4FF5A43BBB91DB71C65344609799C84D6DA505236FCA890133CED9698F66801E46B40E6C45BCA98F2428B3A44E0AF8BA04329977A4DA7E
                                                  Malicious:true
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 3%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....}`e...........!................N5... ...@....@.. ...............................[....@..................................5..K....@...................2...`....................................................... ............... ..H............text...T.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................05......H........1..d...........P ..I...........................................E..............lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....+.......PADPADPP)6..).........V ......]....}..........-.C.... ...#..S.n....xv.|.-..X:.....V...h...................v..-....1.D|-.. ...?.!..."vAw(...2..C?.9.W.F.^:1;j...p..cv..~...~[...............7...L...2.......................".......

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\ucrtbased.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):1660120
                                                  Entropy (8bit):6.562011467084029
                                                  Encrypted:false
                                                  SSDEEP:24576:FoYsYW6Fixna2BNy4ra7hsXZPa1P0i6Q6335lL3BhdJXmNZqByzYZ4t8:yYWxla5P0i6DHXLv7Z4e
                                                  MD5:E5AE5858FFED12C8C4A9AD7CDD7EC5F6
                                                  SHA1:3AD8558EEEE024946568EE151DEB2808CE09A009
                                                  SHA-256:76B653F121FD64FA3E98E891A8C815A585A767F9D98701F68F7B2971C35AD01F
                                                  SHA-512:C77E43A5D0FD786AF7F13C7005F6BD33274B18F1D5C4DED45A5C12610AAEE61BA9DE12080CDA9F8ABE934CF16DA572D62F69B40CDC530A47B9C349A2051DEE24
                                                  Malicious:true
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 4%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k.N.............r-.........y...C.P.....C.O.....C.M.....C.I.....C.L.....C.S.....C.N.....Rich............PE..L...P.!U...........!......... ...............@.......................................j....@A......................................................."...2......<...p...................................@............................................text....,.......................... ..`.data....P...@..."...2..............@....idata..d............T..............@..@.rsrc................j..............@..@.reloc..<............p..............@..B................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\vcruntime140d.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):108760
                                                  Entropy (8bit):6.609506158805602
                                                  Encrypted:false
                                                  SSDEEP:3072:TCLsZSFMEPCl5ikSF+GbTib1iecberxAKdy:TDEPCl55E+GbTib1iecbe3dy
                                                  MD5:3FFF11E5A8E31C1EFA99E98E26DA72F6
                                                  SHA1:CB93C866D51E9FC823CE36B7AD9DAED651384647
                                                  SHA-256:1069F6B46391383228C4688E969AED8BC0F10F2BBBF73A9F57164A9378847F11
                                                  SHA-512:A28E5882E04215BA863025B3EF5F71D708C3EBECB600791E7C9B598859B6BED97F422E38A4FD6A936C000C91966DAC837751F82AA36AD0BF27DB4120EA3B2794
                                                  Malicious:true
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 3%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................+.....tm.........................................................Rich............PE..L...qKZW.........."!.....R...&.......K.......p............................................@A........................@X..........<....................v...2......d....$..T...........................h$..@............................................text...UQ.......R.................. ..`.data...<....p.......V..............@....idata...............X..............@..@_RDATA...............^..............@..@.rsrc................`..............@..@.reloc..d............f..............@..B........................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\x64\SQLite.Interop.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):1137880
                                                  Entropy (8bit):6.585923204543214
                                                  Encrypted:false
                                                  SSDEEP:24576:u1smp+W5MPcaLeaO0PWRgBidFqXlNFwfn6:wsiaBO0PWOB
                                                  MD5:EA1C8AA002182C46D290F4EB11686104
                                                  SHA1:B03CD7BDB72F58BCC2795E7595920E5C7DE38843
                                                  SHA-256:C468569A352D079895F24B3603BDE5B4C548314C4997A2926AB87AE4BCBB9032
                                                  SHA-512:3514987BFD0197B4F249C7C35D6941FBF6EB4031B485218D304B6BA2B13F3A6069CF89ABCE4A0B67D93119742041D9D80F8729EF536CE8DCF76C018CD02DC524
                                                  Malicious:true
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 3%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................m.....j.8...|............0...`.....{.....}.....x....Rich...................PE..d...G.*S.........." .....l..........h'....................................................@..............................................#..$...<....p.......P.......*...2......X...p................................................................................text....j.......l.................. ..`.rdata...Q.......R...p..............@..@.data...Xe.......@..................@....pdata.......P......................@..@text................................@.. data.....;...0...<..................@..@.rsrc........p......................@..@.reloc..............................@..B................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\x86\SQLite.Interop.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):844504
                                                  Entropy (8bit):6.862492571652191
                                                  Encrypted:false
                                                  SSDEEP:12288:Lr9shsglMJF15Yj43MNB2Yldq3+ZeW45+6/rcxJ9RmlJDs9GJk:n9VRJF15Yc3SgN+4z/UYkgk
                                                  MD5:BEE886BBE490BA09680DE9A3F478F1A0
                                                  SHA1:BFF796A4643FB66D97E348549E38A33C40B698B4
                                                  SHA-256:9340CE95583B8F8275F773672934B5D451C712D765B388E69A243BEB01AE8F8E
                                                  SHA-512:E306811BF9A0B42252F8F9C2E83BF66CBA0A6A7EA14409F79713C04E49465EEEC6DF42A27757D7166FF6CD7951AAC73BD9B244B930F321E99326B31065FA2989
                                                  Malicious:true
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 3%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......C..=..~n..~n..~n...n&.~n...n;.~n...ny.~n U.n..~n...n..~n...n..~n...n..~n...n..~n...n..~nRich..~n................PE..L.....*S...........!.....j...B.......%...............................................w....@..............................#..D...<........................2.......E..@...................................@............................................text.../h.......j.................. ..`.rdata..i............n..............@..@.data....G...P...(...0..............@....rsrc................X..............@..@.reloc...L.......N...b..............@..B........................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\zh-CHS\WebCompanionInstaller.resources.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):20184
                                                  Entropy (8bit):7.041817018257667
                                                  Encrypted:false
                                                  SSDEEP:384:iipxl8UU5qmlG9C6ud3EFP27xWkVbDWRpUmaWstUlAM+o/8E9VF0NyqSG1:iipxlhU7Gnud3gKxnVbDLmaIlAMxkENS
                                                  MD5:1D8076583BCFEE39FEB4420C2A84279D
                                                  SHA1:737DCA3C4029888C4E23319B6ADC03BB8771DBED
                                                  SHA-256:F82D5BF9FE50F17BD2D5E5C54B2F218941C74A15F1BEC53951BB96BC129FE9E5
                                                  SHA-512:044D827B3FB2C73A18FCEE30E84F48C2112E44377B9F58C2DEE4FD3E867F75CCF38DA04850633B5B5373790DEDD12C6E61353684CB2D0B57483AA23621320923
                                                  Malicious:true
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 3%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....}`e...........!.................2... ...@....@.. ...............................V....@.................................H2..S....@...................2...`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................2......H...........d...........P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....+.......PADPADPP)6..).........V ......]....}..........-.C.... ...#..S.n....xv.|.-..X:.....V...h...................v..-....1.D|-.. ...?.!..."vAw(...2..C?.9.W.F.^:1;j...p..cv..~...~[...............7...L...2.......................".......

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Application\zh-Hans\WebCompanion.resources.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):45784
                                                  Entropy (8bit):5.707169107371146
                                                  Encrypted:false
                                                  SSDEEP:768:p34u+22ObKL140MIlNZYdodClPGK4VNFKnW9mGc0YW281gsveCfzzjZQ0AMcQjr9:pI2jlwJf1L3nSFNUCgKxnBrntoxr
                                                  MD5:F4C84C8F3B120814D9DC1C02A2D96D5A
                                                  SHA1:F8D18DE1CCF3C8DF703AB6A9705DB7EF77FF2CED
                                                  SHA-256:97DA8558839ACCA438CA0872D8EDDA4B865B9AD4185107E0748CACC387BE1D77
                                                  SHA-512:9093FBD18D6B14A632AB7BA2E152D14EFB4C1732A530590553AECD7F52B94CDD02791DA79EBCC1169CCF6E84599F33E4300EAED96F3A2DB14334B3EED95BFC42
                                                  Malicious:true
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 3%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....}`e...........!.....P... ......>n... ........@.. ...............................}....@..................................m..S........................2........................................................... ............... ..H............text...DN... ...P.................. ..`.rsrc................`..............@..@.reloc...............p..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\BDUpdateServiceCom.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):2894880
                                                  Entropy (8bit):6.916983268484326
                                                  Encrypted:false
                                                  SSDEEP:49152:xMvNfLq1cigqIm9ePTdekCxjGJHzWOsWCP1IYkTzvNr/9qQHi:xMvNlAIm9W8k4jGJ5+IYod/O
                                                  MD5:9C1F9B983C05AFE7B8AE10FDE86B943B
                                                  SHA1:6CB69D90412940B880E48A5A19F86EC313F5643B
                                                  SHA-256:8550F954363A1E0037BA4D9103CB849D9183444FD8500BFC085FFD67024281E8
                                                  SHA-512:D82B418A3AA4ED2BE454285CB54B7204A9E5E5C8AD36858FAFB1ACD7EB682896EEC10C34DCB1011419597432305120BDD7136708DAFE481AA6E0B4403BCBA1E7
                                                  Malicious:true
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                  Preview:MZ......................@...................................X...........!..L.!This program cannot be run in DOS mode....$........tU.D.;.D.;.D.;.P~8.K.;.P~>...;."z.I.;..`?.U.;..`8.\.;.P~?.Q.;.P~:.R.;.P~=.F.;..`>.u.;.D.;.Q.;..|?...;.D.:...;.Mm..G.;..`2.H.;..|?.N.;..|>.y.;..`>.A.;..`?.F.;..`;.E.;..`.E.;.D...E.;..`9.E.;.RichD.;.................PE..L...Z..a...........!......!..........j.......0!..............................p1......^,...@.........................P.).|.....)......./...............+. @..../..s..`.).p............................).@............0!..............................text...&.!.......!................. ..`.orpc...E.... !.......!............. ..`.rdata.......0!.......!.............@..@.data... .....*..z....).............@....rsrc........./......^*.............@..@.reloc...s..../..t...x*.............@..B........................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\DCIService.exe

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):2851544
                                                  Entropy (8bit):6.737661925597467
                                                  Encrypted:false
                                                  SSDEEP:49152:tpQrtwNHHtM/0df81P3y15MSX/OYFMbGLh31EDjqkkOvKtPOL8dKW5X5AXQJO:U+M6uP3y1+SX/fqGV31YjqxQKUL87c
                                                  MD5:A28E6C9C07D6377DEE0696BFB5561C77
                                                  SHA1:484616A7A6C26F3A0C9B5F983CB94232DCCBE0AF
                                                  SHA-256:CD339535745BF3BF7419F901AACAEEBDF8BDE902AC17718CCB9F8EA84154248F
                                                  SHA-512:99F77BC6DC1BDA7F52625F7FBC3C3DEC9EA721F43D60F4F1A5E5B6D984C5A357E27AD4988FEF1D8FF0B282AEE55885D1B7362FBC84AC3C57468B7002D4B144BE
                                                  Malicious:true
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 3%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-. .i.N.i.N.i.N.`....N.;.O.m.N.....n.N.;.K.v.N.;.J.e.N.;.M.g.N.}.O.z.N.i.O.o.N...J..N...F.c.N...h.N...L.h.N.Richi.N.................PE..L....m.e.................r!.........Z.!.......!...@...........................+.....,.+...@...................................)......`*..............P+..2...p*..U..@D).p....................E)......D).@.............!..............................text....q!......r!................. ..`.rdata..^!....!.."...v!.............@..@.data........)..\....).............@....rsrc........`*.......).............@..@.reloc...U...p*..V....).............@..B................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\OnlineThreatsSimple.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):228384
                                                  Entropy (8bit):6.695529952833235
                                                  Encrypted:false
                                                  SSDEEP:6144:dpCLjkxuJXc8KJlX5xBRRCC1aZd0ck+Oc7eMLMw:UjkxuJXlKJlXHBcbeMt
                                                  MD5:D5C8DB1EF5BC00AA406326CB2F1B29EC
                                                  SHA1:CC041F2C5771A4D927E5668F663B18992303ACD2
                                                  SHA-256:7C6168F1E8698647B8885A411D4004D60040E86628A1B1BF5C0A598BB5888F7E
                                                  SHA-512:A6F384CD32D7C8845A34AA376C894866A6A6EC0DE7E36A6985967D07E422D7DE2B91BF52DD54D21DE72A39E8C2A65DEF1837AE1F67407CBAF74E262B116838D7
                                                  Malicious:true
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......p...4.m.4.m.4.m. .n.>.m. .h...m. .i.&.m.f.i.;.m.f.n.!.m.f.h...m. .l.1.m.4.l.].m...d.9.m...m.5.m.....5.m.4...5.m...o.5.m.Rich4.m.........................PE..L......b...........!.....T...................p.......................................u....@.................................T...<....P..l............<.. @...`......D...................................@............p..|............................text...WS.......T.................. ..`.rdata.......p.......X..............@..@.data........0......................@....rsrc...l....P......................@..@.reloc.......`....... ..............@..B................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\WebFilteringSimple.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):185888
                                                  Entropy (8bit):6.61457353282649
                                                  Encrypted:false
                                                  SSDEEP:3072:TdHWEMgubAeKvmGHTDKJtPGQBNjqS9leHTgFF0lo+ghn9vhQfmfjQ7gJIlv:zZubAeqHTalGgNjPvFOo+LUJIlv
                                                  MD5:CF454DB111642FDD96B1088F0BDB900A
                                                  SHA1:8F16E1AC6877AD0391199C66070C10CB84D4E04D
                                                  SHA-256:EA19510B9D3225A4FC8912B827B948215FEE687609795012F6B5AE7FD71E64EE
                                                  SHA-512:477A838CBF05062039119BC47BF639B74F35CF1A2775E1CD4ACF5D2686382C285C2A055BD3CAF21141F496F870F1485000DD877E71386FCA2DEB4F38E1890289
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........o.j...j...j...~...`...~.......~...x...8...N...8...e...8...y...~...i...j..........`......k......k...j...k......k...Richj...........................PE..L.....b...........!................Zv...............................................7....@..........................|.......}..(.......l............... @..........xk.......................m.......l..@...............\............................text............................... ..`.rdata..|...........................@..@.data................l..............@....rsrc...l............v..............@..@.reloc...............|..............@..B................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-console-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):12128
                                                  Entropy (8bit):6.586328290750307
                                                  Encrypted:false
                                                  SSDEEP:192:WfAwWOhWrpT71ojDBQABJwqnajLQvTP+8jIrerl:WfVWOhWrSDBRJwlvQyUIrerl
                                                  MD5:3C89C64D591AB2EAF01FBD2253B3A623
                                                  SHA1:99B595ED628983C88EB09C484777EEA666F631B9
                                                  SHA-256:0DD2878A9AAD0D1A64848DB4A1B4E3851FD5BF049C4BA5B726D114FF45FD947A
                                                  SHA-512:BB370BD639C4B2D25C44D153A7DE6DFF7FCB8F8AF644B6B37243FAB1BFF282D8D3F13770E6862CF0B348FF83E6D7F73B3AEF61E575660DEBCE5664CED50BE715
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..L...@.nU...........!......................... ...............................0......".....@.............................+............ ..................`!..............8............................................................................text...;........................... ..`.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-datetime-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):11616
                                                  Entropy (8bit):6.583423439449143
                                                  Encrypted:false
                                                  SSDEEP:192:FWOhWOUT71ojDBQABJwY1UqnajMHxxBNT06YeO7BN:FWOhW+DBRJwHlI66YeO9N
                                                  MD5:6DBCAFA7FD0B183040B73E7E1D97674B
                                                  SHA1:4A6F7D5CECA5DD225532D95B743FA7B7B724621D
                                                  SHA-256:289EA86DA94DE73F0F0DE4812CAF7EDA170EE612C72A713B3036B2669813D15A
                                                  SHA-512:E7C4DBF91C27C2D1570529E33C47E0E2B77C636A22F32F2956C9A59B5ACAE8B2721EA5802D85BBD179C7931D1542CA20B526487297BE729698027FFD97D4AC44
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..L...F.nU...........!......................... ...............................0............@.......................................... ..................`!..............8............................................................................text... ........................... ..`.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-debug-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):11616
                                                  Entropy (8bit):6.590420646924817
                                                  Encrypted:false
                                                  SSDEEP:192:4WOhWqT71ojDBQABJTwvveqnajsl/cqtm4t:4WOhWrDBRJTw3elPqr
                                                  MD5:D9E02887A85903EE3A4FA7F197865274
                                                  SHA1:F68904FEF682461068EA782F1ED911B124793732
                                                  SHA-256:9487DA37A92B40720EA2AD64EA0C9ADC8B3C7BC4FE1F63A0E03E9C7A18943565
                                                  SHA-512:43FBB849A9A6E41E3B20813EBBE29E9FC233F6C1A7C00F8798F15F5C896BCA7F6906A9A65FBC5569B3D5F901D70AB9A6132F8A9F71193F2D7F5559A607D5CF84
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..L...U.nU...........!......................... ...............................0......v@....@.......................................... ..................`!..............8............................................................................text...+........................... ..`.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-errorhandling-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):11616
                                                  Entropy (8bit):6.656679577113797
                                                  Encrypted:false
                                                  SSDEEP:192:GyfmxD3TWOhW0T71ojDBQABJ2ZqnajxcRGlPHSm:GyfYWOhWZDBRJ2Zll7PHSm
                                                  MD5:FCC2E13D7DB99B2F3725046CA7D392D0
                                                  SHA1:14D31BC9070A47CC58342AEDD17B4EAD672DA6EA
                                                  SHA-256:9CC0615A94B0A320F4B675ECCBC3F7B8C279D9F692165AFC6CE0C877F3981B08
                                                  SHA-512:BD9C7F3D97413F14ABFE75CD2C5CFCB5AA39DE05C8F69A2F6BFAC554FDCF0EB0E41A32C34A5E7FE78A2BEE2AD9D4BE2895A33F138F7F0CB9F02DD3725B1893BD
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..L...C.nU...........!......................... ...............................0............@.......................................... ..................`!..............8............................................................................text............................... ..`.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-file-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):15200
                                                  Entropy (8bit):6.549960035832701
                                                  Encrypted:false
                                                  SSDEEP:192:zYPvVX8rFTsBWOhWwT71ojDBQABJ9t6qnaj9RlSIFspC:EPvVXbWOhW1DBRJ9t6lBRAIFsI
                                                  MD5:D613BAA29AFA3DB1FAA991876DD382F1
                                                  SHA1:795AD1269848846294563480750C91ABF6BF33AF
                                                  SHA-256:4B2DC152F33CD7D88BEBA8696A57CD0383F05C50D2FB63672664717766762A1D
                                                  SHA-512:A7113A430D39A71AF764DDDDDA81F37F280F795AE88F5AB829523B278F82C1487401316C24700BE4451A162567C282BCF08390A583CCD18B1BAF96CD86AB54B3
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..L...U.nU...........!.........................0...............................@......b'....@..........................................0..................`!..............8............................................................................text............................... ..`.rsrc........0......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-file-l1-2-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):11616
                                                  Entropy (8bit):6.615715449552321
                                                  Encrypted:false
                                                  SSDEEP:192:HWOhW7T71ojDBQABJ76qnajMHxxBNT06YeOg:HWOhWIDBRJulI66YeOg
                                                  MD5:00D8B4BED48A1BB8A0451B967A902977
                                                  SHA1:F10EF17BDA66D7CAB2840D7F89C6DE022A7B3FF2
                                                  SHA-256:568D7F8551D8B4199DB3359D5145BC4CB01D6D2F1347547F47967EB06A45C3B5
                                                  SHA-512:E248CBC06FC610F315D7EFCADB39B5CB85DFE5D40858768D5AEA8D41B3B4B23EAFE0DB2B38CCE362FD8BA8BC5EB26E9B2DDDC00E2E8615395BCA818ECFE0DECC
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..L...F.nU...........!......................... ...............................0...........@.............................L............ ..................`!..............8............................................................................text...\........................... ..`.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-file-l2-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):11616
                                                  Entropy (8bit):6.722987574306036
                                                  Encrypted:false
                                                  SSDEEP:192:tWOhWzT71ojDBQABJUrkqnaj9RlSIFxKV:tWOhWwDBRJ4klBRAIFw
                                                  MD5:534483B0F4A1924B1AE6D7E66B4A4926
                                                  SHA1:4E954316ACD216007F4A0225B138E0C0A04FBBED
                                                  SHA-256:C1BCA1BB524C5AE3D877A099F469B6FC34288BAB26AE7A7F4FC47CD869F4958D
                                                  SHA-512:CFAD2DDF8A9AD67E36E978726D8A12CA26B180F73122B2E8D19A83F73028A050D9F418E7525F576CC3A9601B3369D4494DDDBDE620B4011B7CA8A7EC4B0D1B12
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..L...:.nU...........!......................... ...............................0............@.......................................... ..................`!..............8............................................................................text............................... ..`.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-handle-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):11616
                                                  Entropy (8bit):6.618927406863662
                                                  Encrypted:false
                                                  SSDEEP:192:bWOhWxT71ojDBQABJNf+Q2qnaj9RlSIFr:bWOhWqDBRJN2blBRAIFr
                                                  MD5:2BD9500AB908C0E02CA40F19EF647288
                                                  SHA1:DE8CD89FBA64FA131FA842619B10D7D2D8A681D1
                                                  SHA-256:85546A616D5594B884146AA4E13CDBFE841C9D956E648C6EE4840E6F4428BDCD
                                                  SHA-512:1A3C5E306B6BEDC87C250F8CB1B82E2C736A2C0A8E37C67E287914FF49DA88AF21722EFFAD8CC4918D06B303989B09B35EB5D545A590BE9FA8CDBF9028EF75A4
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..L...F.nU...........!......................... ...............................0............@............................._............ ..................`!..............8............................................................................text...o........................... ..`.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-heap-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):12128
                                                  Entropy (8bit):6.56911031198072
                                                  Encrypted:false
                                                  SSDEEP:192:iS6lWWOhWDzT71ojDBQABJSWcqnajxcRGlPHi:OlWWOhWsDBRJ0ll7PHi
                                                  MD5:2BDCA93251D247E98E0A907BF68FFC7B
                                                  SHA1:84BC13DDA79A309B2FB06499EBA090359DBE7CBC
                                                  SHA-256:8434510E84F5ADE3453CFE086ED08260D309F761ED922BB8FF9ED436D8575D82
                                                  SHA-512:E86EC2CF9E964921A912C1992A01CEB8EAB36F5D29D444D1C9B0B9B2F3FC4A831E4FE034C7676E52C01150BA037CA6F46F7DE669A9AAC5EB8BAE2B848E65E7C3
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..L...O.nU...........!......................... ...............................0......l.....@.......................................... ..................`!..............8............................................................................text............................... ..`.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-interlocked-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):12128
                                                  Entropy (8bit):6.592215013580638
                                                  Encrypted:false
                                                  SSDEEP:192:ClYsFqWOhW+T71ojDBQABJsgqnajLQvTP+8jIrS:ClYsFqWOhWvDBRJsglvQyUIrS
                                                  MD5:8A6C74B9A1DB0D730AF45BE603D233C8
                                                  SHA1:A6A3E80AFEEFCC9B34703C6A8EA2C0A94FE998E6
                                                  SHA-256:75B8EAE29AB9ACC906AAFAC2A198FE875D34C22B40ACACE1CD6C3486D67333EF
                                                  SHA-512:8F2E6BE6A08E393ACDB7E50687D6E6FAEFA9243855D92018BC9BE5FFEAD022E4DF96D2D51042A1E2D6D2EADCB88E27F7F4AEA8A5314F8FB32C05CB9CEDEDCD99
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..L...S.nU...........!......................... ...............................0.......-....@.......................................... ..................`!..............8............................................................................text...$........................... ..`.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-libraryloader-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):12128
                                                  Entropy (8bit):6.677642600384801
                                                  Encrypted:false
                                                  SSDEEP:192:BvuBL3B6WOhWryWT71ojDBQABJFvJCeqnajxcRGlPHZ:BvuBL3B6WOhWryXDBRJCell7PHZ
                                                  MD5:A9116F560839DF0C03BE8AD704AB3351
                                                  SHA1:3339421F8CB623B244DDA6E76EC5B6C7D987AF64
                                                  SHA-256:27078BA4E79087A5C1146F35DA386CE043A3C2BBCAED04BD82645EDDB6ED896D
                                                  SHA-512:4BDED31406E6DE3823A72162BA72968047C48F8373B660A431415811052BE622FBF5B4D2123086601440E714DABD703FF0C36ED962590C23144A2E2B00B13FFB
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..L...H.nU...........!......................... ...............................0............@.......................................... ..................`!..............8............................................................................text............................... ..`.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-localization-l1-2-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):14176
                                                  Entropy (8bit):6.665276272236548
                                                  Encrypted:false
                                                  SSDEEP:384:5OMw3zdp3bwjGjue9/0jCRrndbZWOhWlDBRJIXlBRAIFn:5OMwBprwjGjue9/0jCRrndbvs1PIjRAW
                                                  MD5:73483CBC229C62E129627ADBF62B0FFE
                                                  SHA1:074CE67665C86355D3218B5E3EA4B1B335095AF8
                                                  SHA-256:13471EB84DB95F8270398EF1DEB29F0EA024DB17E331497545C36EEA7B2A3A7C
                                                  SHA-512:92F06CB8971E29DA7607C6B1D1377F21C7E6F0E4A169AAA08326038D5CDB09422B91F4F2D26A7978521E0EDBB9CF1235E583F2910048C917CCEF8D12C5E1166A
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..L...J.nU...........!......................... ...............................0.......5....@.......................................... ..................`!..............8............................................................................text............................... ..`.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-memory-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):12128
                                                  Entropy (8bit):6.614199521081865
                                                  Encrypted:false
                                                  SSDEEP:192:oWFWOhW0T71ojDBQABJxAY1hXqnajL1dHx3tKCJAC:DFWOhWZDBRJOY1NlXBtpOC
                                                  MD5:D9E4E446DCCCBFA822059DCD16EDFC41
                                                  SHA1:CDED5E8DBF7A00E080432257F95406F5728E739A
                                                  SHA-256:D70EB06ED4F0C686DDA93F35F065EC5E6249E5C737A24249738314C31F9D5202
                                                  SHA-512:11DEACE1B537FB770281468EFB265D932A22B797EE268FB60D968F2F238CBBEAD6C60114572932732B1FD8D5682C1080E7E927A25F73ED2F5E85640B080A37A3
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..L...K.nU...........!......................... ...............................0............@.............................l............ ..................`!..............8............................................................................text...|........................... ..`.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-namedpipe-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):11616
                                                  Entropy (8bit):6.722719847090586
                                                  Encrypted:false
                                                  SSDEEP:192:iWWOhWYT71ojDBQABJz0ymVqnajLQvTP+8jIrf:1WOhWNDBRJzxmVlvQyUIrf
                                                  MD5:BB05CDFFC71AC2B0C0FB2CC35B409EC2
                                                  SHA1:B327AB67107235BEB5FCD1B893A571E21E29F6FF
                                                  SHA-256:36C42192283F129FF5637A06B7C3D72E5ED8E1C77493623384F2BDAC15118F29
                                                  SHA-512:B55CBF2AAA2F7685925C313D4CE73B8635666E5F2F30E2621FEC88F3B526D296E5D1FB5C28BF3EA5E8621B298E01B75542085E9E3D1A966762173A3E53E4240D
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..L...U.nU...........!......................... ...............................0............@.......................................... ..................`!..............8............................................................................text............................... ..`.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-processenvironment-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):12640
                                                  Entropy (8bit):6.592536159264661
                                                  Encrypted:false
                                                  SSDEEP:192:0vWOhWUT71ojDBQABJWTfqnajMHxxBNT06YeOXw:0vWOhW5DBRJGlI66YeOg
                                                  MD5:14E48E802A6690282EBDE74FD5B78E6F
                                                  SHA1:8CB9ADC2A99C6CA443C2EF0BE6BB093F9059AEB2
                                                  SHA-256:0D10D132CD28B57FB88135D5693BA2C1AACE2FC059D85BDE0318FB9B379B57B7
                                                  SHA-512:710356F5E6D4F6DD7754C72DEFF703B144F91B54E643017C05DC81EBD4150981651E6F3FF20EDED5FCD7ABE0327692E8D6BAB00F454597FC36603BD8389601C3
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..L...L.nU...........!......................... ...............................0......|.....@......................... ...G............ ..................`!..............8............................................................................text...g........................... ..`.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-processthreads-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):13664
                                                  Entropy (8bit):6.657804135821121
                                                  Encrypted:false
                                                  SSDEEP:384:ok1JzNcKSI1WOhWzDBRJS/kPlI66YeO7EN:DcKSmS1P1q66MoN
                                                  MD5:F2FA7C391D7671AB11028E85D29AB27F
                                                  SHA1:734CCF57CAB781D367B62D216B6582F3BB89249D
                                                  SHA-256:28DD68501F527BE6BC54F5F374BC33BE983EA7AC640E66E3A56272CD3B9A5655
                                                  SHA-512:3286FD352FB4149151168BABE4B1E44D22E914D950F41C099748E8D3B117ADA86391FB4E0EF5863AAC07B2A08372CCCE0C470642AC8A7C7DBF97EA72AF1D0583
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..L...U.nU...........!......................... ...............................0.......4....@.......................................... ..................`!..............8............................................................................text............................... ..`.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-processthreads-l1-1-1.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):12128
                                                  Entropy (8bit):6.651268886737345
                                                  Encrypted:false
                                                  SSDEEP:192:79DfIeNWOhWVT71ojDBQABJUqdqnajLQvTP+8jIrnN:79DfIeNWOhWuDBRJhdlvQyUIrN
                                                  MD5:7016BF365A155D29F01A000942A017EF
                                                  SHA1:47E25B97AF56EDBDD20CA72BBA994C6BCF1B81E6
                                                  SHA-256:B5F815D0A41ADD7FD9593036A8E6843FCC221298FEFD61808F960EED3CC19830
                                                  SHA-512:2CD7E88717A2D81811CE03990737888B8A1E9E351DCDAD401FFE5924BDF97BE086BD766A1A5B25411B760CBF81B68BEBD94D915100B6BC1310360813AF11F827
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..L...N.nU...........!......................... ...............................0.......Q....@.......................................... ..................`!..............8............................................................................text............................... ..`.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-profile-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):11104
                                                  Entropy (8bit):6.757141506376564
                                                  Encrypted:false
                                                  SSDEEP:192:+oJnWOhWbT71ojDBQABJhvz3xHqnajxcRGlPHen:+oJnWOhWoDBRJhvdll7PHen
                                                  MD5:5B222E79ED442685E509BB3F16E93482
                                                  SHA1:FD9DE440D03D9B57319C49871B15B8468AB961D3
                                                  SHA-256:3902AFF11857535698367D4DB2DFCCDE6168429DEFAC82C15A535B4A07F7CDDA
                                                  SHA-512:1D057F6990F9999B82F086CB4C0547D638504CA0EC3E801240FDEB1A20F84CF2B812D9CCA64786186F6158954EF5677208EB4F0265E300525B8528CDBDF305B0
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..L...U.nU...........!......................... ...............................0............@.......................................... ..................`!..............8............................................................................text............................... ..`.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-rtlsupport-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):11104
                                                  Entropy (8bit):6.76933325737081
                                                  Encrypted:false
                                                  SSDEEP:192:1IG5WOhWwT71ojDBQABJpqnaj9RlSIFOwbF:1IG5WOhW1DBRJplBRAIFOw5
                                                  MD5:308AEDD0DD83ACFB5AEC8C60782A4AED
                                                  SHA1:E5027F0828AAF4B24EB6C6396FBF0B15E49355F1
                                                  SHA-256:DB1622A0B0013991D759C7955454A8006AA27F81A8B9B5C37CF2595B15B1B217
                                                  SHA-512:281C9B854B958426D3C23DDA7116AF17A95E4BEC3EB7E4FA85CD1216BB8A2B999A764866E831D1022590DADA7E720D5D930417888F174FC91A3FCE78F3393C1C
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..L...O.nU...........!......................... ...............................0............@.......................................... ..................`!..............8............................................................................text............................... ..`.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-string-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):11616
                                                  Entropy (8bit):6.666608120067825
                                                  Encrypted:false
                                                  SSDEEP:192:yMyMvNWOhWPT71ojDBQABJoUqnajsl/cqta:nyMvNWOhWMDBRJFlPq8
                                                  MD5:749B5C0031E0726FA45A3BB9B48B3802
                                                  SHA1:551C7ADF6233B66D9271F5B705AB45D69CB590AA
                                                  SHA-256:7BF7FF35FBCBFC1CB57597ACFB23D2FB13E04E14906F4A626E4E92D689F19CBC
                                                  SHA-512:B7E7D59307AA2432B978484CFCA8E5EA61216C1240BDBD733D4C697609EC371E6F13AEF2A654DE64711371B35DDA2C5C6AE2B13B52E5951B51161D42B2D6ECAA
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..L...R.nU...........!......................... ...............................0............@.......................................... ..................`!..............8............................................................................text............................... ..`.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-synch-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):13664
                                                  Entropy (8bit):6.560273780937202
                                                  Encrypted:false
                                                  SSDEEP:192:Gdv3V0dfpkXc2MAvVaoKZWOhWpT71ojDBQABJdBqnajsl/cqtV:Gdv3V0dfpkXc0vVabWOhWSDBRJblPqH
                                                  MD5:2BBC9CF572B18123A0F27F04492C6EA6
                                                  SHA1:216404ED615263BE2271A8DB7C64DAA5D54D9412
                                                  SHA-256:1FF0D9CEFF0F982B7A78EF34C45980B88099067F4468F11FCDD46DBAC00F6DD6
                                                  SHA-512:F59CF115E6FD8F82F5D2B3C871AB0CFE3BD1C8C5493ACA196DA185A3F6E85E6390BCBA1BB32D409BA17C3C032C43308F609DB14180027FAD564DAA0D5F570309
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..L...R.nU...........!......................... ...............................0............@.............................V............ ..................`!..............8............................................................................text...f........................... ..`.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-synch-l1-2-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):12128
                                                  Entropy (8bit):6.696434650469273
                                                  Encrypted:false
                                                  SSDEEP:192:YttZ38WOhWJT71ojDBQABJFarAyTCqnajMHxxBNT06YeOpFWM:UtZ38WOhWyDBRJErDClI66YeOnT
                                                  MD5:9EFDFFAC1D337807B52356413B04B97B
                                                  SHA1:2590BD486ABCE24312066285FA1C1FEAF8332FE0
                                                  SHA-256:E1A87D7D01E2376DDE81A16658915CCF2ECB692739FEF09ADFB962523756E22D
                                                  SHA-512:B3C164E50D48A78BD08CF365E02E263B97EC2DD3EFCF04914C8677C838E10BE23DF5178A8618E3F2A6FEB6FAA2BB74EAF069E7E2DB7C6E6FD9D0137DCFFBCEAD
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..L...W.nU...........!......................... ...............................0............@.............................v............ ..................`!..............8............................................................................text............................... ..`.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-sysinfo-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):12640
                                                  Entropy (8bit):6.588164083921983
                                                  Encrypted:false
                                                  SSDEEP:192:XtqUKIMFQWOhWq7T71ojDBQABJONnxqnajMHxxBNT06YeOargRow:XtqUlWOhWBDBRJYlI66YeOaURx
                                                  MD5:B697440BDBBA2E896005DE51943EE0DB
                                                  SHA1:F4F7AB7A1D8E4FA43F83401585E6E83136CB16E6
                                                  SHA-256:B31A83C8CC984C2A7ED9D7C9964F8BA302C1051BC478A3A34B98F4F873A6C011
                                                  SHA-512:81270F3E9A91D001155FB9C7F80132D9611082A68C0F849CE95895DC9835223075531CE11A534DC076D75FB76CDEAE9ABEAC23D371CC0DE8428E8C177D7673D5
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..L...W.nU...........!......................... ...............................0......A)....@.............................E............ ..................`!..............8............................................................................text...U........................... ..`.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-timezone-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):11616
                                                  Entropy (8bit):6.747904282517099
                                                  Encrypted:false
                                                  SSDEEP:192:jUWOhWiT71ojDBQABJj6nqnajLQvTP+8jIriNDG:wWOhWTDBRJWnlvQyUIrcG
                                                  MD5:42C72D838C34E4E7164C578A930B8FC7
                                                  SHA1:82D02CB090EB6D81A1499189E4D3E6B82AA60061
                                                  SHA-256:F1667BBDA1B58FC688B422FD2F9F7040919C4ABABE00A4BE78B258CAE2DFC3D3
                                                  SHA-512:1020D6010DCA512ADBC18F44B6453A974A200766013C39F6CB1CD0A72234A241C73587C929F1D0FCADF90C3EB71264086167F05BD7EBCEB5B944F4E4A0811D92
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..L...T.nU...........!......................... ...............................0......).....@.......................................... ..................`!..............8............................................................................text............................... ..`.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-util-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):11616
                                                  Entropy (8bit):6.592529685619637
                                                  Encrypted:false
                                                  SSDEEP:192:bWOhWZT71ojDBQABJAqnajMHxxBNT06YeOy:bWOhWCDBRJAlI66YeOy
                                                  MD5:C0B34D2146CD6F6CC2FE345029066EC8
                                                  SHA1:7EE74D35ADE0BACB113CB9E81156083258EDEB8E
                                                  SHA-256:1573AF23A9BA27B2F3703A718749B776AEA67E654C8C9713F92E41A67AE37C79
                                                  SHA-512:46E8CAEE15AC0BE70A4B15E27967CD4464AB5DDE0FF11E192F81E855CED99C8A83F8B5BE5D1B92F6C8AC593090985736F19227F117A20A59F56416B11E3745B2
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..L...U.nU...........!......................... ...............................0............@.............................9............ ..................`!..............8............................................................................text...I........................... ..`.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-crt-conio-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):12640
                                                  Entropy (8bit):6.6268710535758455
                                                  Encrypted:false
                                                  SSDEEP:192:pj8PWOhWST71ojDBQABJphUzyqnaj9RlSIFK:pjAWOhWDDBRJpYylBRAIFK
                                                  MD5:4296CF3A7180E10AAF6147F4AECD24E4
                                                  SHA1:F81E09AF979A1146774D554783D1A22A03A61393
                                                  SHA-256:147F86FF93D61FEA256B3DE9149E1B36B68A83762E62A3389466218E18359FFC
                                                  SHA-512:60357EDDE6572C5E796F927C3E72C31A96FF700624B7366FDDA64BCF51EE00BF1E9AB477A46D8D3BA7391BA10491E69F745EFEC3607F8F49B6E1A3A3DE7A0648
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..L...X.nU...........!......................... ...............................0......jG....@.......................................... ..................`!..............8............................................................................text............................... ..`.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-crt-convert-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):15712
                                                  Entropy (8bit):6.425222272368789
                                                  Encrypted:false
                                                  SSDEEP:192:fpdkKBcyxWOhWWT71ojDBQABJMIqnajsl/cqtt:JuyxWOhWXDBRJXlPqD
                                                  MD5:5C6FD1C6A5E69313A853A224E18A7FAC
                                                  SHA1:10BAE352F09B214EDEF2DC6ADCB364C45FAFDBEC
                                                  SHA-256:3AA0EB4C47AC94B911F1A440324D26EEE8DDF99557A718F0905BFEE3CF56255F
                                                  SHA-512:08C2B1150F6BF505D10085A515BBFAB6C1E18663C6EF75EC988727E3D30210532D03BFBFBB048B1A843D4FAA5D1060F9079E018A9E892BCE03F899A5A85F6034
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..L...`.nU...........!.........................0...............................@............@..........................................0..................`!..............8............................................................................text............................... ..`.rsrc........0......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-crt-environment-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):12128
                                                  Entropy (8bit):6.584062596989429
                                                  Encrypted:false
                                                  SSDEEP:192:kWOhWaT71ojDBQABJIvqnajxcRGlPH6WE5:kWOhWbDBRJIvll7PHC5
                                                  MD5:6A3D5701446F6635FAFF87014A836EEE
                                                  SHA1:7BBC9DB1C9CE70E9FC7B7348A2C96681E5D8265B
                                                  SHA-256:16BA05A1FA928501FFAEE2E9DCE449D28E8FE538DF5EC6D8D1080B610B15D466
                                                  SHA-512:839A1277B6DBB9F2D6E572E1B50B0AD08C93256A1367F36997DB07285AA7B251346499A643A985A22D9A7618635C11964E414073AA7E1BF60D36368829DE8FB3
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..L...Z.nU...........!......................... ...............................0.......&....@............................."............ ..................`!..............8............................................................................text...2........................... ..`.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-crt-filesystem-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):13664
                                                  Entropy (8bit):6.642134226840258
                                                  Encrypted:false
                                                  SSDEEP:192:b7q6nWlC0i5C5WOhWWT71ojDBQABJHTTKJqnajLQvTP+8jIrF7:/q6nWm5C5WOhWXDBRJHTGJlvQyUIrF7
                                                  MD5:4EC243792D382305DB59DC78B72D0A1E
                                                  SHA1:63B7285646C72EE640D34CDC200BFC5863DB3563
                                                  SHA-256:56E0BDF91EDB21F5F5041F052723025C059A11360BB745F965A9903DE9C61756
                                                  SHA-512:88F648D45927DB65FF8CEAD4BB1959B1297410BF3F5B3B2783A173D708649260A61470342694DE8B93E9C1657DE64DB43DB40EE71ACC661B03786C0921D68D4B
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..L...Y.nU...........!......................... ...............................0............@.......................................... ..................`!..............8............................................................................text............................... ..`.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-crt-heap-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):12640
                                                  Entropy (8bit):6.564400972555511
                                                  Encrypted:false
                                                  SSDEEP:192:8Y17aFBRkWOhWXLT71ojDBQABJz5qqnajxcRGlPHisg:9RWOhWXYDBRJ9qll7PHip
                                                  MD5:A51CFB8CF618571215EEBA7095733B25
                                                  SHA1:DB4215890757C7C105A8001B41AE19CE1A5D3558
                                                  SHA-256:6501894E68A3871962731282A2E70614023EC3F63F600F933EC1785400716CE1
                                                  SHA-512:9AE11AB21486DEA1ABA607A4262F62678C5B0E9F62B6A63C76CFDC7698D872D8696FFB1AAAE7AA2E2CF02C1C7EAA53D0CE503432960F4BE6886FAE0DE2659535
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..L...Z.nU...........!......................... ...............................0......u?....@.......................................... ..................`!..............8............................................................................text...&........................... ..`.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-crt-locale-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):12128
                                                  Entropy (8bit):6.677315318089621
                                                  Encrypted:false
                                                  SSDEEP:192:iWOhW6UT71ojDBQABJmRqnajsl/cqt0AEV1:iWOhWQDBRJmRlPqubV1
                                                  MD5:8D097AA5BEC8BDB5DF8F39E0DB30397C
                                                  SHA1:56F6DA8703F8CDD4A8E4A170D1A6C0D3F2035158
                                                  SHA-256:42C235914844CE5D1BB64002FCA34A776AE25EE658FC2B7B9DA3291E5DEF7D4D
                                                  SHA-512:A891536E2A362FC73472FA7F5266CE29E8036959701BC0862F2B7EA5865DCD1505615EDC8E064FB2F7AAA1B129E48422EFE7B933B01FAED9C2AFADD8A64452DC
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..L...Z.nU...........!......................... ...............................0......h.....@.............................e............ ..................`!..............8............................................................................text...u........................... ..`.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-crt-math-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):22368
                                                  Entropy (8bit):6.188429412305562
                                                  Encrypted:false
                                                  SSDEEP:384:n47isbM4Oe5grykfIgTmLOWOhWB9DBRJelXBtpObE:41Mq5grxfIn+c91PkKE
                                                  MD5:AB87BDAE2F62E32A533F89CD362D081C
                                                  SHA1:40311859DD042A7E392877364568AAD892792BA9
                                                  SHA-256:0439703E47C8FCE1F367F9E36248A738DB6ABCD9F2DD199CB190D5E59ED46978
                                                  SHA-512:DBE0073DA8979F3D32204680015B60435226840E732B5DF964DBEEB7920C0BC5DF92D866964F905518C97CC3539F628664503FFA64E50A2EF90C459B62555444
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..L...X.nU...........!.........................@...............................P............@..............................+...........@...............6..`!..............8............................................................................text....,.......................... ..`.rsrc........@.......2..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-crt-multibyte-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):19808
                                                  Entropy (8bit):6.18946421950789
                                                  Encrypted:false
                                                  SSDEEP:384:iy+Kr6aLPmIHJI6/CpG3t2G3t4odXLlWOhWrDBRJ2pll7PHI:iZKrZPmIHJI6Bq1PUo
                                                  MD5:169E20A74258B182D2CDC76F1AE77FC5
                                                  SHA1:FCE3F718E6DE505AC910CB7333A03A2C6544F654
                                                  SHA-256:224F526871C961615DE17B5D7F7BBEF2F3A799055CAB2C8E3447B43C10C25372
                                                  SHA-512:0881C8704421A5F6E51ABD22C55608DD7FB678491682CE86066E068B1973EBF11D6C2163BE610A49F87E800C8563EBB41ABFE36E1913D7D0B8485FD29ED81BF7
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..L...Y.nU...........!.....$...................@...............................P.......@....@.............................. ...........@...............,..`!..............8............................................................................text....".......$.................. ..`.rsrc........@.......(..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-crt-private-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):64352
                                                  Entropy (8bit):5.548808567064281
                                                  Encrypted:false
                                                  SSDEEP:1536:KaYDe5c4bFAcvxXWpDid3334BkZnGPMwPn7+9:6De5c4bFAcvxXWpDid3334BkZnGPMwP2
                                                  MD5:682BF6B9C07A64929A4484DB51D6C13D
                                                  SHA1:07672CE8F08DB3B1D745B71E9DB3E4729C70793C
                                                  SHA-256:BDD0CCA431EE362BED4F2C1ECCAFB22AA8DD51D57014BE8297789175E5C11F2E
                                                  SHA-512:E4AE0FC24114A58BAEDE8443CB9275811C12A321AC898CDA89EFBD07474B8E60A564C55BBD82E37F521BF46B05FC1CA876F9B33F6D4BBBAED9FE0F03C937FCE1
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..L...X.nU...........!................................................................a.....@.............................................................`!..............8............................................................................text............................... ..`.rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-crt-process-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):12640
                                                  Entropy (8bit):6.589445465477159
                                                  Encrypted:false
                                                  SSDEEP:192:nRQqjd7xWOhW8T71ojDBQABJkoHqnajLQvTP+8jIrrNX:nKAWOhWRDBRJkMlvQyUIrrV
                                                  MD5:3838DD55B0237AF0FBAC474ABB6614CC
                                                  SHA1:0C47256F4A29BC3FA889B5FBE0B1F2D712ACF4ED
                                                  SHA-256:51862322AE3354F254045545B4FF64B7445BC99107B4526C3430DE9CE5C60D88
                                                  SHA-512:CCA018899156601146C5C6AA747603A62D70E3DBBBBDE377B06A78F3D0F2D83F11D7F3DB71D239F4AD8CE2E38B92C93175D2AF5AF56905F87A755B8DD59B7836
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..L...Y.nU...........!......................... ...............................0............@.............................x............ ..................`!..............8............................................................................text............................... ..`.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-crt-runtime-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):16224
                                                  Entropy (8bit):6.474363534458307
                                                  Encrypted:false
                                                  SSDEEP:192:90CjfhrpIhhf4AN5/jivWOhWXT71ojDBQABJBkQgqnajxcRGlPHei8:9b7hrKMWOhWkDBRJBEll7PHQ
                                                  MD5:49363F3CF4671BAA6BE1ABD03033542F
                                                  SHA1:E58902A82DF86ADF16F44EBDC558B92AD214A979
                                                  SHA-256:505D2BDE0D4D7CD3900A9C795CB84AB9C05208D6E5132749AB7C554CCD3C0FCC
                                                  SHA-512:98E78A607CFBB777237DC812F468EC7A1ABCBA9472E20A5780DFC526F7992DA1841FCD9E2F76F20FA161240007F185C7FBDC120FB4C3C1F2B90FDAD5913D65DD
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..L...Y.nU...........!.........................0...............................@......h.....@..........................................0..................`!..............8............................................................................text............................... ..`.rsrc........0......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-crt-stdio-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):17760
                                                  Entropy (8bit):6.391701840073475
                                                  Encrypted:false
                                                  SSDEEP:192:5FbNpuWYFxEpahvWOhWQT71ojDBQABJ/EXqnajL1dHx3tKCJAfg7:LUFVhvWOhWVDBRJclXBtpOfm
                                                  MD5:BE16965ACC8B0CE3A8A7C42D09329577
                                                  SHA1:6AC0F1E759781C7E5342B20F2A200A6AAB66535E
                                                  SHA-256:FCD55331CC1F0FF4FB44C9590A9FB8F891B161147A6947CE48B88BF708786C21
                                                  SHA-512:7BA55FA204D43C15ACA02031F584B3396BB175365DAD88E4047B8A991F1F1DDD88D769E4D8CB93EE0ED45E060A1156E953DF794F9CB8BB687C84C4A088DA2EDF
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..L...Y.nU...........!.........................0...............................@......1.....@.............................a............0...............$..`!..............8............................................................................text...q........................... ..`.rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-crt-string-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):17760
                                                  Entropy (8bit):6.3772354907724695
                                                  Encrypted:false
                                                  SSDEEP:384:2iFMx0C5yguNvZ5VQgx3SbwA7yMVIkFGl7WOhW0DBRJglI66YeOtOk:26S5yguNvZ5VQgx3SbwA71IkFid1P56x
                                                  MD5:3EAE6D370F2623B37EC39C521D1F1461
                                                  SHA1:86D43E2E69B2066333E4AFA28A27C7A74FF89991
                                                  SHA-256:CE74BDC6999D084A1B44B2ECEA42DD28849B2825D7779EFFDC4C18360308B79B
                                                  SHA-512:30B2B6CF5CD1BBDF68DE048E6D992133FE7AB0C847FA0D5EB8C681A9688D60794621A40178451A104036A0FFF2E1BD66A18D9F96BE6B28DBDC0BC1C8A535FC85
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..L...].nU...........!.........................0...............................@.......4....@..........................................0...............$..`!..............8............................................................................text............................... ..`.rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-crt-time-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):14176
                                                  Entropy (8bit):6.536472462531097
                                                  Encrypted:false
                                                  SSDEEP:192:uamDOWOhWKT71ojDBQABJUBXqnajL1dHx3tKCJAH:l/WOhWLDBRJUtlXBtpOH
                                                  MD5:A440776E10098F3A8EF1C5EACA72958E
                                                  SHA1:7B8662714F6E44FB29A4224A038E4127964003E9
                                                  SHA-256:40D8BC312AC7BCA072703E5F0852228CDE418F89BA9AD69551AA7A80A2B30316
                                                  SHA-512:B043CD020D184A239510B2607C94210DC5FDC5D2A2B9285836BDCE8934CC86A1CC3F47A2F520B15DB84F755AC2E7C67E0247099648D292BBD5FB76F683D928DF
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..L...Z.nU...........!......................... ...............................0.......x....@.......................................... ..................`!..............8............................................................................text............................... ..`.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-crt-utility-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):12128
                                                  Entropy (8bit):6.670008463006746
                                                  Encrypted:false
                                                  SSDEEP:192:jfHQduLWOhWnT71ojDBQABJcGqnajMHxxBNT06YeOh0:jf9WOhW0DBRJcGlI66YeOi
                                                  MD5:A0A883E26BE6800508162E2A898148D9
                                                  SHA1:4F79892E7766CB7831211864978575598C86A11B
                                                  SHA-256:9753AE83536767C73E340C36C5F1610BC76A3E67E033B07503EC31431CBA7B90
                                                  SHA-512:70904F2FD074073AEBCF665178B34CF7F0F42CED7223CA296F7F202F6FA0175ACE2832D9802F5BFF4D67891CA09AE14FAC47420D69107E72AA44B541A190F6C3
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..L...Z.nU...........!......................... ...............................0............@.............................^............ ..................`!..............8............................................................................text...n........................... ..`.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\bddci.cat

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:data
                                                  Category:dropped
                                                  Size (bytes):9946
                                                  Entropy (8bit):7.147674409917281
                                                  Encrypted:false
                                                  SSDEEP:192:3D+/yPJCKTXooyKfPFWQFS83v480Hy5qnajsTU5SR:lxrPFRE8/4sluU0R
                                                  MD5:4C62608E0E96006123CEADFFDC36E72F
                                                  SHA1:DDD70A6A42F0B5D5D79C54552AECA852610FD8F0
                                                  SHA-256:5F46A05FA0785C125F0CC114A0ACCC6EF798796DF0F1897A05660C02FB7C04E9
                                                  SHA-512:A62808516B5B3E65B1A757773A0802AD0539E3A8234812814477AE6BCE6BCAABA28CF50FEFC7D909669E6131F09A38639B7C600A7E452D12042B7EC0D191624F
                                                  Malicious:false
                                                  Preview:0.&...*.H........&.0.&....1.0...`.H.e......0.....+.....7......0...0...+.....7..........jmG..#..&...210826120621Z0...+.....7.....0...0..}.R7.4.D.5.D.C.6.8.F.3.C.C.A.C.8.7.8.D.A.8.4.0.9.E.2.E.6.C.C.E.C.E.E.6.2.B.F.9.A.7...1..%06..+.....7...1(0&...F.i.l.e........b.d.d.c.i...i.n.f...0@..+.....7...1200...O.S.A.t.t.r........2.:.6...0.,.2.:.1.0...0...0E..+.....7...17050...+.....7.......0!0...+........t..h.....@..l...+..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....RF.D.4.E.8.1.1.9.2.F.B.9.A.F.1.9.D.5.D.4.7.E.1.1.D.E.C.E.3.9.C.1.D.4.1.B.0.5.1.A...1..-06..+.....7...1(0&...F.i.l.e........b.d.d.c.i...s.y.s...0@..+.....7...1200...O.S.A.t.t.r........2.:.6...0.,.2.:.1.0...0...0M..+.....7...1?0=0...+.....7...0...........0!0...+.........N../.....~...9.....0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}.......;0..70J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........1.0.0.0...0$..+

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\bddci.inf

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:Windows setup INFormation
                                                  Category:dropped
                                                  Size (bytes):4587
                                                  Entropy (8bit):4.99150407247473
                                                  Encrypted:false
                                                  SSDEEP:96:udXrNW2qu5Z5u5j5h5A54FPO9EyNQkF9pSYzONz1oWO9WuS:u1pZ3k5zaEO9E4PFSYSNxov9HS
                                                  MD5:29ED28D5B82805736D39636A7209E0DC
                                                  SHA1:74D5DC68F3CCAC878DA8409E2E6CCECEE62BF9A7
                                                  SHA-256:2A46F7858DAC6A5A2A9AEDD13ABAD17D2ACED6BDD8E7C8A89F99C9E62C3F169E
                                                  SHA-512:AF7C5F67754D8790D8A0CCA630C77912724DB3D6C9F4D2C7A0A3D76CF217A76CC2FBAB698A05C598A3C07A7B76B19B5B27F412B2A731BF14951F0D2A65D229E0
                                                  Malicious:false
                                                  Preview:;;;..;;; BdDci..;;;....[Version].. Signature = "$WINDOWS NT$".. Class = WFPCALLOUTS.. ClassGuid = {57465043-616C-6C6F-7574-5F636C617373}.. Provider = %Bitdefender%.. CatalogFile = bddci.cat.. DriverVer = 08/25/2021,14.3.38.705....[SourceDisksNames] ; "Used by SourceDiskFiles to express where those files are located".. 1 = %DiskName%,,,""....[SourceDisksFiles] ; "In order for a driver file or an application file to be included as part of a signed driver package".. bddci.sys = 1,,....[DestinationDirs] ; Specifies the destination directory for all copyfiles in this inf... DefaultDestDir = 12 ; 12 = \Drivers folder.. BdDci.DriverFiles = 12 ; 12 = \Drivers folder....[DefaultInstall].. CopyFiles=BdDci.DriverFiles..[DefaultInstall.Services].. AddService = %BdDciServiceName%,%SPSVCINST_ASSOCSERVICE%,BdDci.Prevention.Service....[DefaultInstall.Detection].. CopyFiles=BdDci.DriverFiles..[Defa

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\bddci.sys

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (native) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):514976
                                                  Entropy (8bit):6.688592219019769
                                                  Encrypted:false
                                                  SSDEEP:6144:1wtkVx3vTHwqO9eG7RPR1JefV1GdWJKSnqTYtsSB6zE3L0Pq82xF7F7nuO8t6s55:1wKtPkp72xF7F7gtdsrOt48PfcaqupoG
                                                  MD5:5E77DDC9FEC7046BAEA4784F032EF334
                                                  SHA1:F059E32FD5050FB35CB35A613EADBC928F673ECB
                                                  SHA-256:0F41B8DD0D41E750EBBE1EC66D8E4519119AB906E4BC01A33A9FB0C5B0AD5F30
                                                  SHA-512:B2A2C1FF7F6C3A056081E393734D5DD2B7B8FC9E067467C3FCC45909DF6E7AE2ECC8F7FFA8F9117FE9E2BD7FD045D64BA1FA80C00D52D055C27667AFD2399076
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q.....[...[...[.{.Z...[.hr[...[.he[...[.{.Z...[...[...[.{.Z...[Gd.Z...[Gd.[...[Gd.Z...[Rich...[........................PE..L....#&a.................&...................@....@..................................[.....E.................................e..x.......`................!.......G...a..T...........................8b..@............@..P............................text...c........................... ..`PAGE......... ...................... ..`.rdata...5...@...6...(..............@..@.data................^..............@...INIT....7............d.............. ..b.rsrc...`............f..............@..B.reloc...G.......H...r..............@..B................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\bddci_core.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):1367072
                                                  Entropy (8bit):6.5604556241080365
                                                  Encrypted:false
                                                  SSDEEP:24576:Oxoxyqqw0RaqtPo6nf+nUE0SzVMTHJUghNWqmjpy/om:QoYqiEGoY+nUE0CVMTHqgzWBVy/9
                                                  MD5:787E3F15F86329C7330C72197ECFA7F7
                                                  SHA1:B8B031E62ACE433D82619092A599D628DDE99A45
                                                  SHA-256:24D43211728E462DD8F50A1EEAF7016738BC3C641D4818F8B2E4CA2F59DC175F
                                                  SHA-512:B8989D6AA6173AE1BE14C064DC0B764FF9893AB38D98FB26D9E233F445307442B48813C03DD6B7531E1BA60B1CD5B3A7EA85B9FD79E0226412431AAD24E08183
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........V.fd..fd..fd...g..fd...a..fd...`..fd...`..fd...g..fd...a..fd...e..fd..fe.=fd.H.a..fd.H.m..fd.H.d..fd.H....fd..f...fd.H.f..fd.Rich.fd.................PE..L....#&a...........!.........................0......................................rj....@A........................@Q..p....Q..d.......0............... @..........X...................................@............0..0............................text............................... ..`.rdata.......0...0... ..............@..@.data....v...`...d...P..............@....rsrc...0...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\bddci_install.cmd

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):113
                                                  Entropy (8bit):5.024399016495459
                                                  Encrypted:false
                                                  SSDEEP:3:mKDDGQWT0yOA59bR1GqWREEGRMGMily6ZhwKML5r:hSnJOrEE6RVtG
                                                  MD5:E53B0CDFA47603A767603BA0D7D88D5F
                                                  SHA1:E4954AC71F948F6CDE020CEC724C5E40079F1710
                                                  SHA-256:B6F48EC300DFA6C1B9465A1758960CC22E43C1C9E8BC9080B54B1355752C85A2
                                                  SHA-512:861BC7E89D56FC498C8D9D362F775FF1005FE23BDD9A7DCF76682CF3D39ECF13342C52BE1A527995EC47FD2CBD01F91E91F09F4094A0CB04903C9FB1B11921AE
                                                  Malicious:false
                                                  Preview:@echo off..pushd %~dp0..RunDLL32.Exe syssetup,SetupInfObjectInstallAction DefaultInstall 128 %CD%\bddci.inf..popd

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\bddci_install_boot.cmd

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):110
                                                  Entropy (8bit):5.05232264138167
                                                  Encrypted:false
                                                  SSDEEP:3:mKDDGQWT0yOA59bR1GqWREEGRMZiEly6ZhwKML5r:hSnJOrEEMEVtG
                                                  MD5:EB7FD87467EBED250DDF9205BBFCF35A
                                                  SHA1:AD6B37B514DFFC0BAE6D5046C2B34ADFD354AA32
                                                  SHA-256:49AC42D63849F3FC001AE109C63578A43778E97EEF8696EFE7CBA9FB03FE820D
                                                  SHA-512:64A4E216A9EAF6804DFA273AECFB8F7B7BD513EDEC4D75AF1C4C7370E5C5CACC0209475ABE40587A5A8003462AA2F4678E8518D96413C3FDD84220589AB01773
                                                  Malicious:false
                                                  Preview:@echo off..pushd %~dp0..RunDLL32.Exe syssetup,SetupInfObjectInstallAction BootInstall 128 %CD%\bddci.inf..popd

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\bddci_reinstall.cmd

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):216
                                                  Entropy (8bit):5.127188347659828
                                                  Encrypted:false
                                                  SSDEEP:3:mKDDGQWT0yuJqpsgLA5vRpMKz6yEly6ZhwKMLRA59bR1GqWREEGRMGMily6ZhwKf:hSnJGqpsgLQXdEVt4rEE6RVtfn
                                                  MD5:C0D4FA051CFCE46BD180B8E1611FE221
                                                  SHA1:DCE6714DCFB8A5986A74D7997994BC8A7A74D691
                                                  SHA-256:681BAF813771192AAF8853BB0DD3773DA610B429F875CB93A501968DD886EC22
                                                  SHA-512:AAC3C218B41C5A90F81A7E9EEFCEAF9F8854763F254A495AA5455BCBA3D97231DD8AA02B35D43880C1F4A094B5FC0965109B267C4DA15B3682D062DA6D9ABC3E
                                                  Malicious:false
                                                  Preview:@echo off..pushd %~dp0....call bddci_stop..RunDLL32.Exe SETUPAPI.DLL,InstallHinfSection DefaultUninstall 128 %CD%\bddci.inf..RunDLL32.Exe syssetup,SetupInfObjectInstallAction DefaultInstall 128 %CD%\bddci.inf....popd

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\bddci_reinstall_boot.cmd

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):213
                                                  Entropy (8bit):5.153467971136594
                                                  Encrypted:false
                                                  SSDEEP:3:mKDDGQWT0yuJqpsgLA5vRpMKz6yEly6ZhwKMLRA59bR1GqWREEGRMZiEly6ZhwKf:hSnJGqpsgLQXdEVt4rEEMEVtfn
                                                  MD5:D689035E2D21C5D672CA0FA99B1D6FF9
                                                  SHA1:F21E0181303F0FB4A7C82EB76CCF9A5B4AD446E9
                                                  SHA-256:2ED8F11755D68E6E381914AE35995F815168B87948043D3871ED50D638F457AD
                                                  SHA-512:A50BAC4C7AA8A9F3334626F2C0A6DFC0B3D54D402A7E8276C21B9335009430F19DF7B244DAB00F6FDE538E345FECA09996BAF7927FDF0F4134E2D5DA3A94E8C4
                                                  Malicious:false
                                                  Preview:@echo off..pushd %~dp0....call bddci_stop..RunDLL32.Exe SETUPAPI.DLL,InstallHinfSection DefaultUninstall 128 %CD%\bddci.inf..RunDLL32.Exe syssetup,SetupInfObjectInstallAction BootInstall 128 %CD%\bddci.inf....popd

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\bddci_start.cmd

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):61
                                                  Entropy (8bit):4.3212158708844575
                                                  Encrypted:false
                                                  SSDEEP:3:mKDDGQWT0yVTBBn:hSnJVT3n
                                                  MD5:D1AAA0351E290303C8F2773E4444E5DD
                                                  SHA1:757E10E1FDC2919A10BAE72D215A1324F4ABA4E6
                                                  SHA-256:B356443280684F01A3666021662821EB9130EAB58EBE48A400726E7D82591F5B
                                                  SHA-512:7468CE3E229AAD292897BA3F531479D4764A38E1E6B58E3FD4AB9E5232FE6CAF9E040D8F742785B85802C4D4BAEF9598EBC78BDA92D525DA10C6C88AD5D7E2DF
                                                  Malicious:false
                                                  Preview:@echo off..pushd %~dp0..net start bddci..sc query bddci..popd

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\bddci_stop.cmd

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):60
                                                  Entropy (8bit):4.235546013316953
                                                  Encrypted:false
                                                  SSDEEP:3:mKDDGQWT0yVO9rCBBn:hSnJVz3n
                                                  MD5:18D3A452985E52AA8ADFF7737F116EEE
                                                  SHA1:3CE81B54F7C3A913509FCC78538CE239C6D41CB0
                                                  SHA-256:D42E07D8BD6FD9536552704B3556EF3DCC1C43B89E7BF0A4DEF59784391A9098
                                                  SHA-512:D3F337C26690258A3D1D02B555CAF1463FE49C9EA8AD51496EAC8E425AFE65952C2EA870798C2038282E196DBB9E4719FE7FD8742F8488F4B55E7687ED59896E
                                                  Malicious:false
                                                  Preview:@echo off..pushd %~dp0..net stop bddci..sc query bddci..popd

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\bddci_uninstall.cmd

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):110
                                                  Entropy (8bit):5.130096791944795
                                                  Encrypted:false
                                                  SSDEEP:3:mKDDGQWT0yOA5vRpMKz6yEly6ZhwKML5r:hSnJOQXdEVtG
                                                  MD5:32A10363F7CEF5F479734E468FAA54E9
                                                  SHA1:CCCB9C13D1F2A371443FAB4C8EFF346F54C764F5
                                                  SHA-256:E7CBA9FE65F75C973818ED70EBD764EA47B05956B7390DC8942AD6C5D150CE8E
                                                  SHA-512:B48B604312026442CEF5D6D6C437D9B202B97CB72506EE18FEDBC2DDCF8B97B7E6A575626432B3467DB25FEB0DB7F2F1EF5053EE1FDBAAD7A30866F583F74FEB
                                                  Malicious:false
                                                  Preview:@echo off..pushd %~dp0..RunDLL32.Exe SETUPAPI.DLL,InstallHinfSection DefaultUninstall 128 %CD%\bddci.inf..popd

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\bddcihttp.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):2376224
                                                  Entropy (8bit):6.698759684275736
                                                  Encrypted:false
                                                  SSDEEP:49152:VC0U2o0WrUbHxkBfQcfguHeDf7smVaSkF1UcDTYGZSgZsTmh5c1:VPGtQkHecSk3UcoGmz
                                                  MD5:F66029EC83576428B20CDE5A32E24C43
                                                  SHA1:05E4C7CAF1E123F67C999DA1A99AA7AD07896046
                                                  SHA-256:EABA389587402DCECC042810F69139685A6AF9B872D778750A789209621D1F90
                                                  SHA-512:3F0830A0756AF08639069D2B69257ADC48410A5E08F9E25C0572C84C4327277739BE15688F34D71B93710429ED8CE15372CE78F2EFEBE1005E98F07D3F22CD8E
                                                  Malicious:true
                                                  Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.........A<K./oK./oK./o_.,nF./o_.*n../o_.+nP./o..+nC./o-..oJ./o..+nZ./o..,nR./o..*n../o_..nF./oK..o../o..&nd./o../nJ./o...oJ./oK..oJ./o..-nJ./oRichK./o................PE..L....Y.d...........!.........t..............................................P$.......%...@...........................".......".x....`#...............$. @...p#.......!.....................@.!.....h.!.@............................................text.............................. ..`.rdata...H.......J..................@..@.data....`...."..L....".............@....rsrc........`#......$#.............@..@.reloc.......p#......*#.............@..B........................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\bdnc.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):1997344
                                                  Entropy (8bit):6.754349511406938
                                                  Encrypted:false
                                                  SSDEEP:24576:X4/sAkx4It2YxQiLOgr3OPwwne/hh9jPz6aC2gV0eS+cqN8za3Zv97Ci9Q/rC351:XjxjtJQX8hVCBV0eIeq1w32TKfpAw
                                                  MD5:BEF663C7DB6CE506CBB50CCED9A11A2F
                                                  SHA1:21EEB150BDF3051ABAF6393C99E97FF7A34525C4
                                                  SHA-256:24E4A501A7C9BF0D6AFBC9F01D98A88AB83FFFA3F6DA43DA37B684F580E9D7FD
                                                  SHA-512:DF90FB36DC2DAA6D38E9907AA6B07A9D51D58E46D7FE892BE1E6E908440DAD8B8A29A7D19E6D86A8C2C872238D74BFD70566871DFFB8DCCAA2C1D6A32A4B5E03
                                                  Malicious:true
                                                  Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........*...K.}.K.}.K.}.;.|.K.}.;.|KK.}S<z}.K.}S<.|.K.}S<.|.K.}S<.|.K.}.;.|.K.}.;.|.K.}.K.}>K.} ..|.J.}.<.|.K.}.<.|.K.}.<x}.K.}.<.|.K.}Rich.K.}........................PE..L.....a...........!................................................................\.....@.............................p............................:.. @..............p...........................8...@...............$............................text............................... ..`.rdata..............................@..@.data............V..................@....rsrc................N..............@..@.reloc...............R..............@..B........................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\bdnc.ini

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:ASCII text
                                                  Category:dropped
                                                  Size (bytes):108
                                                  Entropy (8bit):4.584132838074214
                                                  Encrypted:false
                                                  SSDEEP:3:RwCKXF83Mnmz8BCjY9kHvGPbGymjyRZF:BE7mz8KYeGbGym4ZF
                                                  MD5:153E80B1EC9BAEC5619ACEEBFDE340C6
                                                  SHA1:5374991113BD75BC60DF99B372E61DEB6D5340EF
                                                  SHA-256:C7890B7AA3FBE8AAEF3CFFD4215B870489A54C9E450B1A91A8021D48BE3547BA
                                                  SHA-512:3FCE1BD79FD944554DCB09E74E33A01F443A358FD3B42334926E8C9DC385C9F717BB9D48F022E5B4A7486AD7A091246C4EEF64CF212BA29812D967F60934E2D2
                                                  Malicious:false
                                                  Preview:BootstrapServer = nimbus.bitdefender.net..# LogFile = bdnc.log..# ProxyName = .# ProxyUser = .# ProxyPass =.

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\bittorrent.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):94752
                                                  Entropy (8bit):6.59207031871241
                                                  Encrypted:false
                                                  SSDEEP:1536:wAW3xF16mcNmDt9hkH5XvXy/T4/0esWpcdF7Zit1UH7yw1g5xFn6X3heV:lmcNm5fkH5oE0fF7Mt1UH7L1w7V
                                                  MD5:F10D1AF7250925D6E5280F0EF1764B4E
                                                  SHA1:B2F0D0B6F6FC0006B5D84FB84A1CA9BB8DCAED29
                                                  SHA-256:1C283CC9B21A2391856E01CE5DE0ACDC14829951E7BE7ED1497812683FCDF24B
                                                  SHA-512:018EB528DC2541F72EC642A68DCFB96C53B653692B9622291A2EBDCDD547BF1E9C464705D2B537ADB0D88470532FA5CFD1EE7C8F1FAD802C876577D2313E8384
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........t.@h..@h..@h../...Hh../...>h../...Rh...3..Qh...3..Vh...3..Oh../...Eh..@h...h..3..Bh..3..Ah..3..Ah..3..Ah..Rich@h..........PE..L.....n\...........!................................................................[.....@.....................................<....P...............2.. @...`..X.......T...............................@............................................text...7........................... ..`.rdata...f.......h..................@..@.data...<.... ......................@....gfids.......@......................@..@.rsrc........P......................@..@.reloc..X....`....... ..............@..B................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\bridge_install.cmd

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):167
                                                  Entropy (8bit):5.102379914131941
                                                  Encrypted:false
                                                  SSDEEP:3:mKDDGQWT0yB83vQXAtlNdfDZj4I5pEIRfT8ZEEyAZ51AUmhMW4crWarA5Mn:hSnJB83vQQtlNj5TL65yULWRCGjn
                                                  MD5:996CD85E5F005D76E1B7F6033AD3840F
                                                  SHA1:D2111E0E5CDB4FBCF0C7220D4BFDF71CB495FB60
                                                  SHA-256:328A059D0FD3BBFCE208BD5DF73D14D0B56B2C0EE79BF7E6E2017211150655C1
                                                  SHA-512:8F1C15E4C0E274E548843D102CF8A722EEDFDC098AD36AE45BF0A84F70C96360E7704A25E0CD7067191E594FA6931F46FF0ADD09DEB7F8BE8F38DF1873B0F81F
                                                  Malicious:false
                                                  Preview:@echo off..pushd %~dp0..sc create DCIService binPath="C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\DCIService.exe" DisplayName= "DCI Bridge Service"..popd

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\bridge_start.cmd

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):49
                                                  Entropy (8bit):4.445644282581652
                                                  Encrypted:false
                                                  SSDEEP:3:mKDDGQWT0yBsns2yAB:hSnJBsZB
                                                  MD5:95E8C6CD0A911F1AB4969C06B8CF77A2
                                                  SHA1:BE1B1F8ABD0420F59ECAB7BCF8120CDC2CE34195
                                                  SHA-256:DE795F6D8591577054813BEE79E7C5B4EE13360039D29AA73971C6B985D26EBD
                                                  SHA-512:E5EEFAF761BE7BF3CEA207E22E98398093FA0A9D3B459AF7DF22BFBF07755816737A7B8B261ACF01AEC8B10B5D8F0D90132A4ECDD83C242B2CDE883039FAC1FF
                                                  Malicious:false
                                                  Preview:@echo off..pushd %~dp0..sc start DCIService..popd

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\bridge_stop.cmd

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):47
                                                  Entropy (8bit):4.323220703147271
                                                  Encrypted:false
                                                  SSDEEP:3:mKDDGQWT0yBs0bbnXA0vQB:hSnJBs0vnX9U
                                                  MD5:2D655B2F0502E2E7DEA4154A8C801219
                                                  SHA1:E20FE8994AD78028516BFDFA1804C3BC8CF19D6F
                                                  SHA-256:93CEBF47CF6FC0088D589B62BF805F371E5EBF12639EB4DAB9F21E753D1BB8AC
                                                  SHA-512:7F6009BD8C5EFB4A60191574CF850AC5F83BFF2F9A38F148206A566F4BAA0E82EE9ABE0C358CFF57F27EC5727685FBAE5A3F03D77A920EF438801F70E06FCC6F
                                                  Malicious:false
                                                  Preview:@echo off..pushd %~dp0..sc stop DCIBridge..popd

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\bridge_uninstall.cmd

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):73
                                                  Entropy (8bit):4.752922463132331
                                                  Encrypted:false
                                                  SSDEEP:3:mKDDGQWT0yB7s5vw414NaDw9IvVun:hSnJBUR4Na1vUn
                                                  MD5:808896D128F2DF4E933CBC8E48B589E2
                                                  SHA1:0B8A2851D08111843EC9DB698CA716053CD94E10
                                                  SHA-256:4827234DB594CD6DC42E97A6E6A418B3D2C691A9354FF6E9C8E03C5B5454F1F0
                                                  SHA-512:83680AD9519207AF630B151C82F7979764D216AF8DC0B68C4BF051E240F52BF7E2FF2C3A138EC7577A33FC1A27CE8731E59FA84C7C008FF7765542AFF767E4FC
                                                  Malicious:false
                                                  Preview:@echo off..pushd %~dp0..sc delete DCIBridge binPath="DCIBridge.exe"..popd

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\concrt140.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):252200
                                                  Entropy (8bit):6.686835136650429
                                                  Encrypted:false
                                                  SSDEEP:6144:HdynmUAZcA2pxuarMEc+vA54+0omeCrB/04LU+KS1yQZS0IuVx8i5S12z/VsTB:6pLnxB/0AncuVx8cz
                                                  MD5:3DA20013485A5651B687711BF859D8B9
                                                  SHA1:6C4071F22F5F5C6B14B8019AD8BECC2D2DD7A14F
                                                  SHA-256:FB9772945DEDBA1C28FB523244DFC3A849EB9EBFE70B166687DB03E196D5CD1E
                                                  SHA-512:FFA88023F5C54674944F7EF2062027C76251E451C0EE42A6B4594EC503FE09E7118E73993C1BFC49F3E0497F42A980E53F4E6A70E11D3DB55AFDA2C4E505C03C
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........Nf.. 5.. 5.. 5BO.5.. 5...5.. 5..!4.. 5..!5}. 5..$4.. 5..#4.. 5..%4.. 5.. 4.. 5...5.. 5.."4.. 5Rich.. 5........................PE..L...}8.^.........."!.........z......@........0.......................................T....@A.............................K..<r..........................(A.......,...;..8............................<..@............p..8............................text...l........................... ..`.data....4...0...2..."..............@....idata.......p.......T..............@..@.rsrc................f..............@..@.reloc...,...........j..............@..B........................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\ftp.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):106528
                                                  Entropy (8bit):6.589366630446392
                                                  Encrypted:false
                                                  SSDEEP:1536:IUXZmooK5uduWApRuPvC/8hL5QTdoYYqsWaJcdFKwZEFT/l9/SliM4ktEsg5xjyO:IUX88WAqPv4RRhFDKFT/CiM4kusKy9rk
                                                  MD5:617CEB4843AC63404DB4EF8963EF968B
                                                  SHA1:A9B99133AD04D17F9C5F6F3C0F589A221BDE25E9
                                                  SHA-256:E8F30170AFB878D4E1768431B6F8484B36456DCCDBCB957F74D4126430CEC7D9
                                                  SHA-512:778D01CACAA17D48903B422F93E5C5B182E6B2324CC582800F4927D3AF3322D7409D8C0071EA7E66160FCE1828969245356E8572CCF65B7DE7078F10516563A2
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........}.^.............x.......x.......x.......G.......G.......G.......x..............`G......`G......`Gc.....`G......Rich............PE..L.....n\...........!................b%....................................................@..........................G......4H..<....................`.. @..........`<..T............................<..@............................................text...|........................... ..`.rdata..$n.......p..................@..@.data........P.......6..............@....gfids.......p.......D..............@..@.rsrc................F..............@..@.reloc...............L..............@..B................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\http.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):160288
                                                  Entropy (8bit):6.677970992034964
                                                  Encrypted:false
                                                  SSDEEP:3072:/TkVtLD/j7esk/PsToM1MXF/VlEMp11l6Nhj+zIXsW6J4BP25eN9q0WK7B:ILD/jq+h1U/VdT1lyhj38p2Ke/FWK7B
                                                  MD5:12613CAB10EC2259B02AF7E5084E43C8
                                                  SHA1:176EE92FD2C2CDEA77E0152459517137726892BE
                                                  SHA-256:B5AB00F61318900BC20AB9D555E31A4A594773123DA18E5B343D39BD722EF14B
                                                  SHA-512:80B0C48F077043ADD53141209C51E0156CCF797E3DC9DFDC05D566E430815917D4D033B04AA7A5455223B687CE7F21477F7344D4712C00E267ED26D96182BB65
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........w..I...I...I...&r..C...&r......&r..[....o.K...'M..Z...'M..Y...&r..L...I.......'M..T....M..L....M..H....MW.H....M..H...RichI...........................PE..L.....n\...........!.....t................................................................@.........................0...........<....P...............2.. @...`..........T...............................@............................................text....r.......t.................. ..`.rdata...............x..............@..@.data....#..........................@....gfids.......@......................@..@.rsrc........P......................@..@.reloc.......`......................@..B........................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\lsa.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):95264
                                                  Entropy (8bit):6.590888680570747
                                                  Encrypted:false
                                                  SSDEEP:1536:23AW3g0416hemmVvaWMHOuiyeT4/0esWpcd+QZOG18FTRyw3g5xI33hslc:MlhemmVTMHWE0f+QUG18FTRL3Rmc
                                                  MD5:93F4A39860864BA3E2951760DC0DF9A7
                                                  SHA1:2FFEDFADA53D4DDFF3D012F31385462196F3469E
                                                  SHA-256:35144EDC0079E04AD022E6BE729B1EB37F93ED4E289A9A547EC61F82CE35B988
                                                  SHA-512:7070485E6F8C3FD52E61E1892609ED017409C3A22826C3E7448F0BD633CB3E9949A81BD10B013B40E0731AC7E2BB23F401F2059477E1AEF54E63B8E2E84A6DC1
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........t.@h..@h..@h../...Hh../...>h../...Rh...3..Qh...3..Vh...3..Oh../...Eh..@h...h..3..Bh..3..Ah..3..Ah..3..Ah..Rich@h..........PE..L....n\...........!......................................................................@.........................@...........<....P...............4.. @...`..l.......T...........................(...@............................................text...w........................... ..`.rdata...f.......h..................@..@.data...<.... ......................@....gfids.......@......................@..@.rsrc........P......................@..@.reloc..l....`......."..............@..B................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\msvcp140.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):456480
                                                  Entropy (8bit):6.668806207955215
                                                  Encrypted:false
                                                  SSDEEP:12288:xltXrXT8sqcLNvDbiv7TlkWBElGuIMyYehUgiW6QR7t5s03Ooc8dHkC2esrMnUv:xfXrXTXLNvDb0TlkWBElqYd03Ooc8dH4
                                                  MD5:448B345BCAC7EC3729F291229C942060
                                                  SHA1:5813E35F62F3C670D02CF18DFA0DCA523108660E
                                                  SHA-256:5B920691E5273821987680FAB51B91F9DE89CF2C66C10C568DCA57EAF2AE74FA
                                                  SHA-512:72D01D35716AD9E1FDE5941854B811765479C73A7A3CDC9E3FEFCD3A6AECF68657354599B5CD18E67C8B1A61A3D5756AE83B13963C08E7BB638E415236C9D136
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......).>gm.P4m.P4m.P4...4o.P4d..4{.P4m.Q4..P4..Q5n.P4..T5f.P4..S5e.P4..U5..P4..P5l.P4..4l.P4..R5l.P4Richm.P4........................PE..L....8.^.........."!.....D...................`......................................+.....@A........................................................... A.......;...z..8...........................Hy..@...................$...@....................text....B.......D.................. ..`.data...l(...`.......H..............@....idata...............`..............@..@.didat..4............t..............@....rsrc................v..............@..@.reloc...;.......<...z..............@..B................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\msvcp140_1.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):28960
                                                  Entropy (8bit):6.861725840767029
                                                  Encrypted:false
                                                  SSDEEP:384:Kd4+Xc9tef8gsj7yPqrpTtWcS5gW56voWi9pBj0HRN7iA9WixHRN7ZEimfklw:BwB1qrFY2AWvYyZ
                                                  MD5:CF8B6FDBB674082AA771277518FFA224
                                                  SHA1:53CE8BCB30178BF428A8A21B75406BFBF7D888D9
                                                  SHA-256:2D42CE741E0157C976CEBA4E57B19E9B3DD3CD25969A4B1AE6FFF0D9ABFFA832
                                                  SHA-512:3ECB7F06179391BBA224288E272451899058CA170412BA9184E7EA5BCB3FE5F2399F2652FA010A8D24290933FE4F98D988A347FDCD14897CDE6690D37C1BEA39
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................("-.......Q.....d.....d...........d.....d.....d.....d.=.....d.....Rich............................PE..L....8.^.........."!.........................0...............................p......n.....@A........................0*..J....@..x....P...............0.. A...`..t...X...8...............................@............@...............................text...z........................... ..`.data...@....0....... ..............@....idata.......@......."..............@..@.rsrc........P.......(..............@..@.reloc..t....`.......,..............@..B........................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\msvcp140_2.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):174368
                                                  Entropy (8bit):6.873198907654365
                                                  Encrypted:false
                                                  SSDEEP:3072:2Z5HgjV47eKf7s/1ViHQqG5n9wqJGbdqnL7wmH9/MwEATGu2I6I7c8w4:2ZdG47O/1owmmr9/MwEACu2I6I3
                                                  MD5:FEB206FE582C088F9697255EADFF2CD5
                                                  SHA1:19679CD834927C1A5C1ED01A75D855ED7C932F21
                                                  SHA-256:2232EC6B4516531A0CA248F0F14A397A36C566D2E22E7AAC6FBADF5504C485B0
                                                  SHA-512:5A6B3B223CB9684434A71E02113D8B9A1F42F6CF589E61784E1E6525F1E4FE7C4A22CAD2CACC4314BB1F3D326E9BE08AF2703F46C3B1D1C9B14E2C3CE66E19AC
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........H..&..&..&.i...&......&.%."..&.%.%..&..'...&.%.'..&.%.#..&.%.&..&.%...&.%.$..&.Rich.&.................PE..L....8.^.........."!.....,...<...............@............................................@A.........................4..@....Q.......`...............h.. A...p..D....\..8............................\..@............P...............................text....+.......,.................. ..`.data... ....@.......0..............@....idata..`....P.......8..............@..@.rsrc........`.......F..............@..@.reloc..D....p.......J..............@..B................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\msvcp140_codecvt_ids.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):26400
                                                  Entropy (8bit):6.826764841044341
                                                  Encrypted:false
                                                  SSDEEP:384:cyW4C8dwOjYOIT1WioEWm6voWi9pBj0HRN7vAKzzWixHRN7HEimfklw:bn2CAqPAW7zayH
                                                  MD5:48FA51AED61FB303B949CB0545AD7759
                                                  SHA1:AE04F67C7F0F1859F3DAF89A3E22D07DFF1992A1
                                                  SHA-256:17CF677904C065E5874621381EE3BF6E7E1EA5C0E15DE3526E0B652959C6A081
                                                  SHA-512:8E8C8AADB4C8C35265657B8BA4EE37D4D91F864F81E3E78A8622F4E94C3626750A50D7BE66E5024C8F6B4EBB9DF95B6687A7D29D81C4C93BEC8D64DEE6365300
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(T.vF..vF..vF.....vF......vF..vG..vF.Q.G..vF.Q.B..vF.Q.E..vF.Q.C..vF.Q.F..vF.Q....vF.Q.D..vF.Rich.vF.........................PE..L....8.^.........."!................0........0...............................p......T.....@A.........................!../...l@..P....P..0............&.. A...`..D...D...8...............................@............@..h............................text............................... ..`.data........0......................@....idata..t....@......................@..@.rsrc...0....P......................@..@.reloc..D....`.......$..............@..B........................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\pop3.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):97312
                                                  Entropy (8bit):6.598500903761848
                                                  Encrypted:false
                                                  SSDEEP:1536:gm5TSzd14C4fqUQUxbJmTS0QdJgWTwTsWoScdygZquT6L2CQ/g5xry3hyXoC:iUQUxNmT1W0yTyg4uT6L2b/6vYC
                                                  MD5:EEF9F8BFBAC36C94B60BF9F56EEA6843
                                                  SHA1:52BE28DB936EAA08CFBF20A03F42C312D8123F69
                                                  SHA-256:D7CB01AA1F43F33BB2ED9770310D63E8E88C18F1999ABFDD924FCE87C379BB5C
                                                  SHA-512:F2D4A720ECE430CE469FAFA5F2CE9667D2C6BE165C2C4EDF76708D57AFB83AAB6AC9102E86EF5D3A13D2F1EAA7010AF0CAF874CAEF76749AC4272A5DC369179F
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......c.|.'...'...'...H.......H.......H...5......&...I$..5...I$..<...I$..7...H..."...'...l....$..$....$..&....$.&....$..&...Rich'...........PE..L....n\...........!................B...............................................Dz....@.........................0 ....... ..<....`...............<.. @...p..........T...............................@............................................text.............................. ..`.rdata...f.......h..................@..@.data...@....0......................@....gfids.......P......."..............@..@.rsrc........`.......$..............@..@.reloc.......p.......*..............@..B........................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\rpc.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):95264
                                                  Entropy (8bit):6.5969601086389975
                                                  Encrypted:false
                                                  SSDEEP:1536:bAW3HK16EzGm6vaWMHup1ydT4/0esWpcdxOZOOC1PczkywPg5xhn33hmlI:fEzGm6TMHZE0fxOYP1WkLPYnIK
                                                  MD5:D48696E276A26FD0015ABBD5969426D2
                                                  SHA1:B98171D31DAC59E2D2FD5B671C7A151D3F1E0CD5
                                                  SHA-256:24A9F556383A23829CBEA48A947F1A0D20343E59D6A2AC7B03BD525D17FF59AD
                                                  SHA-512:0FAA877395297AB7B6D917BC9EF1976C7A9610C1D66679F5F250B419615741E32C9A711AB07EB6065F92C67266BEE29359FB08C645237A8B38BBE623D3D859AD
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........t.@h..@h..@h../...Hh../...>h../...Rh...3..Qh...3..Vh...3..Oh../...Eh..@h...h..3..Bh..3..Ah..3..Ah..3..Ah..Rich@h..........PE..L.....n\...........!................r.....................................................@......................... ...........<....P...............4.. @...`..d.......T...............................@............................................text............................... ..`.rdata...f.......h..................@..@.data...<.... ......................@....gfids.......@......................@..@.rsrc........P......................@..@.reloc..d....`......."..............@..B................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\sav.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):569888
                                                  Entropy (8bit):6.710309793908797
                                                  Encrypted:false
                                                  SSDEEP:12288:jbmBHxoTfKHvvQh4ZiY9eatBURNrvkB2mvaNWXbcuU/daiRF9ha0OoKvCz7cO11E:jbmBHxo7KHXQh4EY9eatBURNrvkB2mvL
                                                  MD5:A89B7B393C40D971B43CD185558BA38C
                                                  SHA1:3B183A378CECBD133F9064E192B6629E74EDC78E
                                                  SHA-256:EAB455BDC63E8E10596C3F420DE906E4AC9C33265CE174DFB72BA35038A821CC
                                                  SHA-512:EF454040E7E026698DE03028ED7C951F22EB1A3D3693799C5225BA2AD2160B43DF4E9AA4E46CACB479BB6DBF159F64385903296F08605F21A99199FF7A780B88
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A.M./.M./.M./.".,.G./.".*.../.".+.X./.#.,.V./.#.*.~./.#.+.../."...J./.M...9./...'.../.../.L./....L./...-.L./.RichM./.................PE..L.....n\...........!.........................................................@.......D....@.................................x...P....................r.. @......dF...~..T...................t...........@............................................text...C........................... ..`.rdata...E.......F..................@..@.data............8..................@....tls................................@....gfids..............................@..@.rsrc................$..............@..@.reloc..dF.......H...*..............@..B................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\scan.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):734752
                                                  Entropy (8bit):6.549973169403991
                                                  Encrypted:false
                                                  SSDEEP:12288:BTkrgrhzPE3YUaakpDLMvxM1kszTSC61T4+IglUUOnhEZ07JlR0H7reME21mgbt7:GglzPE3YUa7pDLMqWszTSC61T4+IglUi
                                                  MD5:D1859C4068F2FB019366F631D4E6A640
                                                  SHA1:714B298F4D424089281F6B70B63C7C151BB2732B
                                                  SHA-256:70D0573766CE7D5AED1841D8D33169CC91217026916A8EA59041D713DE1E1FEF
                                                  SHA-512:C6772146FD6BFA4C7B410B8D0A1AB0E1D5D32D748C90D9B540CD997961E1E41065A267EE82C5F5F9F0601BBE06ECD0F02D9B2BBD2335C53EEE783D0D155A9A55
                                                  Malicious:true
                                                  Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.........t.O..RO..RO..R[..SD..R[..S...R)..RN..R...S^..R...SW..R[..SZ..R[..S@..RO..R...R...S~..R...SK..R...SR..R...SN..R...RN..RO.RN..R...SN..RRichO..R................PE..L...U..a...........!.....@...................`...............................`......KU....@.........................0................p..Hy.............. @.......c...P..p............................Q..@............`..<............................text...f=.......>.................. ..`.orpc...c....P.......B.............. ..`.rdata.......`.......D..............@..@.data....c.......B..................@....rsrc...Hy...p...z..................@..@.reloc...c.......d..................@..B................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\smb.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):160288
                                                  Entropy (8bit):6.655808489108428
                                                  Encrypted:false
                                                  SSDEEP:3072:OmsYq9WXmeNagy7WK4S8S2IhXTvG0FTD+0oozeOA2I0:DsaXm5N7WNcTvbD+26J2I0
                                                  MD5:E853FAB879C6C66DAA7D67DA71713CE9
                                                  SHA1:93024F5ACA7CF2B9C0AB2359EBA88766BEE30319
                                                  SHA-256:0169B536EB9EF2F527E3256F5BF25D2A088ED6228624DA201DFFA7B64CB18727
                                                  SHA-512:B1114639A7F0DBACCD47E6ABD4E6E90D92FDD9F9EA5E57C9B84A46E233B281D819067FCF2EC6F061D070610B7A1C17CCDEE4D5F8BEDDF5100DF86CB4512133C2
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......p.S4...4...4...[...=...[.......[...&....#..5...Z...'...Z.../...Z...$...[...1...4...................5.....5.5.......5...Rich4...................PE..L.....n\...........!.....^..................p............................................@.........................0...........<....@...............2.. @...P..L!......T...........................8...@............p...............................text...v\.......^.................. ..`.rdata.......p.......b..............@..@.data....$..........................@....gfids.......0......................@..@.rsrc........@......................@..@.reloc..L!...P..."..................@..B................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\smtp.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):104992
                                                  Entropy (8bit):6.631913962273684
                                                  Encrypted:false
                                                  SSDEEP:1536:4hCvfBOj7HLJcGc3hVuv5eYt6/ATdoYYqsWaJcdbKZSZ9zj6tEOzg5xWE23hUr:/vfWrcTuvpRRhbK03zj6u0/6r
                                                  MD5:AF69DAC89447E330DABB24CFD6727294
                                                  SHA1:61B2EFE2A1C7B074A6623CDEE6C0BF678501E0C9
                                                  SHA-256:DF7D222C8358E3A26218724065BA6264F54F372A9AA0B638D56FF144CB0A7272
                                                  SHA-512:D02D0EFCE3A5D70CC765BC744992B6887642DE28D98F52FD605FDC54B9B8017A8C5FB13CA8F3481EB07F5EAC9E64E5C3ADEDAE3B71F8C5F518D180F68411AB11
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........}.^.............x.......x.......x.......G.......G.......G.......x..............`G......`G......`Gc.....`G......Rich............PE..L.....n\...........!................!'....................................................@..........................C......XD..<....................Z.. @...........8..T............................8..@............................................text............................... ..`.rdata..Hj.......l..................@..@.data........P.......2..............@....gfids.......p.......@..............@..@.rsrc................B..............@..@.reloc...............H..............@..B................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\ssl.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):164384
                                                  Entropy (8bit):6.754040419127566
                                                  Encrypted:false
                                                  SSDEEP:3072:c1Xa83vdx9QMCeNLBkQyrwcm2LXv4FbxzXtgnvCR0zsl:c1Xaa3PCeNKQcwbLXtMvnzsl
                                                  MD5:64DAEF088239F9C2382F498AAFDAF955
                                                  SHA1:4240EB2572FE650B802533A48CE3E55D0E98EEFE
                                                  SHA-256:963EEC824AF55474D5CF310ECFE3C707233159ECB38F21F4D112FC8CA87D0A85
                                                  SHA-512:1CA3BA5F45A1338A2AA5E0ADF167CB5750E071E1954406892EAF2CFABCC47452136EA247300DD169A5B71851D7BFEFEF4E56182891E48D2C883FCC842977FCCE
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........o,>X.BmX.BmX.Bm7jAlQ.Bm7jGl..Bm7jFlJ.Bm..mY.Bm6UAlK.Bm6UFlH.Bm7jCl].BmX.Cm..Bm6UGlE.Bm.UKl[.Bm.UBlY.Bm.U.mY.Bm.U@lY.BmRichX.Bm........................PE..L.....n\...........!.....`...........v.......p.......................................r....@.................................d...<....p...............B.. @......,.......T...............................@............p...............................text....^.......`.................. ..`.rdata..T....p.......d..............@..@.data...H7... ......................@....gfids.......`......................@..@.rsrc........p......................@..@.reloc..,............$..............@..B........................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\ucrtbase.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):883712
                                                  Entropy (8bit):6.824170675528273
                                                  Encrypted:false
                                                  SSDEEP:24576:0WmPrDND1ONC1r4pD84TfEXpS8sYsen/mKvTZuoy4YJp:DmPrBu1ygr
                                                  MD5:8ED02A1A11CEC72B6A6A4989BF03CFCC
                                                  SHA1:172908FF0F8D7E1C0CBF107F7075ED1DBA4B36C8
                                                  SHA-256:4FD02F2699C49579319079B963425991198F59CB1589B8AFA8795B5D6A0E5DB3
                                                  SHA-512:444FE62A5C324D38BDC055D298B5784C741F3CA8FAAEAED591BD6DCF94205DBF28C7D7F7D3825CCB99EFF04E3FFD831E3F98D9B314820841A0C0960AE6A5E416
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............`.`.`....`.a...`.`..`..:..`..:..`..:....`..:....`..:....`..:..`..:..`.Rich..`.................PE..L...t.nU...........!................`k...............................................(....@A........................`...'............................<...@... ...V...u..8...........................8v..@............................................text............................... ..`.data...............................@....idata..d...........................@..@.rsrc...............................@..@.reloc...V... ...X..................@..B................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\vccorlib140.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):275232
                                                  Entropy (8bit):6.600111760893926
                                                  Encrypted:false
                                                  SSDEEP:3072:HoRQZd7vnoB93x5M1rf0773i8jZuIK7bMevXVdKMHFtEfiS:HHujMqFuIK7YeNdKv
                                                  MD5:199F85E87D48D322249A979F19DBD189
                                                  SHA1:754B6B1CBA661D1D15D5065850C1D67FDE5E922F
                                                  SHA-256:E586C91057CEE6852EEEB796FBFCB091A46B2539E1D928F907F8E16CF74B99F2
                                                  SHA-512:4AE29D2AD1EB5EC5EC49422308CADA89082D66B9EF4C99B69C65DD991023FB60A4776D1DAB7344F10A067C335A6823188D939CDB3908A1A2D1F2369098244734
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......CQD..0*..0*..0*..H...0*..@+..0*..@/..0*..@...0*..@)..0*.....0*..0+.t0*..@#..0*..@*..0*..@..0*..@(..0*.Rich.0*.................PE..L....:.^.........."!.........................0...............................0............@A.............................=.............................. A.......W..lJ..8............................J..@............................................text...+........................... ..`.data... p...0...n..................@....idata..............................@..@.rsrc...............................@..@.reloc...W.......X..................@..B........................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\vcruntime140.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):83752
                                                  Entropy (8bit):6.903773905350177
                                                  Encrypted:false
                                                  SSDEEP:1536:ygQmqDRK9IfURwL67cuhH6poqPpep4yW3UecbiEI+/z3SnC:yg+DRGI86L6gshupXUecbiEZ
                                                  MD5:55C8E69DAB59E56951D31350D7A94011
                                                  SHA1:B6AF2D245AE4D67C38EB1CD31E0C1CFFB29B9B2C
                                                  SHA-256:9D8D21022FF9D3F6B81A45209662A4F3481EDC2BEFAE0C73B83CF942EAB8BE25
                                                  SHA-512:EFB2AC1891724DF16268480628EB230B6EE37ED47B56D2E02A260559865CDD48EE340CE445E58F625E0F4D6DBDC5BFB7CE2EEEDF564B837CFF255EF7D1DC58CD
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......reM.6.#F6.#F6.#F...F4.#F?|.F=.#F6."F..#F.t G%.#F.t'G".#F.t&G*.#F.t#G7.#F.t.F7.#F.t!G7.#FRich6.#F........PE..L...~8.^.........."!................@........................................@.......\....@A........................P................ ..................(A...0..t....#..8............................#..@............................................text...d........................... ..`.data...............................@....idata..............................@..@.rsrc........ ......................@..@.reloc..t....0......................@..B................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\BDUpdateServiceCom.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):3688992
                                                  Entropy (8bit):6.6835125568988
                                                  Encrypted:false
                                                  SSDEEP:49152:6NVwASOmGtlq+yIU6iztwR8XZej3F2pVKy61r7wVv0CTBMAOh5P5UcYimjrdhYYI:G1+zkxP2eirzYYDAWYDxh
                                                  MD5:D8008AF3901A9EC9D4244CF26084E047
                                                  SHA1:ACCAAEEE0EC22128204691F447BA3912C3AFEE72
                                                  SHA-256:22C63916383F6A1ED6D2C3E46025515A46F0B5B9B35B37D2ACCD2EF21B545F64
                                                  SHA-512:9B45BCF3998DCE2C29ED422D156DB1AB1ABF90A11888B1DBFADA8A6BB7E1EA0DA4DB714956BED2DA5CBAB54F14023332E0873CB871D29020FD24A5D0969D15B8
                                                  Malicious:true
                                                  Preview:MZ......................@...................................P...........!..L.!This program cannot be run in DOS mode....$........6.MUW..UW..UW..A<..]W..A<...W..38}.XW..."..DW...".._W..A<..EW..A<..CW..A<..WW..."..fW..UW..IW...>...U..UW...V..\/..VW..."..YW...>.._W...>..hW..."..PW..."..WW..."..TW..."..TW..UW..TW..."..TW..RichUW..........PE..d...x..a.........." ......(..\.......%.......................................=.....,.8...`..........................................)5.|....+5.......=......P;.p.....8. @...0=.,s.../3.p............................/3.8.............(.X............................text...<.(.......(................. ..`.orpc...,.....(.......(............. ..`.rdata...z....(..|....(.............@..@.data........P5......*5.............@....pdata..p....P;.......5.............@..@_RDATA........=......z7.............@..@.rsrc.........=......|7.............@..@.reloc..,s...0=..t....7.............@..B................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\DCIService.exe

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32+ executable (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):3420376
                                                  Entropy (8bit):6.506654255902519
                                                  Encrypted:false
                                                  SSDEEP:49152:g0blwtOa+nH+h4hBNW8hqV9tfP09Q+80YJNSVevwSGCeRyJFdPSQRoPARHJV:ENMc0iGzRUEQRxpV
                                                  MD5:3827CA1C0EC114A29BB576BEF431F070
                                                  SHA1:1189DD380F160046DE9F5F2F1D74459958F31A4B
                                                  SHA-256:DD45886108AA85350FEAA6D9FCC6C922B0874DFA18BBFE23111CC8EDCB37FCB1
                                                  SHA-512:480B6A1FC02FDEC7FC2316F01B239BCE98A6D8152770D329DDC4BFB37E2E00A7987A702900523CCC0380CAABBEE38A404683DBB20FE9C9B9456083559AFB8218
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................$...........J.................................<...Y.....Y.H...Y.....Rich............................PE..d....m.e..........".......%..p......d=%........@..............................4.....A.4...`.................................................l.1.......4......02.......3..2....4..l......p.......................(...P...8.............%..............................text....%.......%................. ..`.rdata..~.....%.......%.............@..@.data...h....P1......61.............@....pdata.......02.......1.............@..@.rsrc.........4.......3.............@..@.reloc...l....4..n....3.............@..B................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\OnlineThreatsSimple.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):274976
                                                  Entropy (8bit):6.453594795582743
                                                  Encrypted:false
                                                  SSDEEP:6144:8/nmbfJjqGaDTzrw4yFbHgs8sUUfkXB1OFE:8SfJ+GcTbAgs8148F
                                                  MD5:BC9AAB911CB1DB5A48257856F37535B8
                                                  SHA1:3E1CB75E5537776CD560F1F43C74DFA78A07BD5F
                                                  SHA-256:8A787F1558CF9ADDE749475C564F6425814CBC878817FB93C046F6475E32CCF0
                                                  SHA-512:E998201E5C53B6167350FEE9A01C32FC9BFE3DB2330C4D4DDF02C33D4A4AEEE329CAD1748DCE06056770E0D5CE40829E5ADB60018A316E64E047F845DEC7CE46
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......|..B8.`.8.`.8.`.,.d.3.`.,.c.=.`.,.e...`.j.d.7.`.j.c.1.`.j.e...`.,.a.=.`.8.a.U.`...i.5.`...`.9.`....9.`.8...9.`...b.9.`.Rich8.`.........................PE..d... ..b.........." .........B..............................................P.......o....`.........................................@...........<....0..l........"...... @...@.................................(...p...8............................................text...<........................... ..`.rdata..............................@..@.data...D"..........................@....pdata...".......$..................@..@_RDATA....... ......................@..@.rsrc...l....0......................@..@.reloc.......@......................@..B................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\WebFilteringSimple.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):224288
                                                  Entropy (8bit):6.345306921696582
                                                  Encrypted:false
                                                  SSDEEP:3072:n2EAXJptVRFX8FwUqFem+3+yv5vJGKX5XG6pD7XwXv3vi5sV3CtJm9X:rKntFUqzc+yfpXhLsVStJm9X
                                                  MD5:696B2B48BCEC337EC8B9A644E078FEA0
                                                  SHA1:741EA54712FE9B4A3F23584C4D58A076B7E285E3
                                                  SHA-256:640098F39E1C1D7B994670C61F5263CB5EF55D5E6DFBD65F02888A01DB818C08
                                                  SHA-512:C2B9C68BBF475A69D5DD34EF53994818F41A9BE1F4F759629FAA282A5FB709ECA37AA32055A3E9F6D12B2CEDA18B3ABA051CEAEFA2411F383689D1EF8B85EC08
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b..&...&...&...2...-...2...#...2......t.......t...)...t.../...2...%...&...N......,......'......'...&.{.'......'...Rich&...........................PE..d......b.........." .........$......\...............................................6+....`.....................................................(....`..l....0.......,.. @...p..................................(.......8............ ...............................text...L........................... ..`.rdata..X.... ......................@..@.data...............................@....pdata.......0......................@..@_RDATA.......P......................@..@.rsrc...l....`......................@..@.reloc.......p.......$..............@..B................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-console-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):12128
                                                  Entropy (8bit):6.590871373830902
                                                  Encrypted:false
                                                  SSDEEP:192:fFWOhWYT71ojDBQABJtqnajxcRGlPHxZzH:dWOhWNDBRJtll7PHvzH
                                                  MD5:1FB62EF7E71B24A44EA5F07288240699
                                                  SHA1:875261B5537ED9B71A892823D4FC614CB11E8C1F
                                                  SHA-256:70A4CD55E60F9DD5D047576E9CD520D37AF70D74B9A71E8FA73C41475CAADC9A
                                                  SHA-512:3B66EFE9A54D0A3140E8AE02C8632A3747BAD97143428AEDC263CB57E3CFA53C479B7F2824051FF7A8FD6B838032D9AE9F9704C289E79EED0D85A20A6F417E61
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d.....nU.........." .........................................................0............`.........................................`...+............ ..................`!..............8............................................................................rdata..@...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-datetime-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):11616
                                                  Entropy (8bit):6.593096817502992
                                                  Encrypted:false
                                                  SSDEEP:192:uWOhWFT71ojDBQABJE41qnajLQvTP+8jIrEPB:uWOhWeDBRJE41lvQyUIrEPB
                                                  MD5:0FB91D94F6D006DA24A3A2DF6D295D81
                                                  SHA1:DB8AE2C45940D10F463B6DBECD63C22ACAB1EEE2
                                                  SHA-256:E08D41881DBEF8E19B9B5228938E85787292B4B6078D5384BA8E19234A0240A8
                                                  SHA-512:16D16EB10031C3D27E18C2EE5A1511607F95F84C8D32E49BBACEE1ADB2836C067897EA25C7649D805BE974BA03FF1286EB665361036FD8AFD376C8EDCFABD88C
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d.....nU.........." .........................................................0.......j....`.........................................`................ ..................`!..............8............................................................................rdata..$...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-debug-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):11616
                                                  Entropy (8bit):6.592799072415155
                                                  Encrypted:false
                                                  SSDEEP:192:LWOhW4T71ojDBQABJ4e7qnajMHxxBNT06YeOV:LWOhWtDBRJv7lI66YeOV
                                                  MD5:C1FDD419184EF1F0895E4F7282D04DC5
                                                  SHA1:42C00EEE48C72BFDE66BC22404CD9D2B425A800B
                                                  SHA-256:E8CF51A77E7720BD8F566DB0A544E3DB1C96EDC9A59D4F82AF78B370DE5891F7
                                                  SHA-512:21AA4D299D4C2EAB267A114644C3F99F9F51964FD89B5C17769A8F61A2B08C237E5252B77CA38F993A74CC721B1B18E702C99BDFA39E0D43D375C56F126BE62C
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d.....nU.........." .........................................................0.......s....`.........................................`................ ..................`!..............8............................................................................rdata..0...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-errorhandling-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):11616
                                                  Entropy (8bit):6.6481423677116895
                                                  Encrypted:false
                                                  SSDEEP:192:jmxD3OlWOhWuFT71ojDBQABJ52Tqnajsl/cqt/3SR:jVlWOhWZDBRJ52TlPqZCR
                                                  MD5:E46BC300BF7BE7B17E16FF12D014E522
                                                  SHA1:BA16BC615C0DAD61EF6EFE5FD5C81CEC5CFBAD44
                                                  SHA-256:002F6818C99EFBD6AEE20A1208344B87AF7B61030D2A6D54B119130D60E7F51E
                                                  SHA-512:F92C1055A8ADABB68DA533FE157F22C076DA3C31D7CF645F15C019CE4C105B99933D860A80E22315377585AE5847147C48CD28C9473A184C9A2149B1D75EE1B1
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d.....nU.........." .........................................................0.......T....`.........................................`................ ..................`!..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-file-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):15200
                                                  Entropy (8bit):6.555039640732934
                                                  Encrypted:false
                                                  SSDEEP:192:CAuVYPvVX8rFTsaWOhW7T71ojDBQABJdlTbqnajLQvTP+8jIrxm:/BPvVXUWOhWIDBRJzTblvQyUIro
                                                  MD5:E87192A43630EB1F6BDF764E57532B8B
                                                  SHA1:F9DDA76D7E1ACDBB3874183A9F1013B6489BD32C
                                                  SHA-256:D9CD7767D160D3B548CA57A7A4D09FE29E1A2B5589F58FBCF6CB6E992F5334CF
                                                  SHA-512:30E29F2FFDC47C4085CA42F438384C6826B8E70ADF617AC53F6F52E2906D3A276D99EFCC01BF528C27ECA93276151B143E6103B974C20D801DA76F291D297C4C
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d.....nU.........." .........................................................@......dp....`.........................................`................0..................`!..............8............................................................................rdata..............................@..@.rsrc........0......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-file-l1-2-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):11616
                                                  Entropy (8bit):6.612267657675765
                                                  Encrypted:false
                                                  SSDEEP:192:SE3WOhWST71ojDBQABJrbA0nqnajLQvTP+8jIrJT:SMWOhWDDBRJf3nlvQyUIrJT
                                                  MD5:7041205EA1A1D9BA68C70333086E6B48
                                                  SHA1:5034155F7EC4F91E882EAE61FD3481B5A1C62EB0
                                                  SHA-256:EFF4703A71C42BEC1166E540AEA9EEAF3DC7DFCC453FEDCB79C0F3B80807869D
                                                  SHA-512:AEA052076059A8B4230B73936EF8864EB4BB06A8534E34FE9D03CC92102DD01B0635BFCE58F4E8C073F47ABFD95FB19B6FBFCDAF3BC058A188665AC8D5633EB1
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d.....nU.........." .........................................................0......e.....`.........................................`...L............ ..................`!..............8............................................................................rdata..\...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-file-l2-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):11616
                                                  Entropy (8bit):6.723077592178679
                                                  Encrypted:false
                                                  SSDEEP:192:uVEWOhWET71ojDBQABJ+AqqnajL1dHx3RKHf+c4uSg:uVEWOhWpDBRJClXBRC8g
                                                  MD5:8FD05F79565C563A50F23B960F4D77A6
                                                  SHA1:98E5E665EF4A3DD6F149733B180C970C60932538
                                                  SHA-256:3EB57CDA91752A2338EE6B83B5E31347BE08831D76E7010892BFD97D6ACE9B73
                                                  SHA-512:587A39AECB40EFF8E4C58149477EBAEB16DB8028D8F7BEA9114D34E22CD4074718490A4E3721385995A2B477FE33894A044058880414C9A668657B90B76D464F
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d.....nU.........." .........................................................0......Q.....`.........................................`................ ..................`!..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-handle-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):11616
                                                  Entropy (8bit):6.612906130780676
                                                  Encrypted:false
                                                  SSDEEP:96:OrTC93EWVAhWwf0pDX/kDbzuT714pVUtOwDD0pBDXiebs/Am2grWXGu2DXJHN1dg:aWOhWBT71ojDBQABJ8kqnajsl/cqt3gf
                                                  MD5:CEDBEAE3CB51098D908EF3A81DC8D95C
                                                  SHA1:C43E0BF58F4F8EA903EA142B36E1CB486F64B782
                                                  SHA-256:3CB281C38FA9420DAEDB84BC4CD0AAA958809CC0B3EFE5F19842CC330A7805A0
                                                  SHA-512:72E7BDF4737131046E5EF6953754BE66FB7761A85E864D3F3799D510BF891093A2DA45B684520E2DBCE3819F2E7A6F3D6CF4F34998C28A8A8E53F86C60F3B78A
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d.....nU.........." .........................................................0......@p....`.........................................`..._............ ..................`!..............8............................................................................rdata..t...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-heap-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):12128
                                                  Entropy (8bit):6.567983866804271
                                                  Encrypted:false
                                                  SSDEEP:192:sZlpWOhW3jT71ojDBQABJfqnajsl/cqtV/:ilpWOhWwDBRJflPq3/
                                                  MD5:13B358D9ECFFB48629E83687E736B61D
                                                  SHA1:1F876F35566F0D9E254C973DBBF519004D388C8D
                                                  SHA-256:1CF1B6F42985016BC2DC59744EFEAC49515F8ED1CC705FE3F5654D81186097CD
                                                  SHA-512:08E54FA2B144D5B0DA199D052896B9CF556C0D1E6F37C2AB3363BE5CD3CF0A8A6422626A0643507AA851FDDF3A2EA3D42A05B084BADF509B35EC50CB2E0BB5CE
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d.....nU.........." .........................................................0......~n....`.........................................`................ ..................`!..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-interlocked-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):11616
                                                  Entropy (8bit):6.636859346769873
                                                  Encrypted:false
                                                  SSDEEP:192:fWOhWBT71ojDBQABJgO39qnajMHxxBNT06YeO8Pw:fWOhW6DBRJDlI66YeO8I
                                                  MD5:C9649C9873F55CB7CDC3801B30136001
                                                  SHA1:3D2730A1064ACD8637BFC69F0355095E6821EDFD
                                                  SHA-256:D05E1BD7FA00F52214192A390D36758FA3FE605B05A890A38F785C4DB7ADEF1F
                                                  SHA-512:39497BAA6301C0AD3E9E686F7DFA0E40DBEA831340843417EECC23581B04972FACC2B6D30173CC93BF107A42F9D5D42515EF9FD73BB17070EB6F54109DC14E3E
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d.....nU.........." .........................................................0............`.........................................`................ ..................`!..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-libraryloader-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):12128
                                                  Entropy (8bit):6.664594338687575
                                                  Encrypted:false
                                                  SSDEEP:192:2qovuBL3BUWOhWZT71ojDBQABJ4wFqnajsl/cqtewMC:2dvuBL3BUWOhWCDBRJ4wFlPqkwMC
                                                  MD5:BEDC3D74C8A93128EF9515FD3E1D40EB
                                                  SHA1:D207C881751C540651DBDB2DBD78E7ECD871BFE1
                                                  SHA-256:FEFC7BC60BD8D0542CCEA84C27386BC27EB93A05330E059325924CB12AAF8F32
                                                  SHA-512:CDCBCE2DBE134F0AB69635E4B42EF31864E99B9AB8B747FB395A2E32B926750F0DD153BE410337D218554434F17E8BC2F5501F4B8A89BB3A6BE7F5472FB18360
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d.....nU.........." .........................................................0......js....`.........................................`................ ..................`!..............8............................................................................rdata..(...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-localization-l1-2-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):14176
                                                  Entropy (8bit):6.6583764022456275
                                                  Encrypted:false
                                                  SSDEEP:384:JOMw3zdp3bwjGjue9/0jCRrndbLAWOhWqDBRJKlI66YeOU/:JOMwBprwjGjue9/0jCRrndbLsP1PT66j
                                                  MD5:769BF2930E7B0CE2E3FB2CBC6630BA2E
                                                  SHA1:B9DF24D2D37CA8B52CA7EB5C6DE414CB3159488A
                                                  SHA-256:D10FF3164ACD8784FE8CC75F5B12F32CE85B12261ADB22B8A08E9704B1E5991A
                                                  SHA-512:9ABDCCCC8EE21B35F305A91EA001C0B8964D8475680FA95B4AFBDC2D42797DF543B95FC1BCD72D3D2CCC1D26DFF5B3C4E91F1E66753626837602DBF73FC8369B
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d.....nU.........." .........................................................0............`.........................................`................ ..................`!..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-memory-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):12128
                                                  Entropy (8bit):6.61420154157855
                                                  Encrypted:false
                                                  SSDEEP:192:SYWOhW8T71ojDBQABJdXqnajMHxxBNT06YeOAd:SYWOhWRDBRJ5lI66YeOY
                                                  MD5:89766E82E783FACF320E6085B989D59D
                                                  SHA1:A3FFB65F0176C2889A6E4D9C7F4B09094AFB87ED
                                                  SHA-256:B04AF86E7B16AADA057A64139065DF3A9B673A1A8586A386B1F2E7300C910F90
                                                  SHA-512:EA4DF1B2763DDE578488BB8DD333BE8F2B79F5277C9584D1FC8F11E9961D38767D6A2DA0B7B01BAD0D002D8DCF67CCA1D8751A518F1EE4B9318081F8DF0422C7
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d.....nU.........." .........................................................0............`.........................................`...l............ ..................`!..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-namedpipe-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):11616
                                                  Entropy (8bit):6.724173936599513
                                                  Encrypted:false
                                                  SSDEEP:192:q4WOhWcpT71ojDBQABJYwqnajMHxxBNT06YeOg3+:dWOhWnDBRJYwlI66YeOg3+
                                                  MD5:B8BCE84B33AE9F56369B3791F16A6C47
                                                  SHA1:50F14D1FE9CB653F2ED48CBB52F447BDD7EC5DF4
                                                  SHA-256:0AF28C5C0BB1C346A22547E17A80CB17F692BF8D1E41052684FA38C3BBCBB8C8
                                                  SHA-512:326092BAE01D94BA05ECEC0EA8A7BA03A8A83C5CAF12BEF88F54D075915844E298DBA27012A1543047B73B6A2AE2B08478711C8B3DCC0A7F0C9FFABBA5B193CF
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d.....nU.........." .........................................................0............`.........................................`................ ..................`!..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-processenvironment-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):12640
                                                  Entropy (8bit):6.593815470935579
                                                  Encrypted:false
                                                  SSDEEP:192:9RWOhW9T71ojDBQABJjw3rXqnajL1dHx3tKCJA6:9RWOhWGDBRJjWTlXBtpO6
                                                  MD5:77E9C54DA1436B15B15C9C7E1CEDD666
                                                  SHA1:6CE4D9B3DC7859D889D4CCD1E8E128BF7CA3A360
                                                  SHA-256:885BD4D193568D10DD24D104CCF92B258A9262565E0C815B01EC15A0F4C65658
                                                  SHA-512:6EECF63D3DF4E538E1D2A62C6266F7D677DAEBD20B7CE40A1894C0EBE081585E01E0C7849CCDF33DD21274E194E203E056E7103A99A3CD0172DF3ED791DCE1C2
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d.....nU.........." .........................................................0...........`.........................................`...G............ ..................`!..............8............................................................................rdata..h...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-processthreads-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):13664
                                                  Entropy (8bit):6.659212810296714
                                                  Encrypted:false
                                                  SSDEEP:384:rWXk1JzNcKSIrTWOhWGDBRJBDlI66YeOM:rbcKS4H1PA66MM
                                                  MD5:540D7C53D63C7FF3619F99F12AAC0AFE
                                                  SHA1:69693E13C171433306FB5C9BE333D73FDF0B47ED
                                                  SHA-256:3062BD1F6D52A6B830DBB591277161099DCF3C255CFF31B44876076069656F36
                                                  SHA-512:CE37439CE1DFB72D4366CA96368211787086948311EB731452BB453C284CCC93CCECEF5C0277D4416051F4032463282173F3EC5BE45E5C3249F7C7EC433F3B3E
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d.....nU.........." .........................................................0............`.........................................`................ ..................`!..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-processthreads-l1-1-1.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):12128
                                                  Entropy (8bit):6.6465314684642856
                                                  Encrypted:false
                                                  SSDEEP:192:EDfIe9WOhWZT71ojDBQABJv84YqnajMHxxBNT06YeOi:EDfIe9WOhWCDBRJv+lI66YeOi
                                                  MD5:6486E2F519A80511AC3DE235487BEE79
                                                  SHA1:B43FD61E62D98EEA74CF8EB54CA16C8F8E10C906
                                                  SHA-256:24CC30D7A3E679989E173DDC0A9E185D6539913AF589EE6683C03BF3DE485667
                                                  SHA-512:02331C5B15D9EE5A86A7AAF93D07F9050C9254B0CD5969D51EFF329E97E29EEA0CB5F2DCCFE2BFA30E0E9FC4B222B89719F40A46BD762E3FF0479DBAC704792C
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d.....nU.........." .........................................................0............`.........................................`................ ..................`!..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-profile-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):11104
                                                  Entropy (8bit):6.758510658575192
                                                  Encrypted:false
                                                  SSDEEP:192:IL+MWOhWaT71ojDBQABJl6lqnajMHxxBNT06YeOm:IL9WOhWbDBRJUllI66YeOm
                                                  MD5:A37FAEA6C5149E96DC1A523A85941C37
                                                  SHA1:0286F5DAFFFA3CF58E38E87F0820302BCF276D79
                                                  SHA-256:0E35BEBD654EE0C83D70361BCAECF95C757D95209B9DBCB145590807D3FFAE2E
                                                  SHA-512:A88DF77F3CC50D5830777B596F152503A5A826B04E35D912C979DED98DC3C055EB150049577BA6973D1E6C737D3B782655D848F3A71BD5A67AA41FC9322F832E
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d.....nU.........." .........................................................0............`.........................................`................ ..................`!..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-rtlsupport-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):12128
                                                  Entropy (8bit):6.5904782348675095
                                                  Encrypted:false
                                                  SSDEEP:192:9GeVZS3WOhWYT71ojDBQABJNVSqnajLQvTP+8jIr5cT:9GeVY3WOhWNDBRJNQlvQyUIrC
                                                  MD5:6E46E5CCA4A98A53C6D2B6C272A2C3BA
                                                  SHA1:BC8F556EE4260CCE00F4DC66772E21B554F793A4
                                                  SHA-256:87FCA6CDFA4998B0A762015B3900EDF5B32B8275D08276ABC0232126E00F55CE
                                                  SHA-512:CFEEA255C66B4394E1D53490BF264C4A17A464C74D04B0EB95F6342E45E24BBC99FF016A469F69683CE891D0663578C6D7ADEE1929CC272B04FCB977C673380F
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d.....nU.........." .........................................................0.......A....`.........................................`................ ..................`!..............8............................................................................rdata..,...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-string-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):11616
                                                  Entropy (8bit):6.669862087147008
                                                  Encrypted:false
                                                  SSDEEP:192:5yMvqWOhWuT71ojDBQABJhN7XqnajL1dHx3tKCJAL:5yMvqWOhWfDBRJXjlXBtpOL
                                                  MD5:B72698A2B99E67083FABD7D295388800
                                                  SHA1:17647FC4F151C681A943834601C975A5DB122CEB
                                                  SHA-256:86D729B20A588B4C88160E38B4D234E98091E9704A689F5229574D8591CF7378
                                                  SHA-512:33BDFE9AC12339E1EDAB7698B344AB7E0E093A31FEDC697463BBE8A4180BB68B6CC711A2CEB22CE410E3C51EFAA7EA800BAD30A93B3AC605B24885D3EF47CB7A
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d.....nU.........." .........................................................0.......s....`.........................................`................ ..................`!..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-synch-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):13664
                                                  Entropy (8bit):6.569352219895776
                                                  Encrypted:false
                                                  SSDEEP:384:ldv3V0dfpkXc0vVaLWOhWYDBRJCOlvQyUIrXr:ldv3VqpkXc0vVa1Z1PlvUwXr
                                                  MD5:E1DEBEDA8D4680931B3BB01FAE0D55F0
                                                  SHA1:A26503C590956D4E2D5A42683C1C07BE4B6F0CE7
                                                  SHA-256:A2D22C5B4B38AF981920AB57B94727ECAD255A346BB85F0D0142B545393A0A2D
                                                  SHA-512:A9211F5B3A1D5E42FDE406AAB1B2718E117BAE3DD0857D4807B9E823A4523C3895CF786519D48410119D1838AB0C7307D6EF530B1159328350CC23EBC32F67CD
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d.....nU.........." .........................................................0............`.........................................`...V............ ..................`!..............8............................................................................rdata..l...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-synch-l1-2-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):12128
                                                  Entropy (8bit):6.702819615773428
                                                  Encrypted:false
                                                  SSDEEP:192:7tZ3RWOhWKT71ojDBQABJXPXqnajL1dHx3tKCJAI:7tZ3RWOhWLDBRJX/lXBtpOI
                                                  MD5:A639C64C03544491CD196F1BA08AE6E0
                                                  SHA1:3EE08712C85AAB71CFBDB43DBEF06833DAA36AB2
                                                  SHA-256:A4E57620F941947A570B5559CA5CCE2F79E25E046FCB6519E777F32737E5FD60
                                                  SHA-512:C940D1F4E41067E6D24C96687A22BE1CB5FFD6B2B8959D9667BA8DB91E64D777D4CD274D5877380D4CFEF13F6486B4F0867AF02110F96C040686CC0242D5234B
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d.....nU.........." .........................................................0.......q....`.........................................`...v............ ..................`!..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-sysinfo-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):12640
                                                  Entropy (8bit):6.594429104154007
                                                  Encrypted:false
                                                  SSDEEP:192:TKIMFR6WOhW2T71ojDBQABJPfqnajMHxxBNT06YeOEK:TU6WOhW3DBRJHlI66YeOp
                                                  MD5:56486925434EBCB5A88DD1DFA173B3D0
                                                  SHA1:F6224DD02D19DEBC1ECC5D4853A226B9068AE3CD
                                                  SHA-256:4F008AA424A0A53A11535647A32FABB540306702040AA940FB494823303F8DCE
                                                  SHA-512:7BB89BD39C59090657AB91F54FB730D5F2C46B0764D32CFA68BB8E9D3284C6D755F1793C5E8722ACF74EB6A39D65E6345953E6591106A13AB008DCF19863AE49
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d.....nU.........." .........................................................0.......%....`.........................................`...E............ ..................`!..............8............................................................................rdata..\...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-timezone-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):11616
                                                  Entropy (8bit):6.7498302358011895
                                                  Encrypted:false
                                                  SSDEEP:96:OliqS7EWVAhWwfbDX/kDbzuT714pVUtOwDD0pBDXiebs/Am2grWXGu2DXBt2Q3Dz:+WOhW6T71ojDBQABJrLqnajxcRGlPHUp
                                                  MD5:6F9F9D52087AE4D8D180954B9D42778B
                                                  SHA1:67419967A40CC82A0CA4151589677DE8226F9693
                                                  SHA-256:EF1D71FE621341C9751EE59E50CBEC1D22947622FFAF8FB1F034C693F1091EF0
                                                  SHA-512:22A0488613377746C13DB9742F2E517F9E31BD563352CC394C3AE12809A22AA1961711E3C0648520E2E11F94411B82D3BB05C7EA1F4D1887AACF85045CF119D7
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d.....nU.........." .........................................................0.......,....`.........................................`................ ..................`!..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-util-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):11616
                                                  Entropy (8bit):6.59720677146787
                                                  Encrypted:false
                                                  SSDEEP:192:ZWOhWKT71ojDBQABJLAjqnajMHxxBNT06YeOOG47zl:ZWOhWLDBRJcjlI66YeOOGu
                                                  MD5:7243D672604766E28E053AF250570D55
                                                  SHA1:7D63E26FFB37BF887760DC28760D4B0873676849
                                                  SHA-256:F24A6158D7083E79F94B2088B2EA4D929446C15271A41C2691B8D0679E83EF18
                                                  SHA-512:05B0EDF51F10DB00ADC81FA0E34963BE1A9F5C4CA303A9C9179C8340D5D2700534C5B924005556C89C02AC598BA6C614EE8AB8415F9AD240417529E5E0F6A41B
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d.....nU.........." .........................................................0......j?....`.........................................`...9............ ..................`!..............8............................................................................rdata..L...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-crt-conio-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):12640
                                                  Entropy (8bit):6.6192154978615525
                                                  Encrypted:false
                                                  SSDEEP:192:3YxWOhWVT71ojDBQABJIY0Vqnaj9RlW5EeHA:3YxWOhWuDBRJ2lBRc5Eeg
                                                  MD5:C0C8790510471F12F3C4555E5F361E8E
                                                  SHA1:7ADFFC87C04B7DF513BB163C3FBE9231B8E6566A
                                                  SHA-256:60BD8F0BD64062292EFF0F5F1A91347B8D61FBE3F2E9B140112501770EAE0B80
                                                  SHA-512:4F71AA0942F86E86F787036DC60EAEA33AF0C277F03CF1E551AAABA48DAD48593BCCEECCC359EFBF18EF99CF49F2D46B4C17159A531FFB1C3A744ABCE57219EB
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d.....nU.........." .........................................................0......P(....`.........................................`................ ..................`!..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-crt-convert-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):15712
                                                  Entropy (8bit):6.430511748217981
                                                  Encrypted:false
                                                  SSDEEP:192:ivlUcyTSWOhW2T71ojDBQABJrJXqnajL1dHx3tKCJA3v:i9DyTSWOhW3DBRJxlXBtpO/
                                                  MD5:EBAC9545734CC1BEC37C1C32FFAFF7D8
                                                  SHA1:2B716CE57F0AF28D1223F4794CC8696D49AE2F29
                                                  SHA-256:D09B49F2A30DCC13B7F0DE8242FA57D0BDEB22F3B7E6C224BE73BC4DD98D3C26
                                                  SHA-512:0396EA24A6744D48CE18F9CCB270880F74C4B6EAB40F8F8BAF5FD9B4AD2AC79B830F9B33C13A3FEC0206A95AD3824395DB6B1825302D1D401D26BDC9EEF003B2
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d.....nU.........." .........................................................@.......*....`.........................................`................0..................`!..............8............................................................................rdata..............................@..@.rsrc........0......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-crt-environment-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):12128
                                                  Entropy (8bit):6.585414377461665
                                                  Encrypted:false
                                                  SSDEEP:192:VjHWOhWGT71ojDBQABJAqnajxcRGlPH6Yv:FHWOhWHDBRJAll7PH6Yv
                                                  MD5:C7C4A49C6EE6B1272ADE4F06DB2FA880
                                                  SHA1:B4B5490A51829653CB2E9E3F6FBE9CAF3BA5561E
                                                  SHA-256:37F731E7B1538467288BF1D0E586405B20808D4BAD05E47225673661BC8B4A9F
                                                  SHA-512:62CCDFAC19EF4E3D378122146E8B2CBA0E1DB2CC050B49522BEDBF763127CC2103A56C5A266E161A51D5BE6BD9A47222EE8BB344B383F13D0AAC0BAA41EAB0FF
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d.....nU.........." .........................................................0............`.........................................`..."............ ..................`!..............8............................................................................rdata..<...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-crt-filesystem-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):13664
                                                  Entropy (8bit):6.641564163430014
                                                  Encrypted:false
                                                  SSDEEP:192:sD81nWlC0i5CkkWOhW+T71ojDBQABJusXqnajL1dHx3tKCJAH5R:sD81nWm5CbWOhWvDBRJvlXBtpOH5R
                                                  MD5:BEF17BF1BA00150163A2E1699FF5840A
                                                  SHA1:89145A894B17427F4CB2B4E7E814C92457FD2A75
                                                  SHA-256:48C71B2D0AF6807F387D97AB22A3BA77B85BDF457F8A4F03CE79D13FBB891328
                                                  SHA-512:489D1B4D405EDBB5F46B087A3EBF57A344BF65478B3CD5FCF273736EA6FDD33E54B1806FBB751849E160370DF8354F39FC7CA7896A05B4660AD577A9E0E683E4
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d.....nU.........." .........................................................0............`.........................................`................ ..................`!..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-crt-heap-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):12640
                                                  Entropy (8bit):6.553505818372369
                                                  Encrypted:false
                                                  SSDEEP:192:I5CY17aFBR1WOhWZT71ojDBQABJxn0lqnajsl/cqtqA/:I5IWOhWCDBRJclPq8y
                                                  MD5:FBFCF220F1BF1051E82A40F349D4BEAE
                                                  SHA1:43154EA6705AB1C34207B66A0A544AC211C1F37D
                                                  SHA-256:9B9A43B9A32A3D3C3DE72B2ACCA41E051B1E604B45BE84985B6A62FB03355E6D
                                                  SHA-512:E9AB17CEB5449E8303027A08AFDBDD118CB59EAEA0D5173819D66D3EE01F0CD370D7230A7D609A226B186B151FE2B13E811339FA21F3EC45F843075CEDC2A5C0
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d.....nU.........." .........................................................0......S.....`.........................................`................ ..................`!..............8............................................................................rdata..(...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-crt-locale-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):12128
                                                  Entropy (8bit):6.676689977859738
                                                  Encrypted:false
                                                  SSDEEP:192:h91WOhWDT71ojDBQABJSvFCHqnaj9RlW5Eq:h91WOhWADBRJoF8lBRc5Eq
                                                  MD5:2C8E5E31E996E2C0664F4A945CECE991
                                                  SHA1:8522C378BDD189CE03A89199DD73ED0834B2FA95
                                                  SHA-256:1C556505A926FD5F713004E88D7F8D68177D7D40A406F6ED04AF7BACD2264979
                                                  SHA-512:14B92E32FB0FD9C50AA311F02763CBA50692149283D625A78B0549B811D221331CF1B1F46D42869500622D128C627188691D7DE04C500F501ACD720CEA7C8050
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d.....nU.........." .........................................................0.......>....`.........................................`...e............ ..................`!..............8............................................................................rdata..|...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-crt-math-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):20832
                                                  Entropy (8bit):6.211462844191868
                                                  Encrypted:false
                                                  SSDEEP:384:qZVacWM4Oe59Ckb1hgmLVXWOhW9DBRJOsAlXBtpOi:qZVJWMq59Bb1jVx01PI7
                                                  MD5:77C5CC86B89EED37610B80F24E88DCC2
                                                  SHA1:D2142ECCE3432B545FEDC8005CC1BF08065C3119
                                                  SHA-256:3E8828AB7327F26DA0687F683944FFC551440A3DE1004CC512F04A2F498520F6
                                                  SHA-512:81DE6533BBA83F01FED3F7BEED1D329B05772B7A13FFE395414299C62E3E6D43173762CB0B326EA7ECF0E61125901FCEE7047E7A7895B750DE3D714C3FE0CC67
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d.....nU.........." .........,...............................................P.......g....`.........................................`....%...........@...............0..`!..............8............................................................................rdata...&.......(..................@..@.rsrc........@.......,..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-crt-multibyte-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):19808
                                                  Entropy (8bit):6.189879847219438
                                                  Encrypted:false
                                                  SSDEEP:384:m7F7vLPmIHJI6/CpG3t2G3t4odXLJWOhW5DBRJvlXBtpOL0VS:m5/PmIHJI6x41PB7VS
                                                  MD5:4394DAFED734DFE937CF6EDBBB4B2F75
                                                  SHA1:06EC8F1F8DD1EAB75175A359A7A5A7EE08D7A57A
                                                  SHA-256:35B247534F9A19755A281E6DC3490F8197DD515F518C6550208B862C43297345
                                                  SHA-512:33D9C5041E0F5B0913DD8826CEB080E2284F78164EFFDE1DBF2C14C1234D6B9F33AF6AE9F6E28527092AD8C2DBC13BDDFC73A5B8C738A725AD0C6BB0AA7FCFAF
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d.....nU.........." .........(...............................................P......".....`.........................................`.... ...........@...............,..`!..............8............................................................................rdata...".......$..................@..@.rsrc........@.......(..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-crt-private-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):62304
                                                  Entropy (8bit):5.557526246773934
                                                  Encrypted:false
                                                  SSDEEP:1536:tt/TFDe5c4bFJcvxXWpDAd3334BkZnwPO4P/V+:tt7FDe5c4bFJcvxXWpDAd3334BkZnwPI
                                                  MD5:18BDFD4B9E28F7EBA7CBB354E9C12FCB
                                                  SHA1:26222EFACB3FCE1995253002C3CE294C7045CF97
                                                  SHA-256:3105DA41B02009383826ED70857DE1A8961DAEB942E9068D0357CDDD939FA154
                                                  SHA-512:7D27EEFF41B1E30579C2A813EEA8385D8A9569BC1ECE5310B0A3F375FBA1894028C5CEC2CF204E153A50411C5DCF1992E8AC38F1C068C8F8AF9BD4897C379C04
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d.....nU.........." ......................................................................`.........................................`...0...............................`!..............8............................................................................rdata..D...........................@..@.rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-crt-process-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):12640
                                                  Entropy (8bit):6.586986623530098
                                                  Encrypted:false
                                                  SSDEEP:192:6WitIqjd7vWOhWqT71ojDBQABJJqnajxcRGlPHXsh:6WitI2WOhWrDBRJJll7PHU
                                                  MD5:7DDD5548E3C4DE83D036B59DBF55867A
                                                  SHA1:E56B4D9CFCA18FB29172E71546DC6EF0383AC4E9
                                                  SHA-256:75F7B0937A1433EA7E7FA2904B02FD46296B31DA822575C0A6BC2038805971EF
                                                  SHA-512:9FB30EF628741CEBBC0F80D07824E80C9C73E0E1341866F4E45DC362FEA211D622AA1CFFC9199BE458609483F166F6C34C68B585EFE196D370C100F9C7315E0D
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d.....nU.........." .........................................................0............`.........................................`...x............ ..................`!..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-crt-runtime-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):16224
                                                  Entropy (8bit):6.4496160353996395
                                                  Encrypted:false
                                                  SSDEEP:192:iGrMUnaPrpJhhf4AN5/KiGWOhW3T71ojDBQABJcGSXqnajL1dHx3tKCJAv+:il42r7QWOhWEDBRJcFlXBtpOW
                                                  MD5:A3F630A32D715214D6C46F7C87761213
                                                  SHA1:1078C77010065C933A7394D10DA93BFB81BE2A95
                                                  SHA-256:D16DB68B4020287BB6CE701B71312A9D887874C0D26B9EBD82C3C9B965029562
                                                  SHA-512:920BB08310EADD7832011AC80EDD3E12CE68E54E510949DBBDE90ADAAC497DEBE050E2B73B9B22D9DC105386C45D558C3F9E37E1C51ED4700DD82B00E80410BC
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d.....nU.........." .........................................................@............`.........................................`...4............0..................`!..............8............................................................................rdata..H...........................@..@.rsrc........0......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-crt-stdio-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):17760
                                                  Entropy (8bit):6.39633954351012
                                                  Encrypted:false
                                                  SSDEEP:192:9rjrvIDmMSNuWYFxEpahlWOhW8T71ojDBQABJqZvKXqnajL1dHx3tKCJA3:Z3vAmiFVhlWOhWRDBRJqZ2lXBtpO3
                                                  MD5:C99C9EEA4F83A985DAF48EED9F79531B
                                                  SHA1:56486407C84BEECADB88858D69300035E693D9A6
                                                  SHA-256:7C416D52A7E8D6113FF85BF833CAE3E11C45D1C2215B061A5BBD47432B2244A5
                                                  SHA-512:78B8FD1FAADA381B7C4B7B6721454A19969011C1D1105FC02BA8246B477440B83DC16F0E0CE0B953A946DA9D1971B65315AC29DBB6DF237A11BECB3D981B16B9
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d.....nU.........." ......... ...............................................@......(.....`.........................................`...a............0...............$..`!..............8............................................................................rdata..t...........................@..@.rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-crt-string-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):17760
                                                  Entropy (8bit):6.38266987954225
                                                  Encrypted:false
                                                  SSDEEP:384:eoax0C5yguNvZ5VQgx3SbwA7yMVIkFGlkWOhW2DBRJ1lBRc5EKe5:Ds5yguNvZ5VQgx3SbwA71IkFHr1PZRcs
                                                  MD5:D3D72D7F4C048D46D81A34E4186600B4
                                                  SHA1:CDCAD0A3DF99F9AEE0F49C549758EE386A3D915F
                                                  SHA-256:FD8A73640A158857DD76173C5D97CEEBA190E3C3EABF39446936B24032B54116
                                                  SHA-512:6BF9D2FDC5C2D8CD08BF543EF7A0CDCB69D7658A12BEE5601EEB9381B11D78D3C42EF9DD7E132E37D1EC34CC3DC66DF0F50AEFADFDC927904B520FDC2F994F18
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d.....nU.........." ......... ...............................................@............`.........................................`................0...............$..`!..............8............................................................................rdata..............................@..@.rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-crt-time-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):14176
                                                  Entropy (8bit):6.533476391950624
                                                  Encrypted:false
                                                  SSDEEP:192:PauO/z7kzFDOWOhWfT71ojDBQABJRtJqnaj9RlW5Eo5:PaPEzMWOhWcDBRJVlBRc5EO
                                                  MD5:A992F1E06C3C32FFE9799D4750AF070A
                                                  SHA1:97FFD536D048720010133C3D79B6DEED7FC82E58
                                                  SHA-256:B401EDAAC4B41DA73356DE9B3358DC21F8B998A63413C868510DC734B1E4022F
                                                  SHA-512:50BD08680FCCFF190454E6555E65E2787BDC0E8A9BF711E364EB0B065951C2430559E049202B8F330AC65E9D4CD588349C524A71F700E179859D7829D8E840B8
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d.....nU.........." .........................................................0............`.........................................`................ ..................`!..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-crt-utility-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):12128
                                                  Entropy (8bit):6.673014876017782
                                                  Encrypted:false
                                                  SSDEEP:192:5BfHQduWWOhWy1T71ojDBQABJPLtXqnajL1dHx3tKCJAaZ:5Bf8WOhWyODBRJFlXBtpOaZ
                                                  MD5:CB4A19B88BEC5A8806B419CF7C828018
                                                  SHA1:2BC264E0ECCB1A9D821BCA82B5A5C58DC2464C5D
                                                  SHA-256:97E4C91103C186517FA248772B9204ACF08FDE05557A19EFE28D11FB0932B1F7
                                                  SHA-512:381EDD45ECD5D2BDEFD1E3AD0C8465A32620DFA9B97717CADB6A584C9528FED0D599D5A4889962F04908CA4E2B7B4497F0E69D8481EE5F34EA5D9106D99760C3
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d.....nU.........." .........................................................0......Y.....`.........................................`...^............ ..................`!..............8............................................................................rdata..t...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bddci.cat

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:data
                                                  Category:dropped
                                                  Size (bytes):9953
                                                  Entropy (8bit):7.143267646872481
                                                  Encrypted:false
                                                  SSDEEP:192:njn/y4JCq+XooyKfPFWQFkgTE80Hy5qnajsTl5cLo:nfGrPFRtEslulN
                                                  MD5:595D134F65D1F9AAB5CA690D6B1662B2
                                                  SHA1:1E38A6020A577707D923DD9D802B2E5C948A7E9C
                                                  SHA-256:FB0DF649161FA7A1289DDFC42825F1BBF93156B1DE1C6526C07A1B6DBA14E6FA
                                                  SHA-512:3AFA8424599E3BD2EF4582EB6A961C7057E90BCA70999D58435DB9E7D0794A14688079CFCC284B8150D452EAB18FBECEFDC23A9FBDE7D618CCEEADE63805E0F6
                                                  Malicious:false
                                                  Preview:0.&...*.H........&.0.&....1.0...`.H.e......0.....+.....7......0...0...+.....7...........J.x...m.s..210826120626Z0...+.....7.....0...0..}.R5.C.E.E.6.0.F.0.7.0.9.3.0.D.C.9.7.1.E.4.D.3.5.D.4.8.E.3.0.3.6.4.F.6.2.3.A.A.D.2...1..%06..+.....7...1(0&...F.i.l.e........b.d.d.c.i...i.n.f...0@..+.....7...1200...O.S.A.t.t.r........2.:.6...0.,.2.:.1.0...0...0E..+.....7...17050...+.....7.......0!0...+........\.`.p...q..]H..d.#..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....R7.C.9.5.7.3.6.8.1.B.B.6.6.6.6.3.3.5.A.0.F.7.1.5.B.B.E.8.C.2.0.4.B.4.1.0.8.4.E.5...1..-06..+.....7...1(0&...F.i.l.e........b.d.d.c.i...s.y.s...0@..+.....7...1200...O.S.A.t.t.r........2.:.6...0.,.2.:.1.0...0...0M..+.....7...1?0=0...+.....7...0...........0!0...+........|.sh..fc5...........0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}.......C0..?0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........1.0.0.0...0$..+

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bddci.inf

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:Windows setup INFormation
                                                  Category:dropped
                                                  Size (bytes):4585
                                                  Entropy (8bit):4.9899603115602105
                                                  Encrypted:false
                                                  SSDEEP:96:udXrNW28u5Z5u5j5h5A54FPO9EyNQkF9pSYzONz1oWO9WuS:u1pX3k5zaEO9E4PFSYSNxov9HS
                                                  MD5:E8B58A307F96DC9CE1EB2729F86E13B0
                                                  SHA1:5CEE60F070930DC971E4D35D48E30364F623AAD2
                                                  SHA-256:2C9A7118EF74C3B168663C8EC6F3A7B27653896E193129ED0BC5E9AA55A0AFBB
                                                  SHA-512:7CD9FE7BCC8C8EC1466ACC1ADC7AB8C9AB6BDAF7C7C27DCC6C0CB43BAB741F2519A88647CE43F74D7E9CAF4AE39AE172DC639ED1B2027B9E8F15F35353613D91
                                                  Malicious:false
                                                  Preview:;;;..;;; BdDci..;;;....[Version].. Signature = "$WINDOWS NT$".. Class = WFPCALLOUTS.. ClassGuid = {57465043-616C-6C6F-7574-5F636C617373}.. Provider = %Bitdefender%.. CatalogFile = bddci.cat.. DriverVer = 08/25/2021,14.6.1.96....[SourceDisksNames] ; "Used by SourceDiskFiles to express where those files are located".. 1 = %DiskName%,,,""....[SourceDisksFiles] ; "In order for a driver file or an application file to be included as part of a signed driver package".. bddci.sys = 1,,....[DestinationDirs] ; Specifies the destination directory for all copyfiles in this inf... DefaultDestDir = 12 ; 12 = \Drivers folder.. BdDci.DriverFiles = 12 ; 12 = \Drivers folder....[DefaultInstall].. CopyFiles=BdDci.DriverFiles..[DefaultInstall.Services].. AddService = %BdDciServiceName%,%SPSVCINST_ASSOCSERVICE%,BdDci.Prevention.Service....[DefaultInstall.Detection].. CopyFiles=BdDci.DriverFiles..[Defaul

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bddci.sys

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32+ executable (native) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):800672
                                                  Entropy (8bit):6.427490885202283
                                                  Encrypted:false
                                                  SSDEEP:24576:TW3je01Io/rAYd/cg3NuRoB4Qn5ZTQuzfSuKRDSqLP6z5BLM5:a3jp1Io/rn/cgduRoB4Q5ZTQuzfShDSs
                                                  MD5:2A241AF18D9F0466AFF6CD77C1561F9B
                                                  SHA1:2C6BFC8E583ED026FDF9EC01265D99E22D39305A
                                                  SHA-256:528804013487CDB1DA617E512D1DE68060602887BCC8A7822BDB1346A2995FFD
                                                  SHA-512:6779667BB57C87FDBF4DEE57682E7851B5AD5BEA39DEB09FCB596AE48EB571317749FF59E825F91BD57527DAB7477DEAC5B24BDBD86471844FAD36876C08DD28
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........."?.Ll.Ll.Ll..Jm.Ll...l.Ll...l.Ll..Mm.Ll.Mlq.Ll..Om.Ll..Hm.Ll;.Im..Ll;.l.Ll;.Nm.LlRich.Ll................PE..d...#$&a.........."..........:......p..........@.............................p.............A....................................................d....P..`........i.......!...`.......D..T...........................0E..................h............................text............................... ..`PAGE....6".......$.................. ..`.rdata..............................@..@.data... ...........................@....pdata...i.......j..................@..@INIT....b....@...................... ..b.rsrc...`....P......................@..B.reloc.......`......................@..B........................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bddci_core.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):1552416
                                                  Entropy (8bit):6.327817060072325
                                                  Encrypted:false
                                                  SSDEEP:24576:401AaTk1RdGCCZQzknHaCj+g62hrrNKVnCVnii7Jvw5wZLqRRw:401AaTmdGCeQzknD/hrIVnCVnd7JvwSX
                                                  MD5:13EFC649989E224C8346C52AE3CC9A93
                                                  SHA1:BF907FEE6FCE0745601219F3FAA89BC2C08434B0
                                                  SHA-256:F994E407E9F78D521F335F25B7A4217FDCC4A5E6DC050FDF90D7870FDA1E0EF7
                                                  SHA-512:7C6F65858E3803AB9ABE075C2E257E322594B875BD6001BE5A6C6BDE0AB271844CCD7F869394666A2CE9B535ABB46E0332697D2C19836F886241881A60697CE0
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........iP.:P.:P.:D..;Z.:D..;D.:D..;..:<..;^.:<..;Z.:<..;..:D..;Y.:P.:..:...;W.:...;{.:...;Q.:..Y:Q.:P.1:Q.:...;Q.:RichP.:................PE..d...+$&a.........." .................>..............................................{p....`A.........................................$..p... %..d.......0...........p.. @......d...............................(...`...8............................................text...l........................... ..`.rdata...4.......6..................@..@.data........@...x..................@....pdata.............................@..@_RDATA...............L..............@..@.rsrc...0............N..............@..@.reloc..d............T..............@..B................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bddci_install.cmd

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):113
                                                  Entropy (8bit):5.024399016495459
                                                  Encrypted:false
                                                  SSDEEP:3:mKDDGQWT0yOA59bR1GqWREEGRMGMily6ZhwKML5r:hSnJOrEE6RVtG
                                                  MD5:E53B0CDFA47603A767603BA0D7D88D5F
                                                  SHA1:E4954AC71F948F6CDE020CEC724C5E40079F1710
                                                  SHA-256:B6F48EC300DFA6C1B9465A1758960CC22E43C1C9E8BC9080B54B1355752C85A2
                                                  SHA-512:861BC7E89D56FC498C8D9D362F775FF1005FE23BDD9A7DCF76682CF3D39ECF13342C52BE1A527995EC47FD2CBD01F91E91F09F4094A0CB04903C9FB1B11921AE
                                                  Malicious:false
                                                  Preview:@echo off..pushd %~dp0..RunDLL32.Exe syssetup,SetupInfObjectInstallAction DefaultInstall 128 %CD%\bddci.inf..popd

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bddci_install_boot.cmd

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):110
                                                  Entropy (8bit):5.05232264138167
                                                  Encrypted:false
                                                  SSDEEP:3:mKDDGQWT0yOA59bR1GqWREEGRMZiEly6ZhwKML5r:hSnJOrEEMEVtG
                                                  MD5:EB7FD87467EBED250DDF9205BBFCF35A
                                                  SHA1:AD6B37B514DFFC0BAE6D5046C2B34ADFD354AA32
                                                  SHA-256:49AC42D63849F3FC001AE109C63578A43778E97EEF8696EFE7CBA9FB03FE820D
                                                  SHA-512:64A4E216A9EAF6804DFA273AECFB8F7B7BD513EDEC4D75AF1C4C7370E5C5CACC0209475ABE40587A5A8003462AA2F4678E8518D96413C3FDD84220589AB01773
                                                  Malicious:false
                                                  Preview:@echo off..pushd %~dp0..RunDLL32.Exe syssetup,SetupInfObjectInstallAction BootInstall 128 %CD%\bddci.inf..popd

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bddci_reinstall.cmd

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):216
                                                  Entropy (8bit):5.127188347659828
                                                  Encrypted:false
                                                  SSDEEP:3:mKDDGQWT0yuJqpsgLA5vRpMKz6yEly6ZhwKMLRA59bR1GqWREEGRMGMily6ZhwKf:hSnJGqpsgLQXdEVt4rEE6RVtfn
                                                  MD5:C0D4FA051CFCE46BD180B8E1611FE221
                                                  SHA1:DCE6714DCFB8A5986A74D7997994BC8A7A74D691
                                                  SHA-256:681BAF813771192AAF8853BB0DD3773DA610B429F875CB93A501968DD886EC22
                                                  SHA-512:AAC3C218B41C5A90F81A7E9EEFCEAF9F8854763F254A495AA5455BCBA3D97231DD8AA02B35D43880C1F4A094B5FC0965109B267C4DA15B3682D062DA6D9ABC3E
                                                  Malicious:false
                                                  Preview:@echo off..pushd %~dp0....call bddci_stop..RunDLL32.Exe SETUPAPI.DLL,InstallHinfSection DefaultUninstall 128 %CD%\bddci.inf..RunDLL32.Exe syssetup,SetupInfObjectInstallAction DefaultInstall 128 %CD%\bddci.inf....popd

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bddci_reinstall_boot.cmd

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):213
                                                  Entropy (8bit):5.153467971136594
                                                  Encrypted:false
                                                  SSDEEP:3:mKDDGQWT0yuJqpsgLA5vRpMKz6yEly6ZhwKMLRA59bR1GqWREEGRMZiEly6ZhwKf:hSnJGqpsgLQXdEVt4rEEMEVtfn
                                                  MD5:D689035E2D21C5D672CA0FA99B1D6FF9
                                                  SHA1:F21E0181303F0FB4A7C82EB76CCF9A5B4AD446E9
                                                  SHA-256:2ED8F11755D68E6E381914AE35995F815168B87948043D3871ED50D638F457AD
                                                  SHA-512:A50BAC4C7AA8A9F3334626F2C0A6DFC0B3D54D402A7E8276C21B9335009430F19DF7B244DAB00F6FDE538E345FECA09996BAF7927FDF0F4134E2D5DA3A94E8C4
                                                  Malicious:false
                                                  Preview:@echo off..pushd %~dp0....call bddci_stop..RunDLL32.Exe SETUPAPI.DLL,InstallHinfSection DefaultUninstall 128 %CD%\bddci.inf..RunDLL32.Exe syssetup,SetupInfObjectInstallAction BootInstall 128 %CD%\bddci.inf....popd

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bddci_start.cmd

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):61
                                                  Entropy (8bit):4.3212158708844575
                                                  Encrypted:false
                                                  SSDEEP:3:mKDDGQWT0yVTBBn:hSnJVT3n
                                                  MD5:D1AAA0351E290303C8F2773E4444E5DD
                                                  SHA1:757E10E1FDC2919A10BAE72D215A1324F4ABA4E6
                                                  SHA-256:B356443280684F01A3666021662821EB9130EAB58EBE48A400726E7D82591F5B
                                                  SHA-512:7468CE3E229AAD292897BA3F531479D4764A38E1E6B58E3FD4AB9E5232FE6CAF9E040D8F742785B85802C4D4BAEF9598EBC78BDA92D525DA10C6C88AD5D7E2DF
                                                  Malicious:false
                                                  Preview:@echo off..pushd %~dp0..net start bddci..sc query bddci..popd

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bddci_stop.cmd

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):60
                                                  Entropy (8bit):4.235546013316953
                                                  Encrypted:false
                                                  SSDEEP:3:mKDDGQWT0yVO9rCBBn:hSnJVz3n
                                                  MD5:18D3A452985E52AA8ADFF7737F116EEE
                                                  SHA1:3CE81B54F7C3A913509FCC78538CE239C6D41CB0
                                                  SHA-256:D42E07D8BD6FD9536552704B3556EF3DCC1C43B89E7BF0A4DEF59784391A9098
                                                  SHA-512:D3F337C26690258A3D1D02B555CAF1463FE49C9EA8AD51496EAC8E425AFE65952C2EA870798C2038282E196DBB9E4719FE7FD8742F8488F4B55E7687ED59896E
                                                  Malicious:false
                                                  Preview:@echo off..pushd %~dp0..net stop bddci..sc query bddci..popd

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bddci_uninstall.cmd

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):110
                                                  Entropy (8bit):5.130096791944795
                                                  Encrypted:false
                                                  SSDEEP:3:mKDDGQWT0yOA5vRpMKz6yEly6ZhwKML5r:hSnJOQXdEVtG
                                                  MD5:32A10363F7CEF5F479734E468FAA54E9
                                                  SHA1:CCCB9C13D1F2A371443FAB4C8EFF346F54C764F5
                                                  SHA-256:E7CBA9FE65F75C973818ED70EBD764EA47B05956B7390DC8942AD6C5D150CE8E
                                                  SHA-512:B48B604312026442CEF5D6D6C437D9B202B97CB72506EE18FEDBC2DDCF8B97B7E6A575626432B3467DB25FEB0DB7F2F1EF5053EE1FDBAAD7A30866F583F74FEB
                                                  Malicious:false
                                                  Preview:@echo off..pushd %~dp0..RunDLL32.Exe SETUPAPI.DLL,InstallHinfSection DefaultUninstall 128 %CD%\bddci.inf..popd

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bddcihttp.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):2731552
                                                  Entropy (8bit):6.533490914139629
                                                  Encrypted:false
                                                  SSDEEP:49152:0V6paqQWRm+RYPdrne0VZaKKRYkeK3dj3qoZH/ojsHNTMGZXEi:JpfRQaRY3K3toYSGD
                                                  MD5:53F6774DF73CC44D29F354AECBDEF948
                                                  SHA1:894158C553F39F8000C858C84AD772714E215D75
                                                  SHA-256:D1130318E699B81F1918F468A8B49C9BE7B8B4293C1078DA4A17DAC6AD999EC6
                                                  SHA-512:5151804071C371FE2458C2FC67441441B01602A529582BED48B0E0226E051F933981DCE1F84E3AC0F2EBE608B463FE1E9C226D058EDD3BF6C5B35BE9E8A9E234
                                                  Malicious:true
                                                  Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......c...'.u.'.u.'.u.3.q.1.u.3.v.,.u.3.p...u...q./.u.A...&.u.u.q.6.u.u.v.-.u.u.p...u.3.t.*.u.'.t...u...|...u...u.&.u.....&.u.'..&.u...w.&.u.Rich'.u.........................PE..d...,Z.d.........." .................8........................................)......g*...`...........................................'......'.x.....)......p(......n). @....).T....s%......................v%.(...`t%.8............................................text............................... ..`.rdata..j...........................@..@.data.........'..d....'.............@....pdata.......p(......((.............@..@_RDATA........)......F).............@..@.rsrc.........)......H).............@..@.reloc..T.....).. ...N).............@..B................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bdnc.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):2529312
                                                  Entropy (8bit):6.515710054151537
                                                  Encrypted:false
                                                  SSDEEP:49152:7LXjFttLwzqzJ94tMozJfQu8FvDj0/pQBuwV3TPNmZfN:7LlwS1vkBQBjVBmBN
                                                  MD5:957DCCB05E3FEABEA72DBE13F4803FDC
                                                  SHA1:A4541A8019EE32B9659C242AD6C6038A723342B6
                                                  SHA-256:3E2C8A240A1BB76A8770DA243AEFD7795EDA97795D8266B39F0907B1AC94551A
                                                  SHA-512:932F4C72F247EE56157388056AC488248C20DF694874124CBB09A0523C6664CBBD88E7DEEE03EFABB3C67018FB8C65C77B152408ACB92C53B1CD8B4989C5C7F0
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............................^..I.;....I.....I.....I....................<..:.....:...................9..........Rich...........PE..d......a.........." .................p........................................&.......'...`.........................................`.#.p.....#.......&.......$.\....X&. @....&.(L....!.p...........................P.!.8............................................text...0........................... ..`.rdata..@...........................@..@.data.........$..p....#.............@....pdata..\.....$......X$.............@..@_RDATA........&.......&.............@..@.rsrc.........&.......&.............@..@.reloc..(L....&..N....&.............@..B................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bdnc.ini

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:ASCII text
                                                  Category:dropped
                                                  Size (bytes):108
                                                  Entropy (8bit):4.584132838074214
                                                  Encrypted:false
                                                  SSDEEP:3:RwCKXF83Mnmz8BCjY9kHvGPbGymjyRZF:BE7mz8KYeGbGym4ZF
                                                  MD5:153E80B1EC9BAEC5619ACEEBFDE340C6
                                                  SHA1:5374991113BD75BC60DF99B372E61DEB6D5340EF
                                                  SHA-256:C7890B7AA3FBE8AAEF3CFFD4215B870489A54C9E450B1A91A8021D48BE3547BA
                                                  SHA-512:3FCE1BD79FD944554DCB09E74E33A01F443A358FD3B42334926E8C9DC385C9F717BB9D48F022E5B4A7486AD7A091246C4EEF64CF212BA29812D967F60934E2D2
                                                  Malicious:false
                                                  Preview:BootstrapServer = nimbus.bitdefender.net..# LogFile = bdnc.log..# ProxyName = .# ProxyUser = .# ProxyPass =.

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bittorrent.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):108576
                                                  Entropy (8bit):6.197741681294066
                                                  Encrypted:false
                                                  SSDEEP:3072:KizDGKhdWOl1bxfvmyW25B8RA+sfCZizxMtFQnIdcKb:tL/WOl1dWHHcKb
                                                  MD5:74D7799C00C804296C0F1B99324B513F
                                                  SHA1:527380E0E44C9FD8CA5F73D103E8E9F56EB13142
                                                  SHA-256:66C0B9D01AFAB9DB8F87164C747DC6BDD05FFAE25092AB4627A8A47857118AB0
                                                  SHA-512:3140D32D4199CC246FDDB292400EC31BCC098E18349D9991828FC1462F7CD6AA3A0666037E569511B37B1CB6BAF34C94BE2FDC70A9685125A72FDD44E427CDAC
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................................................................+......+......+.w.....+......Rich............................PE..d.....n\.........." ................................................................F.....`..........................................>.......?..<....................h.. @..........p0..T............................0...............................................text............................... ..`.rdata..............................@..@.data....(...P.......4..............@....pdata...............H..............@..@.gfids...............V..............@..@.rsrc................X..............@..@.reloc...............^..............@..B........................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bridge_install.cmd

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):167
                                                  Entropy (8bit):5.102379914131941
                                                  Encrypted:false
                                                  SSDEEP:3:mKDDGQWT0yB83vQXAtlNdfDZj4I5pEIRfT8ZEEyAZ51AUmhMW4crWarA5Mn:hSnJB83vQQtlNj5TL65yULWRCGjn
                                                  MD5:996CD85E5F005D76E1B7F6033AD3840F
                                                  SHA1:D2111E0E5CDB4FBCF0C7220D4BFDF71CB495FB60
                                                  SHA-256:328A059D0FD3BBFCE208BD5DF73D14D0B56B2C0EE79BF7E6E2017211150655C1
                                                  SHA-512:8F1C15E4C0E274E548843D102CF8A722EEDFDC098AD36AE45BF0A84F70C96360E7704A25E0CD7067191E594FA6931F46FF0ADD09DEB7F8BE8F38DF1873B0F81F
                                                  Malicious:false
                                                  Preview:@echo off..pushd %~dp0..sc create DCIService binPath="C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\DCIService.exe" DisplayName= "DCI Bridge Service"..popd

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bridge_start.cmd

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):49
                                                  Entropy (8bit):4.445644282581652
                                                  Encrypted:false
                                                  SSDEEP:3:mKDDGQWT0yBsns2yAB:hSnJBsZB
                                                  MD5:95E8C6CD0A911F1AB4969C06B8CF77A2
                                                  SHA1:BE1B1F8ABD0420F59ECAB7BCF8120CDC2CE34195
                                                  SHA-256:DE795F6D8591577054813BEE79E7C5B4EE13360039D29AA73971C6B985D26EBD
                                                  SHA-512:E5EEFAF761BE7BF3CEA207E22E98398093FA0A9D3B459AF7DF22BFBF07755816737A7B8B261ACF01AEC8B10B5D8F0D90132A4ECDD83C242B2CDE883039FAC1FF
                                                  Malicious:false
                                                  Preview:@echo off..pushd %~dp0..sc start DCIService..popd

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bridge_stop.cmd

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):47
                                                  Entropy (8bit):4.323220703147271
                                                  Encrypted:false
                                                  SSDEEP:3:mKDDGQWT0yBs0bbnXA0vQB:hSnJBs0vnX9U
                                                  MD5:2D655B2F0502E2E7DEA4154A8C801219
                                                  SHA1:E20FE8994AD78028516BFDFA1804C3BC8CF19D6F
                                                  SHA-256:93CEBF47CF6FC0088D589B62BF805F371E5EBF12639EB4DAB9F21E753D1BB8AC
                                                  SHA-512:7F6009BD8C5EFB4A60191574CF850AC5F83BFF2F9A38F148206A566F4BAA0E82EE9ABE0C358CFF57F27EC5727685FBAE5A3F03D77A920EF438801F70E06FCC6F
                                                  Malicious:false
                                                  Preview:@echo off..pushd %~dp0..sc stop DCIBridge..popd

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bridge_uninstall.cmd

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):73
                                                  Entropy (8bit):4.752922463132331
                                                  Encrypted:false
                                                  SSDEEP:3:mKDDGQWT0yB7s5vw414NaDw9IvVun:hSnJBUR4Na1vUn
                                                  MD5:808896D128F2DF4E933CBC8E48B589E2
                                                  SHA1:0B8A2851D08111843EC9DB698CA716053CD94E10
                                                  SHA-256:4827234DB594CD6DC42E97A6E6A418B3D2C691A9354FF6E9C8E03C5B5454F1F0
                                                  SHA-512:83680AD9519207AF630B151C82F7979764D216AF8DC0B68C4BF051E240F52BF7E2FF2C3A138EC7577A33FC1A27CE8731E59FA84C7C008FF7765542AFF767E4FC
                                                  Malicious:false
                                                  Preview:@echo off..pushd %~dp0..sc delete DCIBridge binPath="DCIBridge.exe"..popd

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\concrt140.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):317224
                                                  Entropy (8bit):6.325476680883488
                                                  Encrypted:false
                                                  SSDEEP:6144:6lTcrTKDDPzfM0xmNcwwY2baM739NhNN40aBqnWzgPPz:6cKHzEc/Yzz
                                                  MD5:165E673B081CF2C90A2E63A6834ACE1E
                                                  SHA1:544014C03FB2E91454D4BAC4934B1C44F2ED8943
                                                  SHA-256:8BF7EFB1FA4F86DB826B79EA1D3DAA6E18019790D7B5FF58B53BFB4CAD967974
                                                  SHA-512:BB02ED42C4AFC2AE1AD5A01D974B41C511E04964962655CF387E07FB364075A1939CB9EEA0B72BBC73F6813BE9107D650543EE1ACC3583A3A59AA8B416AF9565
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........e............/.<....|@....ct............ct.....ct.....ct......ct.....ct,....ct.....Rich....................PE..d...M8.^.........." ................p.....................................................`A........................................0....M..<................p...6......(A......l....4..T...........................p4..0............................................text...<........................... ..`.rdata...2.......4..................@..@.data....?...0...8..................@....pdata...6...p...8...N..............@..@.rsrc...............................@..@.reloc..l...........................@..B........................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\ftp.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):124448
                                                  Entropy (8bit):6.24372790381547
                                                  Encrypted:false
                                                  SSDEEP:3072:6Wj8gEU217BNkr4yg0IsiO1tpp/1t1tD1YMOYbOPzKTIiz9IB:6CKUokr4yx5iLKL9IB
                                                  MD5:B7C081F03A50C391F5B22A0EE16B8A1E
                                                  SHA1:2FA63728DDDB2E25F69ADF0E02CBD75D053A9965
                                                  SHA-256:42CCB6C597D0952042C3D3FDC0027634C3E9D118706A286277A32A7F6AF6BD30
                                                  SHA-512:8590E537D7DF9523F934CD4BB18C7515D89E74FC8B3E8E35CE70B368C9A99659BF59DEDB020FB470CF8577248F607ED271D52107015CDFFC8A0A9F7E8AC2880B
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......c..E'..'..'..H...#..H......H...[..I.../..I...=..I...7..H..."..'..i......$......&....X.&......&..Rich'..........PE..d.....n\.........." ................p&..............................................E'....`..........................................{......D|..<....................... @......$....g..T............................g.................. ............................text...`........................... ..`.rdata..............................@..@.data...h)...........p..............@....pdata..............................@..@.gfids..............................@..@.rsrc...............................@..@.reloc..$...........................@..B........................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\http.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):194080
                                                  Entropy (8bit):6.267657257196838
                                                  Encrypted:false
                                                  SSDEEP:3072:UFig6fLNAsrACf/dKvqZEB15xo4JC3Zh8nzxGzWZmUbX4ojw:7g6fSsbf/dCqOBzxfJzOpUT4oM
                                                  MD5:C0D7A16BA0340FFAEADEDB5FD82F6984
                                                  SHA1:63AC374A7322E4ECB9B8FED7E67FFCF01B71FC75
                                                  SHA-256:E07A6F752E45E3240C95CBB890B22A154B1CCA571C17FB57F11EF0B86108A7BB
                                                  SHA-512:3E50F009B7A43D2FB58F28F0EAAB4555D9FC68ED72AF970F6A6BD875DAB30B5AD32300E95AC570DDF0D925499E709457EA8757033580493F4BBAE14A20D06C42
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........./...A..A..A..E..A..B..A..D.7.A..~...A..B..A..E..A..@..A..@...A..D..A.b.H..A.b.A..A.b....A.b.C..A.Rich..A.........PE..d.....n\.........." ................................................................sG....`..........................................u......pv..<....................... @......,... Y..T............................Y.................. ............................text............................... ..`.rdata.............................@..@.data....<.......(...f..............@....pdata..............................@..@.gfids..............................@..@.rsrc...............................@..@.reloc..,...........................@..B................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\lsa.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):109088
                                                  Entropy (8bit):6.197321200062162
                                                  Encrypted:false
                                                  SSDEEP:3072:VdO2ha1G2lDb8TfvmyW25B8RA+sfCZizxMC6d+eQms0A:xj2lDbMWUqs0A
                                                  MD5:F89B978400B6C035F975EFC6AB7303A8
                                                  SHA1:173F9F2BC814B19870C7B98057C948B0292340F9
                                                  SHA-256:CA621B67C0AA1FE669C99ABC0EE1A52807321F5BE4092BAD7C49D4291C194B7C
                                                  SHA-512:D0FC9D302EE3B8BE6C65CCB2A2D387A1A914ED9A453CE0CAD6734F2C9D59A0EA8694E39B81382EE7B6F6C61B96DB81F7AD1C227727B65A5A61C0471A35C39E33
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................................................................+......+......+.w.....+......Rich............................PE..d....n\.........." ................@...............................................E.....`.........................................`?.......?..<....................j.. @...........0..T........................... 1...............................................text............................... ..`.rdata..............................@..@.data....(...P.......6..............@....pdata...............J..............@..@.gfids...............X..............@..@.rsrc................Z..............@..@.reloc...............`..............@..B........................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\msvcp140.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):590632
                                                  Entropy (8bit):6.463330275333709
                                                  Encrypted:false
                                                  SSDEEP:12288:Mt8MRN4gE4x4iTqwTQa6IUqXF7XyxpypsdUDqNSfbQEKZm+jWodEEV3Ho/:MCMm9pyp35bQEKZm+jWodEExg
                                                  MD5:E74CAF5D94AA08D046A44ED6ED84A3C5
                                                  SHA1:ED9F696FA0902A7C16B257DA9B22FB605B72B12E
                                                  SHA-256:3DEDEF76C87DB736C005D06A8E0D084204B836AF361A6BD2EE4651D9C45675E8
                                                  SHA-512:D3128587BC8D62E4D53F8B5F95EB687BC117A6D5678C08DC6B59B72EA9178A7FD6AE8FAA9094D21977C406739D6C38A440134C1C1F6F9A44809E80D162723254
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......n...*...*...*.....w.(...#...<...*......./.....".................+.....g.+.....+...Rich*...................PE..d...R8.^.........." .....>..........p"....................................................`A........................................ m..h....G..,...............(;......(A......4.......T...............................0............P......Ti..@....................text....=.......>.................. ..`.rdata.......P.......B..............@..@.data....:...`..."...P..............@....pdata..(;.......<...r..............@..@.didat..h...........................@....rsrc...............................@..@.reloc..4...........................@..B................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\msvcp140_1.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):31528
                                                  Entropy (8bit):6.472533190412445
                                                  Encrypted:false
                                                  SSDEEP:384:R77JqjlI8icUYWhN5tWcS5gWZoMUekWi9pBj0HRN7RA5aWixHRN7osDhzlGs6N+E:R5D8icUlX5YYMLAWRAlypmPB
                                                  MD5:7EE2B93A97485E6222C393BFA653926B
                                                  SHA1:F4779CBFF235D21C386DA7276021F136CA233320
                                                  SHA-256:BD57D8EEF0BC3A757C5CE5F486A547C79E12482AC8E694C47A6AB794AA745F1F
                                                  SHA-512:4A4A3F56674B54683C88BD696AB5D02750E9A61F3089274FAA25E16A858805958E8BE1C391A257E73D889B1EEA30C173D0296509221D68A492A488D725C2B101
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........U..\4~.\4~.\4~...^4~.UL..X4~.Dz.[4~.D}.^4~.\4..v4~.D..Y4~.D{.O4~.D~.]4~.D..]4~.D|.]4~.Rich\4~.........PE..d...W8.^.........." .........$............................................................`A.........................................>..L....?..x....p.......`..4....:..(A......p...@3..T............................3..0............0..0............................text...(........................... ..`.rdata.......0......................@..@.data........P.......,..............@....pdata..4....`.......0..............@..@.rsrc........p.......4..............@..@.reloc..p............8..............@..B................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\msvcp140_2.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):193832
                                                  Entropy (8bit):6.592581384064209
                                                  Encrypted:false
                                                  SSDEEP:3072:V7vC/HAiCsJCzwneNPXU7tm1hTt8KBDal8zg/0LwhORfewlMi0JHV:VTGAtweN85m1f8KBI9wfpsJH
                                                  MD5:937D6FF2B308A4594852B1FB3786E37F
                                                  SHA1:5B1236B846E22DA39C7F312499731179D9EE6130
                                                  SHA-256:261FBD00784BB828939B9B09C1931249A5C778FCEAD5B78C4B254D26CF2C201F
                                                  SHA-512:9691509872FDB42A3C02566C10550A856D36EB0569763F309C9C4592CAF573FBB3F0B6DC9F24B32A872E2E4291E06256EAE5F2A0DEB554F9241403FD19246CAC
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........94..Wg..Wg..WgVt.g..Wg..g..Wg..Sf..Wg..Tf..Wg..Vg..Wg..Vf..Wg..Rf..Wg..Wf..Wg...g..Wg..Uf..WgRich..Wg........................PE..d...W8.^.........." ................p............................................... .....`A........................................ ..................................(A...........K..T........................... L..0...............P............................text............................... ..`.rdata..............................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\msvcp140_codecvt_ids.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):27936
                                                  Entropy (8bit):6.577459666532623
                                                  Encrypted:false
                                                  SSDEEP:384:nGpHh29k7lAv1WioEWQ53tWi9pBj0HRN7evpPOWixHRN76MauOMlVt:nCHc4MqPAWevp3y6MgI
                                                  MD5:1B8D2F7700EB84B832E9750880CDCBD5
                                                  SHA1:3AE22588F9420414182F78A994E1E2D9153E48E2
                                                  SHA-256:13DC526343225AD933612A6BBCEC4F9A3A9A94B00B2F24B7DA8F851E9DE00992
                                                  SHA-512:6DB667391D842511867EED010055E9E3A09897004F77912E055FE794870EFD59CDE822D9AE819963595EB53A17477B24C981A334EBFB3869D71C3FE6A8274F14
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........T...:N..:N..:N9(.N..:N..N..:N..;N..:Nu.;O..:Nu.>O..:Nu.9O..:Nu.?O..:Nu.:O..:Nu..N..:Nu.8O..:NRich..:N........PE..d...W8.^.........." ................ ........................................p...........`A........................................p'..0....(..P....P..0....@.......,.. A...`.. ....!..T............................!..0............ ...............................text...X........................... ..`.rdata..0.... ......................@..@.data........0....... ..............@....pdata.......@......."..............@..@.rsrc...0....P.......$..............@..@.reloc.. ....`.......*..............@..B................................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\pop3.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):111136
                                                  Entropy (8bit):6.222503127418836
                                                  Encrypted:false
                                                  SSDEEP:3072:ucC1a3VOKS2SWfzzIaYSMeEesE9+WryKfmjqnurfTHSMyyGbtYMKZq1gN:uVaMKSuf3IF9eieEMKY1gN
                                                  MD5:4617113B1FA666E743F899D3781483D8
                                                  SHA1:0A1DADB7051C5A5ED9D108F78F83AC2B21419A84
                                                  SHA-256:30AF0CEC58983EF5CCF2B30F074FAAD6AC348CD5FC88461C0B06977839A2C651
                                                  SHA-512:92D0CD9E51DE702A04BC2948E2966219B16C1BEF93DADDDCCF801C58C2DA1DD22AC5B9651583868957098959BEECA2CFDD7465EDECE1120E364935FF65184675
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........?)[.^G..^G..^G..:D..^G..:C..^G..:B..^G.4....^G...D..^G...B..^G...C..^G..:F..^G..^F..^G.x.N..^G.x.G..^G.x....^G.x.E..^G.Rich.^G.........PE..d....n\.........." ......................................................................`..........................................O.......P..<....................r.. @..........p@..T............................@...............................................text.............................. ..`.rdata..<...........................@..@.data....(...`.......>..............@....pdata...............R..............@..@.gfids...............`..............@..@.rsrc................b..............@..@.reloc...............h..............@..B................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\rpc.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):109600
                                                  Entropy (8bit):6.188830642967351
                                                  Encrypted:false
                                                  SSDEEP:3072:zhKIKMqrmSYZKc4yvmyW25B8RA+sfCZizxMI/FsXujHz:RwaSYZKTFCzjHz
                                                  MD5:FD8770A4368ACD38C18CCB0298DCF587
                                                  SHA1:867772D872B84988BD7E9EA2271E470DD443874E
                                                  SHA-256:E039A7E9BDECAF697BD73A47DA557E5582FBFFACC53F9A185790299156C85584
                                                  SHA-512:E1123FA8CF304D082324CFAA5534EA34103226242CEF1D6E1640BD2B343D19AE3BCEC2302C3A6167C57F8196415190D86050FB55E2E6BA0D90AEF189D5CA18C7
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................................................................+......+......+.w.....+......Rich............................PE..d.....n\.........." ................@...............................................E^....`.........................................P?.......?..<....................l.. @...........0..T............................0...............................................text............................... ..`.rdata..............................@..@.data....(...P.......8..............@....pdata...............L..............@..@.gfids...............Z..............@..@.rsrc................\..............@..@.reloc...............b..............@..B........................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\sav.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):743968
                                                  Entropy (8bit):6.401514425912792
                                                  Encrypted:false
                                                  SSDEEP:12288:m/Kz78acbADfu4+2L6QalAMGzxWZ6xb4YXecX9aRleIBakXRa9wItZZcfeNkyfdg:2KMacbADfbzL/alAMGzxWZ6xb4YXecX0
                                                  MD5:47B40A1348A6EDA7087A6241858EF9E1
                                                  SHA1:CA8CE0BA789BAAFC75B593FD8A98D4CF8AFA4956
                                                  SHA-256:CD83B1612C2823488EA267E88FE91A2AEDF6B278BAFDD39FF673BED3ADD39D6B
                                                  SHA-512:DD43A1A08E0DD9386C0C4AA47C2E1A71A6CCD07DEC1D70129C43845C5C32EC038EFB617BEC35320A467BBAC77BAD6ABEFD176C747B2A9113190D3E98D1B50130
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'.}.c...c...c.......g.......r............#..b.......i.......Q.......".......d...c...........+.......b.......b.......b...Richc...........................PE..d.....n\.........." .................G.......................................@............`.........................................@P.......g..P................[...... @... ..t....g..T....................h..(....h............... ...............................text............................... ..`.rdata..XS... ...T..................@..@.data............@...Z..............@....pdata...[.......\..................@..@.tls................................@....gfids..............................@..@.rsrc...............................@..@.reloc..t.... ......................@..B........................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\scan.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):861728
                                                  Entropy (8bit):6.42613102304455
                                                  Encrypted:false
                                                  SSDEEP:12288:CRRnyp7sOXzRW1frmznBFdX1P/paqkHLFgSD7pY8e2Ssoq5f0:8Rw7zRW1DmDDdX1P/paqYn7mnKV0
                                                  MD5:F06086D2B25027ED54B1434B38D41BA7
                                                  SHA1:5EE263A1A51A1565FA42DA998265D868884A0D79
                                                  SHA-256:FB9B4B9E917CAF6719F7FCC031DD7BB0F5F5EF7D39A4C43242D38371C97C9998
                                                  SHA-512:54BE383C1937AF05096090AAD04B80F4B2098060F3A3BC45D0A6068C660337A8E71D5E217FE950E718EABEA31599388D6887E8D0B8F9CBFBA7EFA09C8AB61F5A
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......e5..!Tq.!Tq.!Tq.5?r.&Tq.5?t..Tq.G;.. Tq.s!u.0Tq.s!r.(Tq.5?u./Tq.5?p..Tq.!Tp..Tq.s!t..Tq..!u.%Tq..!t.<Tq..!q. Tq..!.. Tq.!T. Tq..!s. Tq.Rich!Tq.........PE..d......a.........." .....F...................................................p......O.....`......................................... ...................Hy...P..Tf...... @...P..T.......p...........................`...8............p...............................text...|C.......D.................. ..`.orpc........`.......H.............. ..`.rdata..RQ...p...R...J..............@..@.data....}.......P..................@....pdata..Tf...P...h..................@..@_RDATA...............T..............@..@.rsrc...Hy.......z...V..............@..@.reloc..T....P......................@..B........................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\smb.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):196640
                                                  Entropy (8bit):6.135506460645053
                                                  Encrypted:false
                                                  SSDEEP:3072:JL/r6ivsFqEaTIwX9nfyXI9nPRxel7XD6J75Mlsefbc1brS4ukUNfcfI:JLDHqq7XZyAn+tXDbfSbrqrVcfI
                                                  MD5:B4A0352A49D7661E64693765707A0A1A
                                                  SHA1:888F7E14CC08EF0FF4F6557BC8EC3A4AC36D18F3
                                                  SHA-256:4295BBC2CE2CCB68B17DF07B2364EF90B3BB802FC2F44C710B13C1477F424CAA
                                                  SHA-512:8647121A5CFC25FB7FF46308CEBE3C261927BAC40D2FAFE89C01945346993E31FF6B0369E2A686F9F4A16CC61B74C887ED670F30A1A21252E04CD1BA781BB712
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........y...*...*...*...+...*...+...*...+..*9..*...*...+...*...+...*...+...*...+...*...*..*u..+...*u..+...*u.8*...*u..+...*Rich...*................PE..d.....n\.........." .....r...J......d.....................................................`..........................................v......dw..<....................... @...........(..T............................).................. ............................text....q.......r.................. ..`.rdata...............v..............@..@.data...88.......$...f..............@....pdata........... ..................@..@.gfids..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\smtp.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):123936
                                                  Entropy (8bit):6.253892164491635
                                                  Encrypted:false
                                                  SSDEEP:3072:uxc4WaKDtQLGVAlS6wl6O1tpp/1t1tD1YMi93bJWlGrJSb6f:uxgaK3VAlS6kB2sYJSb6f
                                                  MD5:2B8265DFA5B53B61E875F7A83DDE8680
                                                  SHA1:FA3C87C02750700AC0D20D21B88A90B8122BE8E1
                                                  SHA-256:748BAC0CDDAA20C4967F6F495DB6B58F88FB675790C2039E211E42468AFBE2EB
                                                  SHA-512:9011BC9B204DB910F7A06F89928986F03DF234DF39309B183B3FE226677EB0C435F0B8C3EFAAD9689A5FA44BEE034EC99B7AF2C6FC3A2056BC0A4C0D4D9D5DE2
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......o.{!+..r+..r+..rD..s/..rD..s"..rD..sW..rE..s#..rE..s1..rE..s:..rD..s...r+..re..r...s(..r...s*..r...r*..r...s*..rRich+..r........................PE..d.....n\.........." ................<)..............................................s.....`......................................... w.......w..<....................... @...........b..T...........................0c.................. ............................text...@........................... ..`.rdata..............................@..@.data...X)...........n..............@....pdata..............................@..@.gfids..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\ssl.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):182304
                                                  Entropy (8bit):6.392391795533443
                                                  Encrypted:false
                                                  SSDEEP:3072:/ZE4AtMAAKxGbnsGtdZkQQnfO/JHEWw7jN8:SnjAtsKEqHN2jN8
                                                  MD5:9592F5912B31B62193656497E67A2D9B
                                                  SHA1:B8A92656880A7016EDCBA43B1E206D83FE3847E0
                                                  SHA-256:5978DD53996BC3856D01010E4DDC41215DC9D7FE046961FEABEC419972CE94BD
                                                  SHA-512:FFAB48BE1DB5CC30F61D88B3BC02E2EA30C8DCD44BFE9BED786BB7CD699DAC8C456C1D390925C9A9FF2994A54CF98EEE0E76984EBA318792EC9838DB1954B98D
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........#.K.M.K.M.K.M.$.N.O.M.$.I.B.M.$.H..M..!..J.M.%.N.C.M.%.I.Z.M.$.L.N.M.K.L...M.%.H.W.M...D.H.M...M.J.M....J.M...O.J.M.RichK.M.................PE..d.....n\.........." .....f..........`v....................................... ............`.........................................0[.......[..<...............P....... @...........B..T...........................PC.................. ............................text....e.......f.................. ..`.rdata...............j..............@..@.data... R...p.......N..............@....pdata..P............b..............@..@.gfids...............v..............@..@.rsrc................x..............@..@.reloc...............~..............@..B........................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\ucrtbase.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):961192
                                                  Entropy (8bit):6.640639825639145
                                                  Encrypted:false
                                                  SSDEEP:24576:TZAut7MWpJcndd9glcYdhdrH2zC8vh7EenmdvXZi0yplQu:TqkMWDcnjyvhdUb77l
                                                  MD5:D4B22FB86C88C071335FE2FB623E40CE
                                                  SHA1:CC722EB1098B3A630A990DBCEB62E3338B064110
                                                  SHA-256:2195FEF9BD0A01D6B10A2AB77FF4F5BBCA01D65D5F6590BEFC98D80102372605
                                                  SHA-512:369FB5D80535CB1F8D46512234D7777754648AEAB6A3FF1536EDC64CA0097A8E8EAA7C68FEEABF756DE474706F0C7C896B14C4C39CBD5916AD9258F2ED3FCDF1
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b...&.a.&.a.&.a./.....a.&.`..a..6..'.a.l..'.a.l....a.l..p.a.l....a.l..j.a.l..'.a.l..'.a.Rich&.a.........................PE..d.....nU.........." .....J...0......`t..............................................^.....`A............................................P...@...................l....h...B..........Po..8............................o...............`..H............................text...pH.......J.................. ..`.rdata...a...`...b...N..............@..@.data...."..........................@....pdata..l...........................@..@.rsrc................X..............@..@.reloc...............\..............@..B................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\vccorlib140.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):337696
                                                  Entropy (8bit):6.010310833200254
                                                  Encrypted:false
                                                  SSDEEP:3072:uMCZbDoSbwlSCpYQfj+f1D0I/esAjznECGJGSuyuMiQdqyHGxRCcXYJ7q5g03Lbh:uCXSUYQeisA3EJnkgCbDmgpbPSNA
                                                  MD5:9FF7C9FF349B13430FD4575556ED3A15
                                                  SHA1:CED03401B3FFA7BF372B6E7B9CE3D6856D646373
                                                  SHA-256:C04C348CF3CB28A550ADC72D40F7473D03F1EAC63F3B945A6A56C476265295A7
                                                  SHA-512:CB656E556EC12CE5A8979C69C777ABC83B5E8023E90F7A0DC206FEF9DF8C04B96B70CCBCE4F563265392E313AE6E4C4DC2E5A2FDFACA32AB0E167E45C7581374
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^.M...#...#...#.....#..."...#...&...#...'...#... ...#......#...".l.#...*...#...#...#......#...!...#.Rich..#.........PE..d...T:.^.........." .........f......P~.......................................0......M.....`A.............................................>..d...,................ ...... A..........`...T...............................0............................................text...V........................... ..`.rdata...v.......x..................@..@.data...(.... ......................@....pdata... ......."..................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\vcruntime140.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):101672
                                                  Entropy (8bit):6.566355945650465
                                                  Encrypted:false
                                                  SSDEEP:1536:7y6+2mUD0uBFRXqYue/o+18iBH5T7heunxr98nZXR9xecbSQ2bIB0TO:7lXfRXqQw+PHLrCZh9xecbSt
                                                  MD5:8697C106593E93C11ADC34FAA483C4A0
                                                  SHA1:CD080C51A97AA288CE6394D6C029C06CCB783790
                                                  SHA-256:FF43E813785EE948A937B642B03050BB4B1C6A5E23049646B891A66F65D4C833
                                                  SHA-512:724BBED7CE6F7506E5D0B43399FB3861DDA6457A2AD2FAFE734F8921C9A4393B480CDD8A435DBDBD188B90236CB98583D5D005E24FA80B5A0622A6322E6F3987
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......!/.NeNl.eNl.eNl....gNl.l6..nNl.eNm.INl..>o.hNl..>h.uNl..>i.zNl..>l.dNl..>..dNl..>n.dNl.RicheNl.................PE..d...M8.^.........." .........^...... .....................................................`A........................................`1..4....9.......p.......P.......L..(A..........H...T...............................0............................................text...b........................... ..`.rdata...?.......@..................@..@.data...0....@.......4..............@....pdata.......P.......8..............@..@_RDATA.......`.......D..............@..@.rsrc........p.......F..............@..@.reloc...............J..............@..B........................................................................................................................................................................................................................

                                                  C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\vcruntime140_1.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):44328
                                                  Entropy (8bit):6.631745572973897
                                                  Encrypted:false
                                                  SSDEEP:768:uJnUUV7xPg4RdPvv1DHkhhFAWN6srByiYzC:uaY7XN7Ih4CIiYzC
                                                  MD5:21AE0D0CFE9AB13F266AD7CD683296BE
                                                  SHA1:F13878738F2932C56E07AA3C6325E4E19D64AE9F
                                                  SHA-256:7B8F70DD3BDAE110E61823D1CA6FD8955A5617119F5405CDD6B14CAD3656DFC7
                                                  SHA-512:6B2C7CE0FE32FAFFB68510BF8AE1B61AF79B2D8A2D1B633CEBA3A8E6A668A4F5179BB836C550ECAC495B0FC413DF5FE706CD6F42E93EB082A6C68E770339A77C
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........h..j...j...j....l.h....y..h...cq..a...j...[....y..o....y..m....y..p....y..k....y|.k....y..k...Richj...................PE..d...Q8.^.........." .....:...4......pA....................................................`A........................................Pk.......k..x....................l..(A......8...(b..T............................b..0............P..X............................text....9.......:.................. ..`.rdata... ...P..."...>..............@..@.data................`..............@....pdata...............b..............@..@.rsrc................f..............@..@.reloc..8............j..............@..B........................................................................................................................................................................................................................................................

                                                  C:\Program Files\FileZilla FTP Client\AUTHORS

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:Unicode text, UTF-8 (with BOM) text
                                                  Category:dropped
                                                  Size (bytes):3193
                                                  Entropy (8bit):4.996156184369907
                                                  Encrypted:false
                                                  SSDEEP:96:wMewhrsJaqKRQDFeUne+WSZMqGjPhc3YyO6:wBaWB3ZMBjPq3YS
                                                  MD5:6C0F745DF851F8C4D10E1789BFD19FF4
                                                  SHA1:D01763320378FE2AF3A81D0166EAFCA3C0D0E713
                                                  SHA-256:45F98D3DD4A9C7CF58D302E00EBB69A411C120FC4160E04304780DB03DFC2265
                                                  SHA-512:6448FAE1693DB2D596859F9D14A5E4FC4C8E96D2081DCDD8D0C4F7B84655B8F2CE432D8482F073840F6DDEAA501423755B79F3E9C28A9453F8AEB9103ED0180A
                                                  Malicious:false
                                                  Preview:.Project leader:.Tim Kosse <tim.kosse@filezilla-project.org>..Mac port:.Andreas Jacobs..Translators:.- Lithuanian. Darius Zitkevicius.- Dutch. Nathan Samson. Reinout van Schouwen. Age Bosma. Gregory VdSteen. Tim van der Meij.- Chinese (Taiwan). Kene Lin.- Slovenian. Martin Srebotnjak. Iztok Osredkar.- Italian (Italy). Andrea Sanavia. Alessandro Barbieri. Vincenzo Reale. Riccardo Vianello.- Portuguese (Brazilian). Jonh Wendell. Francisco Jodevan Campelo. Victor Westmann. Mauro Araripe.- French (Canadian). H.l.ne Garant.- French (French). David Chaubet. Jean-S.bastien Bour. William Gathoye.- Chinese (Simplified). Emfox Zhou. Sun Junwen.- Korean. Jinwook Kim. Jungman Seo.- Galician. Ignacio Agull.. Iv.n M.ndez L.pez.- Turkish. Bogac Guven. Ozan Hacibekiroglu.- Spanish. Carlos Aiello. Samuel Aguilera. Cristina Yenyxe Gonz.lez Garc.a.- Norwegian Bokm.l. Eirik Hodne. .ka Sikrom.

                                                  C:\Program Files\FileZilla FTP Client\GPL.html

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:HTML document, ASCII text
                                                  Category:dropped
                                                  Size (bytes):16153
                                                  Entropy (8bit):4.851915743894722
                                                  Encrypted:false
                                                  SSDEEP:192:tiMUzQS+LrQWJz6Z6q6pdPIK8kV6AWRzdbDaz0pmN1rMbkBJ9R8/CmBHf3KWkc:tZUz5irJq6jIuV6fRzd3c0pmbMCzRLw7
                                                  MD5:11E176C5E0120EE94E365F999084BCE8
                                                  SHA1:A612F6D40D0D2AE045D80B60BCE6FB6F81A811EF
                                                  SHA-256:F7E89C1EDBBEF8BC837B47C48113A2416F1AF0CFC2B2218DA39085465EA1045C
                                                  SHA-512:D0532DF4FE5E995DF49F3E58127F5FC9637FC4F1AFBB29E92AD16897C1055F77963277F5143458B9A294D1C24559BC594E0AE5469271ECE639C8E66A5555D5A3
                                                  Malicious:false
                                                  Preview:<!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN">.<HTML>.<HEAD>.<TITLE>GNU General Public License</TITLE>.</HEAD>.<BODY BGCOLOR="#FFFFFF" TEXT="#000000" LINK="#1F00FF" ALINK="#FF0000" VLINK="#9900DD">.<H1>GNU General Public License</H1>.<P>.Version 2, June 1991..</P>..<PRE>.Copyright (C) 1989, 1991 Free Software Foundation, Inc..59 Temple Place - Suite 330, Boston, MA 02111-1307, USA..Everyone is permitted to copy and distribute verbatim copies.of this license document, but changing it is not allowed..</PRE>....<H2>Preamble</H2>..<P>. The licenses for most software are designed to take away your.freedom to share and change it. By contrast, the GNU General Public.License is intended to guarantee your freedom to share and change free.software--to make sure the software is free for all its users. This.General Public License applies to most of the Free Software.Foundation's software and to any other program whose authors commit to.using it. (Some other Free Software Foundation softwa

                                                  C:\Program Files\FileZilla FTP Client\NEWS

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:ASCII text
                                                  Category:dropped
                                                  Size (bytes):121547
                                                  Entropy (8bit):4.837305256829653
                                                  Encrypted:false
                                                  SSDEEP:1536:O7XfvUwBWWjVQLFGoTZ9XHQTbyGaU5A+tKvdTLGYKlTVu:kfvH8LTZ2T0sdmIRu
                                                  MD5:326491281E95D6D7695CA7935D45D5B8
                                                  SHA1:4DCFEEB96AFFEC72BBF78DB3901DFA6D6456B3B7
                                                  SHA-256:F2603ABF98CEBF72C1F4A5C92BA9FF6C9284E3E35867F94B69735E0ED4472E9B
                                                  SHA-512:E6C35F0D488F1BEDD08F4D871C051E5FDF6D5B9EA2C55096572E5F9CB9C8F8180D1EE69712994B963F7ACAC77F39977F1D4592A2D07948855BAE9CB6DF0499AB
                                                  Malicious:false
                                                  Preview:This file only lists a short summary of the changes between FileZilla versions. For a full list of changes, please read the ChangeLog file...Legend:. ! Security related bugfix or otherwise critical bugfix. + New feature or important bugfix. - Bugfixes and other changes.. Platform prefixes:. MSW: Microsoft Windows. *nix: Unix (e.g BSD) and Unix-like systems (e.g. Linux). macOS/OS X: Apple macOS..3.67.1 (2024-07-10)..- MSW: Fixed an issue with confirmation dialogs for file deletion not being modal.- Updated to libfilezilla 0.48.1..3.67.1-rc1 (2024-06-27)..- Fixed an issue migrating old queue files if several older versions have been skipped.- Updated to libfilezilla 0.48.0..3.67.0 (2024-04-15)..! SFTP: Fixed PuTTY ECDSA NIST P-521 private key recovery vulnerability (CVE-2024-31497). If you use NIST P-521 keys to connect to SSH/SFTP servers, you should regenerate them and revoke the previous ones..! Official binaries are now built against GnuTLS 3.8.4.- Updated to libfilezill

                                                  C:\Program Files\FileZilla FTP Client\docs\fzdefaults.xml.example

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:XML 1.0 document, ASCII text
                                                  Category:dropped
                                                  Size (bytes):3023
                                                  Entropy (8bit):4.733327350767193
                                                  Encrypted:false
                                                  SSDEEP:48:cvNHZHNyJXQ4JJ76VL1x1V7Jycac7uIMctrK4CunN38cBM:CJTR4e1NTac6au4CK3nM
                                                  MD5:BC0AFACD8028E222472BB32474DB8148
                                                  SHA1:826F5EC70527440C72E0BE67CD4744D95F45F288
                                                  SHA-256:0D2E249A171A07A0B412C9F3ECA041E772D530991D6333F9C96600C8C0935027
                                                  SHA-512:D65AC28F18AE9886F05F19FEB209B6B26199C9353928F304ED705EFA9E0632B66442FDE52E6FCABDC81A9B3B42BB3A751DF5E08929ACEA14ECBFB43294214664
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>.. fzdefaults.xml documentation.. The file fzdefaults.xml is used to provide system-wide default settings for. FileZilla... Usage:.. - Windows:.. Put the file fzdefaults.xml into the same directory as filezilla.exe.. - OS X:.. Modify the app bundle, put fzdefaults.xml into the. Contents/SharedSupport/ subdirectory.. - Other:.. Put fzdefaults.xml into one of the following directories (in order of precedence):.. - ~/.filezilla. - /etc/filezilla. - share/filezilla subdirectory of the install prefix... Default site manager entries:.. Create some new Site Manager entries and export the list of sites. Rename. the resulting XML file to fzdefaults.xml or copy the <Servers> block in it. to fzdefaults.xml. See example below... Global configuration settings.. Location of settings directory:.. By default, FileZilla stores its settings in the user's home directory. If.

                                                  C:\Program Files\FileZilla FTP Client\filezilla.exe

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
                                                  Category:dropped
                                                  Size (bytes):4237896
                                                  Entropy (8bit):6.110743508369225
                                                  Encrypted:false
                                                  SSDEEP:49152:HHzFL+1NfyOT3BxU4/pRjpjqEgpMDqiUy0mTr5FeD2Q+zO3CevC3hPsw3p8MXqAN:zhaT3fpR1TTzOjUeCfl
                                                  MD5:0B8A7845DA90F16EABDAEB3D9B0F018A
                                                  SHA1:F86E26A91DF0FE331EB3FCCABC45D7F46B2DB4CD
                                                  SHA-256:A2C83C06939D38C2A8CCA1C3D217E6537B37C89FACFAD07031A64702AB68C558
                                                  SHA-512:11EC0859D2DB11CD4C2CCB1BC327A17E6DEA0E52E0429A9BBB41ACA5BBAEF648477DE21139476DA9EA711EB9BEB66D486D3A1AE3687E5A83208993FD6BCA18A7
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....f...............(..1..v@................ ..............................@.....F*A...`... .......................................<.H.....<..f...@?.h.... 8......z@.H0....?.(........................... .3.(.....................<.PN...........................text...(.0.......1.................`..`.data... ^....1..`....1.............@....rdata..l....p1......d1.............@..@.pdata....... 8.......8.............@..@.xdata...j... 9..l....9.............@..@.bss....`.....<..........................edata..H.....<......t<.............@..@.idata...f....<..h...v<.............@....CRT....`.... ?.......>.............@....tls.........0?.......>.............@....rsrc...h....@?.......>.............@....reloc..(.....?......z?.............@..B................................................................................................................................

                                                  C:\Program Files\FileZilla FTP Client\fzputtygen.exe

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
                                                  Category:dropped
                                                  Size (bytes):365128
                                                  Entropy (8bit):6.476627712606356
                                                  Encrypted:false
                                                  SSDEEP:6144:4dSNRhY3pH7OehnYmHxlCuNNZRCuFECcColZTGcMRFNW:uSNRC9dtRxlC8ZRiCKlZChRnW
                                                  MD5:77BB6679840AC288332C5A6D16A75769
                                                  SHA1:8E21026DBA55B217031989D0DD0C39AFD9CC45B4
                                                  SHA-256:2A8DA387C83815455941B86815B138D02667702DE88DAE0EBC82E8C5679C0F35
                                                  SHA-512:BEA65E7F182E247249BE6BB3EC07C053D86FD0F70B91C7810156803A510B3C06BA648884FCA0F525D7BCDF813B404D445EFA26617484CD453918572CE5987375
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....f...............(.....^................. ..........................................`... .........................................F............................b..H0......h...........................`...(.......................h............................text...............................`..`.data........ ......................@....rdata.......0......................@..@.pdata...........0..................@..@.xdata...0... ...2..................@..@.bss.... ....`...........................edata..F............0..............@..@.idata...............2..............@....CRT....`............F..............@....tls.................H..............@....rsrc................J..............@....reloc..h............Z..............@..B................................................................................................................................

                                                  C:\Program Files\FileZilla FTP Client\fzsftp.exe

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
                                                  Category:dropped
                                                  Size (bytes):664136
                                                  Entropy (8bit):6.462868501386271
                                                  Encrypted:false
                                                  SSDEEP:12288:lTZBJ97RLnrlh6wqGX/DA8RYxQzaQ15uypHUZD7L7f33:lTZz3Lnrlh68DlYxa7HUZD/7f33
                                                  MD5:92A97C68DAD57B7F4EB8F62227EBB829
                                                  SHA1:10CD73AF24C90BB26E952FC4CB502B484CDD7CE1
                                                  SHA-256:88657B00EB517F683BD40123F21B0298A02FA1646CD664285FD99D26616312B9
                                                  SHA-512:2DD81E24E40BE37EBFC1198365D81040728462C2E9528CC47EE1DC938C82703519DEECA4730C790F2B83D6E253BA77B70062CFD77A95CAD9ADF9D754959C07A9
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....f...............(.~..................... .............................p......Q.....`... .........................................H.......t....P....... ...U......H0...`..X...............................(...................@................................text....}.......~..................`..`.data...............................@....rdata...~..........................@..@.pdata...U... ...V..................@..@.xdata..<U.......V...\..............@..@.bss....`................................edata..H...........................@..@.idata..t...........................@....CRT....`....0......................@....tls.........@......................@....rsrc........P......................@....reloc..X....`......................@..B................................................................................................................................

                                                  C:\Program Files\FileZilla FTP Client\fzshellext.dll

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
                                                  Category:dropped
                                                  Size (bytes):34392
                                                  Entropy (8bit):6.491532747948847
                                                  Encrypted:false
                                                  SSDEEP:768:n2/5ZWpdwrGUxnyiehH/kqjGyxZRaygOENAMx47g:2BZWpvWa9j7ZRNix47g
                                                  MD5:6AABDAD58F1018FF1D6E1D4A818C7021
                                                  SHA1:A1E877E1E6592C535B8C72ADCC69CD3C0EB33FB2
                                                  SHA-256:5A447280BF38EA4ECE57263201522C91320E64E68B860A5911200802DB1AF2BE
                                                  SHA-512:5C1C08D0FCCF430AC031E44A68DD7AC7CE6E61E783DB90B97BEA42ECE7A95963ED4F28C1DCC2E6DCE1DB4F202927240F9E22A28CEF52CD85794BC8A8765CE23B
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....f.V.........#...(.&...R...............@....(g................................l5....@... ......................................................V..H0...................................R......................x................................text...4%.......&..................`..`.data... ....@.......*..............@....rdata.......P.......,..............@..@/4...........`.......2..............@..@.bss....x....p...........................edata...............@..............@..@.idata...............B..............@....CRT....,............J..............@....tls.................L..............@....rsrc................N..............@....reloc...............R..............@..B........................................................................................................................................................................................

                                                  C:\Program Files\FileZilla FTP Client\fzshellext_64.dll

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
                                                  Category:dropped
                                                  Size (bytes):32328
                                                  Entropy (8bit):6.207218961978208
                                                  Encrypted:false
                                                  SSDEEP:768:Dt0BXkUBBBBBBBBBBBB6s8M+d6+7nvfH2kaygOENAMxB2c:WBXkUBBBBBBBBBBBB9X+d6+7WkNixBF
                                                  MD5:F3C63D6CAF1B2799B05CBA3CDB94E838
                                                  SHA1:47963F8E190E14136A9B10C765889A20815E8C1E
                                                  SHA-256:7559EFC11D1E2F889086DB64588FA5329F9298E0F3FD6894E2AD8BA4A7CEAC75
                                                  SHA-512:F387A64FB321C82C1B5A58815AC55C428481CBE771E02419C0F1C12BF28FC8EE38EB6D063C5390F228FCFBFCE44B647861DD421A5A08FAAC03CB0BDD9F33CCA7
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....f..........."...(.$...J...... ...............................................?....`... .................................................x............`..<....N..H0......|............................R..(....................................................text...8".......$..................`..`.data...`....@.......(..............@....rdata..@....P.......*..............@..@.pdata..<....`.......2..............@..@.xdata..,....p.......6..............@..@.bss.....................................edata...............:..............@..@.idata..x............<..............@....CRT....X............D..............@....tls.................F..............@....rsrc................H..............@....reloc..|............L..............@..B................................................................................................................................

                                                  C:\Program Files\FileZilla FTP Client\fzstorj.exe

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
                                                  Category:dropped
                                                  Size (bytes):10312264
                                                  Entropy (8bit):6.093735479469427
                                                  Encrypted:false
                                                  SSDEEP:196608:Y474PITB45BLtG9sCkvf2C/2RrHxvZuNw5EstcMqkhYpuFQkQ:l4Pera
                                                  MD5:D64338B4640EA3CE21AE0F754D22BEC9
                                                  SHA1:98D98C84B2EF53E1A7DF12C9B020BF02AB6340B9
                                                  SHA-256:4543A1AB4B99BE0F188765CA96676B81A63510E8399B9E25E46F67EC694043BF
                                                  SHA-512:AE6ED3DA428ACFAE18B5A25E2C47F21A29C098D8C125FFBBD759A05BC40BECEE3E978481CEEE2830F58CF5D0906AC33B3F2FA9D81407F0FD9C3622B1FD7C17F2
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....f...............(.>G..&...P............. .........................................`... .............................................. ..................\....*..H0...`...f..............................(....................#..x............................text....=G......>G.................`..`.data........PG......BG.............@....rdata....M...K...M...K.............@..@.pdata..\...........................@..@.xdata..t...........................@..@.bss....0N..............................idata....... ......................@....CRT....`....@......................@....tls.........P......................@....reloc...f...`...h.................@..B................................................................................................................................................................................................................

                                                  C:\Program Files\FileZilla FTP Client\libfilezilla-45.dll

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
                                                  Category:dropped
                                                  Size (bytes):952904
                                                  Entropy (8bit):6.424916445255744
                                                  Encrypted:false
                                                  SSDEEP:12288:VqgQNIlOCK02NW+anampAWbLOa8i1S1FPffJvwzn1xkDtQfsn2:VvaU12NmnjpHOpY3kDtQfsn2
                                                  MD5:D10CD60DDB7EE5FF2AAB67733542A4DD
                                                  SHA1:2E627C97780EFDD94D88E4A31B01CA0EC16C042D
                                                  SHA-256:50C59F257A50DDD101150321133E14A7C5379A15FEACC2A5C638B760139CC785
                                                  SHA-512:CCB6F1E4E0DE00635AE9B89A8033545CB7D14783F53D236A6801623C849E9664171DDDFEC816E7F68C387E92261334438DF86F19A4262038972FB03E23899DB7
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....f..........."...(.....V...... .......... .....................................e....`... ...................................... .......0..$Y...............W...Z..H0......................................(...................`?..p............................text...h...........................`..`.data...............................@....rdata..p...........................@..@.pdata...W.......X..................@..@.xdata..\....P......................@..@.bss.....................................edata....... ......................@..@.idata..$Y...0...Z..................@....CRT....X............D..............@....tls.................F..............@....rsrc................H..............@....reloc...............R..............@..B................................................................................................................................

                                                  C:\Program Files\FileZilla FTP Client\libfzclient-commonui-private-3-67-1.dll

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
                                                  Category:dropped
                                                  Size (bytes):625736
                                                  Entropy (8bit):6.399801390370927
                                                  Encrypted:false
                                                  SSDEEP:6144:vc1+MmxFlHVyQdpwaWJ8eho2e3zrJ2gLo4MVnmmaPyq8ub0LqDnKVv7dk4+X8+Wu:imxFl1yQpSgJgjVmPPygUoKVv7j+X8Fm
                                                  MD5:B3D3D12D10A3B49490E6BA4B3F1A47FB
                                                  SHA1:74484883E068B30D4946EB22DDB5D91E93038146
                                                  SHA-256:B14166524542B83C2410A3C5A16AB22F4AC6F58B1AE4DFF82055214D4E5FF02E
                                                  SHA-512:33394FA1D2DF9BDE7E2535224CF05B9001A1DE4C697E7C28F90E1F510756F6828D8C64505443828D169D9D9420E084797A2979B783497CDEEE23679D37BC465A
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....f..........."...(.b...X...... .......... ..........................................`... ..........................................B...0..Xq........... ...'...\..H0......t...............................(....................=...............................text....a.......b..................`..`.data...`............f..............@....rdata..$............r..............@..@.pdata...'... ...(..................@..@.xdata...q...P...r...*..............@..@.bss.....................................edata...B.......D..................@..@.idata..Xq...0...r..................@....CRT....X............R..............@....tls.................T..............@....reloc..t............V..............@..B........................................................................................................................................................................

                                                  C:\Program Files\FileZilla FTP Client\libfzclient-private-3-67-1.dll

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
                                                  Category:dropped
                                                  Size (bytes):1416264
                                                  Entropy (8bit):6.30663547206197
                                                  Encrypted:false
                                                  SSDEEP:24576:Y4V5JRUtKq9bMxRpPJCzwA7+YhGUnqcSbEG:Y4VLuZMx9Cr7+ELQP
                                                  MD5:5F43F99F8725647ADB96185306F6D37F
                                                  SHA1:8A5633445ACB2D38458354C035A5DE38C5532DA9
                                                  SHA-256:C0A291C8ED21683DC9C3472EDF55F7C477EBF09A8BB8DB3387B01EE6CB9D405B
                                                  SHA-512:CB1BC3ADD34EABCD68D612728D2F9D1967D2EFBA5F8AD09419814769A8A4DB481B37DD92244AC420169C386FCD07259E436DDD40B393D772F412B535DDA65411
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....f..........."...(.....h...... .......... ..........................................`... ..............................................@...Y...............p...l..H0..................................@8..(....................K..(............................text...............................`..`.data...P.... ......................@....rdata.......@......................@..@.pdata...p.......r..................@..@.xdata.......P...0...$..............@..@.bss.....................................edata...............T..............@..@.idata...Y...@...Z..................@....CRT....X............Z..............@....tls.................\..............@....reloc...............^..............@..B........................................................................................................................................................................

                                                  C:\Program Files\FileZilla FTP Client\libgcc_s_seh-1.dll

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
                                                  Category:dropped
                                                  Size (bytes):117832
                                                  Entropy (8bit):6.389469326452461
                                                  Encrypted:false
                                                  SSDEEP:1536:7glQqu9+fvPh1sbMuEZ5Ox65AP7FopvcRJ3n0ubJ6AZg2JCZIPkjX0wyNNixQ:lLkfvvsbMBZuwyycRh0hA2K8jXpaNF
                                                  MD5:D547C5614E3AA3570CCA74401EE228F0
                                                  SHA1:285DB5FBFE248C53727C5713A224B792A5BB2CD0
                                                  SHA-256:B3A88C1F361CB35869820CE75BEEBEFC5638EBE80851384CABB3D086CF28351E
                                                  SHA-512:43A3A21F4CD1F972D59B7AFBDD4A978397C696874AEA97DCA3C71BCCE9C27CC688F4AA23A82C2C75825572D3A575626FB8D951FA2CC807604D53E8756856BA40
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....f..........."...'.J.......... .....................................................`... .........................................-...............................H0......`............................z..(.......................H............................text...PI.......J..................`..`.data........`.......N..............@....rdata.......p... ...P..............@..@.pdata...............p..............@..@.xdata...............z..............@..@.bss....P................................edata..-...........................@..@.idata..............................@....CRT....X...........................@....tls................................@....reloc..`...........................@..B........................................................................................................................................................................

                                                  C:\Program Files\FileZilla FTP Client\libgmp-10.dll

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
                                                  Category:dropped
                                                  Size (bytes):650312
                                                  Entropy (8bit):6.66581754728612
                                                  Encrypted:false
                                                  SSDEEP:12288:Wcmt5OEL4lr3m0EpCiOaOKy3yQs/Iotec:TmtAEL8JFa+3y//Ftec
                                                  MD5:1F46E7EF91B3B865F05841110D7D4FE9
                                                  SHA1:82AF0D1683D8D942E55FEC667D4796A87F043848
                                                  SHA-256:45FC2C6B5A0A93C3534C6E7A1BDA7E829715D3AA03044F0A2799847D928C7D79
                                                  SHA-512:03EB921EFB3C81F993827095EAF3284AA9CEA11E115A50A9CEA7476707EC6962B0173D95B3CF9D3086E2E949A43A8DA4AEDFAFA05C9274F075D1CBAD32A2AAF4
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....f..........."...(............ ..........Y.............................@.......#....`... ..........................................e......@............ ..|#......H0...0..................................(....................................................text...............................`..`.data...p.... ......................@....rdata..p....0......................@..@.pdata..|#... ...$..................@..@.xdata..t,...P......................@..@.bss....P................................edata...e.......f...H..............@..@.idata..@...........................@....CRT....X...........................@....tls......... ......................@....reloc.......0......................@..B........................................................................................................................................................................

                                                  C:\Program Files\FileZilla FTP Client\libgnutls-30.dll

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
                                                  Category:dropped
                                                  Size (bytes):2139208
                                                  Entropy (8bit):6.583163697452975
                                                  Encrypted:false
                                                  SSDEEP:49152:c9UBlTKnOv2NDDobIFaE/+LX7BjgTQt3CJRnvR032R9S7zjOGtlqnus5T8APXk2Z:cyBljaDA7MWYRnvgE9mjxsMOf
                                                  MD5:BFD7AEA0841678A2B31F7146592E80B4
                                                  SHA1:5E3BDC26B2F25FABF2FF17436D7AAAB96E596706
                                                  SHA-256:A626893CE834732FFBF7DAE925BD1AD5E34B9CACC2312E4B1760D5D906B7C2DB
                                                  SHA-512:A4D8F14B3E2237C1FC7C3E6E2B3F0DFC9D58A80CE44A0D09AFA44D702FBB33F515044456C7684B5DFFE28EDECAD06986E9963FC1DDA062CFFAC1FE347FAF5431
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....f..........."...(.....p ..6.. .........V..............................0!......B!...`... .........................................#..... ..S...........@.......t .H0....!.d............................-..(...................X. .x............................text...x...........................`..`.data....!......."..................@....rdata..P.... ......................@..@.pdata.......@......................@..@.xdata..............................@..@.bss.....5...............................edata..#............:..............@..@.idata...S.... ..T..................@....CRT....X..... ......P .............@....tls..........!......R .............@....reloc..d.....!.. ...T .............@..B........................................................................................................................................................................

                                                  C:\Program Files\FileZilla FTP Client\libhogweed-6.dll

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
                                                  Category:dropped
                                                  Size (bytes):275016
                                                  Entropy (8bit):7.394944102128841
                                                  Encrypted:false
                                                  SSDEEP:6144:dExBQVThIgKaZ0ElKZfwDsp+p5+gAHurSV8rpkrYNm:QQJhIXRElofAMu57AIJ+im
                                                  MD5:45636F55D682678A8462FFB7BAEFFAF9
                                                  SHA1:ACCAAE7B58217D1D828E584A81687AB3C1E2A6C8
                                                  SHA-256:F992501384DEE8D2EFFDE1D46F3F9DBD8CC85CA833142FBD022B0E91489C80D1
                                                  SHA-512:2103F5B7B62EA9C6B6EA4D5518834B7A7033F86DB933689D400618FDB515682EF7DCEA7EB8738523CF084265873C466BD11206E0580C0DCFFCBE5BAFF26F5C6B
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....f..........."...(.8.......... ..........$.....................................6....`... .........................................+(...@..x...............\.......H0......................................(...................XD...............................text...h6.......8..................`..`.data...0....P.......<..............@....rdata...W...`...X...>..............@..@.pdata..\...........................@..@.xdata..............................@..@.bss.....................................edata..+(.......*..................@..@.idata..x....@......................@....CRT....X....`......................@....tls.........p......................@....reloc..............................@..B........................................................................................................................................................................

                                                  C:\Program Files\FileZilla FTP Client\libnettle-8.dll

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
                                                  Category:dropped
                                                  Size (bytes):328776
                                                  Entropy (8bit):6.886894158158283
                                                  Encrypted:false
                                                  SSDEEP:6144:hJnQCpTG9+lmGaNAgDPHTqqDoN6FDwVDEN8:tpTVmLNfHOqA6B8
                                                  MD5:824B02B63F678895C5A7532AD67F356A
                                                  SHA1:7B5AB8F38CB46C794F2781CC79EA82C19AD24B19
                                                  SHA-256:0A8704B2D7F008AE8EC683B02C38EF4885A7CF8746A613916B38FC1209B19F90
                                                  SHA-512:1D0604128A3EB7194D4E670B0B173F262648B079B18152EF87BF0A61D710322FC884C2866A7D1E288CEB418E0C0444A724CB0A05027784B57DD2C5A652FC3204
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....f..........."...(............ .........T..............................P......A.....`... ..........................................N...................p..........H0...@..H...........................@Z..(.......................P............................text...@...........................`..`.data........ ......................@....rodata.@....0......................@....rdata..."...@...$..................@..@.pdata.......p... ...6..............@..@.xdata..H............V..............@..@.bss.....................................edata...N.......P...t..............@..@.idata..............................@....CRT....X.... ......................@....tls.........0......................@....reloc..H....@......................@..B................................................................................................................................

                                                  C:\Program Files\FileZilla FTP Client\libpng16-16.dll

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
                                                  Category:dropped
                                                  Size (bytes):241224
                                                  Entropy (8bit):6.534781413489453
                                                  Encrypted:false
                                                  SSDEEP:6144:wnClFOtV9yvLwdZRLFfn4lShPNEoDHHpwpFLhpNJ:wBVQgRLFfPh1E+HpejJ
                                                  MD5:28134E4F94659BDFB6B59CF046B51A30
                                                  SHA1:24576793C83D6F17E399F2E7D89F550A1DECDF94
                                                  SHA-256:3FAA0035325B3460FBD02C49C8A97B9BE0F9545E441D423CE7511403F7ABF0B4
                                                  SHA-512:7881211B2F1A3BA37D74EBC66BCAF28A6541715FC8A6CA4960339D8EBB7B22356A43BAE1ADE0F5CE07FC729F8F95ED5536446B88BC7B7B03F7DBA2490E8963BE
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....f..........."...#.....z......P..........h....................................@.....`... ..............................................................@..L....~..H0......d........................... 7..(...................P................................text...............................`..`.data...p...........................@....rdata...N.......N..................@..@.pdata..L....@......................@..@.xdata.......`.......8..............@..@.bss.....................................edata...............P..............@..@.idata...............n..............@....CRT....X............x..............@....tls.................z..............@....reloc..d............|..............@..B........................................................................................................................................................................

                                                  C:\Program Files\FileZilla FTP Client\libsqlite3-0.dll

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
                                                  Category:dropped
                                                  Size (bytes):1279560
                                                  Entropy (8bit):6.379050137395809
                                                  Encrypted:false
                                                  SSDEEP:24576:KjI5ALcbs7Y+GjUa33J8/yt9rgLqLMfKyN1vCQ8tZl15R42C8iF2f7f6QIqy:K85ALGs7zGjUa33FdMSyN16Q8n96tJ
                                                  MD5:E1EB36EAC63FD058AB883F89758A7B79
                                                  SHA1:554E43F92E9C86B42B998B16A74B5175D7CE3415
                                                  SHA-256:6121F361ABE47DDC0B593D6C1AD6FE2D97650BF8228A1ABFB5421DEBD97ABF57
                                                  SHA-512:50B174F1764415C587E288AEF2B7AF0FB678A0BEE9DE24425C5FE58641A0CE42C2C45A196DCCCB08909A6B173281E4B1E26A496617E0B8D53F2951DD7A2D8E2D
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....f..........."...#.....R......P.........8f....................................G......... ......................................@..."...p...............P..d_...V..H0...................................I..(....................s..H............................text..............................`..`.data...P?.......@..................@....rdata..@^.......`..................@..@.pdata..d_...P...`...>..............@..@.xdata...p.......r..................@..@.bss.........0...........................edata..."...@...$..................@..@.idata.......p.......4..............@....CRT....X............D..............@....tls.................F..............@....reloc...............H..............@..B........................................................................................................................................................................

                                                  C:\Program Files\FileZilla FTP Client\libstdc++-6.dll

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
                                                  Category:dropped
                                                  Size (bytes):1977928
                                                  Entropy (8bit):6.5963701164168285
                                                  Encrypted:false
                                                  SSDEEP:24576:vLbdOi6HQ1JkJUyue0AyCeNyeX2Xm9Q90QEaMDYnhSMXlrCYIEl0b41D:vLbdbGQ1JZe0AyCeNyy/qEayYDB
                                                  MD5:EF12801E5F6483BABD69D30254D0BAEB
                                                  SHA1:A1969F6EFF8AE498BBDE801E8485BA19ED697B66
                                                  SHA-256:430DD9DAB2F64289523C129191C75FBD4150D827FFA8E61BD01B8F132A1DBAD6
                                                  SHA-512:B869A63C9F8BE7E97362BDD0086CAC501739D75343755E8B9D2C7E94B5316357BDC342F98DA405810828FDFE569E4FFEB0FBBD6759889E890DA79E91F86C89D5
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....f..........."...'............ ........................................p......k:....`... .........................................VS......0............ ..4.......H0...P..................................(................... ................................text...............................`..`.data....9...0...:... ..............@....rdata.......p.......Z..............@..@.pdata..4.... ......................@..@.xdata..Ly... ...z..................@..@.bss.....................................edata..VS.......T...p..............@..@.idata..0...........................@....CRT....X....0......................@....tls.........@......................@....reloc.......P... ..................@..B........................................................................................................................................................................

                                                  C:\Program Files\FileZilla FTP Client\locales\an\filezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 1358 messages, Project-Id-Version: FileZilla 3.6.0.2 'Ha transcorriu %H:%M:%S'
                                                  Category:dropped
                                                  Size (bytes):133015
                                                  Entropy (8bit):5.0739799528152725
                                                  Encrypted:false
                                                  SSDEEP:3072:2wJjdZHwmLSCdt4nITa5X0BTMXBwA71GM:2gnJSkt4nITa5E8BwA71GM
                                                  MD5:AE5FD79662EEC37EAF19CDE1C80DEF02
                                                  SHA1:8CACA0D1CA663DC641BADD5BA07D03877B8A272B
                                                  SHA-256:084CAC9EFBDA67BD82573977CB75271A69B93210B75146390BD7B1D458CC0F0B
                                                  SHA-512:A6E850624F548E281AF2DC4FC59260E0BC35B4CC5AC7EDA227A1F669566AFA1CFBADD6C677E7C4E5FFBDC28C9DEB08EEAB951E699389E323D018CCC65995BA0A
                                                  Malicious:false
                                                  Preview:........N........*.......T.......T.......T.......U..S....U......pU..A....U.......U..0....U..B....V......SV......hV......rV.......V.......V.......V.......V.."....V.......V.......V.......W.......W......%W....../W......9W......AW......RW......fW..2...tW.......W.......W..6....W.......X.......X......#X..;...+X......gX......rX......}X.......X.......X.......X.......X.......X..+....X.......Y......(Y......:Y......JY.."...QY......tY.......Y..%....Y.......Y.......Y.......Y..4....Y......-Z..:...9Z......tZ.......Z..4....Z.......Z.......Z.......[.......[......#[....../[......5[......K[......S[......h[......s[.......[.......[.......[.......[.......[.......[.......[.......[.......\.......\.......\......<\..%...F\..R...l\..1....\..0....\......"]......3]......D]......c]......i].......].......].......].......].......].......]..3....^..$...6^..$...[^..)....^.......^.......^.......^.......^.......^.......^......._......._......:_......V_......c_.. ...u_......._......._......._......._......._......._......

                                                  C:\Program Files\FileZilla FTP Client\locales\an\libfilezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 11 messages, Project-Id-Version: FileZilla 3.6.0.2 'Para cuenta! O certificau ha estau refusau'
                                                  Category:dropped
                                                  Size (bytes):1602
                                                  Entropy (8bit):5.169124390852664
                                                  Encrypted:false
                                                  SSDEEP:48:tqty/Thq/TAzjL145Vqck0CvwASDfmncKMhXo20a:tjk0ju5VZCvtSDv22T
                                                  MD5:37FE0FBD12807BDA24EE11E13B23224A
                                                  SHA1:CDEFDB79F57DC02C244C507C90839042179F43C4
                                                  SHA-256:B263BEB33273A7C974642333FEDF8AA5FECF78F202AF091F68986FD4E25CB063
                                                  SHA-512:9EB47734E428FE9827CCE76CDA5B2C3D13DAC2936D587D1CB90E865B8A2F0444A2395648C1A17B98EC5A8EC5CEEA8AE1F7000CB46F3196B91AAC1E365C5CA2A4
                                                  Malicious:false
                                                  Preview:................t...................$.......X.......R...K...!.......................0...........%...5...B.......x...........*...)...g...T...^.......=...........Y...&...s...>.......'.......4...........6....Beware! Certificate has been revoked.Could not get distinguished name of certificate issuer, gnutls_x509_get_issuer_dn failed.Could not get distinguished name of certificate subject, gnutls_x509_get_dn failed.Failed to verify peer certificate.Network unreachable.Remote certificate not trusted..Server did not properly shut down TLS connection.Unsupported certificate type.gnutls_certificate_get_peers returned no certificates.unknown.Project-Id-Version: FileZilla 3.6.0.2.Report-Msgid-Bugs-To: https://trac.filezilla-project.org/.PO-Revision-Date: 2013-05-27 12:31+0100.Last-Translator: Jorge P.rez P.rez <jorgtum@gmail.com>.Language-Team: softaragon.s.Language: an.MIME-Version: 1.0.Content-Type: text/plain; charset=UTF-8.Content-Transfer-Encoding: 8bit.Plural-Forms: nplurals=2; plural=(n

                                                  C:\Program Files\FileZilla FTP Client\locales\ar\filezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 1846 messages, Project-Id-Version: FileZilla3 '\330\247\331\204\331\205\331\206\331\202\330\266\331\212 %H:%M:%S'
                                                  Category:dropped
                                                  Size (bytes):208851
                                                  Entropy (8bit):5.436382596304126
                                                  Encrypted:false
                                                  SSDEEP:3072:B5Wm2alqE3KBsJmfmTkCF5XTs7kywdccGr+6qMleMybc2FTmMArh:BJrKi0mICF5XTsI7eMrwCmMArh
                                                  MD5:1D0B07687A926A6C60DAC1023966D1F0
                                                  SHA1:54FAB17DF1D3AAF1A63BB5B26DE02CB38FDC89A3
                                                  SHA-256:6E0176D61FC07140059745653F6790E57F880D1A228EEB41816F23840F206DEC
                                                  SHA-512:2C44932433C03A34CD0CB1F1532D7FF920007AF04E54D3D236C3B6A091C2CAED3B26A7C3F5267BBDAA14D16A3BA4A56D7629ABFA8F831DAFACD5128701535318
                                                  Malicious:false
                                                  Preview:........6........9......|s......|s......}s.......s..S....s.......s..A....t......Nt..0..._t..B....t.......t.......t.......t.......u......'u......5u......?u......Ju......Xu......hu.."....u.......u.......u.......v..+....v.......v.......v.......v..5....w......Ew......Ow......_w......lw......vw......~w.......w.......w.......w.......w.......w..K....w..0...@x..2...qx..2....x.......x..0....x......#y..6...;y......ry......xy.......y.......y..;....y.......y.......y.......y.......y.......z......"z......9z......@z......Qz......gz.......z.......z..+....z.......z.......z.......z.......z.."....{......${......5{..%...T{......z{.......{.......{.. ....{.......{..H....{..I....|..4...g|.......|..:....|.......|.......|.......}..4..."}..$...W}......|}.......}.......}.......}.......}.......}.......}.......}.......}.......}.......~......$~....../~......<~......U~......^~......{~.......~.......~.......~.......~.......~.......~.......~.......~..................%.......O...A...R.......1.......0...........G.......

                                                  C:\Program Files\FileZilla FTP Client\locales\ar\libfilezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 83 messages, Project-Id-Version: FileZilla3 '\330\252\331\205 \330\247\331\204\330\252\331\210\331\202\331\212\330\271 \330\271\331\204\331\211 \330\264\331\207\330\247\330\257\330\251 \331\201\331\212 \330\247\331\204\330\263\331\204\330\263\331\204\330\251 \330\250\330\247\330\263\330\252\330\256\330\257\330\247\331\205 \330\256\331\210\330\247\330\261\330\262\331\205\331\212\330\251 \330\272\331\212\330\261 \330\242\331\205\331\206\330\251'
                                                  Category:dropped
                                                  Size (bytes):9399
                                                  Entropy (8bit):5.414653644286702
                                                  Encrypted:false
                                                  SSDEEP:192:gvA19RBypcqet90vMm3dAdBkAPHt+FkC7x/kp:ggReg9EAvkjV75kp
                                                  MD5:F399112D051BC159E55CCAC6960DE07F
                                                  SHA1:761DB2DE7D852AB72A8D0F2720576321F4339C44
                                                  SHA-256:99CD265A321004F52C2587487624B33B6E95F40AB7D0CE3E09DD1E422D854CC7
                                                  SHA-512:A1F2D937D4F0DD8E6062741CC7C22F05568AD7E4402F074C3B1D56A368866834C4CB81B96403BB6675D7740A21503328A035F5E496D259AF1A8310ECE27AA291
                                                  Malicious:false
                                                  Preview:........S...............L.......L...A...M...A.......................$...........#.......C...>...]...).........................................../...1...H.......z...X.......R....... ...A.......b... ...{... .......!...................................".......<.......P.......].......s...................................................7...#.......[.......u...4.......P...............#...!.......E...)...V...(...........................................................(.......D...+...[...+.......L.......-...................N... ...k...0.......M.......$...........0.......I.......c...,...x...#.......%.......$.......%.......'...:...n...b...?.......7.......-...I...1...w...........5...............M.......k...R...Q.......8...........I...*...i...6.......&.......Q.......=...D...........".......".......>.......>...&...S...e...........y.......q...R...&.......&.......*.......2...=...5...p...2................................... .......5...+...M...%...y...3.......(.......-.......&...*...5...Q...6.......A...

                                                  C:\Program Files\FileZilla FTP Client\locales\az\filezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 1609 messages, Project-Id-Version: FileZilla 'Ke\303\247ib: %H:%M:%S'
                                                  Category:dropped
                                                  Size (bytes):157205
                                                  Entropy (8bit):5.435967174707923
                                                  Encrypted:false
                                                  SSDEEP:3072:0OFjwpymHuSd9F7hTVJP5w/j2NKY9xEBaU6rFQPEa:9jyru09F7hTVNdEZEa
                                                  MD5:23EB7C935F71424709D224F802D34622
                                                  SHA1:3D4720F6E91346ECC8D7ADC96ABED365E735D7A0
                                                  SHA-256:528CCF745F003448E845B4DF4176B8583C8DBB6C8109253D7B5E4A059E1F5E3A
                                                  SHA-512:83435474B44C68747FF29B12CF3D635FB23ACDCF52B0C8C53D502AD78293DE7F5850C0A67A55DE4F52F49ADB8FC3BC4A1FCF1B6C9BE950373C3FDED9464572D4
                                                  Malicious:false
                                                  Preview:........I.......d2.......d.......d.......d.......d..S....d...... e..A...<e......~e..0....e..B....e.......f.......f......"f......Bf......Wf......ef......of......zf.......f.."....f.......f.......f.......g.......g.......g..5....g......(h......2h......<h......Dh......Uh......ih......zh..2....h.......h.......h..6....h......%i......+i......7i......Ji..;...Ri.......i.......i.......i.......i.......i.......i.......i.......j.......j..+....j......Cj......Vj......hj......xj.."....j.......j.......j..%....j.......j.......k.......k..H...&k..I...ok..4....k.......k..:....k......5l......Ll..4...kl.......l.......l.......l.......l.......l.......l.......l.......m.......m......(m......=m......Hm......Um......nm......wm.......m.......m.......m.......m.......m.......m.......m.......n.......n.......n..%...$n..O...Jn..R....n..1....n..0....o......Po......ao......ro.......o.......o.......o.......o.......o.......o.......p......%p......0p..2...Ep..3...xp.......p..$....p..$....p..)....q......+q......Aq......Sq......

                                                  C:\Program Files\FileZilla FTP Client\locales\az\libfilezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 75 messages, Project-Id-Version: FileZilla 'Z\311\231ncird\311\231 etibarl\304\261 bir alqoritm istifad\311\231 ed\311\231r\311\231k sertifikat imzalanm\304\261\305\237d\304\261r'
                                                  Category:dropped
                                                  Size (bytes):7492
                                                  Entropy (8bit):5.305346427526518
                                                  Encrypted:false
                                                  SSDEEP:192:nKlTfb5IZGJqe790vMm3dptKIzPIi2mGAhFWZq:KlTD5IkB9EptLGQ/
                                                  MD5:C690B37688DCBE96EA3D9741B19278D1
                                                  SHA1:5ECD6521E7133B6A100A4BBB8CC94AA3EF79D77B
                                                  SHA-256:1552F2E020E0538A37A04E39C4F99F7A953B0761FA6129FA126DFE039EEA9485
                                                  SHA-512:65401153CFC84C2C32AEA7D1E8BC498B4065059BB804CF3AD9E3F9599B767966B14AA958798B037F42CF5A6114365B59A1BCB20114D3E7D934194172ED864D49
                                                  Malicious:false
                                                  Preview:........K.......t...................A.......A...........Q.......j...$...~...........)...................................:.......V...1...o...........X.......R....... ...h...!...........................................................).......?.......W.......r...................................4.......P...........p...#...............).......(...................*.......@.......X.......k.......y...................+.......+.......L.......-...c................... .......0.......M... ...$...n...........................,.......#.......%...,...$...R...%...w...'.......n.......?...4...7...t...-.......1...............5...)......._.......g...P...0...<.......................!.......,.......$...?.......d.......x...,.......(.......+.......>...........X...`...v...Z.......+...2..."...^... ...............$.......(...........................+.......@..."...`...(.......................................=.......^...\...........%...............(.......2...C.......v...............................................

                                                  C:\Program Files\FileZilla FTP Client\locales\bg_BG\filezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 1832 messages, Project-Id-Version: FileZilla3 '%H:%M:%S \320\270\320\267\320\274\320\270\320\275\320\260\320\273\320\270'
                                                  Category:dropped
                                                  Size (bytes):229770
                                                  Entropy (8bit):5.340559157036443
                                                  Encrypted:false
                                                  SSDEEP:6144:2b8twtzICF55T7TUsgSJWyhcHofdhjjz+JBeyGW+JD3:2xtFbUsPJWyhcHolhj+JBeydwr
                                                  MD5:9B2A09B8B91B9AF62B409BDE931E0BAE
                                                  SHA1:7A38BD6BE58DF6637557688E36E0C5C9A04E6116
                                                  SHA-256:CE7CBE1840ECF883B44C63BC6999954F656180D28CB921060D747D4096F1AD7B
                                                  SHA-512:167E7B8E4DB711EC67A6BC63F185ED32F1D376FF42BF2BDBA6D98212B63C31DC6D94F5B19B7CCA4AF8A315739E430958876DBC1BDBB4A825502AB285E1EB42C2
                                                  Malicious:false
                                                  Preview:........(.......\9.......r.......r.......r.......r..S....r.......s..A...,s......ns..0....s..B....s.......s.......t.......t......2t......Gt......Ut......_t......jt......xt.......t.."....t.......t.......t.......u..+....u.......u.......v.......v..5.../v......ev......ov.......v.......v.......v.......v.......v.......v.......v.......v.......v..K....w..0...`w..2....w..2....w.......w..0....x......Cx..6...[x.......x.......x.......x.......x..;....x.......x.......y.......y.......y......+y......By......Yy......`y......qy.......y.......y.......y..+....y.......y.......y.......z.......z.."...!z......Dz......Uz..%...tz.......z.......z.......z.. ....z.......z..H....z..I...={..4....{.......{..:....{.......|.......|......#|..4...B|..$...w|.......|.......|.......|.......|.......|.......|.......|.......|.......}.......}....../}......D}......O}......\}......u}......~}.......}.......}.......}.......}.......}.......}.......}.......~.......~......!~......+~..%...;~..O...a~..R....~..1.......0...6.......g.......

                                                  C:\Program Files\FileZilla FTP Client\locales\bg_BG\libfilezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 92 messages, Project-Id-Version: FileZilla3 '\320\241\320\265\321\200\321\202\320\270\321\204\320\270\320\272\320\260\321\202 \320\262\321\212\320\262 \320\262\320\265\321\200\320\270\320\263\320\260\321\202\320\260 \320\276\321\202 \321\201\320\265\321\200\321\202\320\270\321\204\320\270\320\272\320\260\321\202\320\270 \320\265 \320\277\320\276\320\264\320\277\320\270\321\201\320\260\320\275 \321\201 \320\275\320\265\320\267\320\260\321\211\320\270\321\202\320\265\320\275 \320\260\320\273\320\263\320\276\321\200\320\270'
                                                  Category:dropped
                                                  Size (bytes):11977
                                                  Entropy (8bit):5.248848108647641
                                                  Encrypted:false
                                                  SSDEEP:192:Y8iwMfrQ1Y3cqet90vMmnDedAxlZ4ljJK4h9+1G1uCM8xA2fa4lJ1q4aEenD:NFZ1Y3g9hAxlGljdh9+1G1o8dfa4iXD
                                                  MD5:053BF24A6AB464186EA2AB41574A8945
                                                  SHA1:014189077150F775CC4E95393746D40672A25E24
                                                  SHA-256:E8C71A3476C49AF1D7464602A17A65FD46FBD2639C340A0994C1897BA051FBDA
                                                  SHA-512:F5CF6EC9F9731770A483FEEEDDDC116E30600DDE22C5AD8203BAD86129EEC38B270C8D676441BB6694AF6640B4E63A2AACC88D32BD85BE967F9EA816FFA2DD4B
                                                  Malicious:false
                                                  Preview:........\...........................A.......A...........a.......z...$.......................>.......)...,...0...V...........................................1...........;...0...V...X.......R....... ...3.......T... ...m...(....... ...............%.......(.......!...D.......f.......................................................................1.......L.......d.......v...........7.......................4.......P...C...........#...............).......(...........0.......N.......d.......|...................................+.......+.......+...:...1...f...L.......-.......-...........A.......a... ...~...0.......M.......$...........C.......\.......v...,.......#.......%.......$.......%...'...'...M...n...u...?.......7...$...-...\...1...............5...............w.......................>...............?.......@...F...F.......v.......T...E...L.......(.......M.......8...^...<.......O...........$...D.......q...........p...........V.......J.......X...-...M.......e.......N...:...:.......S.......T...

                                                  C:\Program Files\FileZilla FTP Client\locales\ca\filezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 1722 messages, Project-Id-Version: FileZilla 'transcorregut %H:%M:%S'
                                                  Category:dropped
                                                  Size (bytes):169579
                                                  Entropy (8bit):5.14736427041785
                                                  Encrypted:false
                                                  SSDEEP:3072:0hv2JeCN74nimGr396FXbToWiTwFRrO0+pWMNoGDm0UaHcOwJvONw1nxmnBPwzKc:0hv9SEKrt6FXbTo/+Rn+pWMKGPUaHwvz
                                                  MD5:572C8FEAEA47465939802913CB42A2A0
                                                  SHA1:9844563B5C6302865A61AD11858CC5B0EC3F5586
                                                  SHA-256:90668BE984FB2E9BFE1779A45F4A0D3F358B25B3B351F8224639C0FEDF601ABD
                                                  SHA-512:3E6DA60D8FDB6194EFAE92D3D0411F327456BE8F1538B39A41B865CF12F5CD4827C4355B1F67B5241DCC212DE331E9D18F5BCA0B3E3C544E699FB26B08F065B6
                                                  Malicious:false
                                                  Preview:.................5.......k.......k.......k.......k..S....k......0l..A...Ll.......l..0....l..B....l.......m......(m......2m......Rm......gm......um.......m.......m.......m.."....m.......m.......m.......n..+....n.......o.......o.......o..5...Ao......wo.......o.......o.......o.......o.......o.......o.......o.......o.......o.......p..0...&p..2...Wp.......p.......p..6....p.......p.......p.......q.......q..;...!q......]q......hq......sq.......q.......q.......q.......q.......q.......q.......q..+....q......(r......;r......Mr......]r.."...dr.......r.......r..%....r.......r.......r.......r.. ....s......!s..H...7s..I....s..4....s.......s..:....t......Ft......]t..4...|t.......t.......t.......t.......t.......t.......u.......u.......u......(u......0u......Du......Yu......du......qu.......u.......u.......u.......u.......u.......u.......u.......v.......v.......v......-v......6v..%...@v..O...fv..R....v..1....w..0...;w......lw......}w.......w.......w.......w.......w.......w.......w.......w......!x......

                                                  C:\Program Files\FileZilla FTP Client\locales\ca\libfilezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 75 messages, Project-Id-Version: FileZilla 'Un certificat de la cadena s'ha signat amb un algoritme insegur'
                                                  Category:dropped
                                                  Size (bytes):7590
                                                  Entropy (8bit):5.004437490454456
                                                  Encrypted:false
                                                  SSDEEP:192:nKl+30ZGJqe790vMm3dpYe2KsM2XeFw6ImJWRX2:Kl+30kB9Eph3V94m
                                                  MD5:C76C8B0BF8CAD94EC38A46128AC7F8C5
                                                  SHA1:79E4C3961785448438DAABB37C1676DEA39052F3
                                                  SHA-256:76AB8D14BDD35A78A93115C3317EF1E13008FB7C88B7BAFF213F60987288FBE7
                                                  SHA-512:FEEA8025667E7C0A37A8670581EDCB3DE182CB360909C0325E050DCF29B352A2B3079BF6A3E159F4CFFCEF8E6D0C958575B78D3E632B76CA83EFA1903784B467
                                                  Malicious:false
                                                  Preview:........K.......t...................A.......A...........Q.......j...$...~...........)...................................:.......V...1...o...........X.......R....... ...h...!...........................................................).......?.......W.......r...................................4.......P...........p...#...............).......(...................*.......@.......X.......k.......y...................+.......+.......L.......-...c................... .......0.......M... ...$...n...........................,.......#.......%...,...$...R...%...w...'.......n.......?...4...7...t...-.......1...............5...)......._.......g...?.......I...F...6...............".......%.......8...,.......e...2...x...........!...............E......."...S...d...v...].......3...9...0...m...%........................................... .......6...#...M.......q..........."...............#...............N...)...c...x...........5...........-...8...F...+.......................................................)...

                                                  C:\Program Files\FileZilla FTP Client\locales\ca_ES@valencia\filezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 1159 messages, Project-Id-Version: FileZilla '%H:%M:%S transcorregut'
                                                  Category:dropped
                                                  Size (bytes):112096
                                                  Entropy (8bit):5.111512965778223
                                                  Encrypted:false
                                                  SSDEEP:3072:90eaYBFt+tP3eE9Edx5XctZEidfGM0E/dDVWImTjdxqagUMBDF9q5NFdyGt:9EOc2EMx5XctZEidfGi/x7mvdxqagUM2
                                                  MD5:298F7C6F0E269E221483970C1C95C36A
                                                  SHA1:8C3E77B34DE92E11D42B9244DB4A9DC45EB5EC15
                                                  SHA-256:056ADA42D056183F5B5CFA5DDA4F99EF501F7969A72877804F82F154BE2AB999
                                                  SHA-512:A0E0D781D0353E6A5FC8CF4089E19B4EDA4DF47F84D020FCED74D6D2631B495B950C49C5336C2BB3ADFCF6CC40759302090506637C0366063F2C4E7BCD6498CE
                                                  Malicious:false
                                                  Preview:................T$.......H.......H.......H.......H..S....H.......I..A....I......^I..0...oI..B....I.......I.......I.......I.......J.."...%J......HJ......YJ......iJ......wJ.......J.......J.......J.......J.......J.......J..2....J.......K......(K..6...@K......wK......}K.......K..;....K.......K.......K.......K.......K.......L.......L..+...&L......RL......eL......wL.."...~L.......L.......L..%....L.......L.......L..4....M......JM......VM......mM..4....M.......M.......M.......M.......M.......N.......N......!N......)N......4N......MN......VN......sN......~N.......N.......N.......N.......N.......N.......N..%....N..R....O..0..._O.......O.......O.......O.......O.......O.......O.......O.......P.......P......EP......eP..3...pP..$....P..$....P..)....P.......Q.......Q......@Q......MQ......RQ......gQ......{Q.......Q.......Q.......Q.. ....Q.......Q.......Q.......R.......R.......R......&R......6R......:R......@R......FR......QR......ZR......eR......qR..)...xR.......R.......R.......R.......R.......R......

                                                  C:\Program Files\FileZilla FTP Client\locales\ca_ES@valencia\libfilezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 5 messages, Project-Id-Version: FileZilla 'La xarxa no \303\251s accessible'
                                                  Category:dropped
                                                  Size (bytes):777
                                                  Entropy (8bit):5.236978483855701
                                                  Encrypted:false
                                                  SSDEEP:12:i5yLScMqZ7a10KeJa54J6t02vtRQuo9Pm/C38nJmeLXXmBQWiOWr7KSCeJctR8x9:HZ80h454J6t0qty19CC381XmGqrtm/
                                                  MD5:7E2C4E079E8A1A2671BAC61EDD831995
                                                  SHA1:47E901E2D01445793AFA0BAB71A1E7D314498AE6
                                                  SHA-256:589EAD4511C2E86324AED0CB4DF6A88F204C0E4FA271F368B89CE2FC40673394
                                                  SHA-512:2A18EF98BF20C91782AD3C47D4755C14EC25F30F373FBBEFC732BF8147AD872B1B5B2F749C86CDA92E4915A29D6C45CD0B4C5B53D6126F41A49C194E6D197BA8
                                                  Malicious:false
                                                  Preview:................D.......l.......l.......m...........0...............................$.......6................Network unreachable.Remote certificate not trusted..Server did not properly shut down TLS connection.unknown.Project-Id-Version: FileZilla.Report-Msgid-Bugs-To: https://trac.filezilla-project.org/.PO-Revision-Date: 2009-06-11 10:49+0100.Last-Translator: Toni Hermoso Pulido <toniher@softcatala.cat>.Language-Team: Catal..Language: ca_ES@valencia.MIME-Version: 1.0.Content-Type: text/plain; charset=UTF-8.Content-Transfer-Encoding: 8bit.Plural-Forms: nplurals=2; plural=(n != 1);.X-Poedit-Language: Catalan.X-Poedit-SourceCharset: utf-8..La xarxa no .s accessible.No s'ha validat el certificat remot..El servidor no ha tancat correctament la connexi. TLS.desconegut.

                                                  C:\Program Files\FileZilla FTP Client\locales\co\filezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 1851 messages, Project-Id-Version: FileZilla in Corsican '%H:%M:%S trascorsu'
                                                  Category:dropped
                                                  Size (bytes):191582
                                                  Entropy (8bit):5.220542534644073
                                                  Encrypted:false
                                                  SSDEEP:3072:tzGRFYGG7jm0F8sqmfYTmCF5XTs7k1wz3vqJNvGtmf:poFfG7jm037YaCF5XTsIUCr7
                                                  MD5:6F9055BF9CC4EB5CB9FA3024554BCCF6
                                                  SHA1:1D2E71486E748E12E90A698A34773B46BF56351A
                                                  SHA-256:042CD3406642130025C735020B07A8E3784703348CD34B9A3FEEEF5C58DBA072
                                                  SHA-512:27FF62105F33B3349F4375D93BEE80800E3BF3508D0C45C2B198EA1091F092D0FCBB26D6B880E9AF1BC80BE7CFD9D53A9D90F954F4147F9DDA32D8D803B17E27
                                                  Malicious:false
                                                  Preview:........;........9.......s.......s.......s.......s..S....s......@t..A...\t.......t..0....t..B....t......#u......8u......Bu......bu......wu.......u.......u.......u.......u.......u.."....u.......u.......v.......v..+....v......*w......8w......Lw..5..._w.......w.......w.......w.......w.......w.......w.......w.......w.......x.......x......$x..K...Dx..0....x..2....x..2....x......'y..0...By......sy..6....y.......y.......y.......y.......y..;....y......+z......6z......>z......Iz......[z......rz.......z.......z.......z.......z.......z.......z..+....z.......{......({......:{......J{.."...Q{......t{.......{..%....{.......{.......{.......{.. ....{.......|..H...$|..I...m|..4....|.......|..:....|......3}......J}......S}..4...r}..$....}.......}.......}.......}.......~.......~.......~......'~......-~......C~......K~......_~......t~.......~.......~.......~.......~.......~.......~.......~.......~......................&.......:.......H.......Q.......[...%...k...O.......R.......1...4...0...f...............

                                                  C:\Program Files\FileZilla FTP Client\locales\co\libfilezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 162 messages, Project-Id-Version: libfilezilla in Corsican 'Un certificatu in a catena h\303\250 statu firmatu aduprendu una cudificazione micca sicura'
                                                  Category:dropped
                                                  Size (bytes):17350
                                                  Entropy (8bit):5.092791744531162
                                                  Encrypted:false
                                                  SSDEEP:384:9+QnapycC9NcTx1WmNtXUYM7fPzbUy0g8JQa4m:9++aIcddNEfcfD/
                                                  MD5:2AFD08A8A971E81C96BCBF2B1B8E9621
                                                  SHA1:463634E8D56FF257BB105C463017C02DECD08549
                                                  SHA-256:9550ACBE121572058E406F7E76C9D573E79F5E902DDA5C11CE431A8DAF3AF05F
                                                  SHA-512:0A7E70CF1AA15F13C0135AAFECDA1401E4C56DBCDB6808355CDED099EC8B9E29B456D1E2340B22EA56210C06CCC1367088784D39E71BF730E9F7CE16EB4D569C
                                                  Malicious:false
                                                  Preview:................,.......<.......<...A...=...A...............*...............$.......L...>...........&...............>.......9...+...2...e...8.......)....... .......0...........M.......`.......}...................1...............I.......I...e...7.......T.......^...<...........0.......#.......+.......X...7...R...............#.......#....... ...?.......`... ...y...........(....... ...............%... .......F.......d.......}...(.......!...................................$.......:.......T...0...h..."...................................................3.......I.......`.......v..................."..............."........... .......:.......K.......].......j...............................................................(.......A...7..._...................4.......P...........I...#...]...........)...............(...............L...........e...................................<...................>.......P.......b.......u...........+.......+.......+.......1...,...L...^...-.......-...................

                                                  C:\Program Files\FileZilla FTP Client\locales\cs_CZ\filezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 1770 messages, Project-Id-Version: FileZilla 3 '%H:%M:%S uplynulo'
                                                  Category:dropped
                                                  Size (bytes):170571
                                                  Entropy (8bit):5.441177049564246
                                                  Encrypted:false
                                                  SSDEEP:3072:OdHhILKJaG4mUeE9oFOvTcuu0whdhqpaD8JggM5:OdBLFOeOoFOvTcd3hk+
                                                  MD5:17DF78DE7BC5767F93CC3E25B5E01E61
                                                  SHA1:9664F4D9609646A837AD940EF166954BCBCA3C59
                                                  SHA-256:94B280FB9FE9E182B2BEA0433A0AC3D4D4CE8BC82A9E855E33A61EB1C9B727D6
                                                  SHA-512:504A0A10BEB10B5E381BB87E06E9E4D8B197BC025808B0DE363B84923C62EC7572BE950043E3453890329BB9B8912898FAB024E0747D0EBE40431DE988E20194
                                                  Malicious:false
                                                  Preview:................l7.......n.......n.......n.......n..S....n......0o..A...Lo.......o..0....o..B....o.......p......(p......2p......Rp......gp......up.......p.......p.......p.."....p.......p.......p.......q..+....q.......r.......r.......r..5...Ar......wr.......r.......r.......r.......r.......r.......r.......r.......r.......r.......s..0...&s..2...Ws..2....s.......s..0....s.......t..6...!t......Xt......^t......jt......}t..;....t.......t.......t.......t.......t.......t.......u.......u......&u......7u......Mu......hu......vu..+....u.......u.......u.......u.......u.."....u.......v.......v..%...:v......`v......hv......xv.. ....v.......v..H....v..I....w..4...Mw.......w..:....w.......w.......w..4....w..$...4x......Yx......xx.......x.......x.......x.......x.......x.......x.......x.......x.......x.......y.......y.......y......2y......;y......Xy......cy......}y.......y.......y.......y.......y.......y.......y.......y.......y..%....y..O....z..R...nz..1....z..0....z......${......5{......F{......e{......

                                                  C:\Program Files\FileZilla FTP Client\locales\cs_CZ\libfilezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 75 messages, Project-Id-Version: FileZilla 3 'Certifik\303\241t v \305\231et\304\233zci byl podeps\303\241n pomoc\303\255 nejist\303\251ho algoritmu'
                                                  Category:dropped
                                                  Size (bytes):7451
                                                  Entropy (8bit):5.286533035657734
                                                  Encrypted:false
                                                  SSDEEP:192:nKlb3BZGJqe790vMm3dwvQnhUCCrdItpkuHwSXb:KlbxkB9EwvQh66tCbk
                                                  MD5:95D9B64531FD1D36473AC31E7DE7461D
                                                  SHA1:64F2342F513A7F48F5565A82E6D56FA0C7FB917E
                                                  SHA-256:6D8376F9B1EB29B81C4E889253152166A6366A3FCD7709515FFA4C5CB4E4485A
                                                  SHA-512:A3CD574F532E8672B3EE48B4784B593F19B98BBF9A38066C7D7FC2E76DD5D1924E9F2ED0C887D876F290351ACB5CD6A69FD30F079DE4662F7C81C0F49B3917A7
                                                  Malicious:false
                                                  Preview:........K.......t...................A.......A...........Q.......j...$...~...........)...................................:.......V...1...o...........X.......R....... ...h...!...........................................................).......?.......W.......r...................................4.......P...........p...#...............).......(...................*.......@.......X.......k.......y...................+.......+.......L.......-...c................... .......0.......M... ...$...n...........................,.......#.......%...,...$...R...%...w...'.......n.......?...4...7...t...-.......1...............5...)......._.......g...B...W...@.......,...................%...%...E...-...k...................................&...$...J...K...........v.......o...*...........0....... ...........................0.......I.......].......v..........................."...........................4...@...M...O...............-.......!...!...+...C...1...o...................................................%...

                                                  C:\Program Files\FileZilla FTP Client\locales\cy\filezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 1445 messages, Project-Id-Version: FileZilla 3.10.0 '%H:%M:%S wedi pasio'
                                                  Category:dropped
                                                  Size (bytes):135646
                                                  Entropy (8bit):5.144687368595161
                                                  Encrypted:false
                                                  SSDEEP:1536:tkKUHStaQL6CtWPQm9J075HH9EHdL3dp7CeTeYKrAB6RPurMGfx5WBy5QSeX9c:tkK6QxtWom9+cdL3HnTFGRPuQG5sVV9c
                                                  MD5:54790F870842A0ADE0A3C16E848FA201
                                                  SHA1:7E33413487614B305B41E07CEC373906CBF76749
                                                  SHA-256:77091B8871ACE3A53BE9877FF077B355A362F1FE701A8D089F2C77D2274FB6A4
                                                  SHA-512:4F3F83BD74A20730A4122EFFC763C758713FC7C5EAFF88B9CEB79A312EAE3FBEBF7B17692FD22E69C7CB223925E1A223578A1BC91317A35BEFC7F3E8E71408C9
                                                  Malicious:false
                                                  Preview:................D-......lZ......lZ......mZ......~Z..S....Z.......Z..A....Z......>[..0...O[..B....[.......[.......[.......[.......[.......[.......\.......\..".../\......R\......c\......s\.......\..5....\.......\.......\.......\.......\.......\.......]..2....]......M]......h]..6....].......].......].......]..;....].......^.......^......#^......5^......L^......S^......d^.......^.......^..+....^.......^.......^.......^.......^.."....^......!_......2_..%...Q_......w_......._......._..4...._......._..:...._......!`......8`..4...W`.......`.......`.......`.......`.......`.......`.......`.......`.......a.......a...... a......-a......Fa......Oa......la......wa.......a.......a.......a.......a.......a.......a.......a..%....a..R....b..1...lb..0....b.......b.......b.......b.......c.......c......,c......5c......Nc......Uc.......c.......c.......c..3....c..$....c..$....d..)...Bd......ld.......d.......d.......d.......d.......d.......d.......d.......d.......e......%e......7e.. ...Ke......le......qe......

                                                  C:\Program Files\FileZilla FTP Client\locales\cy\libfilezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 64 messages, Project-Id-Version: FileZilla 3.10.0 'Gorlfi byffer arg'
                                                  Category:dropped
                                                  Size (bytes):5828
                                                  Entropy (8bit):5.092451786909809
                                                  Encrypted:false
                                                  SSDEEP:96:mBgoJ85wJHFVQk0jJqe790vMmO87kqGu5GlO4S7wQV7o0BLl+I5Qta:mBFJ82JlUJqe790vMmdFglHSBVtHQw
                                                  MD5:AF4894F1C316BCFF81BBF9EBF611A32B
                                                  SHA1:5EA4803018922ED950D598C017A3C81258977F26
                                                  SHA-256:263F85F018CD13ADE5BBCEE9543ECEE9E2D1909D3ACEA5FB9B9F238E865B6F87
                                                  SHA-512:50C8DB6637D553224919A76D2FF6B80DD0F9FEAA8B27DC94196BBB95ADE84864DBA67F71834B5E0A47C17309499679096BCC9C1AAFBB46C6C1014CEA8F570F6D
                                                  Malicious:false
                                                  Preview:........@.......................................6...$...J.......o...........................................X.......R...j...!...................................".......<.......P.......f.......~...........................................4.......P...F...........#...............).......(...........3.......Q.......g...........................................+.......+.......-...=.......k........... .......0.......$...................8.......R...,...g...#.......%.......$.......%.......'...)...7...Q...-.......1...............5...........<.......D...................).......%...E.......k...).......&.......(.......".......R.......H...p...#...................................".......<.......P.......d... ...x...................%.......................6..."...[...Y...........*...............&.......(...:.......c...........................................................2......./...I...3...y...&.......'.......#.......0... ...,...Q.......~...................8.......>.......-...8..."...f...$.......&...

                                                  C:\Program Files\FileZilla FTP Client\locales\da\filezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 1798 messages, Project-Id-Version: FileZilla 3 '%H:%M:%S forl\303\270bet'
                                                  Category:dropped
                                                  Size (bytes):167891
                                                  Entropy (8bit):5.187307057717882
                                                  Encrypted:false
                                                  SSDEEP:3072:tY3k24IBNmsAmB6EkCF4vTcpXrw/toK4Ju+AvTQxs4NJOJA8tre1nB+yH:tWLjtj69CF4vTcZbK4J6ExsYJOJAESlb
                                                  MD5:37357FCE5BFF631E5772AE32B838EFA7
                                                  SHA1:1D2975FBF9C3DCB6E89D490CA48119EC528D5BA4
                                                  SHA-256:766B1EEFB87537C96847CD3938C774B7B818AE994206CD5B670377C8E05BB3C4
                                                  SHA-512:246634EF0D8DFAD8420594C3A5E72973420CE1CB68EB09A98B24DF7D7CC176CED514DFC0E42F9550A2BEB3BC9CF857CFB25B0E9892B06FDFB02EE83973B7F4B5
                                                  Malicious:false
                                                  Preview:................L8......|p......|p......}p.......p..S....p.......p..A....q......Nq..0..._q..B....q.......q.......q.......q.......r......'r......5r......?r......Jr......Zr.."...tr.......r.......r.......s..+....s.......s.......s.......s..5....t......7t......At......Qt......^t......ht......pt.......t.......t.......t.......t.......t..K....t..0...2u..2...cu..2....u.......u..0....u.......v..6...-v......dv......jv......vv.......v..;....v.......v.......v.......v.......v.......v.......w......+w......2w......Cw......Yw......tw.......w..+....w.......w.......w.......w.......w.."....w.......x......'x..%...Fx......lx......tx.......x.. ....x.......x..H....x..I....y..4...Yy.......y..:....y.......y.......y..4....z..$...@z......ez.......z.......z.......z.......z.......z.......z.......z.......z.......z.......z.......{.......{......%{......>{......G{......d{......o{.......{.......{.......{.......{.......{.......{.......{.......{.......{..%....|..O...*|..R...z|..1....|..0....|......0}......A}......R}......

                                                  C:\Program Files\FileZilla FTP Client\locales\da\libfilezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 76 messages, Project-Id-Version: FileZilla 3 'Et certifikat i k\303\246den er underskrevet med en usikker algoritme'
                                                  Category:dropped
                                                  Size (bytes):7384
                                                  Entropy (8bit):5.014574991266602
                                                  Encrypted:false
                                                  SSDEEP:96:Uf2D+4ZYAHgtVvqk9Ra1Jqe790vMmU87cqO6zu53RQKWVB0APZZXIQrUkautWpzo:UMCZGJqe790vMm3dwHkWQr19WBzQT
                                                  MD5:2912398251DF424CD1525C2B974E0500
                                                  SHA1:600A55B0A0029F6CC53BB889D55743AF6FAE0C10
                                                  SHA-256:C2C497DF48091AC787E1716E24DE4F2D4CF143FC25C888DA9A7B56FA1CAD3A62
                                                  SHA-512:F531B51991FAB3AAAEFA32B25DBCCE3F96693D0822DE79E7F178EFDA180A1787121F6042ADA161E8337076D83AE14DB1C5CA792B58FE9C7D05BF0E78825A22D0
                                                  Malicious:false
                                                  Preview:........L.......|...................A.......A...........a.......z...$...............>.......)...........<.......O.......l...................1...............X.......R...d... .......!...........................'.......=.......W.......k.......x.......................................................'...4...9...P...n...........#...............).......(...2.......[.......y...................................................+.......+...9...L...e...-....................... .......0...>...M...o...$...............................,...*...#...W...%...{...$.......%.......'.......n.......?.......7.......-.......1...).......[...5...x...................?...6...=...v...................#.......$.......C.../...,...s...................%.......*.......$...:...9..._...........].......T.......$...j...&...................................................$.......2.......D.......`.......|................... ...............?.......P...@...........%...............".......0...........:.......V.......f...............

                                                  C:\Program Files\FileZilla FTP Client\locales\de\filezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 1810 messages, Project-Id-Version: FileZilla '%H:%M:%S vergangen'
                                                  Category:dropped
                                                  Size (bytes):180573
                                                  Entropy (8bit):5.195070774397416
                                                  Encrypted:false
                                                  SSDEEP:3072:XgodV/U6Dx51LgGAmBt/PCFY4Tcuuywf+WbGOQoJhDLMmws:X+6D31LLjt3CFY4TcdF+mGONhXMvs
                                                  MD5:45274D5A662C2C2B9318254E6027F7E4
                                                  SHA1:6FA170E94520E965F84AC220363AC74052776119
                                                  SHA-256:B53AAD10C0477AE23C59C9AC0F8A8396F95BA85FC5CA1646B80DE87C23892460
                                                  SHA-512:6756EAC20761265B1B951BF5F561BAD07D0DA64759FBF8E4A6FFEECA6C5D951932AA76C71A7678B4FF4C9804F8C21DA2B28A5F0B2AAF48359A08FAA76B9F66BD
                                                  Malicious:false
                                                  Preview:.................8......<q......<q......=q......Nq..S...\q.......q..A....q.......r..0....r..B...Pr.......r.......r.......r.......r.......r.......r.......r.......s.......s.."...4s......Ws......hs......Pt..+...`t.......t.......t.......t..5....t.......t.......u.......u.......u......(u......0u......Au......Su......gu......xu.......u..0....u..2....u..2....v......=v..0...Xv.......v..6....v.......v.......v.......v.......v..;....w......Aw......Lw......Tw......_w......qw.......w.......w.......w.......w.......w.......w.......w..+....w......+x......>x......Px......`x.."...gx.......x.......x..%....x.......x.......x.......x.. ....y......$y..H...:y..I....y..4....y.......z..:....z......Iz......`z..4....z..$....z.......z.......z.......{.......{.......{......){......4{......:{......P{......X{......l{.......{.......{.......{.......{.......{.......{.......{.......{.......|.......|......,|......3|......G|......U|......^|......h|..%...x|..O....|..R....|..1...A}..0...s}.......}.......}.......}.......}......

                                                  C:\Program Files\FileZilla FTP Client\locales\de\libfilezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 77 messages, Project-Id-Version: FileZilla 3.x 'Ein Zertifikat der Kette wurde mit einem unsicheren Algorithmus signiert'
                                                  Category:dropped
                                                  Size (bytes):7807
                                                  Entropy (8bit):5.0823288836762295
                                                  Encrypted:false
                                                  SSDEEP:192:dclrpHZpJqe790vMm3dmSnAiHHDJac1CAdk8ypJ1xu:ERvB9EmSnAinDJBRdk8yf6
                                                  MD5:1BC2A1ED88772E7EA54CB9858D7B44CE
                                                  SHA1:8072B1BBF1796972EE7E6A081C63CA97A6E80880
                                                  SHA-256:70E1678DF4928BF7FA7D988300B4A297967F8CCC85D0B637C96D274AE479FAE5
                                                  SHA-512:A9D38159591664A4814A48FEC1006626B648421C90D4FA7014432F82634BD125CF1A6D21AA090FA42C142CECEEC5A9AA2C6FF7ABEAEBE1C8E29D77ED6C6236AD
                                                  Malicious:false
                                                  Preview:........M...........................A.......A.../.......q...........$...............>.......)...".......L......._.......|...................1...............X.......R...t... .......!...................'.......7.......M.......g.......{...............................................................<.......V...4...h...P...............#...........&...)...7...(...a...............................................................%...+...<...+...h...L.......-.................../... ...L...0...m...M.......$...................*.......D...,...Y...#.......%.......$.......%.......'.......n...C...?.......7.......-...*...1...X...........5.......................H.......L...................4...%...P...&...v...N.......................*...2..."...]...(.......$.......B....... .......p...2...f.......'.......<...2.......o...............................................................0... ...P.......q...........".......................>.......N...=...........'...............0.......6......."...K.......n.......

                                                  C:\Program Files\FileZilla FTP Client\locales\el\filezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 1753 messages, Project-Id-Version: FileZilla Client 3.43.0 '%H:%M:%S \317\200\316\255\317\201\316\261\317\203\316\261\316\275'
                                                  Category:dropped
                                                  Size (bytes):240645
                                                  Entropy (8bit):5.371537352604987
                                                  Encrypted:false
                                                  SSDEEP:3072:XEJK9cGD7jtp/NBGymGYE9oFovTmuugw+CstK+JLJ6A8K2vTdyqnT3FJ9t01J9fe:UoHpNo6YOoFovTmdeCsp2vThTVnk3lU
                                                  MD5:BB99D2AE75AB13D317EC35F7FAD39A42
                                                  SHA1:9475276172CB8C666D67C2A2F92C913C238EA665
                                                  SHA-256:72BC925DA83D3767B7E018AF16609DF71BD927D94B645F8763EEA3E606835F86
                                                  SHA-512:D3D18F98A87010F2DB365682FF67ADD5F9C13E23305C1B1519A64E3119E04D594F106FA17A842AB87FCA701C5C12D99F6AEF517CA1D94586B31DFF471AAF4F16
                                                  Malicious:false
                                                  Preview:.................6.......m.......m.......m.......m..S....m...... n..A...<n......~n..0....n..B....n.......o.......o......"o......Bo......Wo......eo......oo......zo.......o.."....o.......o.......o.......p..+....p.......p.......q.......q..5...1q......gq......qq.......q.......q.......q.......q.......q.......q.......q.......q.......q..0....r..2...Gr..2...zr.......r..0....r.......r..6....s......Hs......Ns......Zs......ms..;...us.......s.......s.......s.......s.......s.......t.......t.......t......5t......Pt......^t..+...gt.......t.......t.......t.......t.."....t.......t.......u..%..."u......Hu......Pu......`u.. ...ku.......u..H....u..I....u..4...5v......jv..:...vv.......v.......v..4....v.......w......;w......Ew......Sw......`w......lw......ww......}w.......w.......w.......w.......w.......w.......w.......w.......w.......x......&x......@x......Fx......Zx......ox......vx.......x.......x.......x.......x..%....x..O....x..R...1y..1....y..0....y.......y.......y.......z......(z.......z......Dz......

                                                  C:\Program Files\FileZilla FTP Client\locales\el\libfilezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 75 messages, Project-Id-Version: FileZilla Client 3.39.0 '\316\223\316\271\316\261 \317\204\316\267\316\275 \317\205\317\200\316\277\316\263\317\201\316\261\317\206\316\256 \316\265\316\275\317\214\317\202 \317\200\316\271\317\203\317\204\316\277\317\200\316\277\316\271\316\267\317\204\316\271\316\272\316\277\317\215 \317\207\317\201\316\267\317\203\316\271\316\274\316\277\317\200\316\277\316\271\316\256\316\270\316\267\316\272\316\265 \316\255\316\275\316\261\317\202 \316\261\316\275\316\261\317\203\317\206\316\261\316\273\316\256\317\202'
                                                  Category:dropped
                                                  Size (bytes):10416
                                                  Entropy (8bit):5.338958307157953
                                                  Encrypted:false
                                                  SSDEEP:192:nKlfNbaZGJqe790vMm3dLr4r9j6yVtEuLdQY7kyETMS3Hrbl:KlfNbakB9ELr4r9DtREj
                                                  MD5:AF620E0DCB310A03EDA039DEBA665F62
                                                  SHA1:588E593DB4AE8A7B205C151B33C6ABC8FEE16848
                                                  SHA-256:52E60A1E0D9A72407A0C5E529845CA45BB0D79A786469623A25F2CC63C48BC92
                                                  SHA-512:00A6CDBF24DFE6FE2688080851D1270DB232045D9B8672EA32735DAF89DDCBA67B6CC8BF04DFE093F66C7DB5625D39D3003070EB93EFE186DF87577399D2F375
                                                  Malicious:false
                                                  Preview:........K.......t...................A.......A...........Q.......j...$...~...........)...................................:.......V...1...o...........X.......R....... ...h...!...........................................................).......?.......W.......r...................................4.......P...........p...#...............).......(...................*.......@.......X.......k.......y...................+.......+.......L.......-...c................... .......0.......M... ...$...n...........................,.......#.......%...,...$...R...%...w...'.......n.......?...4...7...t...-.......1...............5...)......._.......g.......8...........#...N...0...r...K.......U.......e...E...&.......D.......I.......<...a...T...............V...................|...U...#...U...y...L............... ...3...$...T.......y...<.......&...............*.......8...B.../...{...M.......0......."...*...y...M...........*...y...g.......J.......V...W...c.......=.......(...P...9...y...*.......$...............I...

                                                  C:\Program Files\FileZilla FTP Client\locales\en\filezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 1 message, Content-Type: text/plain; charset=UTF-8
                                                  Category:dropped
                                                  Size (bytes):275
                                                  Entropy (8bit):5.068502214276212
                                                  Encrypted:false
                                                  SSDEEP:6:ilijRPeQ8KMW0YEi/R3AFxR/RSXm5wN2Vpf/KLY4JK9:i4NeQWiGn/IXmK8KE4Jc
                                                  MD5:807D27E041DD3ED1CD2C872C283A6E52
                                                  SHA1:C94A40DB0CBE1EFA783A463526C423DEA89F500F
                                                  SHA-256:DD0B523740C89630994264359E1ECCEF53C6848928EFC7C034F993C1B3E4B22F
                                                  SHA-512:21657B5B353A53BBDA7370D863CDC0003E21761ADD65737D3C6DE49294B44E28C9C35B61BE3C9A06E5E78B5A65F6C11546865D778509863F266092C7B72EA2CA
                                                  Malicious:false
                                                  Preview:................$.......,.......,.......-....Content-Type: text/plain; charset=UTF-8.Content-Transfer-Encoding: 8bit.Language: en.Language-Team: .Last-Translator: .MIME-Version: 1.0.Plural-Forms: nplurals=2; plural=(n != 1);.PO-Revision-Date: .Project-Id-Version: FileZilla..

                                                  C:\Program Files\FileZilla FTP Client\locales\es\filezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 1842 messages, Project-Id-Version: FileZilla '%H:%M:%S transcurrido'
                                                  Category:dropped
                                                  Size (bytes):180855
                                                  Entropy (8bit):5.114137453690148
                                                  Encrypted:false
                                                  SSDEEP:1536:4eaK1NtgHfGYAQ8sOm3mfW2l7U4TR4RpkCFCQxOuT2Q1rR7BJUw6GA8E8HgD5A9+:AK1r++3sJmfmTkCF55TT7XUw6+8U2eyV
                                                  MD5:A39D63D5049D4D8C712B283F77229372
                                                  SHA1:7D74EB3AB4FB16ED6204BB04EC976BE18B8C184D
                                                  SHA-256:28F121E7BA96650DD9363E15D59EA11496D9675C7967D8E233920E49B5747ACD
                                                  SHA-512:B017E737B767B2ACD86453BAD28C08BA691C990192B3055562384A8EACDC086ADAE3CAC24235BBBC26F8EB8D2D244508612034C0C9519F7C7CEDA932DCA98CA0
                                                  Malicious:false
                                                  Preview:........2........9......<s......<s......=s......Ns..S...\s.......s..A....s.......t..0....t..B...Pt.......t.......t.......t.......t.......t.......t.......t.......u.......u......(u.."...Bu......eu......vu......^v..+...nv.......v.......v.......v..5....v.......w.......w.......w......,w......6w......>w......Ow......aw......uw.......w.......w..K....w..0....x..2...1x..2...dx.......x..0....x.......x..6....x......2y......8y......Dy......Wy..;..._y.......y.......y.......y.......y.......y.......y.......y.......z.......z......'z......Bz......Pz..+...Yz.......z.......z.......z.......z.."....z.......z.......z..%....{......:{......B{......R{.. ...]{......~{..H....{..I....{..4...'|......\|..:...h|.......|.......|.......|..4....|..$....}......<}......[}......e}......s}.......}.......}.......}.......}.......}.......}.......}.......}.......}.......}.......~.......~......;~......F~......`~......f~......z~.......~.......~.......~.......~.......~.......~..%....~..O.......R...Q...1.......0...................

                                                  C:\Program Files\FileZilla FTP Client\locales\es\libfilezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 75 messages, Project-Id-Version: FileZilla 'Un certificado de la cadena se ha firmado con un algoritmo inseguro'
                                                  Category:dropped
                                                  Size (bytes):7622
                                                  Entropy (8bit):4.944677525982757
                                                  Encrypted:false
                                                  SSDEEP:192:nKlLgiZGJqe790vMm3dpUFtuVRCb2+FEAJ1h52K:KlLgikB9Ep8Rz1V
                                                  MD5:00AE32765AAFBDFDE1371A120D876C6B
                                                  SHA1:E260A9E1D9C58F8818A0A6036B38B9A321A4C691
                                                  SHA-256:3EDDA140F7FC66300EB304C4BC05E086187F124C0D2B3F61B24A120DA7DC963A
                                                  SHA-512:613BB8B18627EC19CBB1407ED2E1535DFEA43ABC5C6347B13C757F9E40265032E76E46400D7C52165739993E6B490E045C12C5653EC689F5D92AC10720A5445D
                                                  Malicious:false
                                                  Preview:........K.......t...................A.......A...........Q.......j...$...~...........)...................................:.......V...1...o...........X.......R....... ...h...!...........................................................).......?.......W.......r...................................4.......P...........p...#...............).......(...................*.......@.......X.......k.......y...................+.......+.......L.......-...c................... .......0.......M... ...$...n...........................,.......#.......%...,...$...R...%...w...'.......n.......?...4...7...t...-.......1...............5...)......._...~...g...C.......I...*...(...t...........,.......,.......7...........N...3...a...#.......................B....... ...<...]...]...^.......0.......-...K...(...y...................................................&...'.......N..."...m...........).......................U.......V...`...........2...............;.......0...L.......}.........................................../...

                                                  C:\Program Files\FileZilla FTP Client\locales\et\filezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 1282 messages, Project-Id-Version: filezilla 'Aega kulunud: %H:%M:%S'
                                                  Category:dropped
                                                  Size (bytes):111622
                                                  Entropy (8bit):5.195468538893027
                                                  Encrypted:false
                                                  SSDEEP:1536:K2Vk6so54tBvDXC7mjVO7x6X1edxqNyuRix1jRRUEnq6C8sxp/9671O5:nk62Z78mjv8dxquYEdYz9671Y
                                                  MD5:277F5EC216CF5EB1027BEC518E52ED32
                                                  SHA1:22820C453A59A258A43D634C57C6F85600383A90
                                                  SHA-256:54BF2804E0BEDC30BE6AF8A0CA757E155BA570635A9EEBB10ACCDBA9E18B7A41
                                                  SHA-512:C2D0A37BEA7AFA9A3709996E88DC0209AAFDA2597A378440666F343A267B01D0DE1169EF4DB98689CFF8E36182B37317A98433D1B9094C0F3F9F0386D35557E3
                                                  Malicious:false
                                                  Preview:................,(......<P......<P......=P......NP..S...\P.......P.......P..0....P..B....Q......QQ......fQ......pQ.......Q.......Q.......Q.......Q.......Q.......Q.."....Q.......R......&R......6R......DR..5...XR.......R.......R.......R.......R.......R.......R.......R..2....R......!S......<S..6...TS.......S.......S.......S.......S..;....S.......S.......S.......T.......T......3T......:T......KT......fT......tT..+...}T.......T.......T.......T.......T.."....T.......U.......U..%...8U......^U......fU......vU..4....U.......U..:....U.......V.......V..4...>V......sV.......V.......V.......V.......V.......V.......V.......V.......V.......V.......W.......W......(W......AW......JW......gW......rW.......W.......W.......W.......W.......W.......W.......W..%....W..R....X..0...gX.......X.......X.......X.......X.......X.......X.......X.......Y.......Y......MY......mY......xY..3....Y..$....Y..$....Y..)....Z......5Z......KZ......]Z......jZ......wZ......|Z.......Z.......Z.......Z.......Z.......Z.......[.. ...

                                                  C:\Program Files\FileZilla FTP Client\locales\et\libfilezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 7 messages, Project-Id-Version: filezilla 'M\303\244lu eraldamine eba\303\265nnestus'
                                                  Category:dropped
                                                  Size (bytes):897
                                                  Entropy (8bit):5.2711594973736995
                                                  Encrypted:false
                                                  SSDEEP:24:9PZM5T2r80hLnI5r/t0qtydgcBXmHWj1dJ9YVzn:9BprjLI5r2qcqDCdJkT
                                                  MD5:5EFC220D09DD367B9F6F564CCCB9E8A4
                                                  SHA1:B7EF72F9BD305088D05A55835C0D34BF66FCC4F0
                                                  SHA-256:E3DAA21D3381497DC96862CF2D5F20C24634A6901DE8420989AD89BA81AEFA76
                                                  SHA-512:BB7DA2AE6C8DE7731841B9FF300232D5506EE8DF51F7E49CC1D3D19CA12B5B0B4757E2D604D3B2331100D4454FAB8031875021300B141CBD7FCCB430B77D0C9D
                                                  Malicious:false
                                                  Preview:................T...........................................0...................).......1...................'.......+...+... ...W.......x....Memory allocation failure.Network unreachable.Remote certificate not trusted..Server did not properly shut down TLS connection.Unsupported certificate type.unknown.Project-Id-Version: filezilla.Report-Msgid-Bugs-To: https://trac.filezilla-project.org/.PO-Revision-Date: 2016-12-05 22:22+0200.Last-Translator: Janek Hortla <peemot .t gmail punkt com>.Language-Team: .Language: et_EE.MIME-Version: 1.0.Content-Type: text/plain; charset=UTF-8.Content-Transfer-Encoding: 8bit.X-Poedit-SourceCharset: utf-8.Plural-Forms: nplurals=2; plural=(n != 1);.X-Generator: Poedit 1.8.11..M.lu eraldamine eba.nnestus.V.rk pole ligip..setav.Kaugsertifikaat ei ole usaldusv..rne..Server ei sulgend korrektselt TLS .hendust.Mittetoetatud sertifikaadit..p.tundmatu.

                                                  C:\Program Files\FileZilla FTP Client\locales\eu\filezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 1669 messages, Project-Id-Version: filezilla '%H:%M:%S igaro dira'
                                                  Category:dropped
                                                  Size (bytes):161461
                                                  Entropy (8bit):5.097923332761019
                                                  Encrypted:false
                                                  SSDEEP:1536:2dC69Pymg+y9VVmPKy7U4m6lDH9yFZJsZlTRQsru9XAgwxFh1qVktPmRXgcvi16x:+9PTC9XmPtD9yFfkTitigw11ttuRW6x
                                                  MD5:37520BEA4A5AFD36C5974BBF9A7FAA58
                                                  SHA1:E116D2549A26A0B7C914AE0B52B0B6B79FF93FEA
                                                  SHA-256:5508D0AC990141FAB92E4D436F8A55258CCE08ABDC67CF80BE6C1677568C3D6D
                                                  SHA-512:4C384DBA511CB31029A6726B3CC5CFBC1747A0B4196A4CE826E9B1B51099622DF4270B72B1200B0810FD1621BED7E9FB3DD78D3D7B0C0A4F66330FEA5BC67089
                                                  Malicious:false
                                                  Preview:................D4......lh......lh......mh......~h..S....h.......h..A....h......>i..0...Oi..B....i.......i.......i.......i.......j.......j......%j....../j......:j......Jj.."...dj.......j.......j.......k..+....k.......k.......k..5....k.......l.......l.......l......;l......El......Ml......^l......pl.......l.......l.......l..2....l.......l.......m..6...)m......`m......fm......rm.......m..;....m.......m.......m.......m.......m.......n.......n...... n......6n......Qn......_n..+...hn.......n.......n.......n.......n.."....n.......n.......o..%...#o......Io......Qo.. ...ao.......o..H....o..I....o..4...+p......`p..:...lp.......p.......p..4....p.......q......1q......;q......Iq......Vq......bq......hq......~q.......q.......q.......q.......q.......q.......q.......q.......r.......r......+r......1r......Er......Zr......ar......ur.......r.......r..%....r..O....r..R....s..1..._s..0....s.......s.......s.......s.......t.......t.......t......(t......At......Ht......wt.......t.......t..2....t..3....t......

                                                  C:\Program Files\FileZilla FTP Client\locales\eu\libfilezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 75 messages, Project-Id-Version: filezilla 'Kateko ziurtagiri bat algoritmo ez seguru bat erabiliz sinatu zen'
                                                  Category:dropped
                                                  Size (bytes):7296
                                                  Entropy (8bit):4.976943025099505
                                                  Encrypted:false
                                                  SSDEEP:96:inIKT56uR0rgnVvqk9Ra1Jqe790vMmU87cqO6zu5r2EYx2tqsS0NQSTeAUEnKykb:nKleqZGJqe790vMm3dc2k1FNAnEnElJ
                                                  MD5:CA0175CF709FF5DD4894FD0103B985EA
                                                  SHA1:C146C50D9B4006DA36020B897A5703B777192608
                                                  SHA-256:B4FA9F93E558FBD9049424095A9ED358E0345159AF3454FE41C5C099A0985C11
                                                  SHA-512:034AE5BF76AD9A508B4CF2B91763D6C5AFF425A34CFDFEC0324AFDFF9F7DADD344AA0B48063A53AA0E7F9A1AA86A3CDF000E2ED6D4B1497A04E27B9A95423F9A
                                                  Malicious:false
                                                  Preview:........K.......t...................A.......A...........Q.......j...$...~...........)...................................:.......V...1...o...........X.......R....... ...h...!...........................................................).......?.......W.......r...................................4.......P...........p...#...............).......(...................*.......@.......X.......k.......y...................+.......+.......L.......-...c................... .......0.......M... ...$...n...........................,.......#.......%...,...$...R...%...w...'.......n.......?...4...7...t...-.......1...............5...)......._.......g...A.......9...:.......t...........$.......#.......4...........0...,...@.......m...................E....... .......a.../...Z......./.......-.......*...J.......u...............................................................5.......O.......i...................4.......H...........2...2...G.......z...".......)...........................................8.......M...'...

                                                  C:\Program Files\FileZilla FTP Client\locales\fa_IR\filezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 1146 messages, Project-Id-Version: FileZilla3 '%H:%M:%S \330\263\331\276\330\261\331\212 \330\264\330\257\331\207'
                                                  Category:dropped
                                                  Size (bytes):128961
                                                  Entropy (8bit):5.415307562752638
                                                  Encrypted:false
                                                  SSDEEP:3072:niJ+l3JmazXdxiaQDZflEJi1QYt3uo1t5S2AE1lgU70Xxo6My/w2rl:niJ+l3HzNxiamfrdu8XgU7iF/w2rl
                                                  MD5:363A037E42BEE31166854C0B334EC74D
                                                  SHA1:68F1A0871407E00D8F4B3D1C3317DD1765F47462
                                                  SHA-256:A0BDF1A7F4693882B9373AC8D2AAF782A778371925166DC8EC6EB54093F81D5C
                                                  SHA-512:CDA3BF3C92F9D5B5CAE71D37827FB63CBF1A0A66F3D550BB0B55C20246532424487D24AD285B9C4AADECCFE23383A94E83021F679849AF4D4CA5C65628EB82A8
                                                  Malicious:false
                                                  Preview:........z........#.......G.......G.......G.......G..S....G......0H..A...LH.......H..0....H..B....H.......I......(I......2I......@I......PI.."...jI.......I.......I.......I.......I.......I.......I.......I.......I.......I.......J..2....J......RJ......mJ..6....J.......J.......J.......J..;....J.......K.......K......(K......?K......PK......kK......yK..+....K.......K.......K.......K.......K.......K.......K..%....L......@L......HL..4...^L.......L.......L.......L..4....L.......M......)M......3M......AM......NM......ZM......`M......vM......~M.......M.......M.......M.......M.......M.......M.......M.......N.......N.......N......2N......@N..%...JN..0...pN.......N.......N.......N.......N.......N.......N.......O.......O......7O......WO..$...bO..$....O..)....O.......O.......O.......O.......P.......P......%P......9P......YP......uP.......P.. ....P.......P.......P.......P.......P.......P.......P.......P.......P.......Q.......Q.......Q.......Q...... Q......+Q......7Q......>Q......EQ......SQ......eQ......

                                                  C:\Program Files\FileZilla FTP Client\locales\fa_IR\libfilezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 8 messages, Project-Id-Version: FileZilla3 '\330\252\331\210\330\254\331\207! \332\257\331\210\330\247\331\207\331\212\331\206\330\247\331\205\331\207 \330\250\330\247\330\267\331\204 \330\264\330\257\331\207 \330\247\330\263\330\252'
                                                  Category:dropped
                                                  Size (bytes):1232
                                                  Entropy (8bit):5.754461174675916
                                                  Encrypted:false
                                                  SSDEEP:24:uiStKzL0xz80hLnI54J3t0qtyxiHtPD7No3XmcSyW0y3fD108gu4S4/QL9m7:ujYOzjLI5hqcwbGmcuveD/7
                                                  MD5:21DAB03D2178D2A9B3540B70A994D676
                                                  SHA1:91B615462C2BC837938A333432EA8C47224411B3
                                                  SHA-256:F554A8709234232F23DC85831054951FE55AED08A828FF81EE9CDDAE3820C978
                                                  SHA-512:C6F47FF2662FF837E1EF90D1760690F78245DD69A6F0EAD7CBCF43A9F545BD7955DDCA04BB3489AB49EE4837C38A3DA0301EFF95ECC88F29AF3ED8ECB8F1A637
                                                  Malicious:false
                                                  Preview:................\...................$.......!.......................0...........I.......f.......n...3...m...3.......%.......F.......@...B...;................Beware! Certificate has been revoked.Failed to verify peer certificate.Network unreachable.Remote certificate not trusted..Server did not properly shut down TLS connection.Unsupported certificate type.unknown.Project-Id-Version: FileZilla3.Report-Msgid-Bugs-To: https://trac.filezilla-project.org/.PO-Revision-Date: 2010-01-08 19:53+0330.Last-Translator: hadi <hadiaj168@yahoo.com>.Language-Team: Barnamenevis.org <http://barnamenevis.org/forum/showthread.php?t=207094>.Language: fa_IR.MIME-Version: 1.0.Content-Type: text/plain; charset=UTF-8.Content-Transfer-Encoding: 8bit.X-Poedit-Language: Persian.X-Poedit-Country: IRAN, ISLAMIC REPUBLIC OF.X-Poedit-SourceCharset: utf-8.Plural-Forms: nplurals=2; plural=(n > 1);......! ......... .... ... ....... .. ..... ...... .../......... .... .

                                                  C:\Program Files\FileZilla FTP Client\locales\fi_FI\filezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 1753 messages, Project-Id-Version: FileZilla Client 3.x.x '%H:%M:%S kulunut'
                                                  Category:dropped
                                                  Size (bytes):165615
                                                  Entropy (8bit):5.1958794635505985
                                                  Encrypted:false
                                                  SSDEEP:3072:XEJK9cGP8GymGYE9oFovTmuugw8GJIkCCW0VGkikk68uKO9WD:Uo56YOoFovTmdDJv2
                                                  MD5:915BB615A8749338920EAF329F96A00A
                                                  SHA1:81B6D686BB3E53034F05CDAC3B0BB4B5DABD422C
                                                  SHA-256:B43E9D0EACB684F683129FC1D9D1D7EEED84EA9DB98BE35D91D33B68D0EC33A8
                                                  SHA-512:BE1592DB89B53E57BDF9DF4348E274808AA39E647882C7853E86E33966E301086ED3A9DFACE332BE8FF19EC79725C0F9366F1988A582B63FFE5B61F365A16ADF
                                                  Malicious:false
                                                  Preview:.................6.......m.......m.......m.......m..S....m...... n..A...<n......~n..0....n..B....n.......o.......o......"o......Bo......Wo......eo......oo......zo.......o.."....o.......o.......o.......p..+....p.......p.......q.......q..5...1q......gq......qq.......q.......q.......q.......q.......q.......q.......q.......q.......q..0....r..2...Gr..2...zr.......r..0....r.......r..6....s......Hs......Ns......Zs......ms..;...us.......s.......s.......s.......s.......s.......t.......t.......t......5t......Pt......^t..+...gt.......t.......t.......t.......t.."....t.......t.......u..%..."u......Hu......Pu......`u.. ...ku.......u..H....u..I....u..4...5v......jv..:...vv.......v.......v..4....v.......w......;w......Ew......Sw......`w......lw......ww......}w.......w.......w.......w.......w.......w.......w.......w.......w.......x......&x......@x......Fx......Zx......ox......vx.......x.......x.......x.......x..%....x..O....x..R...1y..1....y..0....y.......y.......y.......z......(z.......z......Dz......

                                                  C:\Program Files\FileZilla FTP Client\locales\fi_FI\libfilezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 75 messages, Project-Id-Version: FileZilla Client 3.x.x 'Ketjun sertifikaatti allekirjoitettiin k\303\244ytt\303\244en turvatonta algoritmia'
                                                  Category:dropped
                                                  Size (bytes):7441
                                                  Entropy (8bit):5.033639577891653
                                                  Encrypted:false
                                                  SSDEEP:192:nKlBQZGJqe790vMm3djIk65qQWx2n9kBL:KlBQkB9EjLaqQWxvL
                                                  MD5:F5889732EB539EE6D922C8F268B90F22
                                                  SHA1:D1BF651E7C623E71DBB1105970A4DE5D3F4AD7FD
                                                  SHA-256:FEF68C4F87F882DE690217E887D45C0C0B8D13B7CC5E73B439FB2AF72815228C
                                                  SHA-512:8AF5A09B1D2FE1AC7368F8386C8F210414714B3D1CD5CE6CEE93E120662806A207EC34CC8A8900699D3B827F33F7CD6924C60F4F6DADA075C5D024CE3AC9244F
                                                  Malicious:false
                                                  Preview:........K.......t...................A.......A...........Q.......j...$...~...........)...................................:.......V...1...o...........X.......R....... ...h...!...........................................................).......?.......W.......r...................................4.......P...........p...#...............).......(...................*.......@.......X.......k.......y...................+.......+.......L.......-...c................... .......0.......M... ...$...n...........................,.......#.......%...,...$...R...%...w...'.......n.......?...4...7...t...-.......1...............5...)......._.......g...G...?...?...............".......#.......#...*...4...N...........................................B....... ...?...\...`...P.......).......*...8...-...c...................!...............................!...".......D.......a.......}...!.......................<.......H...........w...6...............*.......,...........:.......U.......j...........................#...

                                                  C:\Program Files\FileZilla FTP Client\locales\fr\filezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 1825 messages, Project-Id-Version: fr '%H:%M:%S \303\251coul\303\251e(s)'
                                                  Category:dropped
                                                  Size (bytes):188166
                                                  Entropy (8bit):5.205645364219349
                                                  Encrypted:false
                                                  SSDEEP:3072:Oa0mEkKsJmB3XkCFjpT77XnwY/V4w4plYfOP5gDT11+aw/gOm5DPWR+fDQ:HrB230CFjpT7TJ/VPAlgcIT11lw/gOmc
                                                  MD5:45C44901F78A309FD7DE1E53B9982A84
                                                  SHA1:C97A2EB30C711D7826A807542421456F0D903F87
                                                  SHA-256:FB3F2C335171585F39B6849D338AB1510DE1680419F7F01E8B32A958F32EF1AC
                                                  SHA-512:C75D38699F951E3508DE0F01AF7C755073F3DF554C6F5DFA913CA74DDB26302F15C9541AA05CB8E9AC23FE3021A8312CB2EEC3D14E12A5C764DECCDDFB9F8F3E
                                                  Malicious:false
                                                  Preview:........!.......$9......,r......,r......-r......>r..S...Lr.......r..A....r.......r..0....s..B...@s.......s.......s.......s.......s.......s.......s.......s.......s.......t.......t.."...2t......Ut......ft......Nu..+...^u.......u.......u.......u..5....u.......u.......u.......v.......v......&v.......v......?v......Qv......ev......vv.......v..K....v..0....v..2...!w..2...Tw.......w..0....w.......w..6....w......"x......(x......4x......Gx..;...Ox.......x.......x.......x.......x.......x.......x.......x.......x.......y.......y......2y......@y..+...Iy......uy.......y.......y.......y.."....y.......y.......y..%....z......*z......2z......Bz.. ...Mz......nz..H....z..I....z..4....{......L{..:...X{.......{.......{.......{..4....{..$....|......,|......K|......U|......c|......p|......||.......|.......|.......|.......|.......|.......|.......|.......|.......}.......}......+}......6}......P}......V}......j}.......}.......}.......}.......}.......}.......}..%....}..O....}..R...A~..1....~..0....~.......~......

                                                  C:\Program Files\FileZilla FTP Client\locales\fr\libfilezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 77 messages, Project-Id-Version: fr 'Un certificat de la cha\303\256ne a \303\251t\303\251 sign\303\251 en utilisant un algorithme non s\303\251curis\303\251'
                                                  Category:dropped
                                                  Size (bytes):7877
                                                  Entropy (8bit):5.0201004736899675
                                                  Encrypted:false
                                                  SSDEEP:192:dcl/ZpJqe790vMm3db71/JMoKWrKRxVk+oYblV:E/vB9Eb71yg+Rb3
                                                  MD5:D293080740D59E95F516A952CB6BBE81
                                                  SHA1:EBED2C4E8DCFF798AAB234069723E26ADA777A63
                                                  SHA-256:B207CF284CC20713E03031451592CE48BBDA7ABA7AD56F88B79D38C2B9B50E3A
                                                  SHA-512:C309EBC906255A6DD7F0EED8C62CDDB80BB11BA3C14B73B17C13A9BE2B0D76837EFFE534E556EF0CA6C6ADC8D3CFEE688CE51CE633E84421808393AD3987B039
                                                  Malicious:false
                                                  Preview:........M...........................A.......A.../.......q...........$...............>.......)...".......L......._.......|...................1...............X.......R...t... .......!...................'.......7.......M.......g.......{...............................................................<.......V...4...h...P...............#...........&...)...7...(...a...............................................................%...+...<...+...h...L.......-.................../... ...L...0...m...M.......$...................*.......D...,...Y...#.......%.......$.......%.......'.......n...C...?.......7.......-...*...1...X...........5.......................T...z...J.......$....... ...?...+...`...+.......C.......8...........5.......H...!...h...(.......%.......F......."... ...^...C...P...............,..."...-...O.......}...................................................+...$.......P...!...n...........,......."...............:.......R...K...........+...............3...................].......x.......

                                                  C:\Program Files\FileZilla FTP Client\locales\gl_ES\filezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 1638 messages, Project-Id-Version: FileZilla 3 GL 1.0 'transcorreron %H:%M:%S'
                                                  Category:dropped
                                                  Size (bytes):161120
                                                  Entropy (8bit):5.100258482579059
                                                  Encrypted:false
                                                  SSDEEP:1536:aRA92JUYQkBdRjzVVmHry7U4m6lDEdyF+i8ZJTxQIru9XvtwcB5KWHhlPqz1+Za2:0AAWAXmH2odyFjYTCJNtwczqzUZaAp
                                                  MD5:475AE41589B1DFD15765EDF32E9BDB53
                                                  SHA1:EDBFC58C102EA2AE05329BD009F39BBA668E77D5
                                                  SHA-256:DDD6DAC8DDAC1360B8D013F5DBF76B29613FB4166D715AA178F372EBB5491E0B
                                                  SHA-512:A4CF43EF567899EFFEE4B3221609B4CD8DCD2F79A72A9C68B0925B9DE59BAF0A33B672247102C92EB60CEF890F2F5BF85FC6664759BF21E59CA10CB447F26FBD
                                                  Malicious:false
                                                  Preview:........f.......L3......|f......|f......}f.......f..S....f.......f..A....g......Ng..0..._g..B....g.......g.......g.......g.......h......'h......5h......?h......Jh......Zh.."...th.......h.......h.......i..+....i.......i.......i..5....i......$j.......j......8j......@j......Qj......cj......wj.......j..2....j.......j.......j..6....j......3k......9k......Ek......Xk..;...`k.......k.......k.......k.......k.......k.......k.......k.......l......$l......2l..+...;l......gl......zl.......l.......l.."....l.......l.......l..%....l.......m......$m.. ...4m......Um..H...km..I....m..4....m......3n..:...?n......zn.......n..4....n.......n.......o.......o.......o......)o......5o......;o......Qo......Yo......mo.......o.......o.......o.......o.......o.......o.......o.......o.......p.......p......-p......4p......Hp......Vp......_p..%...ip..O....p..R....p..1...2q..0...dq.......q.......q.......q.......q.......q.......q.......q.......r.......r......Jr......jr......ur..2....r..3....r.......r..$....r..$...!s..)...

                                                  C:\Program Files\FileZilla FTP Client\locales\gl_ES\libfilezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 75 messages, Project-Id-Version: FileZilla 3 GL 1.0 'Un certificado na cadea foi asinado usando un algoritmo inseguro'
                                                  Category:dropped
                                                  Size (bytes):7679
                                                  Entropy (8bit):5.005956534609618
                                                  Encrypted:false
                                                  SSDEEP:192:nKlUU8ZGJqe790vMm3dsUPXPtPLK5mQJC1:KlUTkB9EsuftmQQQ
                                                  MD5:F656676E52A4651F9A3E428952858B28
                                                  SHA1:1CBD35986C365CAC890D626815D2E028FFE8A46D
                                                  SHA-256:515395C0F8D5EED699CA5777411C720B9CBE6C5BD037FC0D0FADB8C7409E173E
                                                  SHA-512:F83AD89FABEEF1F5071590ED4EDA43BE3A361EB5D8F9FD2D2EE51B997FE7A31D1E2C26C660AA38E6FE74E3B8CE6C47BA845838829C47633A78A4C479610D73C2
                                                  Malicious:false
                                                  Preview:........K.......t...................A.......A...........Q.......j...$...~...........)...................................:.......V...1...o...........X.......R....... ...h...!...........................................................).......?.......W.......r...................................4.......P...........p...#...............).......(...................*.......@.......X.......k.......y...................+.......+.......L.......-...c................... .......0.......M... ...$...n...........................,.......#.......%...,...$...R...%...w...'.......n.......?...4...7...t...-.......1...............5...)......._.......g...@.......K...o...0....... .......%.......*...3...0...^...................'.......................A...,...!...n..._.......X...........I...+...x...1...........................................&.......D... ...\...!...}...)...................................'...R...C...V...............+...........+...,...D...-...q...!...........................................".../...

                                                  C:\Program Files\FileZilla FTP Client\locales\he_IL\filezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 1684 messages, Project-Id-Version: PACKAGE VERSION '%H:%M:%S \327\242\327\221\327\250\327\225'
                                                  Category:dropped
                                                  Size (bytes):173021
                                                  Entropy (8bit):5.264148940978267
                                                  Encrypted:false
                                                  SSDEEP:3072:uW57WI3MJ7YrLqswmINwdC+jTTxQgwt+m6eEh68aQ1a3GkKqJFovgKgW:ue76AnKNqC+jTTxQNaeEA8aQ1a3GkKq2
                                                  MD5:0D3D780CC1D5E195E1382372B98E24BD
                                                  SHA1:6ADB64FC788F473B112D1CE418AEDE9CF9F392F2
                                                  SHA-256:DB7F52A3811E802AB9E7FB34D5F650901D1638BE4C929903385962EEA66C05E8
                                                  SHA-512:B70EE875F3861E1A8DF5A45E82E3195ABD90DA6E95E2E6F478C3F26B87B36023782B9599C90E7C162A8BCFC9A69704A6516AC3A863073C0EE8A8250E71C65CCD
                                                  Malicious:false
                                                  Preview:.................4......\i......\i......]i......ni..S...|i.......i..A....i.......j..0...?j..B...pj.......j.......j.......j.......j.......k.......k.......k......*k......:k.."...Tk......wk.......k......pl..+....l.......l.......l.......l..5....l.......m......!m......1m......>m......Hm......Pm......am......sm.......m.......m.......m..K....m..0....n..2...Cn..2...vn.......n..0....n.......n..6....o......Do......Jo......Vo......io..;...qo.......o.......o.......o.......o.......o.......o.......p.......p......#p......9p......Tp......bp..+...kp.......p.......p.......p.......p.."....p.......p.......q..%...&q......Lq......Tq......dq.. ...oq.......q..H....q..I....q..4...9r......nr..:...zr.......r.......r.......r..4....r..$...)s......Ns......ms......ws.......s.......s.......s.......s.......s.......s.......s.......s.......s.......t.......t......'t......0t......Mt......Xt......rt......xt.......t.......t.......t.......t.......t.......t.......t..%....t..O....u..R...cu..1....u..0....u.......v......*v......

                                                  C:\Program Files\FileZilla FTP Client\locales\he_IL\libfilezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 11 messages, Project-Id-Version: filezilla '\327\240\327\220 \327\234\327\224\327\231\327\226\327\224\327\250! \327\252\327\242\327\225\327\223\327\224 \327\226\327\225 \327\240\327\251\327\234\327\234\327\224'
                                                  Category:dropped
                                                  Size (bytes):1697
                                                  Entropy (8bit):5.471233536275054
                                                  Encrypted:false
                                                  SSDEEP:48:tqxxnE1/Thq/TAzjL145r2qcEjtzWsDQAn9zD:tGnE1k0ju5r2UC2ntD
                                                  MD5:CD866D5DE8316678CEC0532328D8C627
                                                  SHA1:42A9D2F414E26E5062653050AB2EDDB7BA50EE0E
                                                  SHA-256:C628FA6FCE34EB21749A6BA6D81AAD896A100D7BD5071E96F62DE0FE4D85DBD8
                                                  SHA-512:408C2A90A92204562220C912C92A098545F53A02B623AE5E9E16B4D7CF3CA5F66C8443ED6B3237D56BA78112B3121D405BBC96C354BD3D8F80C8FAF69F0C29AB
                                                  Malicious:false
                                                  Preview:................t...................$.......X.......R...K...!.......................0...........%...5...B.......x...........-...K...{...y...r.......0...h...........*.......;.......%.......O...C............Beware! Certificate has been revoked.Could not get distinguished name of certificate issuer, gnutls_x509_get_issuer_dn failed.Could not get distinguished name of certificate subject, gnutls_x509_get_dn failed.Failed to verify peer certificate.Network unreachable.Remote certificate not trusted..Server did not properly shut down TLS connection.Unsupported certificate type.gnutls_certificate_get_peers returned no certificates.unknown.Project-Id-Version: filezilla.Report-Msgid-Bugs-To: https://trac.filezilla-project.org/.PO-Revision-Date: 2013-10-02 14:28+0300.Last-Translator: Yaron Shahrabani <sh.yaron@gmail.com>.Language-Team: Gezer.Language: he.MIME-Version: 1.0.Content-Type: text/plain; charset=UTF-8.Content-Transfer-Encoding: 8bit.Plural-Forms: nplurals=2; plural=(n != 1);.X-Generato

                                                  C:\Program Files\FileZilla FTP Client\locales\hr\filezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 1178 messages, Project-Id-Version: filezilla 0 'Proteklo je %H:%M:%S'
                                                  Category:dropped
                                                  Size (bytes):115199
                                                  Entropy (8bit):5.205349630497045
                                                  Encrypted:false
                                                  SSDEEP:1536:fYGg+ufTo6Nneme5375Zm01DGdxdwBA5HxOp30z0vzM5XUYJE3UVckLPLALF:JZ6hemeD9Gdx2OmA0vzM5EYJLPzuF
                                                  MD5:6B32566D840A14484912924D619C42B4
                                                  SHA1:87940B3765C9FE59D7D18F9F6FE478D1D106AD0E
                                                  SHA-256:2114B7CCBA3BFA876E8A38E11A7BA2CA2EBEA59E29DA446D02C5DBE65C346AEE
                                                  SHA-512:F1B12EAD8A8016DE2BB7267BC82D84CDFB5F61001B4DBA9BDB5E9B723D9A6DD0138C69686F24C4C8CB6A51AB45908E21BF69FD64C0FF3BCFF197074ED575C2BD
                                                  Malicious:false
                                                  Preview:.................$.......I.......I.......I.......I..S....I......0J..A...LJ.......J..0....J..B....J.......K.......K......+K......;K.."...UK......xK.......K.......K.......K.......K.......K.......K.......K.......K.......K..2....L......=L......XL..6...pL.......L.......L.......L..;....L.......L.......M.......M......%M......<M......MM......hM......vM..+....M.......M.......M.......M.."....M.......M.......N..%...*N......PN......XN......hN..4...~N.......N.......N.......N..4....N......*O......IO......SO......aO......nO......tO.......O.......O.......O.......O.......O.......O.......O.......P.......P.......P......0P......7P......EP..%...OP..R...uP..1....P..0....P......+Q......<Q......MQ......lQ......rQ.......Q.......Q.......Q.......Q.......Q.......R..3....R..$...?R..$...dR..)....R.......R.......R.......R.......R.......R.......S.......S......6S......RS......_S.. ...qS.......S.......S.......S.......S.......S.......S.......S.......S.......S.......S.......S.......S.......T.......T..)....T......=T......

                                                  C:\Program Files\FileZilla FTP Client\locales\hr\libfilezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 5 messages, Project-Id-Version: filezilla 0 'Mre\305\276ne veze su nedostupne'
                                                  Category:dropped
                                                  Size (bytes):859
                                                  Entropy (8bit):5.415494296183774
                                                  Encrypted:false
                                                  SSDEEP:24:g8W80h45rfvt0qty1f/YvXmG6gjk0lLoO+:qj45r+qcPxD/
                                                  MD5:B68C4DA7D7E4DB18848B7B9B7E6A542D
                                                  SHA1:164D01F3825DE4A312FDD7C3DDD1F4D05B12FA8F
                                                  SHA-256:837840EA54CE476A4954180619CCA71361C9C609751BB39F37D46885DF7BAD10
                                                  SHA-512:277D3FCD22795E888D22C60D3FD2CF9D08FDD91128AD6D4A8A22917758C17BFB84B1634E2DD8327A3F4B420D24CDB79489FDDA4BC758A5378DE3B9BA7399718A
                                                  Malicious:false
                                                  Preview:................D.......l.......l.......m...........0...............................&.......*...&.......Q....Network unreachable.Remote certificate not trusted..Server did not properly shut down TLS connection.unknown.Project-Id-Version: filezilla 0.Report-Msgid-Bugs-To: https://trac.filezilla-project.org/.PO-Revision-Date: 2009-07-28 08:40+0100.Last-Translator: Zdenko Rup.i. <zrupcic@gmail.com>.Language-Team: Croatian <hr@li.org>.Language: hr.MIME-Version: 1.0.Content-Type: text/plain; charset=UTF-8.Content-Transfer-Encoding: 8bit.Plural-Forms: nplurals=3; plural=n%10==1 && n%100!=11 ? 0 : n%10>=2 && n%10<=4 && (n%100<10 || n%100>=20) ? 1 : 2;.X-Poedit-Language: Croatian.X-Poedit-Country: CROATIA.X-Poedit-SourceCharset: utf-8..Mre.ne veze su nedostupne.Udaljeni certifikat nije vjerodostojan.Poslu.itelj nije uredno zatvorio TLS-vezu.nepoznato.

                                                  C:\Program Files\FileZilla FTP Client\locales\hu_HU\filezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 1630 messages, Project-Id-Version: FileZilla 3 'Eltelt: %H:%M:%S'
                                                  Category:dropped
                                                  Size (bytes):164176
                                                  Entropy (8bit):5.348876664509075
                                                  Encrypted:false
                                                  SSDEEP:3072:QULQR9nLfComHRTd9FyYTVJNtwaFBFw9qDwYiVTAZuA8B17m9s:QfPDClRp9FyYTVrXwIiVEZuLRm9s
                                                  MD5:13B69988312883B385900B149A396409
                                                  SHA1:5A96641FD934F875C3BE459899893D4A777DE683
                                                  SHA-256:62600458174371DAFE15E4DE96C76B808C8CA0EE3D0BC8490F643FD9B7A8DFF6
                                                  SHA-512:5D8E28C469BB4A706450B751A092F068E4BA78C01638D0876DD46054B52989C1E69C745D0EB5466F0F215F9F8905FF7EB261D9587928470B373ECAE00BAB9A51
                                                  Malicious:false
                                                  Preview:........^........3.......e.......e.......e.......f..S....f......pf..A....f.......f..0....f..B....g......Sg......hg......rg.......g.......g.......g.......g.......g.......g.."....g.......h......(h.......i..+... i......Li......Zi..5...ni.......i.......i.......i.......i.......i.......i.......i.......j..2....j......Ij......dj..6...|j.......j.......j.......j.......j..;....j.......k......'k......2k......Dk......[k......bk......sk.......k.......k.......k..+....k.......k.......k.......l.......l.."...#l......Fl......Wl..%...vl.......l.......l.. ....l.......l..H....l..I...4m..4...~m.......m..:....m.......m.......n..4...0n......en.......n.......n.......n.......n.......n.......n.......n.......n.......n.......o.......o.......o......3o......<o......Yo......do......~o.......o.......o.......o.......o.......o.......o.......o..%....o..O....p..R..._p..1....p..0....p.......q......&q......7q......Vq......\q......rq......{q.......q.......q.......q.......q.......q..2....r..3...=r......qr..$...|r..$....r..)...

                                                  C:\Program Files\FileZilla FTP Client\locales\hu_HU\libfilezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 75 messages, Project-Id-Version: FileZilla 3 'A hiteles\303\255t\303\251si l\303\241nc egyik tan\303\272s\303\255tv\303\241nya nem biztons\303\241gos algoritmussal van al\303\241\303\255rva'
                                                  Category:dropped
                                                  Size (bytes):7663
                                                  Entropy (8bit):5.207445939163463
                                                  Encrypted:false
                                                  SSDEEP:192:nKlOaZGJqe790vMm3dwW3TZVJvfzztD/ATZAP:KlOakB9EwApHVZ
                                                  MD5:866ADD9F73663C55DA6F6AF2474E572C
                                                  SHA1:0BD7CE865E6198AA9EE91B537FCC9B1A280F15C4
                                                  SHA-256:566AF80F6F8FAAF4B48A755644409ECB4F96108452E61B9C3D7A0106D419C47E
                                                  SHA-512:F826D6CB4CE395636F1CA5529FA4096EB99CFDCA6366DD7CBB5AA677D1FBA210052632DBFB08A2A2B4C9ED05FFD5243EC70AFC34647C2376D6031586AE29D0E2
                                                  Malicious:false
                                                  Preview:........K.......t...................A.......A...........Q.......j...$...~...........)...................................:.......V...1...o...........X.......R....... ...h...!...........................................................).......?.......W.......r...................................4.......P...........p...#...............).......(...................*.......@.......X.......k.......y...................+.......+.......L.......-...c................... .......0.......M... ...$...n...........................,.......#.......%...,...$...R...%...w...'.......n.......?...4...7...t...-.......1...............5...)......._.......g...Y.......D...W...!.............../...............5...........T...!...n...).......&.......$.......F....... ...M...v...n...i.......:...O...=...........................................'.......:.......X...$...w...........%.......#...................#.......<...<...N...J...............$.......".......2...9...:...l...............................................&...,...

                                                  C:\Program Files\FileZilla FTP Client\locales\hy\filezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 1562 messages, Project-Id-Version: \325\200\325\241\325\265\325\245\326\200\325\245\325\266 \325\251\325\241\326\200\325\243\325\264\325\241\325\266\325\270\326\202\325\251\325\265\325\270\326\202\325\266 '\324\261\325\266\326\201\325\245\325\254 \325\247\325\235 %H:%M:%S'
                                                  Category:dropped
                                                  Size (bytes):182588
                                                  Entropy (8bit):5.41488472590013
                                                  Encrypted:false
                                                  SSDEEP:3072:wXTkXcM236mmHOFd9zgET2auoxC9zwGzZskb+:wXToV/OD9zgET2ZOdkS
                                                  MD5:E0D6CA2F731D66520BD5C5DEA73604A6
                                                  SHA1:1BFB905328D2B2D915E905B97D4C5FEA744BD869
                                                  SHA-256:EEC54130F4D599871E6C6DA7B901DCA809446EB50F6A2F53EDA63554E70206A9
                                                  SHA-512:3324CF983E02B5167D49AF844A2A6DAF88E5F984C8E9F5184FA7F2415F204A440C66D8C30BD721E9219471D982826DB778703E5D3DFA90419B337A6858EEF169
                                                  Malicious:false
                                                  Preview:.................0.......a.......a.......a.......a..S....a......0b..A...Lb.......b..0....b..B....b.......c......(c......2c......Rc......gc......uc.......c.......c.......c.."....c.......c.......c.......c.......d..5....d......Pd......Zd......dd......ld......}d.......d.......d..2....d.......d.......d..6....e......Me......Se......_e......re..;...ze.......e.......e.......e.......e.......e.......e.......f......(f......6f..+...?f......kf......~f.......f.......f.."....f.......f.......f..%....f...... g......(g......8g..H...Ng..I....g..4....g.......h..:..."h......]h......th..4....h.......h.......h.......h.......h.......i.......i.......i......4i......<i......Pi......ei......pi......}i.......i.......i.......i.......i.......i.......i.......i.......j.......j......+j......9j......Bj..%...Lj..O...rj..R....j..1....k..0...Gk......xk.......k.......k.......k.......k.......k.......k.......k.......k......-l......Ml......Xl..2...ml..3....l.......l..$....l..$....m..)...)m......Sm......im......{m.......m......

                                                  C:\Program Files\FileZilla FTP Client\locales\hy\libfilezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 74 messages, Project-Id-Version: \325\200\325\241\325\265\325\245\326\200\325\245\325\266 \325\251\325\241\326\200\325\243\325\264\325\241\325\266\325\270\326\202\325\251\325\265\325\270\326\202\325\266 '\325\216\325\257\325\241\325\265\325\241\325\243\325\253\326\200\325\250 \325\267\325\262\325\251\325\241\325\265\325\270\326\202\325\264 \325\275\325\277\325\270\326\200\325\241\325\243\326\200\325\276\325\241\325\256 \325\247 \325\270\325\271 \325\241\325\266\325\276\325\277\325\241\325\266\325\243 \325\241\325\254\325\243\325\270\326\200\325\253\325\251\325\264\325\270\325\276'
                                                  Category:dropped
                                                  Size (bytes):8756
                                                  Entropy (8bit):5.344938445616127
                                                  Encrypted:false
                                                  SSDEEP:96:lGMQZMYFVxSdIKgnVvqk9Ra1Jqe790vMmU87cqLu5J+pKTZO+7DswmTqDZeiBKfZ:AMWHr/ZGJqe790vMm3d0UYZpM4MQ2
                                                  MD5:F1CF847FD9307F45224D500A41659E53
                                                  SHA1:E60EA95873B53E4C4985F3FB31DC6F88AD524FA5
                                                  SHA-256:A6DE37A294436B47B39568CCB5FCA92652864289AE696A862CAA5DAD5DC1F6D8
                                                  SHA-512:C90C4A60FFE2E34F15337416E35467BC72BFB92DD77B631CEA161E5505E5D1959608C055BBF078D6D6202FFB3B611C393BED977FC5CC14D8D2ACED8A4FCC1E20
                                                  Malicious:false
                                                  Preview:........J.......l...................A.......A...........A.......Z...$...n...........)...................................*.......F...1..._...........X.......R....... ...X...!...y.............................................................../.......G.......b.......z...........................4.......P...........`...#...t...........).......(...........................0.......H.......[.......i.......{...........+.......+.......L.......-...S................... .......0.......M.......$...^...........................,.......#.......%.......$...B...%...g...'.......?.......7.......-...-...1...[...........5.......................d.......b...<...7.......%.......@.......>...>...M...}...(.......;.......J...0...J...{...J.......r.......9.......m.......f...,...I.......7......./...........E.......X.......u...................7...............*...........@.../...T...-.......?.......2.......C...%...z...i... .......:.......)...@...J...j...@.......@.......2...7...$...j...(.......$...............-.......6...

                                                  C:\Program Files\FileZilla FTP Client\locales\id_ID\filezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 1851 messages, Project-Id-Version: id_ID '%H:%M:%S terlewati'
                                                  Category:dropped
                                                  Size (bytes):171512
                                                  Entropy (8bit):5.142886215672199
                                                  Encrypted:false
                                                  SSDEEP:3072:tzGRFYaqVUrSsqmfYTmCF5XTs7k1wdcFtMvrm5+XPxgi:poFfqVi7YaCF5XTsI0gMvrmmPmi
                                                  MD5:1283645BD04DD46DA2AFBE5D771ED446
                                                  SHA1:F8A84852859E2F239D072DE5DD5F131390253491
                                                  SHA-256:A63FF37F27724EF31A04BC3E2692E255FE6233E406EDA955BD644D9A9D7FB2ED
                                                  SHA-512:9687A385362111E69F6EF5566EED0B098A82845519D52DCF626548A3F4FCEC423CF1099CEB2239F9037A9E96E31F9094D2DCE757C262E9D0544DEE0C44AC1FA1
                                                  Malicious:false
                                                  Preview:........;........9.......s.......s.......s.......s..S....s......@t..A...\t.......t..0....t..B....t......#u......8u......Bu......bu......wu.......u.......u.......u.......u.......u.."....u.......u.......v.......v..+....v......*w......8w......Lw..5..._w.......w.......w.......w.......w.......w.......w.......w.......w.......x.......x......$x..K...Dx..0....x..2....x..2....x......'y..0...By......sy..6....y.......y.......y.......y.......y..;....y......+z......6z......>z......Iz......[z......rz.......z.......z.......z.......z.......z.......z..+....z.......{......({......:{......J{.."...Q{......t{.......{..%....{.......{.......{.......{.. ....{.......|..H...$|..I...m|..4....|.......|..:....|......3}......J}......S}..4...r}..$....}.......}.......}.......}.......~.......~.......~......'~......-~......C~......K~......_~......t~.......~.......~.......~.......~.......~.......~.......~.......~......................&.......:.......H.......Q.......[...%...k...O.......R.......1...4...0...f...............

                                                  C:\Program Files\FileZilla FTP Client\locales\id_ID\libfilezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 77 messages, Project-Id-Version: id_ID 'Sebuah sertifikat dalam rangkaian ditandatangani menggunakan algoritma yang tidak aman'
                                                  Category:dropped
                                                  Size (bytes):7526
                                                  Entropy (8bit):4.9619687757729745
                                                  Encrypted:false
                                                  SSDEEP:192:dclXcpF0ZpJqe790vMm3dkGl+LoDlT2N1:EsMvB9Ek2HlS1
                                                  MD5:52D40E3C52EFC12CE4FBF75D061477AC
                                                  SHA1:BBDB7B182D54B6C93E258394287B8C0508834D6D
                                                  SHA-256:B01DE1679EF41B55E5014AB71E2771252BA87AF820ADEC288BF3F0417F88975D
                                                  SHA-512:9D9158CAB88E7CB30FB2B86CFB91DDAF06ECD298B7511B979F8D948CE6C6FFD14E1E512B6A7E5F4F8412B097524E0C4605A0FC1ABDAE55833A77FB21227F22E4
                                                  Malicious:false
                                                  Preview:........M...........................A.......A.../.......q...........$...............>.......)...".......L......._.......|...................1...............X.......R...t... .......!...................'.......7.......M.......g.......{...............................................................<.......V...4...h...P...............#...........&...)...7...(...a...............................................................%...+...<...+...h...L.......-.................../... ...L...0...m...M.......$...................*.......D...,...Y...#.......%.......$.......%.......'.......n...C...?.......7.......-...*...1...X...........5.......................V...w...A...................)...&...A...)...h...B.......'...........................!.......=.......[...I...u...........Z.......S...:...'.......#.......%...........................0.......P.......h...........#.......#....... ...........................+.......K.......d...:...x...N...............2...........R...8...a...0...........................

                                                  C:\Program Files\FileZilla FTP Client\locales\is\filezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 678 messages, Project-Id-Version: is '%H:%M:%S li\303\260nar'
                                                  Category:dropped
                                                  Size (bytes):38942
                                                  Entropy (8bit):5.314830106377919
                                                  Encrypted:false
                                                  SSDEEP:768:Qly33kbSNs25iufkEcJ77U/3fu4FZbX9o0qYVPvzam6o:Ay33Xs2MufG97Y3LZRoiVPT6o
                                                  MD5:38C648C0BEF0B49830B7AEF80BA7C7E6
                                                  SHA1:75D4AC51E02936EB059F5E64C2EA8DC3949F607A
                                                  SHA-256:0B7F0CD4903979E21B4A29BB06A221D96343B393E19814DCF0EEAEDB704C7B7C
                                                  SHA-512:3FE30219FADB4D367713C238779F9CABEDACA64D9C401508DCACA2FB3BA31F2FB95E33E1DD527C37AFEE4690EBA95348CE5A4E514853185ED01F13793B1B0722
                                                  Malicious:false
                                                  Preview:................L.......|*......|*......}*.......*.......*..A....*.......*..0....+..B...<+.......+.......+.......+.......+.......+.......+.."....+.......,.......,......%,......3,......G,......Q,......[,......c,......t,.......,.......,.......,.......,..;....,.......,.......,.......-.......-......*-......E-......S-..+...\-.......-.......-.......-.......-.......-.......-..%....-..............".......2.......H...:...T......................................................../......./......./......1/......9/......N/......Y/......f/......./......./......./......./......./......./......./......./.......0.......0......"0..%...,0......R0......c0......t0.......0.......0.......0.......0.......0.......0.......1......'1..)...21......\1......r1.......1.......1.......1.......1.......1.......1.......1.. ....1.......2.......2......72......?2......C2......I2......Q2......a2......e2......k2......q2......|2.......2.......2.......2..)....2.......2.......2.......2.......2.......2.......3.......3......!3......

                                                  C:\Program Files\FileZilla FTP Client\locales\is\libfilezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 4 messages, Project-Id-Version: is 'Ekki n\303\246st samband vi\303\260 neti\303\260'
                                                  Category:dropped
                                                  Size (bytes):712
                                                  Entropy (8bit):5.32647311364711
                                                  Encrypted:false
                                                  SSDEEP:12:ixdt9ZXZLL9aF5x1t02vtRQC/2/lJjusXmBQWiOWVYi4TJNiKNWksL1mUhvRl:8hL05Dt0qtyV7RXmGyi4TJdNWPRVD
                                                  MD5:8CA844D6DF53D01EEF26691C1CC4DD59
                                                  SHA1:A85E9990C2B7FA5AF1AFAF1FB85229F4484C9055
                                                  SHA-256:DD26168A6FB66F52FB6BB3CDA1708A4AD76D9843FE107363C3DA2BB028D3446F
                                                  SHA-512:0636EA648DAE0003017273A23570A0169C687F25AB21B00EB7F7462C7F62F72C8C04E483D1A00906CB97A1AF356A9410CBA760801F941F52117383956FB8861B
                                                  Malicious:false
                                                  Preview:................<.......\.......\.......]...5...q.......................n...1................Network unreachable.gnutls_certificate_get_peers returned no certificates.unknown.Project-Id-Version: is.Report-Msgid-Bugs-To: https://trac.filezilla-project.org/.PO-Revision-Date: 2011-01-20 13:20+0000.Last-Translator: Sveinn . Felli <sveinki@nett.is>.Language-Team: icelandic <openoffice@openoffice.is>.Language: is.MIME-Version: 1.0.Content-Type: text/plain; charset=UTF-8.Content-Transfer-Encoding: 8bit.Plural-Forms: nplurals=2; plural=(n != 1);.X-Generator: KBabel 1.11.4.X-Poedit-Basepath: C:\dev\FileZilla\Translations..Ekki n.st samband vi. neti..gnutls_certificate_get_peers fann engin skilr.ki...ekkt.

                                                  C:\Program Files\FileZilla FTP Client\locales\it\filezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 1846 messages, Project-Id-Version: FileZilla italian translation v. 30.06.2023 'Trascorsi %H:%M:%S'
                                                  Category:dropped
                                                  Size (bytes):177761
                                                  Entropy (8bit):5.087223259494641
                                                  Encrypted:false
                                                  SSDEEP:3072:B5Wm2agqrsJmfmTkCF5XTs7kywoAsGSeakXjqw09fV7w5:BJK0mICF5XTsISAsGSVkXjqw09fV7w5
                                                  MD5:ACA71917E6C8E548A0C0FA5223B30340
                                                  SHA1:A06A495A4774F054E9DDF9418BDDE36269DB3BBA
                                                  SHA-256:EE13F6243B72061B427E5DB9E224AF73CEF3C8E2A2DEDEC08E1E1C1C6B29CB19
                                                  SHA-512:5A27A48691CDC0C015ACD4819B55D7DEF361957E13A66E13161CE4A26BD909FA4764296CF2A81F66CCA7F92BEFDE8F740D43218F7E0EB1491E69E85D7904D7C8
                                                  Malicious:false
                                                  Preview:........6........9......|s......|s......}s.......s..S....s.......s..A....t......Nt..0..._t..B....t.......t.......t.......t.......u......'u......5u......?u......Ju......Xu......hu.."....u.......u.......u.......v..+....v.......v.......v.......v..5....w......Ew......Ow......_w......lw......vw......~w.......w.......w.......w.......w.......w..K....w..0...@x..2...qx..2....x.......x..0....x......#y..6...;y......ry......xy.......y.......y..;....y.......y.......y.......y.......y.......z......"z......9z......@z......Qz......gz.......z.......z..+....z.......z.......z.......z.......z.."....{......${......5{..%...T{......z{.......{.......{.. ....{.......{..H....{..I....|..4...g|.......|..:....|.......|.......|.......}..4..."}..$...W}......|}.......}.......}.......}.......}.......}.......}.......}.......}.......}.......~......$~....../~......<~......U~......^~......{~.......~.......~.......~.......~.......~.......~.......~.......~..................%.......O...A...R.......1.......0...........G.......

                                                  C:\Program Files\FileZilla FTP Client\locales\it\libfilezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 77 messages, Project-Id-Version: Filezilla italian translation v. 28.04.2019 'Un certificato nella struttura \303\250 stato firmato con un algoritmpo non sicuro'
                                                  Category:dropped
                                                  Size (bytes):7696
                                                  Entropy (8bit):4.952366620150389
                                                  Encrypted:false
                                                  SSDEEP:192:dclJFN0wBL/mtZpJqe790vMm3dQ7Ps1+ePU4n3DyfbmDyuwN:EVJqvB9EQjS+e92l
                                                  MD5:E286C5544F3D9D87AE88ED60C47832D0
                                                  SHA1:7C97098E95F6565F4F8A208AF5EA9141FCA08E7F
                                                  SHA-256:C961206C8E570A356EB08E02F2A9874519E731938D4A2C89528CEB46A8295DA7
                                                  SHA-512:E04372AFC524FA750756B46184A29032E000529DC1B0C90DA401934CCF3EAD0C790FA17ED562714DEDA74454B5E2BA188746BC5849ABDA7B0D813314669F8EF2
                                                  Malicious:false
                                                  Preview:........M...........................A.......A.../.......q...........$...............>.......)...".......L......._.......|...................1...............X.......R...t... .......!...................'.......7.......M.......g.......{...............................................................<.......V...4...h...P...............#...........&...)...7...(...a...............................................................%...+...<...+...h...L.......-.................../... ...L...0...m...M.......$...................*.......D...,...Y...#.......%.......$.......%.......'.......n...C...?.......7.......-...*...1...X...........5.......................L.......F...-.......t...........,.......).......F......."...A.......d.......{... .......#.......!.......D......."...E...Y...h...P.......%.......1...9...$...k..........................................................."...,.......O...$...n...........+.......................1.......P...<...........+.......................2...........L.......e.......

                                                  C:\Program Files\FileZilla FTP Client\locales\ja_JP\filezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 1846 messages, Project-Id-Version: FileZilla Client 3.66.0 '%H:%M:%S \347\265\214\351\201\216'
                                                  Category:dropped
                                                  Size (bytes):200329
                                                  Entropy (8bit):5.962040053828061
                                                  Encrypted:false
                                                  SSDEEP:3072:B5Wm2ayTzFzHvisJmfmTkCF5XTs7kyw2kN6XZ53J/rYnqa26ExIv8:BJgPT0mICF5XTsI1aFr3
                                                  MD5:78D36DABEBC04958AD5B67AB5A050222
                                                  SHA1:DF1D18A3EAC50B8D7BCE20B8787FDDDA084FF3A8
                                                  SHA-256:74559A50CA495A9BCB5F4839383E469D65E6289D7658CA85109E31EC56EAFF75
                                                  SHA-512:8D3B77F9448699F525DFC5D8CDA489BC669AB6C9CB116FA624A1CB0ADF52922C9FA817053044FC98A0F43C643540C4C92FEB5C49F68693C5CBC3D8A7420CBBAB
                                                  Malicious:false
                                                  Preview:........6........9......|s......|s......}s.......s..S....s.......s..A....t......Nt..0..._t..B....t.......t.......t.......t.......u......'u......5u......?u......Ju......Xu......hu.."....u.......u.......u.......v..+....v.......v.......v.......v..5....w......Ew......Ow......_w......lw......vw......~w.......w.......w.......w.......w.......w..K....w..0...@x..2...qx..2....x.......x..0....x......#y..6...;y......ry......xy.......y.......y..;....y.......y.......y.......y.......y.......z......"z......9z......@z......Qz......gz.......z.......z..+....z.......z.......z.......z.......z.."....{......${......5{..%...T{......z{.......{.......{.. ....{.......{..H....{..I....|..4...g|.......|..:....|.......|.......|.......}..4..."}..$...W}......|}.......}.......}.......}.......}.......}.......}.......}.......}.......}.......~......$~....../~......<~......U~......^~......{~.......~.......~.......~.......~.......~.......~.......~.......~..................%.......O...A...R.......1.......0...........G.......

                                                  C:\Program Files\FileZilla FTP Client\locales\ja_JP\libfilezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 130 messages, Project-Id-Version: libfilezilla 0.45.0 '\343\203\201\343\202\247\343\203\274\343\203\263\343\201\256\350\250\274\346\230\216\346\233\270\343\201\214\345\256\211\345\205\250\343\201\247\343\201\252\343\201\204\343\202\242\343\203\253\343\202\264\343\203\252\343\202\272\343\203\240\343\201\247\347\275\262\345\220\215\343\201\225\343\202\214\343\201\246\343\201\204\343\201\276\343\201\231'
                                                  Category:dropped
                                                  Size (bytes):14346
                                                  Entropy (8bit):5.852934501935568
                                                  Encrypted:false
                                                  SSDEEP:192:uVZ9GJ7AUiXllHcvrMFqeY9FOMmnDe+Cs4z/O/1h6P7layY4F7fxY:yZ9G/65AIC9iCov6P7QyY4FDxY
                                                  MD5:5541DB371C08D850F0FB634168D97679
                                                  SHA1:FD5E559F2DFE2760BB24597DCE86DE2B1579B37D
                                                  SHA-256:E3A33A10597B2498C5A71676F003902E574A8178E81A7FA51594906F89E1C458
                                                  SHA-512:C38639058815EA36B26EB95A93FC9DD9C1EE644AB76F5F31334A9BB335438CF42AA6D97040120A281ACDB6D6E12F12FD200E89B47146B504778C45D2CA506068
                                                  Malicious:false
                                                  Preview:................,.......<.......<...A...=...A.......................$.......L...........`...&...............>.......)....... ...*...0...K.......|...................................1...........0...I...J...I.......7.......T.......^...k...........0.......X.......R...o... ............... ...............(...<... ...e...........%...............................(.......!...D.......f..................................."...................................7.......M.......d.......z...............................................................,.......A.......V.......u...........7.......................4.......P...E...........#...............).......(...........2.......I.......g.......}...................................................+.......+...9...+...e...1.......L.......-.......-...>.......l................... ...............0.......G..."...&...j...@.......6.......M.......$...W.......|...........................,.......#.......%...&...$...L...%...q...'.......n.......?.......7...n...-.......1...

                                                  C:\Program Files\FileZilla FTP Client\locales\ka\filezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 346 messages, Project-Id-Version: FileZilla3 '\341\203\222\341\203\220\341\203\225\341\203\230\341\203\223\341\203\220: %H:%M:%S'
                                                  Category:dropped
                                                  Size (bytes):31273
                                                  Entropy (8bit):4.834963965479984
                                                  Encrypted:false
                                                  SSDEEP:384:Wu1xrYbNs1LW6fnX5mLk7Qm4+AD7YsNLBLy7cUHdTUEmPrSA/ghwBFfH8UI0ma6I:T17VIg7QII
                                                  MD5:28A4D8D37C74052065C1B2DA31258323
                                                  SHA1:AF94C6A4FBB319ADCFADB314844506ACEC2915FF
                                                  SHA-256:FC53721F201C99711F0CBEDDFF0651E53036B904FA11C38AAA0583F74E151325
                                                  SHA-512:04A7A895AE6BE26CCCA3F288FF24FC5FF160548EB4EFE311653EF9D4ABC692FE656530D083756E43B7B96347ECF1AE8A36FF823169C17EB6FDFAAD66E5F10BF8
                                                  Malicious:false
                                                  Preview:........Z...................................................................................2...........O.......g.......m.......y..........................................."................................................... .......).......C.......I.......W.......a.......g.......p...........$.......)...........................................!.......).......9.......=.......H.......Q.......\.......c.......q.......w................................... ...........................................................+.......1.......7.......?.......I.......Y...-...a...................................*...........................................................%.......1.......:.......F.......P.......U.......n...#.......................................4...............?...........Z.......d........................................... ..............."...................(.......:.......E.......L.......e...................................................%.......(...'..."...P.......s...................+...

                                                  C:\Program Files\FileZilla FTP Client\locales\kab\filezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 1692 messages, Project-Id-Version: kab '%H:%M:%S i yezrin'
                                                  Category:dropped
                                                  Size (bytes):156066
                                                  Entropy (8bit):5.264107025266423
                                                  Encrypted:false
                                                  SSDEEP:3072:VGo2FbnGpn4mO7396F2YTEW7Hw8sK+7+7fsuFEsdDBc1JDMj4y4aBOH+pf8XUajd:so+Gt07t6F2YTEMvsKuWsuFEsdDBc1Ok
                                                  MD5:B2FA0C24741C141308B1C1756E5D9943
                                                  SHA1:D24033414D9241F64A7D0F181E123096AFD82B9F
                                                  SHA-256:F0A317EC6250187F7FD087EB8E6EBA0A8899255D3C7F940D3260E049A820EDAB
                                                  SHA-512:1745DA0C6C61D4815D5DA480BA68913B3091D2919481BC9CE620A7856234F9C7BE30490DC239EE6249195D918953145FE772DE03B730942C74EC04D35485832D
                                                  Malicious:false
                                                  Preview:.................4.......i.......i.......i.......i..S....i......Pj..A...lj.......j..0....j..B....j......3k......Hk......Rk......rk.......k.......k.......k.......k.......k.."....k.......k.......l.......l..+....m......,m......:m......Nm..5...am.......m.......m.......m.......m.......m.......m.......m.......m.......n.......n......&n..0...Fn..2...wn.......n..0....n.......n..6....o......Eo......Ko......Wo......jo..;...ro.......o.......o.......o.......o.......o.......o.......p.......p......6p......Dp..+...Mp......yp.......p.......p.......p.."....p.......p.......p..%....q.......q......6q......Fq.. ...Qq......rq..H....q..I....q..4....r......Pr..:...\r.......r.......r..4....r.......s......!s......+s......9s......Fs......Rs......]s......cs......ys.......s.......s.......s.......s.......s.......s.......s.......t.......t......&t......,t......@t......Ut......\t......pt......~t.......t..%....t..O....t..R....u..1...Zu..0....u.......u.......u.......u.......u.......v.......v......#v......<v......Cv......

                                                  C:\Program Files\FileZilla FTP Client\locales\kab\libfilezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 75 messages, Project-Id-Version: kab 'Aselkin deg uzrar yettwazemmel s walguritm war ta\311\243list'
                                                  Category:dropped
                                                  Size (bytes):7330
                                                  Entropy (8bit):5.142135212910864
                                                  Encrypted:false
                                                  SSDEEP:192:nKloZGJqe790vMm3dqMWDoAnJMB2cUkNtYoHVfAo:KlokB9EqMlvpek5T
                                                  MD5:CC37AE27FDDCC590DEBEA38233E1BF58
                                                  SHA1:1E3858148937873E86C0CE416E1DCA560F45CA10
                                                  SHA-256:BA05EE9428FF6F5FD1BB4186C6E8A9F83D2207D7C19E036D9BC84A6314080DB6
                                                  SHA-512:60C277FD36069BD58AB6E06A211F0735CC3A305F3ECA026A0A406AAF6B327CD930AB24BE30A82FFE91DF2A43F16D06AAFAA9791DC4EEF509F101A6D2BD5400E3
                                                  Malicious:false
                                                  Preview:........K.......t...................A.......A...........Q.......j...$...~...........)...................................:.......V...1...o...........X.......R....... ...h...!...........................................................).......?.......W.......r...................................4.......P...........p...#...............).......(...................*.......@.......X.......k.......y...................+.......+.......L.......-...c................... .......0.......M... ...$...n...........................,.......#.......%...,...$...R...%...w...'.......n.......?...4...7...t...-.......1...............5...)......._.......g...7.......0...A.......r...........+.......+.......$...........&.......6.......Q.......h...%.......<...............G.......H...O...*.......%.......!...........................3.......N.......c.......s...................................,...........!.......>...I...R...R...............,...........<...#...W...0...{...............................................#..."...

                                                  C:\Program Files\FileZilla FTP Client\locales\km_KH\filezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 41 messages, Project-Id-Version: 1.0 '&\341\236\242\341\237\206\341\236\226\341\236\270...'
                                                  Category:dropped
                                                  Size (bytes):2729
                                                  Entropy (8bit):5.309723021212998
                                                  Encrypted:false
                                                  SSDEEP:48:62f9Hs2dNtxG9XYUxG9f1nG8gXXOIKp2whe09qctuO95cDoRS/3BmAk8AG7oePVs:62f9M2dNtxGyUxHUp9z97V95cDoRS/RS
                                                  MD5:2B5110DB4CF29BB59491E54230ADB438
                                                  SHA1:9E9FC9A7425E3D1E12E0A8F86CB3FC3BCA6097F0
                                                  SHA-256:C8FBC56C527F5114E587436FF359BF5FE5688794D4586810D27BDF52A26AF397
                                                  SHA-512:6DB5A64B9171F98A1D3518FAE07EC0DB9941CC9E01169A786F2201FC5C7BEA30F98BA363993EECCF174E3AB1FFC0907D7F879095EB09414785A5365E0DD3D97D
                                                  Malicious:false
                                                  Preview:........).......d...................................................2...........................,.......2.......8.......>.......E.......J.......U.......\.......j.......p.......x.......................................................................................................................$.......,.......:.......G.......Q.......W.......`.......e.......o......................."...4...3.......h...........#...).......M.......g.......x...................#..............."...............%...........3.......M.......[.......r...........................................$.......-...!.......O...9...n...B...................................3.......R.......b.......|....................&About....&Account:.&Active.&Add files to queue.&Always trust this host, add this key to the cache.&Connect.&Copy to clipboard.&Edit.&File.&Help.&Host:.&Low.&Password:.&Port:.&Quickconnect.&Read.&Server.&Settings.&Skip.&Test.&Theme:.&Transfer mode:.&Upload.About FileZilla.Account.Active mode.Connecting.Connecting

                                                  C:\Program Files\FileZilla FTP Client\locales\ko_KR\filezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 1759 messages, Project-Id-Version: FileZilla3 '%H:%M:%S \352\262\275\352\263\274'
                                                  Category:dropped
                                                  Size (bytes):168929
                                                  Entropy (8bit):6.04507685389886
                                                  Encrypted:false
                                                  SSDEEP:3072:oZfrqQ8FusJm8fo9CFfZT2tpvOYmNYqb2BVcW:oZfrc3/fyCFfZT2v4bIl
                                                  MD5:1E3AE78A4E0CE7DF989F77F24F8500F3
                                                  SHA1:E0ED01042CA5C679C5CACBEC5DFECFEE37964FE0
                                                  SHA-256:1B5A7103532B339BAC45345FB757ADE6EBBC21E2C5B258EB2FAA3D0B8D1FE0C4
                                                  SHA-512:3011F13E26EB55FFBF0FE762FCF9FA21E505442D742DC2F9B9F3C575AA58E5B31DB896B508C7CFA115FAB8520437FEEFDF34D3296D594FAD5FDFDC2CE0B22589
                                                  Malicious:false
                                                  Preview:.................7.......n.......n.......n.......n..S...,n.......n..A....n.......n..0....n..B... o......co......xo.......o.......o.......o.......o.......o.......o.......o.......o.."....p......5p......Fp.......q..+...>q......jq......xq.......q..5....q.......q.......q.......q.......q.......r.......r.......r......1r......Er......Vr......dr..K....r..0....r..2....s..2...4s......gs..0....s.......s..6....s.......t.......t.......t......'t..;.../t......kt......vt......~t.......t.......t.......t.......t.......t.......t.......t.......u...... u..+...)u......Uu......hu......zu.......u.."....u.......u.......u..%....u.......v.......v......"v.. ...-v......Nv..H...dv..I....v..4....v......,w..:...8w......sw.......w.......w..4....w..$....w.......x......+x......5x......Cx......Px......\x......gx......mx.......x.......x.......x.......x.......x.......x.......x.......x.......y.......y......0y......6y......Jy......_y......fy......zy.......y.......y.......y..%....y..O....y..R...!z..1...tz..0....z.......z......

                                                  C:\Program Files\FileZilla FTP Client\locales\ko_KR\libfilezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 65 messages, Project-Id-Version: FileZilla3 '\354\235\270\354\246\235\354\204\234 \354\262\264\354\235\270\354\235\230 \353\260\234\355\226\211\354\236\220\352\260\200 \354\235\270\354\246\235\354\204\234 \352\263\265\354\235\270 \352\270\260\352\264\200\354\235\264 \354\225\204\353\213\230'
                                                  Category:dropped
                                                  Size (bytes):6027
                                                  Entropy (8bit):5.844477730380801
                                                  Encrypted:false
                                                  SSDEEP:96:HxAy/4Gt4CiqVHqk9RaOJt9gvMmO87kqGu5hPkcHPmmV/+6T1gVmqL/ALuxT5dpK:HaA1riqdLJt9gvMmdFDs6ZZi/xK
                                                  MD5:596E122032E2469496A04B9641D8F9F3
                                                  SHA1:CB0F08E79DBB7FAFECF4D760225C4AA0A1C9ADBB
                                                  SHA-256:9AC48D986DE1ED4D04969A7540B6339AADB11782F3685426492395FB0DC6D8DC
                                                  SHA-512:BA4212E2434D710586DA1FFFF722DE94A6B1DAF5327EC0BE46A582E0492C905A4CE8A5DE62544930A2F80ACAF99CCD2FA5ED97908A63D208FFA033D722AB010F
                                                  Malicious:false
                                                  Preview:........A.......$.......,.......,...A...-.......o...........$...............)...........................;.......X.......t...........X.......R....... ...T...!...u...............................................................+.......C.......[.......p...........4.......P..........."...#...6.......Z...)...k...............................................................0...+...G...+...s...-....................... .......0...+...$...\...........................,.......#.......%.......$...@...%...e...'.......-.......1...............5...0.......f.......n...B...........Y.......t...........%....................................... ...1.......R... ...p...`.......V.......'...I.......q...$...........................................................<.......W.......i...................E.......K.......!...G...$...i.......................................................(.......9...*...G...#...r...;.......-.......=......."...>...(...a...+.......;.......+...................9... ...S...;...t...2.......7...

                                                  C:\Program Files\FileZilla FTP Client\locales\ku\filezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 228 messages, Project-Id-Version: FileZilla '%H:%M:%S derbas b\303\273'
                                                  Category:dropped
                                                  Size (bytes):14829
                                                  Entropy (8bit):5.27645645740533
                                                  Encrypted:false
                                                  SSDEEP:384:xrnwiJv5GoCnEbBjZtN1DstWtEx6glX/LjPAy:x7w3oHBNX1DI6KX/nPAy
                                                  MD5:1F1345D3CD16B336A96E9E4267A1749E
                                                  SHA1:6EAE212A4FC8C1E7BBB79ECF7C8889CE470E04D7
                                                  SHA-256:4A15156AF1FBFB7ABABC0AA3BE985C7C335AEA6C819D3C2678D382C4A64E5FFF
                                                  SHA-512:BF29492F5AEE8BB2B1708B7CA7616AD3863EF6DE0AA49FE5BFE7EBC9FE31DB262B75AC78086CB44CA3F6A7D46B60D616F313F64F5C2DA4C44A93A1B795689AFE
                                                  Malicious:false
                                                  Preview:................<.......\.......\.......].......n.......|...............................................................................................................2.......;.......A.......G.......P.......i...$...p...)...................................................................................&.......4.......:.......B.......J.......R.......d.......l.......v.......|...........................................................................................4...........L.......U......._.......|..........."...................................................................2.......=.......T..."...q...................................................................6...........>...(...Z...................2...(.......[.......l.......................................................................................4.......K..."...d...-...........................................................................4.......K.......R.......[......._...$...y...;...................................

                                                  C:\Program Files\FileZilla FTP Client\locales\ky\filezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 557 messages, Project-Id-Version: Filezilla pot '%H:%M:%S \323\251\321\202\321\202\322\257'
                                                  Category:dropped
                                                  Size (bytes):36312
                                                  Entropy (8bit):5.529332216261294
                                                  Encrypted:false
                                                  SSDEEP:768:wW2kCQrcHpazaOoId0xjSnjBwiwvDEoWX3Af+3Bk2YAUwGQ:wWKQ4JazvdCOn9BAf0k27D
                                                  MD5:A4D75DE691580F848F3AF93A14B846CD
                                                  SHA1:9063813AEF305C932F5DBDD5DD65C0C4AD24318A
                                                  SHA-256:7C3C4185F3FF24CE9C548BD690D8A9F79C630B7733B7EB8F3B9D6AEEC551DF4A
                                                  SHA-512:8426B23EFB7D9663E9CE7E3F480D09DBC14D2754CB5B820FA0EB08D88815920860BAA78481984410C13AE30CCED0F108FADB2C8F0729338C191DC43C974A1625
                                                  Malicious:false
                                                  Preview:........-................".......".......".......".......#..A...(#......j#..0...{#..B....#.......#.......$.......$.......$......'$......7$.."...Q$......t$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......%......)%....../%......;%......C%......N%......Y%......p%.......%.......%.......%..+....%.......%.......%.......&.......&.......&......,&......4&......D&......Z&......f&......}&.......&.......&.......&.......&.......&.......&.......&.......&.......'.......'......)'......2'......O'......Z'......`'......t'.......'.......'.......'.......'.......'.......'.......'.......'.......(.......(...... (......O(......o(..$...z(.......(.......(.......(.......(.......(.......(.......(.......)....../)......K)......X).. ...j).......).......).......).......).......).......).......).......).......).......).......).......).......).......*.......*..)....*......>*......E*......S*......e*......k*......v*.......*.......*.......*.......*.......*.......*.......*.......*.......*......

                                                  C:\Program Files\FileZilla FTP Client\locales\ky\libfilezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 3 messages, Project-Id-Version: Filezilla pot '\320\220\320\273\321\213\321\201\320\272\321\213 \321\201\320\265\321\200\320\262\320\265\321\200\320\264\320\270\320\275 \321\201\320\265\321\200\321\202\320\270\321\204\320\270\320\272\320\260\321\202\321\213 \320\270\321\210\320\265\320\275\320\270\321\207\321\202\322\257\322\257 \321\215\320\274\320\265\321\201.'
                                                  Category:dropped
                                                  Size (bytes):619
                                                  Entropy (8bit):5.664389560285669
                                                  Encrypted:false
                                                  SSDEEP:12:iCafiag5TIt02vtRQMF//y4/MqJvXmBQWiOWzBek10rZxBlt6FE:/af85TIt0qtyMty4/zXmGz8ZxBlt62
                                                  MD5:60288B4A6419B532452524A6C23ECEF8
                                                  SHA1:026E060D479EC5C43B16144CEB3EB8FF16167623
                                                  SHA-256:F15E750C07EF781BEB22368CD97810AB1FB3B514901495E4F737E04F563B5ECF
                                                  SHA-512:8FC1B2EF4A616289F6373AB389B57474FF6E92DA58DC798782F62A0BBFC0EC0AF80051B8DC04E3370B95E004C092B4D5ACC5BDB8AC6657436E872BB8186FD533
                                                  Malicious:false
                                                  Preview:................4.......L.......L.......M.......m.......u...S...........Z....Remote certificate not trusted..unknown.Project-Id-Version: Filezilla pot.Report-Msgid-Bugs-To: https://trac.filezilla-project.org/.PO-Revision-Date: 2012-11-14 23:21+0600.Last-Translator: Chynggyz Jumaliev <translatorky@lavabit.com>.Language-Team: Kirghiz <ky@li.org>.Language: ky.MIME-Version: 1.0.Content-Type: text/plain; charset=UTF-8.Content-Transfer-Encoding: 8bit.Plural-Forms: nplurals=1; plural=0;.X-Generator: Gtranslator 2.91.5........ ......... ........... ......... ...............

                                                  C:\Program Files\FileZilla FTP Client\locales\lo_LA\filezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 1255 messages, Project-Id-Version: FileZilla Lao '\340\273\203\340\272\212\340\273\211\340\273\200\340\272\247\340\272\245\340\272\262\340\273\204\340\272\233\340\273\201\340\272\245\340\273\211\340\272\247 %H:%M:%S'
                                                  Category:dropped
                                                  Size (bytes):174021
                                                  Entropy (8bit):5.090992088442991
                                                  Encrypted:false
                                                  SSDEEP:1536:eJSmUKzrAo6u6/UtWVRUZmLbM75mUqDgCYSoZXD5SH8vjyGQaT:eJSmtsT/z0mLoq/YSoZXDEijy7aT
                                                  MD5:61B83DE54A9C9F3540FC495BC17FD645
                                                  SHA1:067BD9A8A7123D2348401DB66AF9DD6C1763CBC0
                                                  SHA-256:E104A8DEF226B36162FAE7EC3CC2721D2B51622B799D1845859FB2C33BDEA5AA
                                                  SHA-512:D28E5A58CD49F9CE272F6E29C02F7A34E037D2A65B94A87AB7C50E5EB994EDD2435C99B53E3ED7280048F87874B488D1EEFF50D860C7B3D810FD9B0AD5D80769
                                                  Malicious:false
                                                  Preview:................T'.......N.......N.......N.......N..S....N.......O..A....O......^O..0...oO..B....O.......O.......O.......P.......P.......P......+P.."...EP......hP......yP.......P.......P.......P.......P.......P.......P.......P.......P..2....P......-Q......HQ..6...`Q.......Q.......Q.......Q..;....Q.......Q.......Q.......R.......R......!R......2R......MR......[R..+...dR.......R.......R.......R.......R.......R.......R..%....R......"S......*S......:S..4...PS.......S..:....S.......S.......S..4....T......7T......VT......`T......nT......{T.......T.......T.......T.......T.......T.......T.......T.......T.......T.......U......"U......<U......BU......VU......kU......rU.......U.......U..%....U..1....U..0....U......'V......8V......IV......hV......nV.......V.......V.......V.......V.......V.......V.......W..3....W..$...PW..$...uW..)....W.......W.......W.......W.......W.......X.......X...... X......4X......TX......pX......}X.. ....X.......X.......X.......X.......X.......X.......X.......X.......X......

                                                  C:\Program Files\FileZilla FTP Client\locales\lo_LA\libfilezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 25 messages, Project-Id-Version: FileZilla Lao '\340\272\245\340\272\260\340\272\247\340\272\261\340\272\207! \340\273\203\340\272\232\340\272\256\340\272\261\340\272\232\340\272\256\340\272\255\340\272\207\340\272\226\340\272\267\340\272\201\340\272\233\340\272\273\340\272\224\340\272\255\340\272\255\340\272\201'
                                                  Category:dropped
                                                  Size (bytes):4012
                                                  Entropy (8bit):5.239054463360799
                                                  Encrypted:false
                                                  SSDEEP:96:od5K0lk0eidtu5m2KS8anuV8pXOn5QSdwiXgHS:eXkAtEXnuOnSmyN
                                                  MD5:52288DBEE33EA1486C884ABC9032CB87
                                                  SHA1:2EFEBE51FAFF02249F104356771E41500CC919B0
                                                  SHA-256:D01791A6FAB4A63E15769383D1C039E9DA4D865F31CC3A89017F5303595004FF
                                                  SHA-512:40E3BF3FEADCDB36508B6F0A2912C9EDF7AC48C223AC378534111F65845DADE7F36A3EAA147F758575347E0905CAADCC30BF1361CDEE8A071B410A3442206EF8
                                                  Malicious:false
                                                  Preview:....................................$.......X.......R...+...!...~...........................................+...........;... ...[...0...|...$...............,.......#.......%...=...$...c...%.......1...............5...........3.......;...D...........$...........`...}...N.......E...-...9...s...0.......W...........6...Q.......Z...".......}...H.......*...J.......u...H.......f...a...`.......b...)...Q.......W.......Y...6............Beware! Certificate has been revoked.Could not get distinguished name of certificate issuer, gnutls_x509_get_issuer_dn failed.Could not get distinguished name of certificate subject, gnutls_x509_get_dn failed.Failed to verify peer certificate.Network unreachable.Operation already in progress.Other system error.Out of memory.Process file table overflow.Protocol not supported on given socket type.Remote certificate not trusted..Resource temporarily unavailable.Server did not properly shut down TLS connection.Socket address outside address space.Socket has been shut d

                                                  C:\Program Files\FileZilla FTP Client\locales\lt_LT\filezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 1395 messages, Project-Id-Version: lt_LT_updated '%H:%M:%S pra\304\227jo'
                                                  Category:dropped
                                                  Size (bytes):133662
                                                  Entropy (8bit):5.2741865088245525
                                                  Encrypted:false
                                                  SSDEEP:3072:VZkwej+VRmLzGdL4R0TCRQTE6ZBODw2zni6iL:V/ej+VGzYL4R0TCRN6GDwSc
                                                  MD5:840B91093D860351B79F3CEEFCD6743E
                                                  SHA1:165CA0EBAAC661DAD88AE71AECA9B7618FCF9E25
                                                  SHA-256:E53F04338629B60F5490C5F740FDCB4A66835AABB7B980221A87FF606F3DF49B
                                                  SHA-512:6D58E5695131D5B44692699100ED2AA25DEA8EF126D5D7380CCCDF78C785D83B9AB80CE9D381791F91ECF22D529D9D0303634F140E404596BA4C8F60051427A6
                                                  Malicious:false
                                                  Preview:........s........+......LW......LW......MW......^W..S...lW.......W..A....W.......X..0.../X..B...`X.......X.......X.......X.......X.......X.......X.......X.."....Y......2Y......CY......SY......aY......uY.......Y.......Y.......Y.......Y.......Y..2....Y.......Y.......Z..6...*Z......aZ......gZ......sZ.......Z..;....Z.......Z.......Z.......Z.......Z.......[.......[......5[......C[..+...L[......x[.......[.......[.......[.."....[.......[.......[..%....\......-\......5\......E\..4...[\.......\..:....\.......\.......\..4....]......B]......a]......k]......y].......].......].......].......].......].......].......].......].......].......^......"^......-^......G^......M^......a^......v^......}^.......^.......^..%....^..R....^..1..."_..0...T_......._......._......._......._......._......._......._.......`.......`......:`......Z`..3...e`..$....`..$....`..)....`.......a......#a......5a......Ba......Oa......Ta......ia......}a.......a.......a.......a.. ....a.......a.......a.......b.......b......"b......

                                                  C:\Program Files\FileZilla FTP Client\locales\lt_LT\libfilezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 30 messages, Project-Id-Version: lt_LT_updated 'Sertifikatas gijoje buvo pasira\305\241ytas nesaugiu algoritmu'
                                                  Category:dropped
                                                  Size (bytes):2998
                                                  Entropy (8bit):5.2693891328219635
                                                  Encrypted:false
                                                  SSDEEP:48:1jBmrOg6/Thq/TALeB4Z0UW1450oqcWm5/8XFDDKXonJGy+rcoz5McBA:FAKgSk0LeGuu50oQm5/4DJGy2o
                                                  MD5:51EB51DDE2168EFE894984675CABCF72
                                                  SHA1:C371F885F06E32A4B5BCC148EC302D380BF45408
                                                  SHA-256:3BA1382198BA0A0D3AAC6FBAC96F7CEAD6554A0DA948A63698865900CA1FE449
                                                  SHA-512:BE2DA6133C704C350CAAE8DC3DBE7FA919A24CB4DBFF68B434B625083DD83BA7F3BD5B93B8AB69FE0884734B04AAE34BB7DD820B71A2659B42031A9D671ACBD2
                                                  Malicious:false
                                                  Preview:....................................A...........?.......X...$...l...........X.......R.......!...].......................................................................7.......K...)...\...................................0.......#.......$...:......._...5...|...................8.......................(.......$...G...M...l...M.......'....... ...0.......Q.......b.......}...........................)...................$...$...=.......b.......}...........'.......-.......,.......%...)...'...O...3...w............A certificate in the chain was signed using an insecure algorithm.Argument buffer overflow.Bad file descriptor.Beware! Certificate has been revoked.Cannot assign requested address.Could not get distinguished name of certificate issuer, gnutls_x509_get_issuer_dn failed.Could not get distinguished name of certificate subject, gnutls_x509_get_dn failed.Failed to verify peer certificate.File descriptor not a socket.GnuTLS error %d.GnuTLS error %d in %s.GnuTLS error %d in %s: %s.GnuTLS error

                                                  C:\Program Files\FileZilla FTP Client\locales\lv_LV\filezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 1190 messages, Project-Id-Version: lv 'Pag\304\201ju\305\241as %H:%M:%S'
                                                  Category:dropped
                                                  Size (bytes):90734
                                                  Entropy (8bit):5.344731706456686
                                                  Encrypted:false
                                                  SSDEEP:1536:dSPOGwXNAmMeHJeS575CoRM9T7jg8my/uLZFrp+a+A74+wQxhRx:PwmMiMKM9TE9JfxB
                                                  MD5:EBAA9220652273AD45A1989B4326B085
                                                  SHA1:A0B045387C1F23DC58885C89493C1C5D0F04D65B
                                                  SHA-256:1DF2A7CD57D445CC780565C1A42536072F411FB456EA37C4F8F71F09B7093131
                                                  SHA-512:6D11ADB05E5FF01E82A8EBE3DA94977A2215D7F45966F962B2268AB8F2B1BFCE07595BCEA1292E6728CC0DB3177C2C89D5173F70D0B78A6FC8DC85ACC450CF0A
                                                  Malicious:false
                                                  Preview:................L%......|J......|J......}J.......J.......J..A....J.......J..0....K..B...<K.......K.......K.......K.......K.......K.......K.......K.."....K.......L.......L......-L..5...AL......wL.......L.......L.......L.......L.......L.......L.......L..2....L.......M......7M..6...OM.......M.......M.......M.......M.......M.......M.......M.......M.......M.......M.......N......$N..+...-N......YN......lN......~N.......N.."....N.......N.......N..%....N.......O.......O.. ...&O......GO..4...]O.......O..:....O.......O.......O..4....P......DP......cP......mP......{P.......P.......P.......P.......P.......P.......P.......P.......P.......P.......Q.......Q......8Q......CQ......]Q......cQ......wQ.......Q.......Q.......Q.......Q.......Q..%....Q..1....Q..0... R......QR......bR......sR......yR.......R.......R.......R.......R.......R.......R.......R..$....S..$...(S..)...MS......wS.......S.......S.......S.......S.......S.......S.......S.......T......#T......0T......BT.. ...VT......wT......|T.......T......

                                                  C:\Program Files\FileZilla FTP Client\locales\lv_LV\libfilezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 21 messages, Project-Id-Version: lv 'Uzmanieties! Sertifik\304\201ts ir ticis anul\304\223ts'
                                                  Category:dropped
                                                  Size (bytes):1823
                                                  Entropy (8bit):5.269666762687083
                                                  Encrypted:false
                                                  SSDEEP:48:IkIELBXLm2Hf5eCVz+weRekSXI5Uqcve/KznKGEzhE:lIEtbmKfdVzySXI5UVx/
                                                  MD5:180EDB0EFD351573CCCA6281FFF5EF22
                                                  SHA1:9967F5186433ADC7BC47B797F61AA0D6193A5D7D
                                                  SHA-256:B5FC5367B7EB6648F67C1585259EB4AB6EE6488DAFD11E33829D5A55AD40D199
                                                  SHA-512:3529A8A9530221805A724F41BD493B67CA81DA038E77B20E94874544822952C1A639476E8C32BFF0C745B2C47D80BB1CAA963336626D501AEAD4B52B1184D595
                                                  Malicious:false
                                                  Preview:........................l.......l...$...m...........................................!...........6.......L.......^.......r...............................................................(.......E.......M...+...........;...!...O.......q...........$.......-...........................&.......;.......O......._.......x...........................)....... ................Beware! Certificate has been revoked.Connection aborted.Connection attempt timed out.Connection refused by server.Connection reset by network.Connection reset by peer.Failed to verify peer certificate.Interrupted by signal.Message too large.Network unreachable.Operation already in progress.Operation in progress.Operation not supported.Other system error.Out of memory.Permission denied.Protocol not supported.Remote certificate not trusted..Unsupported certificate type.unknown.Project-Id-Version: lv.Report-Msgid-Bugs-To: https://trac.filezilla-project.org/.PO-Revision-Date: 2015-03-23 22:57+0200.Last-Translator: Ivo Simsons <sims

                                                  C:\Program Files\FileZilla FTP Client\locales\mk_MK\filezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 927 messages, Project-Id-Version: filezilla '%H:%M:%S \320\277\320\276\320\274\320\270\320\275\320\260\321\202\320\276'
                                                  Category:dropped
                                                  Size (bytes):90439
                                                  Entropy (8bit):5.270634579670592
                                                  Encrypted:false
                                                  SSDEEP:1536:3oNFI+hnAA+qeVx7xlc7ciL+nPRZH7YNLtTzuoeVSaU4v5XBuyW:3w5JAlqek7cw+nPjGRHuoL4v5g
                                                  MD5:3AA3C845E0D900B2608777C1DCC08E14
                                                  SHA1:EF063F29F0B662918F29B6E6BAA855784FABC6B7
                                                  SHA-256:3B585B68050C762CDD712C5FDF4100D68FDE7EE40847A293489CD64DA97804DC
                                                  SHA-512:4568C1C02161D2825C652C34A4D14920BDC424ED4C8C43E02C90B98972C5813E893E4BDF25DD5B8640A0B8D9D81773935D2C098C91D6A39842B759BC00B90033
                                                  Malicious:false
                                                  Preview:.........................:.......:.......:.......:..S...,:.......:.......:..0....:..B....:......!;......+;......9;......I;.."...c;.......;.......;.......;.......;.......;.......;.......;.......;.......;.......<..2....<......K<......f<..6...~<.......<.......<.......<..;....<.......=.......=......!=......3=......J=......[=..+...d=.......=.......=.......=.."....=.......=.......=..%....>......5>......=>......S>......_>......v>..4....>.......>.......>.......>.......>.......?.......?......"?......;?......D?......a?......l?.......?.......?.......?.......?.......?.......?..%....?..0....?......+@......<@......M@......l@......r@......{@.......@.......@.......@.......@..$....@..$....A..)...?A......iA.......A.......A.......A.......A.......A.......A.......A.......B.. ....B......6B......;B......SB......WB......]B......eB......uB......yB.......B.......B.......B.......B.......B.......B..)....B.......B.......B.......B.......C.......C.......C......"C......5C......CC......KC......WC......hC......pC......

                                                  C:\Program Files\FileZilla FTP Client\locales\mk_MK\libfilezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 5 messages, Project-Id-Version: filezilla '\320\235\320\265 \320\265 \320\264\320\276\321\201\321\202\320\260\320\277\320\275\320\260 \320\274\321\200\320\265\320\266\320\260\321\202\320\260'
                                                  Category:dropped
                                                  Size (bytes):896
                                                  Entropy (8bit):5.626666021115751
                                                  Encrypted:false
                                                  SSDEEP:24:uqch80h45r/t0qtyijbCYbpJXmulpFuj6GGfrm8:unj45r2qciLbpkuOai8
                                                  MD5:7E94E2D8D48B709C247A40473E07C87A
                                                  SHA1:5C2DA1B16DAB5FEF9F89574883004508605A53A4
                                                  SHA-256:8E80536EFC73E3257B817CC6C0DF2EE232F0B73393735CA619E391CF1423CBFE
                                                  SHA-512:F78596C4B8A3F5F65786D774F25CD8F671D3485C8F1A855640CC04CE5ED124D780A4D4425098555727724CF17144701DE81CE95FC4BADA1B8117C52022E9F13D
                                                  Malicious:false
                                                  Preview:................D.......l.......l.......m...........0.......................'.......A.......a...........m....Network unreachable.Remote certificate not trusted..Server did not properly shut down TLS connection.unknown.Project-Id-Version: filezilla.Report-Msgid-Bugs-To: https://trac.filezilla-project.org/.PO-Revision-Date: 2005-11-12 22:18+0100.Last-Translator: Dimce Grozdanoski <dimce.grozdanoski@ridarec.com>.Language-Team: Macedonian.Language: mk_MK.MIME-Version: 1.0.Content-Type: text/plain; charset=UTF-8.Content-Transfer-Encoding: 8bit.X-Generator: KBabel 1.3.1.X-Poedit-Country: MACEDONIA.X-Poedit-Language: Macedonian.Plural-Forms: nplurals=2; plural=(n != 1);.... . ........ ................ .......... .. . .. ................ .. .. ........ .... ... ..... TLS ......................

                                                  C:\Program Files\FileZilla FTP Client\locales\nb_NO\filezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 1630 messages, Project-Id-Version: FileZilla 3 '%H:%M:%S brukt'
                                                  Category:dropped
                                                  Size (bytes):150752
                                                  Entropy (8bit):5.186689308381152
                                                  Encrypted:false
                                                  SSDEEP:3072:QULQR9jNx4omHRTd9FyYTVJNtwpVjp6DL7QCBGNzoXVgzyk5XwzmmkBLHHwUXiC2:Qf7v4lRp9FyYTVrWVjsDXQCBGNGm5XM5
                                                  MD5:AFAE604BF822399D7856F5A9AFAC46A8
                                                  SHA1:669A4FCC5A45A070390ECB178580FD3D1DB0F06F
                                                  SHA-256:31E1EC6ADDE5C6488AA17765C9A75BD7BFC1E9B75C7ACF92CE4ACBE8FB6403E4
                                                  SHA-512:5C284090ABCF6F23A4425BB062847BD1ABD6BA61043F31CC6DE01A44DDF1DC5DA91CB846184570FE05E21CAF311D2F42353E239AA1EB8DC999FA02A2C280DB1B
                                                  Malicious:false
                                                  Preview:........^........3.......e.......e.......e.......f..S....f......pf..A....f.......f..0....f..B....g......Sg......hg......rg.......g.......g.......g.......g.......g.......g.."....g.......h......(h.......i..+... i......Li......Zi..5...ni.......i.......i.......i.......i.......i.......i.......i.......j..2....j......Ij......dj..6...|j.......j.......j.......j.......j..;....j.......k......'k......2k......Dk......[k......bk......sk.......k.......k.......k..+....k.......k.......k.......l.......l.."...#l......Fl......Wl..%...vl.......l.......l.. ....l.......l..H....l..I...4m..4...~m.......m..:....m.......m.......n..4...0n......en.......n.......n.......n.......n.......n.......n.......n.......n.......n.......o.......o.......o......3o......<o......Yo......do......~o.......o.......o.......o.......o.......o.......o.......o..%....o..O....p..R..._p..1....p..0....p.......q......&q......7q......Vq......\q......rq......{q.......q.......q.......q.......q.......q..2....r..3...=r......qr..$...|r..$....r..)...

                                                  C:\Program Files\FileZilla FTP Client\locales\nb_NO\libfilezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 75 messages, Project-Id-Version: FileZilla 3 'Et sertifikat i kjeden ble signert med usiiker algoritme'
                                                  Category:dropped
                                                  Size (bytes):7116
                                                  Entropy (8bit):5.046084087739837
                                                  Encrypted:false
                                                  SSDEEP:96:inIKT56aEsSgPgnVvqk9Ra1Jqe790vMmU87cqO6zu53hABTxg0UJprd/Natq7H5D:nKlS7tZGJqe790vMm3dwsT9UpRNatq7Z
                                                  MD5:C5B2B81905E3D57D226D155C719B6837
                                                  SHA1:EE6DAA1E2A66E850D01551F9634C2B769B12AC33
                                                  SHA-256:B85A7A42B4755E3B22C3BD2ECB36BC80E429EF1CAA355C180A208898A51F14B4
                                                  SHA-512:4B647220F6352D47B0EE8029369724390BF17B3F08160E566014A0AC413EA68FD60BAF9AE96C7C8329292116062072E1D1DD9EB820C9C30E78446B8392DA3F45
                                                  Malicious:false
                                                  Preview:........K.......t...................A.......A...........Q.......j...$...~...........)...................................:.......V...1...o...........X.......R....... ...h...!...........................................................).......?.......W.......r...................................4.......P...........p...#...............).......(...................*.......@.......X.......k.......y...................+.......+.......L.......-...c................... .......0.......M... ...$...n...........................,.......#.......%...,...$...R...%...w...'.......n.......?...4...7...t...-.......1...............5...)......._.......g...8.......9...F................... .......(.......,...........-..."...@.......c.......~...!.......>.......!.......`.......X...}...,.......#...........'.......G.......V.......j.......................................................................7.......K...8...`...=...............#...............$...&...)...K.......u...............................................

                                                  C:\Program Files\FileZilla FTP Client\locales\ne\filezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 490 messages, Project-Id-Version: ne '%H:%M:%S \340\244\265\340\244\277\340\244\244\340\245\207\340\244\225\340\245\213'
                                                  Category:dropped
                                                  Size (bytes):74033
                                                  Entropy (8bit):4.896420974888798
                                                  Encrypted:false
                                                  SSDEEP:768:Ao7lQ8BHzJwP77U0O8/yZSpQIWM7vIvzK:Ag3BHOP77U0O8/y3qvIvzK
                                                  MD5:F45684874AEE25E780FF0EF38608235F
                                                  SHA1:405F81A265D83A759FDDAAFA13890E85D13E84A6
                                                  SHA-256:C5AB599F8F96E3B742BDDEBA2671E94A28F70B7304F92FBFAEE4476DF246D7F4
                                                  SHA-512:A34874175180C86462CFFC9AB42D256FB0E16681740A5C5DBCD402C414A399605753E70B167FFE92AEA3D7C8392E86FC851D661EE0EF88E6468EA081144B37FA
                                                  Malicious:false
                                                  Preview:................l...........................................................................2...........O.......g.......m.......y...........................................".................... ....... ....... ....... ......& ......? ......H ......b ......h ......v ....... ....... ....... ....... ..$.... ..).... ....... .......!......#!......(!......@!......H!......X!......\!......g!......p!......{!.......!.......!.......!.......!.......!.......!.......!.. ....!.......!......."......."......'"....../"......9"......J"......P"......V"......^"......h"......x"..-...."......."......."......."......."..*....".......".......#.......#......&#......4#......=#......I#......R#......^#......h#......#$.......%.......%......6%..#...M%......q%.......%.......%..U....%.......%.......&..4....&.......&..?....&..0....'......?'......I'......d'......j'.......'.......'.......'.. ....'..5....'..+....(......8(.."...@(......c(......o(.......(.......(.......(.......(..9....(.......).......)......")......9)......

                                                  C:\Program Files\FileZilla FTP Client\locales\ne\libfilezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 2 messages, Project-Id-Version: ne '\340\244\237\340\244\276\340\244\242\340\244\276\340\244\225\340\245\213 \340\244\252\340\245\215\340\244\260\340\244\256\340\244\276\340\244\243\340\244\252\340\244\244\340\245\215\340\244\260 \340\244\265\340\244\277\340\244\266\340\245\215\340\244\265\340\244\276\340\244\270 \340\244\227\340\244\260\340\244\277\340\244\217\340\244\250 \340\245\244'
                                                  Category:dropped
                                                  Size (bytes):581
                                                  Entropy (8bit):5.595739426336334
                                                  Encrypted:false
                                                  SSDEEP:12:iu9a4Bwt02vtRQV/iTI1J8jAfY9sXmBQWiOWKbzJaFxAEuB3qBl:tfBwt0qtyliT5Mw9sXmGKBO63B3O
                                                  MD5:7D05EAA4F52F77E0800BE52DACE58C0A
                                                  SHA1:9D3C719C259D42824606B9439CDE6ACBE76B0639
                                                  SHA-256:E574D5D624E78CE026B8C92A603B55677FE25D55D1DBA1A448A250CD7F282F1D
                                                  SHA-512:AC75D69B8F0F9726AABD017FD4101E41B9A45ED3BA13DB7880582C8DA2DA57173D1D60DA271763407249200632D19BF885F8820D6DECD012E70F66AF69D7BA6D
                                                  Malicious:false
                                                  Preview:................,.......<.......<.......=.......]...[........Remote certificate not trusted..Project-Id-Version: ne.Report-Msgid-Bugs-To: https://trac.filezilla-project.org/.PO-Revision-Date: 2006-11-18 04:11+0545.Last-Translator: shyam krishna ball <shyamkrishna_bal@yahoo.com>.Language-Team: Nepali <info@mpp.org.np>.Language: ne.MIME-Version: 1.0.Content-Type: text/plain; charset=UTF-8.Content-Transfer-Encoding: 8bit.Plural-Forms: nplurals=2;plural=(n!=1).X-Generator: KBabel 1.11.4........ .......... ....... ..... ..

                                                  C:\Program Files\FileZilla FTP Client\locales\nl\filezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 1844 messages, Project-Id-Version: filezilla_nl '%H:%M:%S verstreken'
                                                  Category:dropped
                                                  Size (bytes):174977
                                                  Entropy (8bit):5.109928221397619
                                                  Encrypted:false
                                                  SSDEEP:3072:Jp7bWqCzIsJmfmTkCF55Ts7XywHlDKQRD/y69rmMgA4sXAKJ3AFazQd77cTRtU1Z:Jp7bWqCl0mICF55TsTnD17j7gA4aAKJ4
                                                  MD5:A36919794B621E55888C71D177CD4BD9
                                                  SHA1:0C2B83005B20055999480342971E9E2A9C6B71BC
                                                  SHA-256:8E1DAFDECBE0C548DF6C3200EC73B88948E2D17CD37031F403C6C98131BC87DC
                                                  SHA-512:2682B397064F7A800126C8A8DFE2A9BC69C1341DA3FCE67EDB50906366859C906D7FFB7115E1B343325A98336B0500A79374A980211DBA7A4CFF8062DA605E3C
                                                  Malicious:false
                                                  Preview:........4........9......\s......\s......]s......ns..S...|s.......s..A....s.......t..0...?t..B...pt.......t.......t.......t.......t.......u.......u.......u......*u......8u......Hu.."...bu.......u.......u......~v..+....v.......v.......v.......v..5....v......%w....../w......?w......Lw......Vw......^w......ow.......w.......w.......w.......w..K....w..0... x..2...Qx..2....x.......x..0....x.......y..6....y......Ry......Xy......dy......wy..;....y.......y.......y.......y.......y.......y.......z.......z...... z......1z......Gz......bz......pz..+...yz.......z.......z.......z.......z.."....z.......{.......{..%...4{......Z{......b{......r{.. ...}{.......{..H....{..I....{..4...G|......||..:....|.......|.......|.......|..4....}..$...7}......\}......{}.......}.......}.......}.......}.......}.......}.......}.......}.......}.......~.......~.......~......5~......>~......[~......f~.......~.......~.......~.......~.......~.......~.......~.......~.......~..%....~..O...!...R...q...1.......0...........'.......

                                                  C:\Program Files\FileZilla FTP Client\locales\nl\libfilezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 75 messages, Project-Id-Version: filezilla_nl 'Een certificaat in de keten is getekend met een onveilig algoritme'
                                                  Category:dropped
                                                  Size (bytes):7407
                                                  Entropy (8bit):4.9476877772337335
                                                  Encrypted:false
                                                  SSDEEP:192:nKlJU+7MZGJqe790vMm3dcjZnfB5dW9UOvVT15:KlJUPkB9EcjJfB5dWhz
                                                  MD5:3DB90A1D477AB46129C3EBB0F6EE54FB
                                                  SHA1:DDA309BDBBFB729F0F4A7764D6C28944D2B0E6E5
                                                  SHA-256:A8FF4FE34A303CFA00D21E795C722B3F8B50C1B349041620532AEAF8A00DFE09
                                                  SHA-512:4FBFC1ADED9AEA0AE7EEEA77E984E1FE94B82D3A2BCC957768D2AEFD0087703539D0CDA0C2B651734605FED083E21F59DB0F5AE3FBF2DA0EDF09505C832D9051
                                                  Malicious:false
                                                  Preview:........K.......t...................A.......A...........Q.......j...$...~...........)...................................:.......V...1...o...........X.......R....... ...h...!...........................................................).......?.......W.......r...................................4.......P...........p...#...............).......(...................*.......@.......X.......k.......y...................+.......+.......L.......-...c................... .......0.......M... ...$...n...........................,.......#.......%...,...$...R...%...w...'.......n.......?...4...7...t...-.......1...............5...)......._.......g...B.......C...0...#...t...#.......&.......&.......+...........6.......K... ...i...................>...............g...'...^.......!.......*.......#...;......._.......s........................................... ......."...........:.......U.......q...........8.......I..........."...(...7.......`...&...x...9....................... ...........3.......F.......Y...5...

                                                  C:\Program Files\FileZilla FTP Client\locales\nn_NO\filezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 1540 messages, Project-Id-Version: filezilla '%H:%M:%S brukt'
                                                  Category:dropped
                                                  Size (bytes):140470
                                                  Entropy (8bit):5.1794678934518235
                                                  Encrypted:false
                                                  SSDEEP:3072:Xo/aElm9G+d93gMTAaun3qD5tw4iKMSkc+YhMP3BaDELO4AMI8:Xo/jmGg93gMTAZn3qDnQe+YhMP4DELOg
                                                  MD5:FD9142C4972D22B4E1AC9625640D238A
                                                  SHA1:64F8217B5625A4937320D8E4AA0C18785AD989F0
                                                  SHA-256:F5B90F4847B9789A28D9FBBA20E3A43EABB4A915BE35B42C258CBE255B0F52A9
                                                  SHA-512:D81534C20BF05DFEBA472565C810DC27DE664A4410C79480A952A2CB3F6806A4602DE33B5F16CEBF4775AD15CE7FCD690C7889A6B360D1D74F023B5CF1299213
                                                  Malicious:false
                                                  Preview:................<0......\`......\`......]`......n`..S...|`.......`..A....`.......a..0...?a..B...pa.......a.......a.......a.......a.......a.......a.......b.."....b......Bb......Sb......cb......qb..5....b.......b.......b.......b.......b.......b.......b.......c..2....c......Nc......ic..6....c.......c.......c.......c.......c..;....c......!d......,d......7d......Id......`d......gd......xd.......d.......d..+....d.......d.......d.......d.......e.."....e......5e......Fe..%...ee.......e.......e.......e..H....e..I....f..4...Lf.......f..:....f.......f.......f..4....f......3g......Rg......\g......jg......wg.......g.......g.......g.......g.......g.......g.......g.......g.......h.......h......'h......2h......Lh......Rh......fh......{h.......h.......h.......h..%....h..O....h..R...$i..1...wi..0....i.......i.......i.......i.......j......!j......7j......@j......Yj......`j.......j.......j.......j..2....j..3....k......6k..$...Ak..$...fk..)....k.......k.......k.......k.......k.......k.......l.......l......

                                                  C:\Program Files\FileZilla FTP Client\locales\nn_NO\libfilezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 74 messages, Project-Id-Version: filezilla 'Eit sertifikat i kjeda vart signert med ein utrygg algoritme'
                                                  Category:dropped
                                                  Size (bytes):7040
                                                  Entropy (8bit):5.0180120036182005
                                                  Encrypted:false
                                                  SSDEEP:192:AMCiVrZGJqe790vMm3dq2dIlSKfJS+f6mH:AG1kB9Eq2aS+xf6O
                                                  MD5:AB6590A0E85D3FA85665924BB7F26E63
                                                  SHA1:0BD995B73D7F70684C734B7B159BE420B98E11A3
                                                  SHA-256:73C137B8F287A4EF622F85F86E4542456065B350A5EF8E600ABF623D7FF84A03
                                                  SHA-512:6928D802B2240C12BAC2AF7C5F6A1E9ADE022D61BA510742902A96B68BA05735E0E02740A3FECB19ED0D7C45EB70664E79283289245A36DEDD48504DFBA44536
                                                  Malicious:false
                                                  Preview:........J.......l...................A.......A...........A.......Z...$...n...........)...................................*.......F...1..._...........X.......R....... ...X...!...y.............................................................../.......G.......b.......z...........................4.......P...........`...#...t...........).......(...........................0.......H.......[.......i.......{...........+.......+.......L.......-...S................... .......0.......M.......$...^...........................,.......#.......%.......$...B...%...g...'.......?.......7.......-...-...1...[...........5.......................<.......A...................*...0...>.......o...%...............%...........................1...B...Q...$.......b.......a.......(...~...+.......$...................................3.......F.......U.......g.......~...................!.......................C.......O...X...........$...............-.......&.../.......V.......s...............................................

                                                  C:\Program Files\FileZilla FTP Client\locales\oc\filezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 1094 messages, Project-Id-Version: Filezilla en occitan '%H:%M:%S passada(s)'
                                                  Category:dropped
                                                  Size (bytes):87025
                                                  Entropy (8bit):5.165547828090658
                                                  Encrypted:false
                                                  SSDEEP:1536:FXqZ8LQlP6YcngPCxmm7Mr75ZhrxJl3oFIzfZunVCXjIGLI90ckntTHtWFVQR22R:BqdlP6YvPCxmm7C3xoFIzZunVCXMGZnt
                                                  MD5:C03D3C497E35E82DE89B11A17709C8C8
                                                  SHA1:8E000D40E4382E21E32B00E66F64570FFDA08058
                                                  SHA-256:A08A50077330FA0A9C38CDA5E99B0FA67E5132EC59C741AEE4D182AA6857DA7A
                                                  SHA-512:09071044973F63D2179867CA98EB6AFAD89EB33513112FACF25204CB54CA6F3A6C9C841B8C05C38E56E3BFCE84A89F6863FCD3EBD65DFAFF968F29797D8E8CB3
                                                  Malicious:false
                                                  Preview:........F.......L"......|D......|D......}D.......D..S....D.......D.......E..0....E..B...NE.......E.......E.......E.......E.."....E.......E.......F.......F......%F......9F......CF......MF......UF......fF......zF..2....F.......F.......F..6....F......%G......+G......7G..;...?G......{G.......G.......G.......G.......G.......G..+....G.......H.......H......%H.."...,H......OH......`H..%....H.......H.......H.......H..4....H.......I.......I......+I..4...JI.......I.......I.......I.......I.......I.......I.......I.......I.......I.......I.......J...... J......=J......HJ......bJ......hJ......|J.......J.......J.......J.......J..%....J..1....J..0....K......MK......^K......oK.......K.......K.......K.......K.......K.......K.......L......"L..$...-L..$...RL..)...wL.......L.......L.......L.......L.......L.......L.......M......$M......@M......MM.. ..._M.......M.......M.......M.......M.......M.......M.......M.......M.......M.......M.......M.......M.......M.......M.......N..)....N......3N......:N......HN......

                                                  C:\Program Files\FileZilla FTP Client\locales\oc\libfilezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 6 messages, Project-Id-Version: Filezilla en occitan 'Ret inaccessible'
                                                  Category:dropped
                                                  Size (bytes):855
                                                  Entropy (8bit):5.163557715694271
                                                  Encrypted:false
                                                  SSDEEP:24:n4ApArSs80hLnI5TRqkt0qtyl5rW9XmG03Qh5y8Y:arSsjLI5V4qcvr74y8Y
                                                  MD5:67747215DC2408178FE975B7CE166B30
                                                  SHA1:66CF6DF8299DAE5DA03C3EB027DB27E8F9902F14
                                                  SHA-256:719B14C0E3B74EDFD11A5D8DBA68D85935E5FF8E70287556FD810F0A871CF35B
                                                  SHA-512:4F0A44AD98021F7BA3C10F75055683119CE8A6AC80C0006D2626099CA99269CCC791E6625741E8679BC2F0D17034E8E8CB3A3F3BC8D316A91BCF9FF0B9EEC498
                                                  Malicious:false
                                                  Preview:................L.......|.......|.......}...........0.......................................!.......=...........,.......L....Network unreachable.Remote certificate not trusted..Server did not properly shut down TLS connection.Unsupported certificate type.unknown.Project-Id-Version: Filezilla en occitan.Report-Msgid-Bugs-To: https://trac.filezilla-project.org/.PO-Revision-Date: .Last-Translator: T.ni Galhard <tony.gaillard@supinfo.com>.Language-Team: T.ni Galhard <tony.gaillard@supinfo.com>.Language: oc.MIME-Version: 1.0.Content-Type: text/plain; charset=UTF-8.Content-Transfer-Encoding: 8bit.Plural-Forms: nplurals=2; plural=(n > 1);.X-Poedit-Language: occitan.X-Poedit-Country: Occit.nia..Ret inaccessible.Certificat alunhat sens fisan.a..Lo servidor a pas tampat la connexion TLS d'un biais corr.ct.Tipe de certificat pas suportat.desconegut.

                                                  C:\Program Files\FileZilla FTP Client\locales\pl_PL\filezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 1787 messages, Project-Id-Version: FileZilla '%H:%M:%S up\305\202yn\304\231\305\202o'
                                                  Category:dropped
                                                  Size (bytes):172988
                                                  Entropy (8bit):5.389385684433894
                                                  Encrypted:false
                                                  SSDEEP:3072:vBLRSqa0GAmBwE9oFOvTcuuyw7nrTzDrB0qNL4J:pLfanjwOoFOvTcdBrTzBXw
                                                  MD5:F1C9A9442056221D06948586F3487494
                                                  SHA1:062F8DB51ACB2C156FC921A6A3C7500D93742ED4
                                                  SHA-256:22E449754FD8025E8ECD42997BCB373B082F0C798C325FA1D58FB3F6C94B2D79
                                                  SHA-512:A12CE8FC2990C3D41BFB8D6B40B8A5984F4B703CE7A7E8128B6BFE336B4E7ECCCBB49EF88C5F3831B6F4CF7B4CCF9C8020F1D19A61C3475C33007479C241F943
                                                  Malicious:false
                                                  Preview:.................7.......o.......o.......o.......o..S....o......@p..A...\p.......p..0....p..B....p......#q......8q......Bq......bq......wq.......q.......q.......q.......q.."....q.......q.......q.......r..+....r.......s......*s......>s..5...Qs.......s.......s.......s.......s.......s.......s.......s.......s.......s.......t.......t..0...6t..2...gt..2....t.......t..0....t.......u..6...1u......hu......nu......zu.......u..;....u.......u.......u.......u.......u.......v.......v....../v......6v......Gv......]v......xv.......v..+....v.......v.......v.......v.......v.."....v.......w......+w..%...Jw......pw......xw.......w.. ....w.......w..H....w..I....x..4...]x.......x..:....x.......x.......x..4....y..$...Dy......iy.......y.......y.......y.......y.......y.......y.......y.......y.......y.......y.......z.......z......)z......Bz......Kz......hz......sz.......z.......z.......z.......z.......z.......z.......z.......z.......z..%....{..O....{..R...~{..1....{..0....|......4|......E|......V|......u|......

                                                  C:\Program Files\FileZilla FTP Client\locales\pl_PL\libfilezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 77 messages, Project-Id-Version: FileZilla 3.x 'Certyfikat w \305\202a\305\204cuchu zosta\305\202 podpisany przy u\305\274yciu niezabezpieczonego algorytmu'
                                                  Category:dropped
                                                  Size (bytes):7810
                                                  Entropy (8bit):5.257568702090042
                                                  Encrypted:false
                                                  SSDEEP:192:dclYeGiSZpJqe790vMm3dmDCGBpk1C/69GJnYcdjkNsx:EYeG/vB9EmDCG81Ojtkg
                                                  MD5:EBBEAB96D8AA3EBFCFF2942BF786C1A5
                                                  SHA1:CF13F076B67FB1FAD835EC84FFB4BD5F2FBA3D94
                                                  SHA-256:62E417EC1C6523A1534C7909CBC12153E3A544F81F6C7FC9A4858651CA578DB6
                                                  SHA-512:778AE71C9C99FF06F54A30D95FE3DD999A4DD0D551EA0DB6FED89451EB735ABF90DE3662C6C3E03990C8453751D69D27B59BE3A8D99C084265A1EAB17EF45CE8
                                                  Malicious:false
                                                  Preview:........M...........................A.......A.../.......q...........$...............>.......)...".......L......._.......|...................1...............X.......R...t... .......!...................'.......7.......M.......g.......{...............................................................<.......V...4...h...P...............#...........&...)...7...(...a...............................................................%...+...<...+...h...L.......-.................../... ...L...0...m...M.......$...................*.......D...,...Y...#.......%.......$.......%.......'.......n...C...?.......7.......-...*...1...X...........5...............@.......S...&...@...z...................).......).......C...G...(...............-.......$.......$.......!...D...;...f...!.......\.......V...!...1...x...8...................................#.......=.......R.......h.......}...#.......%.......'...............)...&.......P.......k...?.......X...............3...-.......a...2...u...............................

                                                  C:\Program Files\FileZilla FTP Client\locales\pt_BR\filezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 1710 messages, Project-Id-Version: FileZilla 3 '%H:%M:%S decorridos'
                                                  Category:dropped
                                                  Size (bytes):166533
                                                  Entropy (8bit):5.162185469776971
                                                  Encrypted:false
                                                  SSDEEP:3072:4t5r6bei9mHSsnmmG+D96FhbTeWirwRVkXiFntLJ1f6F:4br6bSu+J6FhbTe/SVkXiFn8
                                                  MD5:6F15813F43B1F11C09F9C6131825BCB2
                                                  SHA1:283B1AB3561D5B8B7FDBB00A8856BBA46AB31531
                                                  SHA-256:768D355AECAD926CAC97CA263DAC8724E034A92508116F197833D11DCC886C13
                                                  SHA-512:D2913F0B7E3E8A8668DD997C5F2D19FAF95B8BDFCE166F77176DF79769DE5364F046228653639B0BA1AE5198D7DAD785FCC4BD1ABE285984219B41E17E5D2840
                                                  Malicious:false
                                                  Preview:.................5.......j.......j.......j.......k..S....k......pk..A....k.......k..0....k..B....l......Sl......hl......rl.......l.......l.......l.......l.......l.......l.."....l.......m......(m.......n..+... n......Ln......Zn......nn..5....n.......n.......n.......n.......n.......n.......n.......o.......o......'o......8o......Fo..0...fo..2....o.......o.......o..6....o......4p......:p......Fp......Yp..;...ap.......p.......p.......p.......p.......p.......p.......p.......q......%q......3q..+...<q......hq......{q.......q.......q.."....q.......q.......q..%....q.......r......%r.. ...5r......Vr..H...lr..I....r..4....r......4s..:...@s......{s.......s..4....s.......s.......t.......t.......t......*t......6t......<t......Rt......Zt......nt.......t.......t.......t.......t.......t.......t.......t.......t.......u.......u.......u......5u......Iu......Wu......`u..%...ju..O....u..R....u..1...3v..0...ev.......v.......v.......v.......v.......v.......v.......v.......w.......w......Kw......kw......vw..2...

                                                  C:\Program Files\FileZilla FTP Client\locales\pt_BR\libfilezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 65 messages, Project-Id-Version: FileZilla 3 'Argumento de buffer overflow'
                                                  Category:dropped
                                                  Size (bytes):6028
                                                  Entropy (8bit):5.089027281636174
                                                  Encrypted:false
                                                  SSDEEP:96:Lf6miVHHCSVQk01Jqe790vMmO87kqGu537LIREFXHI/e//5f1GDHbcgNQ9QCe:Lf6VHHCSMJqe790vMmdF9PTFXHGCJ1Gb
                                                  MD5:A4930D67E9AD80BF2350C87AA286D52B
                                                  SHA1:B0554862C02797E7DED872A397912BD4FBD7DA8B
                                                  SHA-256:4941885C4013C03FE74FFDA0E5BB3E2B382F5B10C929A7E05752137FBAA1C438
                                                  SHA-512:03B861F2270FE16B6B45C2354106F731870A3714091EDE5AE7BB1ABF98C1DCCECFCDFA8A769788972C8CBDBCAD24DE25E38BAA0BC45F9256F017927A46C1F3F7
                                                  Malicious:false
                                                  Preview:........A.......$.......,.......,.......-.......F...$...Z...................................................X...!...R...z...!...................................2.......L.......`.......m...........................................................4.......P...c...........#...............).......(...'.......P.......n...................................................+.......+.......-...Z................... .......0.......$...........<.......U.......o...,.......#.......%.......$.......%... ...'...F...7...n...-.......1...............5...#.......Y.......a.......>.......[...%...z...2...............'...........................L...p...`...i...........;...&...j...............................................................+.......I.......d.......{...................6.......1...........7...'...I.......q...........-...................................1.......G.......T...)...f...........:.......(.......8.......+...H... ...t...$.......1.......0...................2.......G...:...]...........$.......(...

                                                  C:\Program Files\FileZilla FTP Client\locales\pt_PT\filezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 1539 messages, Project-Id-Version: FileZilla 3 pt '%H:%M:%S decorrido'
                                                  Category:dropped
                                                  Size (bytes):149620
                                                  Entropy (8bit):5.139808226790429
                                                  Encrypted:false
                                                  SSDEEP:3072:sdk00gGklm9uhd930MT6auss3l6qLeZHbMgqA:sd6gmuf930MT6Zv3l61
                                                  MD5:A7B079CB9136BDBACC5824EC7BAC11F3
                                                  SHA1:07D9682218D5A77AB8711AFAA35FE6D383C79BB7
                                                  SHA-256:D537CB32256FC953BB147B3A95CA4B8B702F28B137B5E53DC93E207FDC5CE895
                                                  SHA-512:472118DCA296BB316B00383200EDB7DFCF9A035509CD94DACCE16D9D0B8355BEA5C9DDF13887737023EBFFFEE418A746F06DA2CE73567B70F458F294B9D80581
                                                  Malicious:false
                                                  Preview:................40......L`......L`......M`......^`..S...l`.......`..A....`.......a..0.../a..B...`a.......a.......a.......a.......a.......a.......b.......b.......b......*b.."...Db......gb......xb.......b.......b..5....b.......b.......b.......b.......b.......c......!c......2c..2...@c......sc.......c..6....c.......c.......c.......c.......d..;....d......Fd......Qd......\d......nd.......d.......d.......d.......d.......d..+....d.......d.......e...... e......0e.."...7e......Ze......ke..%....e.......e.......e.......e..H....e..I...'f..4...qf.......f..:....f.......f.......g..4...#g......Xg......wg.......g.......g.......g.......g.......g.......g.......g.......g.......g.......h.......h......&h....../h......Lh......Wh......qh......wh.......h.......h.......h.......h.......h..%....h..O....h..R...Ii..1....i..0....i.......i.......j......!j......@j......Fj......\j......ej......~j.......j.......j.......j.......j..2....j..3...'k......[k..$...fk..$....k..)....k.......k.......k.......l.......l.......l......

                                                  C:\Program Files\FileZilla FTP Client\locales\pt_PT\libfilezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 74 messages, Project-Id-Version: FileZilla 3 pt 'Um certificado na cadeia foi assinado com um algor\303\255tmo inseguro'
                                                  Category:dropped
                                                  Size (bytes):7318
                                                  Entropy (8bit):5.04659601916853
                                                  Encrypted:false
                                                  SSDEEP:192:AMs7mlhpZGJqe790vMm3dANARJXMaXlUopoQhlIGuyuboPU4LXp:At7cpkB9EANEcaaFxmU4Dp
                                                  MD5:C456FA1DECA8F79FCF54C8ACFFF26C79
                                                  SHA1:485B766D4EEFAF01520301B79D7455DB3022F3AD
                                                  SHA-256:526068AE2A7DE83F4CCD82F24B403C3D2C994EB1C2DF4A05FEF83F2F1716CEC0
                                                  SHA-512:99873421C6A23506B73ED62957EB4AF3B0BBB5CD4FCB6EC8F8EB7B7DCE528E9B4EB9012B3F9BD72BF0F4D2BB1FE7528D81FECC3950AF79B9ED24AD6DD8BA6EBA
                                                  Malicious:false
                                                  Preview:........J.......l...................A.......A...........A.......Z...$...n...........)...................................*.......F...1..._...........X.......R....... ...X...!...y.............................................................../.......G.......b.......z...........................4.......P...........`...#...t...........).......(...........................0.......H.......[.......i.......{...........+.......+.......L.......-...S................... .......0.......M.......$...^...........................,.......#.......%.......$...B...%...g...'.......?.......7.......-...-...1...[...........5.......................@.......H...................:...%...W...#...}...3...............(....... ......."...3..."...V...M...y...'.......q.......j...a...3...............'.../.......W.......f.......{.......................................................2...'...K.......s...........H.......X...........O.......a...................3...................+.......C.......].......s...........*...........

                                                  C:\Program Files\FileZilla FTP Client\locales\ro_RO\filezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 1588 messages, Project-Id-Version: Filezilla '%H:%M:%S trecut(e)'
                                                  Category:dropped
                                                  Size (bytes):128690
                                                  Entropy (8bit):5.228935986587944
                                                  Encrypted:false
                                                  SSDEEP:1536:DTs3NTNeQdSSRaZnThmQ17U4m1kbFNFTTJjmrh3pu6HTUVwCXPA07GB8SOIf1RGp:DA9gQraZnVmQxbFPTTJYw6Hoq6DDfy/8
                                                  MD5:968722136ECD137A27038B6672344302
                                                  SHA1:EADED840643AB4853194E1AE231C2B924CBFA99A
                                                  SHA-256:2A3972C55C8DCC837FF284F12E688AAD8CC20A8D6A8EBF39481CE816F27B59A1
                                                  SHA-512:5460ABBB88270B7FCF058329457B2D7E643660163E800613B703936FA509ED33283A68921C94153DE9FAED110A97904A1A0FC6477B658F085A901AED3E26DDE5
                                                  Malicious:false
                                                  Preview:........4........1......\c......\c......]c......nc......|c..A....c.......c..0....c..B....d......_d......td......~d.......d.......d.......d.......d.......d.......d.."....e......#e......4e..+...De......pe......~e.......e..5....e.......e.......e.......e.......f.......f.......f......%f......7f......Kf......\f......jf..0....f..2....f.......f..0....g......:g..6...Rg.......g.......g.......g.......g..;....g.......g.......g.......h.......h......1h......8h......Ih......_h......zh.......h..+....h.......h.......h.......h.......h.."....h.......i......-i..%...Li......ri......zi.......i.. ....i.......i..H....i..I....j..4..._j.......j..:....j.......j.......j..4....k......Fk......ek......ok......}k.......k.......k.......k.......k.......k.......k.......k.......k.......k.......l.......l......(l......El......Pl......jl......pl.......l.......l.......l.......l.......l.......l..%....l..1....l..0...-m......^m......om.......m.......m.......m.......m.......m.......m.......m.......n......3n......>n..2...Sn..3...

                                                  C:\Program Files\FileZilla FTP Client\locales\ro_RO\libfilezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 11 messages, Project-Id-Version: Filezilla 'Aten\310\233ie! Certificatul a fost anulat'
                                                  Category:dropped
                                                  Size (bytes):1646
                                                  Entropy (8bit):5.222022552859678
                                                  Encrypted:false
                                                  SSDEEP:48:tq8Q/Thq/TAzjL145iqclgF6ZCPOoGNb2C8:tMk0ju5iH1Znxb2C8
                                                  MD5:243852DDD865013CB22D4A6A3410079F
                                                  SHA1:A3817471720949DF0AC5A064EA1612695A6CA5BD
                                                  SHA-256:88ADC555F6887263DEBEAC578F25681BF92237B3CA1DE21BB1C2FA5F20446546
                                                  SHA-512:1C23C672BE5522FD724E0B3155829139E6D8BA2385BC00E36C5EEFE478C058F622AAD8989D2B09FD2F653701433167571F11749553D8F5812003B6D23F244CA4
                                                  Malicious:false
                                                  Preview:................t...................$.......X.......R...K...!.......................0...........%...5...B.......x...........$...|...e.......Z.......0...b...........+.......3...............=...%.......c....Beware! Certificate has been revoked.Could not get distinguished name of certificate issuer, gnutls_x509_get_issuer_dn failed.Could not get distinguished name of certificate subject, gnutls_x509_get_dn failed.Failed to verify peer certificate.Network unreachable.Remote certificate not trusted..Server did not properly shut down TLS connection.Unsupported certificate type.gnutls_certificate_get_peers returned no certificates.unknown.Project-Id-Version: Filezilla.Report-Msgid-Bugs-To: https://trac.filezilla-project.org/.PO-Revision-Date: 2013-06-13 21:17+0200.Last-Translator: Alexandru Bogdan Munteanu <muntealb@gmail.com>.Language-Team: MunteAlb, Lauren.iu Anisie <muntealb@gmail.com>.Language: ro_RO.MIME-Version: 1.0.Content-Type: text/plain; charset=UTF-8.Content-Transfer-Encoding: 8bi

                                                  C:\Program Files\FileZilla FTP Client\locales\ru\filezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 1798 messages, Project-Id-Version: \320\240\321\203\321\201\321\201\320\272\320\270\320\271 \320\277\320\265\321\200\320\265\320\262\320\276\320\264 '%H:%M:%S \320\267\320\260\321\202\321\200\320\260\321\207\320\265\320\275\320\276'
                                                  Category:dropped
                                                  Size (bytes):223671
                                                  Entropy (8bit):5.415079621054186
                                                  Encrypted:false
                                                  SSDEEP:6144:tv/yj69CF4vTcZ3iclybCAlHenfteJzGxWtWjU:EtFp3iclybCAlHenfteJzGxWtEU
                                                  MD5:39D9EE82BDE187BE8F6FFFE7747D996A
                                                  SHA1:DF65D1513304AB26C0E1E65F6D1A8B2A2E4DBA66
                                                  SHA-256:B4F4FA764FD7C81D84B452A811782BCED5B2F8A8BCE6742C911108FA4C95F364
                                                  SHA-512:EB02D3ACC8A45A07DAC2EC766A407CE2C06BF186258468A90ED2682B2C1A52BAE6E2D15A6E815EF252FAA2B7C8EE19EF832A7E59255B19BE724A019AC962ED96
                                                  Malicious:false
                                                  Preview:................L8......|p......|p......}p.......p..S....p.......p..A....q......Nq..0..._q..B....q.......q.......q.......q.......r......'r......5r......?r......Jr......Zr.."...tr.......r.......r.......s..+....s.......s.......s.......s..5....t......7t......At......Qt......^t......ht......pt.......t.......t.......t.......t.......t..K....t..0...2u..2...cu..2....u.......u..0....u.......v..6...-v......dv......jv......vv.......v..;....v.......v.......v.......v.......v.......v.......w......+w......2w......Cw......Yw......tw.......w..+....w.......w.......w.......w.......w.."....w.......x......'x..%...Fx......lx......tx.......x.. ....x.......x..H....x..I....y..4...Yy.......y..:....y.......y.......y..4....z..$...@z......ez.......z.......z.......z.......z.......z.......z.......z.......z.......z.......z.......{.......{......%{......>{......G{......d{......o{.......{.......{.......{.......{.......{.......{.......{.......{.......{..%....|..O...*|..R...z|..1....|..0....|......0}......A}......R}......

                                                  C:\Program Files\FileZilla FTP Client\locales\ru\libfilezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 75 messages, Project-Id-Version: \320\240\321\203\321\201\321\201\320\272\320\270\320\271 \320\277\320\265\321\200\320\265\320\262\320\276\320\264 '\320\241\320\265\321\200\321\202\320\270\321\204\320\270\320\272\320\260\321\202 \320\262 \321\206\320\265\320\277\320\276\321\207\320\272\320\265 \320\261\321\213\320\273 \320\277\320\276\320\264\320\277\320\270\321\201\320\260\320\275 \321\201 \320\270\321\201\320\277\320\276\320\273\321\214\320\267\320\276\320\262\320\260\320\275\320\270\320\265\320\274 \320\275\320\265\320\267\320\260\321\211\320\270\321\211\320\265\320\275\320\275\320\276\320\263\320\276 \320\260\320\273\320'
                                                  Category:dropped
                                                  Size (bytes):9536
                                                  Entropy (8bit):5.344860283663808
                                                  Encrypted:false
                                                  SSDEEP:192:nKlPRxG8pZGJqe790vMm3dkNhH8hHQZuYm5pcztQAEQp7KZwzOM38pAWDhsKf:KlPRrkB9EsB8hwcAQA97KZwwhn
                                                  MD5:77C31C9B2DDC8E5582047098B2D63C02
                                                  SHA1:2DDDF0E6672F8D5F1EC588180AF4733C6FA41024
                                                  SHA-256:EEBB5B2E99A407DB351FA34DE7118974A9415F4E8658F37E1109EA976BD28B0F
                                                  SHA-512:1A3346190DAD416913820287B5C651B6F6D244DD889D0BC509F3C117A8E3A07ED96F0765E57D00CD0E7154C2C9A4D9ED30F48C56A06060F576D248F7B3B71234
                                                  Malicious:false
                                                  Preview:........K.......t...................A.......A...........Q.......j...$...~...........)...................................:.......V...1...o...........X.......R....... ...h...!...........................................................).......?.......W.......r...................................4.......P...........p...#...............).......(...................*.......@.......X.......k.......y...................+.......+.......L.......-...c................... .......0.......M... ...$...n...........................,.......#.......%...,...$...R...%...w...'.......n.......?...4...7...t...-.......1...............5...)......._.......g.......G...y.......%...N...0...t...<.......I.......L...,...%...y...C.......8.......0.......6...M...n.......@...........4...x.......W...-...;.......J...................#... ...@.......a.......|...!.......8.......*.......'... ...=...H...F.......,.......0......._...+...............%...4...C...3...x...H.......I...........?...'...n...2.......,.......%...............N...

                                                  C:\Program Files\FileZilla FTP Client\locales\sk_SK\filezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 1318 messages, Project-Id-Version: FileZilla 3 '%H:%M:%S uplynulo'
                                                  Category:dropped
                                                  Size (bytes):126808
                                                  Entropy (8bit):5.3930410905204065
                                                  Encrypted:false
                                                  SSDEEP:1536:hlooFLPewVxO02ALzmpGV75ZmdEzdtjDA3OBWHN0TnYEmVpCRYsDV4kobiix8trl:UALPHVr/mp3Cdt/ZEpChQxQ
                                                  MD5:FD26971AD02C44336F70C165ECF6A362
                                                  SHA1:F0238610E6FF8FA62897CD71304AD18A3AD88029
                                                  SHA-256:38E25F7C5D62E8D8194C788B1EEC95F06A50086521A7567836EB9A934F8CEFBB
                                                  SHA-512:63F483515605DDC4F6A834517FE10F1BE797822A9EF026BB6EC5036D3BB51473A05D46404A21CC33E1BD4B3D5DB0DBA8F9245A800880DC715E220589FBFA03BE
                                                  Malicious:false
                                                  Preview:........&.......L)......|R......|R......}R.......R..S....R.......R..A....S......NS..0..._S..B....S.......S.......S.......S.......T.......T.......T.."...5T......XT......iT......yT.......T.......T.......T.......T.......T.......T.......T..2....T.......U......8U..6...PU.......U.......U.......U..;....U.......U.......U.......U.......V.......V......-V......HV......VV..+..._V.......V.......V.......V.......V.."....V.......V.......V..%....W......@W......HW......XW..4...nW.......W..:....W.......W.......X..4... X......UX......tX......~X.......X.......X.......X.......X.......X.......X.......X.......X.......X.......Y.......Y......5Y......@Y......ZY......`Y......tY.......Y.......Y.......Y.......Y..%....Y..R....Y..1...5Z..0...gZ.......Z.......Z.......Z.......Z.......Z.......Z.......Z.......[.......[......M[......m[..3...x[..$....[..$....[..)....[...... \......6\......H\......U\......b\......g\......|\.......\.......\.......\.......\.. ....\.......].......]......)]......1]......5]......;]......C]......

                                                  C:\Program Files\FileZilla FTP Client\locales\sk_SK\libfilezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 11 messages, Project-Id-Version: FileZilla 3 'Pozor! Platnos\305\245 certifik\303\241tu bola odvolan\303\241'
                                                  Category:dropped
                                                  Size (bytes):1568
                                                  Entropy (8bit):5.362865375572286
                                                  Encrypted:false
                                                  SSDEEP:24:X/1qDgGStP/Thq/TCxz80hLn1L054JLt0qtymJhXmGIpYT1f/Wp9GRIa7B:tqDW/Thq/TAzjL1453qc08BOT1fWfa7B
                                                  MD5:69BF86010132722D7FAF001E81DF896B
                                                  SHA1:2545810A9C9C45F0D47188B630ACB987B744D290
                                                  SHA-256:1B60A2838F9ED7DB6AC94D7FE5C1D7397DF3D6A924FA185B3B3A8BC5CFC120E3
                                                  SHA-512:8350784E96F06405F0657992326392F06A3820266E0C48736A0280990F75ED9CDEC06298E198C3D0BFFBFC1D27CFF873AE391780C989B0888BF2703C0DBBFC07
                                                  Malicious:false
                                                  Preview:................t...................$.......X.......R...K...!.......................0...........%...5...B.......x...........,.......r...>...h.......,...........G...,...Y...4...............;................Beware! Certificate has been revoked.Could not get distinguished name of certificate issuer, gnutls_x509_get_issuer_dn failed.Could not get distinguished name of certificate subject, gnutls_x509_get_dn failed.Failed to verify peer certificate.Network unreachable.Remote certificate not trusted..Server did not properly shut down TLS connection.Unsupported certificate type.gnutls_certificate_get_peers returned no certificates.unknown.Project-Id-Version: FileZilla 3.Report-Msgid-Bugs-To: https://trac.filezilla-project.org/.PO-Revision-Date: 2011-12-22 13:08+0100.Last-Translator: Ivan Mas.r <helix84@centrum.sk>.Language-Team: Slovak <sk-i18n@lists.linux.sk>.Language: sk.MIME-Version: 1.0.Content-Type: text/plain; charset=UTF-8.Content-Transfer-Encoding: 8bit.Plural-Forms: nplurals=3; plur

                                                  C:\Program Files\FileZilla FTP Client\locales\sl_SI\filezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 1818 messages, Project-Id-Version: FileZilla 3.55.1 'Prete\304\215eni \304\215as: %H:%M:%S'
                                                  Category:dropped
                                                  Size (bytes):172907
                                                  Entropy (8bit):5.234825102169664
                                                  Encrypted:false
                                                  SSDEEP:3072:VXImB9isbmBlXkCFE8T77X4w6F4hSkeJqJA:VYcYl0CFE8T7TCWUx
                                                  MD5:47CB8A3A7780A367455CCD03C4FF5D99
                                                  SHA1:FA45E6D295DE2B74AAA7F7FC95F71263F287571F
                                                  SHA-256:52C9924E656ACA709E6B9B09BD4EB6213D2AAF32A5C9536020503CCB79F7FF67
                                                  SHA-512:2AC32B3B1603C914E0C7430BBA4C015082A5954177D3B9D3006A9D232910CD0A0FCFB991D7A51BB8152467E2B537B300AD5EC40813E65004016964CB36B1A15F
                                                  Malicious:false
                                                  Preview:.................8.......q.......q.......q.......q..S....q......0r..A...Lr.......r..0....r..B....r.......s......(s......2s......Rs......gs......us.......s.......s.......s.......s.."....s.......s.......s.......t..+....t.......u......(u......<u..5...Ou.......u.......u.......u.......u.......u.......u.......u.......u.......u.......v.......v..K...4v..0....v..2....v..2....v.......w..0...2w......cw..6...{w.......w.......w.......w.......w..;....w.......x......&x.......x......9x......Kx......bx......yx.......x.......x.......x.......x.......x..+....x.......y.......y......*y......:y.."...Ay......dy......uy..%....y.......y.......y.......y.. ....y.......y..H....z..I...]z..4....z.......z..:....z......#{......:{......C{..4...b{..$....{.......{.......{.......{.......{.......|.......|.......|.......|......3|......;|......O|......d|......o|......||.......|.......|.......|.......|.......|.......|.......|.......}.......}......*}......8}......A}......K}..%...[}..O....}..R....}..1...$~..0...V~.......~......

                                                  C:\Program Files\FileZilla FTP Client\locales\sl_SI\libfilezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 75 messages, Project-Id-Version: FileZilla 3.40.0 'Potrdilo v verigi je bilo podpisano z algoritmom, ki ni varen'
                                                  Category:dropped
                                                  Size (bytes):7258
                                                  Entropy (8bit):5.096302501731969
                                                  Encrypted:false
                                                  SSDEEP:96:inIKT569zYQySDgnVvqk9Ra1Jqe790vMmU87cqO6zu571KFMSg0LY3ArNoYEOtPT:nKlMzKSCZGJqe790vMm3deaLuY06KjQ
                                                  MD5:72213EFAB61DDA9D5F71B1B5261EB465
                                                  SHA1:D670916F7B9497F45DF9A75AD31B86734DB38601
                                                  SHA-256:790EA12C3702B9EA9311313E186C2F7ED6E490C18B95751C005A7A0F22C0B5AF
                                                  SHA-512:442DD23FFEE61FA6B6ED0F7BA3A6ED64E9BC75DB472367F1A24C6CC9DDAE287BF0431C49612229976097BC443E9029756940C69D691065C937004333D8479D43
                                                  Malicious:false
                                                  Preview:........K.......t...................A.......A...........Q.......j...$...~...........)...................................:.......V...1...o...........X.......R....... ...h...!...........................................................).......?.......W.......r...................................4.......P...........p...#...............).......(...................*.......@.......X.......k.......y...................+.......+.......L.......-...c................... .......0.......M... ...$...n...........................,.......#.......%...,...$...R...%...w...'.......n.......?...4...7...t...-.......1...............5...)......._.......g...=..._...2.......#...............".......'...0...(...X...........#.......'.......%.......".......>...*.......i...S.......N.......+...)...+...U...$...........................................................$.......>.......^.......|...$......."...............S.......H...J.........../...............+...................I......._.......s...........................%...

                                                  C:\Program Files\FileZilla FTP Client\locales\sr\filezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 1293 messages, Project-Id-Version: Filezilla 0 '\320\237\321\200\320\276\321\202\320\265\320\272\320\273\320\276 \321\230\320\265 %H:%M:%S'
                                                  Category:dropped
                                                  Size (bytes):165364
                                                  Entropy (8bit):5.2847196590387355
                                                  Encrypted:false
                                                  SSDEEP:3072:hzMBwcT4r6mpsodxzorsNPTtKJj7B1bJREYplLkiT8zlm68X5Go:hz4wG4rVsSxzorQPTsJj7B1tREYp9ezG
                                                  MD5:4C65AF738638953953AB9D0F34255122
                                                  SHA1:BC6445926B48797A6DECF1D5C5678B6E75A52C44
                                                  SHA-256:70CC8DE90776FA85FAAF746EC87B05B9D35741BE34E86E5BE7CE9F58129FAA31
                                                  SHA-512:7F23331210A199F8F46438774ADB54D4A18D2C4476D828B48EA302FA08DEDD6DF6B6F4F0392FB0E045B10105628F686B715CB9AF9DF3131BEC0F522248EC67D5
                                                  Malicious:false
                                                  Preview:.................(.......P.......P.......P.......P..S....Q......`Q..A...|Q.......Q..0....Q..B....R......CR......XR......bR......pR......{R.......R.."....R.......R.......R.......R.......R.......S.......S.......S......'S......8S......LS..2...ZS.......S.......S..6....S.......S.......S.......T..;....T......MT......XT......cT......uT.......T.......T.......T.......T..+....T.......T.......U...... U......0U.."...7U......ZU......kU..%....U.......U.......U.......U..4....U.......V..:....V......ZV......qV..4....V.......V.......V.......V.......V.......W.......W.......W......1W......9W......NW......YW......rW......{W.......W.......W.......W.......W.......W.......W.......W.......X.......X..%....X..R...EX..1....X..0....X.......X.......Y.......Y......<Y......BY......XY......aY......zY.......Y.......Y.......Y..3....Y..$....Z..$...4Z..)...YZ.......Z.......Z.......Z.......Z.......Z.......Z.......Z.......Z.......[....../[......<[.. ...N[......o[......t[.......[.......[.......[.......[.......[.......[......

                                                  C:\Program Files\FileZilla FTP Client\locales\sr\libfilezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 11 messages, Project-Id-Version: Filezilla 0 '\320\236\320\277\321\200\320\265\320\267\320\275\320\276! \320\241\320\265\321\200\321\202\320\270\321\204\320\270\320\272\320\260\321\202 \321\230\320\265 \320\276\321\202\320\272\320\260\320\267\320\260\320\275'
                                                  Category:dropped
                                                  Size (bytes):1885
                                                  Entropy (8bit):5.614040531495989
                                                  Encrypted:false
                                                  SSDEEP:48:tqk/Thq/TAzjL145qqc/F52/ovVKK0VKsq3n:t3k0ju5q5F52/ovVK7VKln
                                                  MD5:BDBC57157C4C4FC4BD1125527E7CA979
                                                  SHA1:E03BF390041093B2B254607D14B86103962DA357
                                                  SHA-256:3E9A085F53CA4687835C9CE292AA08B0EB71322FE4AEA3FBF1302B038368804B
                                                  SHA-512:7D7AF4900880BB191386BCE4FD50FF5F0A697359915EE2DF20D02C99F1166EF707130F468A041852171023D7CB4857D1CD328D875E2085CFF6598DAD4A861D57
                                                  Malicious:false
                                                  Preview:................t...................$.......X.......R...K...!.......................0...........%...5...B.......x...........8...................L...<......./.......E...?...C.......6.......I...........J....Beware! Certificate has been revoked.Could not get distinguished name of certificate issuer, gnutls_x509_get_issuer_dn failed.Could not get distinguished name of certificate subject, gnutls_x509_get_dn failed.Failed to verify peer certificate.Network unreachable.Remote certificate not trusted..Server did not properly shut down TLS connection.Unsupported certificate type.gnutls_certificate_get_peers returned no certificates.unknown.Project-Id-Version: Filezilla 0.Report-Msgid-Bugs-To: https://trac.filezilla-project.org/.PO-Revision-Date: 2010-10-29 02:30+0100.Last-Translator: Nikola Radovanovic <nrad@eunet.rs>.Language-Team: Serbian <sr@li.org>.Language: sr.MIME-Version: 1.0.Content-Type: text/plain; charset=UTF-8.Content-Transfer-Encoding: 8bit.Plural-Forms: nplurals=3; plural=n%10==1

                                                  C:\Program Files\FileZilla FTP Client\locales\sv\filezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 1624 messages, Project-Id-Version: FileZilla 3 '%H:%M:%S f\303\266rflutet'
                                                  Category:dropped
                                                  Size (bytes):150146
                                                  Entropy (8bit):5.225359759459092
                                                  Encrypted:false
                                                  SSDEEP:3072:pR1bCQvxdV+YmHrrdyFjyTmaPAmB7bUxUga6h5LFUGC1HRk7cbnDfFD8nokfmHKO:NbSdrxyFjyTmkzF4h5LFuPSnokfmHKxE
                                                  MD5:EFDEDC82664388B5C3CC365AF0EF5758
                                                  SHA1:D1C826B80BC3DE650FF0E9BEE13C75CEA668E9F3
                                                  SHA-256:30234AA84999DC2AFBDB306F3ECDA6C015203F4B4794D217061032FA2CB1374B
                                                  SHA-512:726A980C4611231FB4FA9658A37DBB08A033B3B25115C1F65E513E306665ADDCEFA6AE547B279AFC361160C0D28D0B235FAB10FFF70ADD1BAEAA62A1E386ED7B
                                                  Malicious:false
                                                  Preview:........X........2.......e.......e.......e.......e..S....e.......f..A...,f......nf..0....f..B....f.......f.......g.......g......2g......Gg......Ug......_g......jg......zg.."....g.......g.......g.......g.......g..5....g......0h......:h......Gh......Qh......Yh......jh......|h.......h.......h..2....h.......h.......h..6....i......Li......Ri......^i......qi..;...yi.......i.......i.......i.......i.......i.......i.......j.......j....../j......=j..+...Fj......rj.......j.......j.......j.."....j.......j.......j..%....k......'k....../k......?k......Jk..H...`k..I....k..4....k......(l..:...4l......ol.......l.......l..4....l.......l.......m.......m.......m......'m......3m......>m......Dm......Zm......bm......vm.......m.......m.......m.......m.......m.......m.......m.......n.......n......!n......6n......=n......Qn......_n......hn..%...rn..O....n..R....n..1...;o..0...mo.......o.......o.......o.......o.......o.......o.......p.......p......$p......Sp......sp......~p..2....p..3....p.......p..$....q..$...

                                                  C:\Program Files\FileZilla FTP Client\locales\sv\libfilezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 74 messages, Project-Id-Version: FileZilla 3 'Ett certifikat i kedjan var signerat med en os\303\244ker algoritm'
                                                  Category:dropped
                                                  Size (bytes):7067
                                                  Entropy (8bit):5.073984641049982
                                                  Encrypted:false
                                                  SSDEEP:192:AMExXnZGJqe790vMm3deOixURJVIDHppM:AH5kB9EeOi+RTIDHpC
                                                  MD5:422617C51D6B6876973A1267F8270BC6
                                                  SHA1:9DFA8A4D614014F56FC29DD6E3B898876E8451F9
                                                  SHA-256:25567F52B6A1D6B8D977D4835604A15604CCBCCC4702E2D5C45293D6DBD4321C
                                                  SHA-512:FD47F3010895DB15B3C8D7B17492CDD3B358AF2A2A72EFF81BC288A5A2C7D68FA92CB7F2F282A61817F99A13F6D03793B645372260546B9211AFEF6F5AFD58F2
                                                  Malicious:false
                                                  Preview:........J.......l...................A.......A...........A.......Z...$...n...........)...................................*.......F...1..._...........X.......R....... ...X...!...y.............................................................../.......G.......b.......z...........................4.......P...........`...#...t...........).......(...........................0.......H.......[.......i.......{...........+.......+.......L.......-...S................... .......0.......M.......$...^...........................,.......#.......%.......$...B...%...g...'.......?.......7.......-...-...1...[...........5.......................<...}...C.......................%...5... ...[...4...|...........2...............).......+...D...S...p...........Y.......O...<...+.......7...................................1.......H.......Z.......n...........................................................=...4...E...r...!.......)...............*.......(...G.......p........................................... ...........

                                                  C:\Program Files\FileZilla FTP Client\locales\ta\filezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 1705 messages, Project-Id-Version: FileZilla '%H:%M:%S \340\256\256\340\257\201\340\256\237\340\256\277\340\256\250\340\257\215\340\256\244\340\256\244\340\257\201'
                                                  Category:dropped
                                                  Size (bytes):285909
                                                  Entropy (8bit):4.847717687455472
                                                  Encrypted:false
                                                  SSDEEP:1536:kjBINf/kB1OAC8mnVgmGZy7U4m60DH96FpJEZGToQsrh9XArwueyxpdR21f06aDW:k3OLbnmmGlD96FvbTlWirwbMdQ1P3B
                                                  MD5:2449A7A3089C1B88C678021ADD1DD724
                                                  SHA1:5E4EBA5F95088940CB5BB243FD21F65767C47F11
                                                  SHA-256:D59BDD7CD20E35B35A8501B28B5D3CE60DEEBFD75EC29C7D46CF7C2B83AA621B
                                                  SHA-512:400CE8C860DB49AD1BDCACF83B6CF362359A4F65C33D0F92145A6CA102D6DA0FBD5D561F5047B534E0154E80E95CE3654864A0CCC7A3EAC4791C3698C845153F
                                                  Malicious:false
                                                  Preview:................d5.......j.......j.......j.......j..S....j...... k..A...<k......~k..0....k..B....k.......l.......l......"l......Bl......Wl......el......ol......zl.......l.."....l.......l.......l.......m..+....m.......m.......n.......n..5...1n......gn......qn.......n.......n.......n.......n.......n.......n.......n.......n.......n..0....o..2...Go......zo.......o..6....o.......o.......o.......o.......p..;....p......Mp......Xp......cp......up.......p.......p.......p.......p.......p.......p..+....p.......q......+q......=q......Mq.."...Tq......wq.......q..%....q.......q.......q.. ....q.......r..H....r..I...er..4....r.......r..:....r......+s......Bs..4...as.......s.......s.......s.......s.......s.......s.......s.......t.......t.......t......3t......>t......Kt......dt......mt.......t.......t.......t.......t.......t.......t.......t.......t.......u.......u..%....u..O...@u..R....u..1....u..0....v......Fv......Wv......hv.......v.......v.......v.......v.......v.......v.......v.......w......&w..2...

                                                  C:\Program Files\FileZilla FTP Client\locales\th_TH\filezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 1338 messages, Project-Id-Version: FileZilla Thai '\340\271\203\340\270\212\340\271\211\340\271\200\340\270\247\340\270\245\340\270\262\340\271\204\340\270\233\340\271\201\340\270\245\340\271\211\340\270\247 %H:%M:%S'
                                                  Category:dropped
                                                  Size (bytes):186489
                                                  Entropy (8bit):5.065712135912668
                                                  Encrypted:false
                                                  SSDEEP:3072:BYmTjxmqq4w1TT2/xVbTq/xGw3mjK1v1a7m:KmTjZqP1TT2/xWZx1vL
                                                  MD5:82934597A91398189945E25B1D2D6E8A
                                                  SHA1:34441252955FE26A0342274278D12E22AA63A2F9
                                                  SHA-256:57232B5409F8EA0FBEAEDB01E884844B50DCC171239329305CC9A453019097B7
                                                  SHA-512:8CEDBE259C50E1AB3A73D99FF068434D9DA48FEF2C0237EA7C3346F86E6A427E8D9E5A03722D6D86FCB8DE8B83C73FF7C84304565269D8A1D56633FD37B505B5
                                                  Malicious:false
                                                  Preview:........:........).......S.......S.......S.......S..S....S......0T..A...LT.......T..0....T..B....T.......U......(U......2U......@U......PU.."...jU.......U.......U.......U.......U..5....U.......V.......V.......V......"V......3V......GV..2...UV.......V.......V..6....V.......V.......V.......W..;....W......HW......SW......^W......uW......|W.......W.......W.......W..+....W.......W.......W.......X...... X......'X......8X..%...WX......}X.......X.......X..4....X.......X..:....X......'Y......>Y..4...]Y.......Y.......Y.......Y.......Y.......Y.......Y.......Y.......Y.......Z.......Z....../Z......:Z......GZ......`Z......iZ.......Z.......Z.......Z.......Z.......Z.......Z.......Z.......Z.......[..%....[..1...3[..0...e[.......[.......[.......[.......[.......[.......[.......[.......\.......\......K\......k\......v\..3....\..$....\..$....\..)....]......3]......I]......[]......h]......u]......z].......].......].......].......].......].......].. ....^......3^......8^......P^......X^......\^......b^......

                                                  C:\Program Files\FileZilla FTP Client\locales\th_TH\libfilezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 45 messages, Project-Id-Version: FileZilla Thai '\340\270\243\340\270\260\340\270\247\340\270\261\340\270\207! \340\271\203\340\270\232\340\270\243\340\270\261\340\270\232\340\270\243\340\270\255\340\270\207\340\270\226\340\270\271\340\270\201\340\271\200\340\270\236\340\270\264\340\270\201\340\270\226\340\270\255\340\270\231'
                                                  Category:dropped
                                                  Size (bytes):6222
                                                  Entropy (8bit):5.160951448498475
                                                  Encrypted:false
                                                  SSDEEP:192:oH3ewMmdrfzUJz8SMO/6T6LIi9KeWw7pqFYYo:MvfzCz8SMQeEIw7pqFY9
                                                  MD5:829E10B9BEBC5FFCD3D3DB2887D8D444
                                                  SHA1:83395C334582C43190B816368A08EB74313B058A
                                                  SHA-256:BB2F2C2B1EA7944229126F1490A4D95B63CEC0242F33BCCFBCC1790B312D16A7
                                                  SHA-512:1751DCFE5EFC3DC1182F06DA95A38D9009FD362ADC1DC2F56F8E523BE8A9AF22C9A90CFAD5AFCB6DE7DED51E2401730A7C5368D161DF2C655C49835D8E3CB5F5
                                                  Malicious:false
                                                  Preview:........-...........................$...................2.......E.......b...................X.......R.......!...`.......................................................................,.......K.......e.......w...#...............................................+.......+...6...-...b................... .......0.......$...........D.......].......w...%.......1...............5...........7.......?...G.......Z... ...?...{...].......].......r...w...l...........W...........].......(.......2...%...6...X...,...............?.......`.......C...v...K.......Q.......E...X...K.......l.......B...W...:.......?.......H.......3...^...x.......b...........n...W.......K...H...Z...............u...v...K.......*...8...E...c...c...............?.......b...........2....Beware! Certificate has been revoked.Cannot assign requested address.Connection aborted.Connection attempt timed out.Connection refused by server.Connection reset by network.Connection reset by peer.Could not get distinguished name of certificate issu

                                                  C:\Program Files\FileZilla FTP Client\locales\tr\filezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 1841 messages, Project-Id-Version: FileZilla 'Ge\303\247en: %H:%M:%S'
                                                  Category:dropped
                                                  Size (bytes):176547
                                                  Entropy (8bit):5.34986970657202
                                                  Encrypted:false
                                                  SSDEEP:3072:OLt8HpjyNsJmfmTkCF15TT7XUw6nKjyGYDl268ATS/EhsW+Vols7HstzlBt:OKX0mICF15TTTOVGYDl268AmEhsW+VoR
                                                  MD5:FAD9FA6DB37D4246F3C76337442FA233
                                                  SHA1:3BBDD875789EA76D6A881CEF9A49EC08559F578E
                                                  SHA-256:105E06BE3EBF1864F6DCC75E8568E571A6DB78CB6A170E009E682129E25021CF
                                                  SHA-512:B9CD6AFFB1B6D9FA76A9FEDDD0CABF22A1FB00F07AE78B702EAB573733FC68DFAF2C9186344FC1CFE3FC4C7F90AFF0530DA047FAEDD0192FC09B8BFD8DBEA81A
                                                  Malicious:false
                                                  Preview:........1........9......,s......,s......-s......>s..S...Ls.......s..A....s.......s..0....t..B...@t.......t.......t.......t.......t.......t.......t.......t.......t.......u.......u.."...2u......Uu......fu......Nv..+...^v.......v.......v.......v..5....v.......v.......v.......w.......w......&w.......w......?w......Qw......ew......vw.......w..K....w..0....w..2...!x..2...Tx.......x..0....x.......x..6....x......"y......(y......4y......Gy..;...Oy.......y.......y.......y.......y.......y.......y.......y.......y.......z.......z......2z......@z..+...Iz......uz.......z.......z.......z.."....z.......z.......z..%....{......*{......2{......B{.. ...M{......n{..H....{..I....{..4....|......L|..:...X|.......|.......|.......|..4....|..$....}......,}......K}......U}......c}......p}......|}.......}.......}.......}.......}.......}.......}.......}.......}.......~.......~......+~......6~......P~......V~......j~.......~.......~.......~.......~.......~.......~..%....~..O....~..R...A...1.......0...................

                                                  C:\Program Files\FileZilla FTP Client\locales\tr\libfilezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 75 messages, Project-Id-Version: FileZilla 'Zincirdeki bir sertifika g\303\274venli olmayan bir algoritma kullan\304\261larak imzalanm\304\261\305\237'
                                                  Category:dropped
                                                  Size (bytes):7255
                                                  Entropy (8bit):5.183774194603898
                                                  Encrypted:false
                                                  SSDEEP:192:nKllslRbs8OZGJqe790vMm3dpuk/YlSUoeg34ooidr2WQo:KllslRb0kB9EpuFwN
                                                  MD5:8C501012D1158DB14142FD23965A7B19
                                                  SHA1:D01D52B5AC282B9A484D5F1BA7819CE708ABBB96
                                                  SHA-256:95445DFC3F7121E466386189622C6677D4E5701F64BD98269887D25B167CA0EE
                                                  SHA-512:B397130F50F192B22588825EDDF1E31BDC4A96E99861BD20898940BBC17A84C49FDA46C32AAADC39AF98EB0793335F967F8E8F02BAFC8F8BCB3D42DD20120BA7
                                                  Malicious:false
                                                  Preview:........K.......t...................A.......A...........Q.......j...$...~...........)...................................:.......V...1...o...........X.......R....... ...h...!...........................................................).......?.......W.......r...................................4.......P...........p...#...............).......(...................*.......@.......X.......k.......y...................+.......+.......L.......-...c................... .......0.......M... ...$...n...........................,.......#.......%...,...$...R...%...w...'.......n.......?...4...7...t...-.......1...............5...)......._.......g...R.......F...\... ...............(...............!...........?...,...Y...(.......(.......-.......4...........;...S...T...E.......!.......$....... ...5.......V.......g... ......................................."...................G... ..._...................5.......E...........&...'...;.......c...........+...........................................$.......1.......

                                                  C:\Program Files\FileZilla FTP Client\locales\uk_UA\filezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 1846 messages, Project-Id-Version: FileZilla '%H:%M:%S \320\274\320\270\320\275\321\203\320\273\320\276'
                                                  Category:dropped
                                                  Size (bytes):235638
                                                  Entropy (8bit):5.417871783378249
                                                  Encrypted:false
                                                  SSDEEP:6144:BJNjM0mICF5XTsI7rwmSbsNc2sIkQxavV:BJ6vFF78mSgNc20Cad
                                                  MD5:5FAB3A171BF12FFA1B52373D8FEC0F8D
                                                  SHA1:91A6A215DD1130F21B8C0BFFD8622BE502DA6671
                                                  SHA-256:E2EF209A335FA6B1E33E4B53B4B0032E30DD66963041D83D093E57D965020749
                                                  SHA-512:9E1E1275C7957675225AB3624D04F537C15DAEDAF83EC309EC0C27E4A111C0D409D2A08A867142545500EEA637EDBC169D9DF37BF1A0A4E7861BF3781FCE61FB
                                                  Malicious:false
                                                  Preview:........6........9......|s......|s......}s.......s..S....s.......s..A....t......Nt..0..._t..B....t.......t.......t.......t.......u......'u......5u......?u......Ju......Xu......hu.."....u.......u.......u.......v..+....v.......v.......v.......v..5....w......Ew......Ow......_w......lw......vw......~w.......w.......w.......w.......w.......w..K....w..0...@x..2...qx..2....x.......x..0....x......#y..6...;y......ry......xy.......y.......y..;....y.......y.......y.......y.......y.......z......"z......9z......@z......Qz......gz.......z.......z..+....z.......z.......z.......z.......z.."....{......${......5{..%...T{......z{.......{.......{.. ....{.......{..H....{..I....|..4...g|.......|..:....|.......|.......|.......}..4..."}..$...W}......|}.......}.......}.......}.......}.......}.......}.......}.......}.......}.......~......$~....../~......<~......U~......^~......{~.......~.......~.......~.......~.......~.......~.......~.......~..................%.......O...A...R.......1.......0...........G.......

                                                  C:\Program Files\FileZilla FTP Client\locales\uk_UA\libfilezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 77 messages, Project-Id-Version: FileZilla '\320\241\320\265\321\200\321\202\320\270\321\204\321\226\320\272\320\260\321\202 \321\203 \320\273\320\260\320\275\321\206\321\216\320\263\321\203 \320\261\321\203\320\273\320\276 \320\277\321\226\320\264\320\277\320\270\321\201\320\260\320\275\320\276 \320\267 \320\262\320\270\320\272\320\276\321\200\320\270\321\201\321\202\320\260\320\275\320\275\321\217\320\274 \320\275\320\265\320\267\320\260\321\205\320\270\321\211\320\265\320\275\320\276\320\263\320\276 \320\260\320\273\320'
                                                  Category:dropped
                                                  Size (bytes):9764
                                                  Entropy (8bit):5.429173954208195
                                                  Encrypted:false
                                                  SSDEEP:192:dclPvksY47DZpJqe790vMm3dpqKk2SsVV3LR/feyLRm32CpXUjUXk:EXksYeDvB9Epq9a3LR/G4Rm32CpXcj
                                                  MD5:46E7D4965D4F0B97004012907CCF4BCA
                                                  SHA1:BEC4B8516EA44AB0ACF8DF9FF3933D72D1498BE5
                                                  SHA-256:649118FA6620B34022288F3A6BDDEA54045A185A61FD744604B3743EF535C1C6
                                                  SHA-512:B2B3AA2647BDD8946C0056B1F4BAE8E5BAEBD8F89AF666E9E96FB432220B8260DB78A4F8D454BBEE72A5F8C73F19D9A2408FF67FFCAA03C4D2FD53C6F2C0D05D
                                                  Malicious:false
                                                  Preview:........M...........................A.......A.../.......q...........$...............>.......)...".......L......._.......|...................1...............X.......R...t... .......!...................'.......7.......M.......g.......{...............................................................<.......V...4...h...P...............#...........&...)...7...(...a...............................................................%...+...<...+...h...L.......-.................../... ...L...0...m...M.......$...................*.......D...,...Y...#.......%.......$.......%.......'.......n...C...?.......7.......-...*...1...X...........5...............1...............m.......6.......8...I...3.......E.......t.......G...q...$.......8.......:.......1...R...@.......j.......<...0.......m...........l.......V......./...X...................".......................#.......2...B...8...u...0.......2.......>.......9...Q.../.......4.......c.......l...T...........@.......#..."...D...F...Q.......$...............&...

                                                  C:\Program Files\FileZilla FTP Client\locales\vi_VN\filezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 1837 messages, Project-Id-Version: filezilla 3.59.0 '\304\220\303\243 \304\221\306\260\341\273\243c %H:%M:%S'
                                                  Category:dropped
                                                  Size (bytes):193868
                                                  Entropy (8bit):5.645859513519328
                                                  Encrypted:false
                                                  SSDEEP:3072:FsjxEC3AWSxhqPsJm1zTkCF05T77XUwws+nSwU42qYbfnkboGOnLCPsoCY89W8kZ:6ju6AVx7qzICF05T7TbwWbkorT9WT
                                                  MD5:DD181DBDA5E7EE36D7E2247D73BA327D
                                                  SHA1:EED3B6C999CF61AD374E5718565E79F9BD9F10BA
                                                  SHA-256:4B9EBAC6ECC62D63D4F12681A62EC23B6A9E522B0BE3E16EE7A9402015527EC0
                                                  SHA-512:6A88D5104F2FC6CC23619FA8EC9F5A5BB67C40441B8000FC7C13EA1EE740CF93C4E1DD260ADC0B4D69D2F2372558C8C3ADB8A3F3A2D44B2AE4EFA383571A5CBC
                                                  Malicious:false
                                                  Preview:........-........9.......r.......r.......r.......r..S....s......`s..A...|s.......s..0....s..B....t......Ct......Xt......bt.......t.......t.......t.......t.......t.......t.......t.."....t.......u......&u.......v..+....v......Jv......Xv......lv..5....v.......v.......v.......v.......v.......v.......v.......v.......w......%w......6w......Dw..K...dw..0....w..2....w..2....x......Gx..0...bx.......x..6....x.......x.......x.......x.......y..;....y......Ky......Vy......^y......iy......{y.......y.......y.......y.......y.......y.......y.......z..+....z......5z......Hz......Zz......jz.."...qz.......z.......z..%....z.......z.......z.......{.. ....{.......{..H...D{..I....{..4....{.......|..:....|......S|......j|......s|..4....|..$....|.......|.......}.......}......#}......0}......<}......G}......M}......c}......k}.......}.......}.......}.......}.......}.......}.......}.......}.......~.......~......*~......?~......F~......Z~......h~......q~......{~..%....~..O....~..R.......1...T...0...................

                                                  C:\Program Files\FileZilla FTP Client\locales\vi_VN\libfilezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 75 messages, Project-Id-Version: filezilla 3.41.0-rc1 'Gi\341\272\245y ch\341\273\251ng nh\341\272\255n trong chu\341\273\227i x\303\255ch \304\221\303\243 \304\221\306\260\341\273\243c k\303\275 b\341\272\261ng m\341\273\231t thu\341\272\255t to\303\241n kh\303\264ng an to\303\240n'
                                                  Category:dropped
                                                  Size (bytes):8499
                                                  Entropy (8bit):5.510594910305927
                                                  Encrypted:false
                                                  SSDEEP:192:nKls6ZGJqe790vMm3dcbEELnXElrAC8R2aLn:KltkB9EcbEyn0pAH2aD
                                                  MD5:6A4DA2920F8BC850DDB8A9AB82959499
                                                  SHA1:FFDEE6B7F34535418A5A33AEE367ED75105A488C
                                                  SHA-256:0C085A7062CE530780CABDCC9403050C33B6DAF079A46AF9BAEECC2F9239A2E1
                                                  SHA-512:3EFC3DD0D3325D73CB3ABD432F204B7EE4F092C30EA6F6904162660C37A5FDA259E9E2C4007D070A60CDEDECA74CCA35CFCFB02FE306A151520A916E5993FCD8
                                                  Malicious:false
                                                  Preview:........K.......t...................A.......A...........Q.......j...$...~...........)...................................:.......V...1...o...........X.......R....... ...h...!...........................................................).......?.......W.......r...................................4.......P...........p...#...............).......(...................*.......@.......X.......k.......y...................+.......+.......L.......-...c................... .......0.......M... ...$...n...........................,.......#.......%...,...$...R...%...w...'.......n.......?...4...7...t...-.......1...............5...)......._.......g...f.......i....... ...W.......x...7...............3.........../...'...J...2...r.../.......9.......P.......,...`...m.......b.......:...^...<.......9................... .......9.......V...&...k.........../.......).......+.......&...6...0...]...5...............S.......]...2...*.......7.......+.......M.......3...m...5.......!.......$...................7.......H...#...

                                                  C:\Program Files\FileZilla FTP Client\locales\zh_CN\filezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 1820 messages, Project-Id-Version: FileZilla 3 '\345\267\262\350\200\227\346\227\266 %H:%M:%S'
                                                  Category:dropped
                                                  Size (bytes):159077
                                                  Entropy (8bit):6.2667539203764795
                                                  Encrypted:false
                                                  SSDEEP:3072:1isLm0gomCFSVTQ7kkwnTzhmFUkONey5rxePF:hbgrCFSVTQI3zhTdQPF
                                                  MD5:5FE037FBA2A3230AC69F59B1A790A1D0
                                                  SHA1:1ABBC832F47629BF3A82BF211739C8B68E6051CD
                                                  SHA-256:8CE7FAC3B221049D831DD1F43277AA9D1BBB4BBBAB020F038E368A63AA5A802C
                                                  SHA-512:FE824B5ED36A4BCE5DC6937E8F6CD667BB9FD8BC6DC77FE3123DEE7C3C7A93C80336D484F83047243085844440606705906CA1659C842DB768DE5C94EB111FE7
                                                  Malicious:false
                                                  Preview:.................8.......q.......q.......q.......q..S....q......Pr..A...lr.......r..0....r..B....r......3s......Hs......Rs......rs.......s.......s.......s.......s.......s.......s.."....s.......t.......t.......t..+....u......:u......Hu......\u..5...ou.......u.......u.......u.......u.......u.......u.......u.......v.......v......&v......4v..K...Tv..0....v..2....v..2....w......7w..0...Rw.......w..6....w.......w.......w.......w.......w..;....w......;x......Fx......Nx......Yx......kx.......x.......x.......x.......x.......x.......x.......x..+....x......%y......8y......Jy......Zy.."...ay.......y.......y..%....y.......y.......y.......y.. ....y.......z..H...4z..I...}z..4....z.......z..:....{......C{......Z{..4...y{..$....{.......{.......{.......{.......|.......|......#|.......|......4|......J|......R|......f|......{|.......|.......|.......|.......|.......|.......|.......|.......|.......}......&}......-}......A}......O}......X}......b}..%...r}..O....}..R....}..1...;~..0...m~.......~.......~......

                                                  C:\Program Files\FileZilla FTP Client\locales\zh_CN\libfilezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 75 messages, Project-Id-Version: FileZilla 3 '\350\257\201\344\271\246\351\223\276\344\270\255\346\237\220\345\274\240\350\257\201\344\271\246\347\232\204\347\255\276\345\220\215\344\275\277\347\224\250\344\272\206\344\270\215\345\256\211\345\205\250\347\232\204\347\256\227\346\263\225'
                                                  Category:dropped
                                                  Size (bytes):6663
                                                  Entropy (8bit):6.043681250288299
                                                  Encrypted:false
                                                  SSDEEP:96:inIKT56eFn8AlgnVvqk9Ra1Jqe790vMmU87cqO6zu53YL83KlUSKMHEElNElEeze:nKlzn8A0ZGJqe790vMm3dw+lfDrEl3y
                                                  MD5:336C05F3A32545E23392F0096E2775FA
                                                  SHA1:6274816F4F1920BB12A9C1E57A419A88E810ABD6
                                                  SHA-256:A2AD25FE9206B046D126CB7933E06522F62C11799BA6C71D340BB297DF6AD90E
                                                  SHA-512:D3522F2D782B0EE30038BD8D663B12E7F0A5F9CAEDF18323933705535B3D00E574AC9953AA5B1AC178C7E5B67043133DB973316928D773C84EF69A576BE6FF39
                                                  Malicious:false
                                                  Preview:........K.......t...................A.......A...........Q.......j...$...~...........)...................................:.......V...1...o...........X.......R....... ...h...!...........................................................).......?.......W.......r...................................4.......P...........p...#...............).......(...................*.......@.......X.......k.......y...................+.......+.......L.......-...c................... .......0.......M... ...$...n...........................,.......#.......%...,...$...R...%...w...'.......n.......?...4...7...t...-.......1...............5...)......._.......g...<..."...-..._...............................................................-.......F.......\...'...r...........M.......C...........?.......X.......q................... ...........................................-.......C.......V...!...r...................-.......?...........".......5.......T...'...g...)...........................................................

                                                  C:\Program Files\FileZilla FTP Client\locales\zh_TW\filezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 1841 messages, Project-Id-Version: '\347\266\223\351\201\216\346\231\202\351\226\223 %H:%M:%S'
                                                  Category:dropped
                                                  Size (bytes):158375
                                                  Entropy (8bit):6.233321326002652
                                                  Encrypted:false
                                                  SSDEEP:3072:OLt8HgCZowXsJmfmTkCF15TT7XUwomD4vuLlh4hOXx42r92ERK61+1Rkgf7IcGM5:OKzOb0mICF15TTTkSx42TkhhfB
                                                  MD5:3AD8418FF2C7BA4EC3448BB0F6CC426E
                                                  SHA1:40BE758B8F0A7BCC6B0FFC3D7D78EC3FFB9A8373
                                                  SHA-256:66D4A2A1C1067C35EB21BDC1C83C3D50960FE4AECDD0F394D55E2556BF9BE342
                                                  SHA-512:52CF00C322814474CB7A21663A466A7C13F03D9F08E848A88017C210EBE8C353D0EF95D04E550D08D20E6767ECB786C199B8B7069C1EF715BEE461F6C77E1B2A
                                                  Malicious:false
                                                  Preview:........1........9......,s......,s......-s......>s..S...Ls.......s..A....s.......s..0....t..B...@t.......t.......t.......t.......t.......t.......t.......t.......t.......u.......u.."...2u......Uu......fu......Nv..+...^v.......v.......v.......v..5....v.......v.......v.......w.......w......&w.......w......?w......Qw......ew......vw.......w..K....w..0....w..2...!x..2...Tx.......x..0....x.......x..6....x......"y......(y......4y......Gy..;...Oy.......y.......y.......y.......y.......y.......y.......y.......y.......z.......z......2z......@z..+...Iz......uz.......z.......z.......z.."....z.......z.......z..%....{......*{......2{......B{.. ...M{......n{..H....{..I....{..4....|......L|..:...X|.......|.......|.......|..4....|..$....}......,}......K}......U}......c}......p}......|}.......}.......}.......}.......}.......}.......}.......}.......}.......~.......~......+~......6~......P~......V~......j~.......~.......~.......~.......~.......~.......~..%....~..O....~..R...A...1.......0...................

                                                  C:\Program Files\FileZilla FTP Client\locales\zh_TW\libfilezilla.mo

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GNU message catalog (little endian), revision 0.0, 65 messages, Project-Id-Version: '\345\217\203\346\225\270\347\267\251\346\262\226\345\215\200\346\272\242\344\275\215'
                                                  Category:dropped
                                                  Size (bytes):5388
                                                  Entropy (8bit):6.0170717052499505
                                                  Encrypted:false
                                                  SSDEEP:96:Lf6mi6Glzn9VQk01Jqe790vMmO87kqGu5Wij6cnyX3E2C+okHiH:Lf6hB9MJqe790vMmdFcoyHZC+o3H
                                                  MD5:F5BFFE8389B57ABB36CCA99AA5EB42B4
                                                  SHA1:42EBA1D4BE15DC4E4D6B45DB2C4AF8323A0034A3
                                                  SHA-256:896DDD34D4034080A5C9FCF122E3AD4BBD66A08C8BDFDEC17A70DF1C7E4DA6BB
                                                  SHA-512:DCC4A745335F961A0DD8F577A038655261C8531EF29AAFBCD39C31224B2D10910A20ACADBF3192F33EE5EA24AC8449CB268884C687F3997C5C93B9D535CF248F
                                                  Malicious:false
                                                  Preview:........A.......$.......,.......,.......-.......F...$...Z...................................................X...!...R...z...!...................................2.......L.......`.......m...........................................................4.......P...c...........#...............).......(...'.......P.......n...................................................+.......+.......-...Z................... .......0.......$...........<.......U.......o...,.......#.......%.......$.......%... ...'...F...7...n...-.......1...............5...#.......Y.......a................... ...........0.......L.......Y.......l...................L.......B...........A.......Z.......t...............................................................#.......6...!...R.......t...........2.......A...........................;...'...N...(...v...............................................................'...)...:...&...d...)...............................#.......(...(.......Q.......b.......s...&.......$.......$.......!...

                                                  C:\Program Files\FileZilla FTP Client\resources\16x16\filezilla.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):459
                                                  Entropy (8bit):7.421008793663681
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7IC8jAqPfRPV9wVWxc79/mrKGjHpE6oFlUb/gq:tjAAJPV9wWuh/qHC6oFgN
                                                  MD5:F3C6E2F122398052A7AFE5D9924A32E7
                                                  SHA1:587AD001EE990EA397C14524D92E78CE79581897
                                                  SHA-256:3837185790FA51CF6A91655182B81F8AF988170FD693012A2F153EB7963FB9FA
                                                  SHA-512:85A46585FA11D3752FCDA256FC84A94EB498D9E872B3251D94DE2AF2E2655EE4E0929961139F7DCA956CB7BBE569BA0D5F3BA4BF324C9631835C5C7143692B2E
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx......Q...K...f.F....K3...l...m..~.v.........M.....-.8.......1t....0..E.e|.h...<....x{.h....Mml,.......d`..k...2..4....mml.)Q.o4.x...x1...t....k...c...!..4.....**Jcy...q..!..}*!.._O.j`.=T....b.h3.N.5....\...w..1m..~=.[ZX.........P..8.Jur2M...5.5...<Xm6M2...o...z.....e..[[.+|.|9?n...C..n.:....'........;.'....l.*...U.h.q..3k../\.'K.....|..D....f.....@.P...nsh.......U...7......:.,..7\5....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\16x16\throbber.gif

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:GIF image data, version 89a, 16 x 16
                                                  Category:dropped
                                                  Size (bytes):583
                                                  Entropy (8bit):6.361058456070397
                                                  Encrypted:false
                                                  SSDEEP:12:SQVdHeF5EQJHav2uw3dxeXCLUUrUCL03M+vh1en:OxMOuQreXqUf3M+vh1e
                                                  MD5:9279BC2F725A07944E01E3B56489466E
                                                  SHA1:713093C59B442D9E5DE54576B0749E8B91EB72E8
                                                  SHA-256:3C4B0072D9EC072C6BA94EEF2972DFC9A1C3EF6E466F29ACF8A663799E6047E7
                                                  SHA-512:2B2ED3CE522CB6837033A4950466B69002B55D6D30B5B2A8A5559B40443919964FB1D1FFB456B5AF2A60C0C35B25BF2C4BB588DA58E5727228A294DA4A90F798
                                                  Malicious:false
                                                  Preview:GIF89a..........BBB...bbb............!..NETSCAPE2.0.....!.......,..........3h...0.Ik.!......N.f..1.......A.@Q.-;.9..)...Jk.H..!.......,..........-h.....!BT.......ECClD3l 1^@Q..,o.A.... K84$..!.......,..........-h...k.!..d4j.pD.@....5..U...Q.a..p...n.....!.......,..........-h.@.+.........m.@.. .JA.E.....5..Xm..08.$..!.......,..........+hjP.+........&vA@\b4..I..Z.P.t ....<....!.......,..........+h...=.K.P.;M.E.X...C..A@tC;.h.....B..=.....!.......,..........*h....=.'....& .U...p.@t.....~/.....j..%..!.......,..........,h.l.-...uQ..V@Q`. ..8*...DH....`..B.....H..;

                                                  C:\Program Files\FileZilla FTP Client\resources\16x16\unknown.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit gray+alpha, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):89
                                                  Entropy (8bit):5.060583578134108
                                                  Encrypted:false
                                                  SSDEEP:3:yionv//thPl9vtJK6PtFSqpRuH9vKHlbp:6v/lhPO6fONKHdp
                                                  MD5:03198F6783D16BE48CEA18301F1457DB
                                                  SHA1:55598904340172041826972F784BEA4F3FF9B179
                                                  SHA-256:640CEE2F245A1DD93DBC3CF6CB7D61875431D199DC4ED12C6578DE96E3DD4238
                                                  SHA-512:F59C88C9050554A43640524A100B1E7FF05C2B696FE967BD8AB88B24F67DE606D0824E5A0474FDA12C02C01BC995A337D62D56B8B02DE96ADC264C68F0AB4497
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...............7.... IDATx.c.7...x.a4..0..F...0...z......sH....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\20x20\unknown.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 20 x 20, 8-bit gray+alpha, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):184
                                                  Entropy (8bit):6.302679924142554
                                                  Encrypted:false
                                                  SSDEEP:3:yionv//thPlbGiIJHdhJ+jE2F+82AmjjvOG4eFHdW2xoalvOEsxT6e6LIx/kup:6v/lhPU31+jE2dUj69igs2nxTT6ETp
                                                  MD5:81865F3AC002213307807A172D3E2BA0
                                                  SHA1:A8A8D792D913E45A3B25CDB8C2662ED9EB7B0EB4
                                                  SHA-256:979D50D9330CD9A8F915F822D4E40A62170483FC276D5866FB37E5951F913F98
                                                  SHA-512:06759F6A3457B91DE47A10BB8C8CB42183B800146CD0149A6A26CC2CFF5280BCB2EE9EF437A2DB560BFA6524E6172339BFE112EC9785E92D8891FB51A67031D3
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............'......IDATx.c .$1,b......[.}.......G....+..P.`. ... .............#F!;P.Ob....>"Fa?P......3H.W....L...y....6!L....&a...(.?.x......^........IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\24x24\unknown.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 24 x 24, 8-bit gray+alpha, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):212
                                                  Entropy (8bit):6.669656469204791
                                                  Encrypted:false
                                                  SSDEEP:3:yionv//thPlT/Xt+Gw1Ul4HoJZKx2pee3M9P/17uRXY2HkqYHk6wizCUKOeq7ldE:6v/lhPXPxm60x8Bc9P/x8d7TCDHmVp
                                                  MD5:D0C1B3BAFF23B05FFF6BB33ADDD5C94D
                                                  SHA1:1E496CC0A6FB53A0F69436FA7E653290C423C93E
                                                  SHA-256:02ED6B1F90F7DB4143BBA9B7B622EE307E4409C7D3EAA67BA219859FE643F6CF
                                                  SHA-512:4323B06FD4BC2F788A2A63FA57F02265B3F5475CD74CD4715B7B142B2B88ED422F521B724ECC990F458682ECF39FC4F5CDEDD133B6AA719612068B1CF4B73485
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............J~.s....IDATx...%T.@.....2...X..G.T*..%..`.....q..u..|V..]..iX../Z..........p.].l)....B.g.)qW....Y...Y...Y..z.Q..!4z.d=B....*..aN1.kq"..E.$..%..4.......K7..Ss.j......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\32x32\filezilla.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):746
                                                  Entropy (8bit):7.634189179638557
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7ivTFAH8ei9K9IiKtO0M4+ZPWzANsYaQupZVtnWQ+5OoCOBnZJYz:7Api9VFO0xmP7NsmupLJWdOoCOxZJ6
                                                  MD5:BAA555FA887E09927F18600880C5364D
                                                  SHA1:8537F935CA921F9D79C7D6C2B34B39608152ECE7
                                                  SHA-256:7411D2321A7110EAF08A2816AB28ED209442AEF7D774A7A69A2A3AB40C07AF22
                                                  SHA-512:BDB7AFD1E1503577826280FB8D813001B514D931318F0CA440BDF03313623D5F5620BA1ECC9A7C65262D4EF92C763DCD107FA4F9A3EFB5D2F598A2172CF0CC25
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx....mi..{.H.I/..Vvc...m..m.m..5...mw......>...E.......d.i.{7@...s.......~3......1b.-.\......"S..Fl..;\....|.IE...F.......l.iE...F.)(......G..4.....d....r..........H.j..f..B..._{....l._.B..x.....8..O.....4........X...l.FF...CP..D....8..k.ti......!Re.......4.<H;.*.d.S...g.L.....L.t.(..x{#\.....!2........;dg.._....8.....hL.'..A*....I..#......jk. ..z.....T...@...&..y..:.^......4.=+{........?..tM..u&..&.gf..;z.:.....|.Y_|.N...xO&..6.gg......Rx...;}...?.....}..ss.q...m.u\...G._.Q6....9...N./...>...<8..Z..P.};j.AWH....@76USC..U......pn.....k4...Z-6..q.....j.A..L.......7..v........1YW..++.n..S...........`...}))(...O>ir.P...&(.;9..$.............d.Y.[.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\480x480\filezilla.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 480 x 480, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):7870
                                                  Entropy (8bit):7.8279205287088685
                                                  Encrypted:false
                                                  SSDEEP:192:tv6dCGVB5k0RUekkGJ+Vqk3ST+9cNG5wPGf7bU7:tSd3B1RKkGJ+Zz9lwa7bU7
                                                  MD5:95FEF4675F817D2D06A7CDDF9A109288
                                                  SHA1:0981D4769DFA65E65ABD7681E5E4ADE3B457F94E
                                                  SHA-256:50EEEE967412EC62B165C3519425A387C61BCC52FDBBA74151A7F3E647EE357B
                                                  SHA-512:E7EC935145FDACA44BC2343224B713873C3775FD37F2719CAE7E24E759FCCBB1C6730CA631EAD77A4D8464DD9A9C7EB97706563FE715A56B6F8664E52B50640F
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............J.N.....PLTEGpL.............................................................................................................................................................. ........QQ.....CC...............++..hh.oo...88.............^^......................ww.....................................................................KK.............55...................XX.~~.......``...ff.BB.......RR.........vv......nn.........!!....................................................gg.......................99.......MM....)).........CC...............||.............\\...UU....... .ii......................66..........vv.......pp.KK.dd......................,,.............BB.SS........................................................................%.......tRNS...5i-....WQ...q.D.....&z ...........K.._.=....................................................e..........z........................-.........M..\......!T......................

                                                  C:\Program Files\FileZilla FTP Client\resources\48x48\filezilla.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1132
                                                  Entropy (8bit):7.7759314571334945
                                                  Encrypted:false
                                                  SSDEEP:24:31grSsEyCBQCK/Ub1kiSFLsz8VGSOyqlbK/mALA47iZRd4e9KGHJa1:3arfE31b/swdSOHd4XE4GNBc1
                                                  MD5:DFABA6D62BCDA50ECCFB39EF591C207B
                                                  SHA1:00D18080A95C7EEC55C2A91623895AF241917F56
                                                  SHA-256:ADCC02F2D63D265DA0254695E90C7AF672702DF1F274D614F01B358383B3EB8B
                                                  SHA-512:0716D9BE24E022021392814960AFA0C89A49444A9D47A9587EF727BDF90C1E796147C710F3214937854BA5198B3B14E81FCF346F88D78CC69153A148E1843DC5
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W......3IDATx...lli...k{.dm..Z..m..;S.^...\.5f.=_.n&'.?.g.$O...b.9....3...a..F!.d.9.........3..#..c.....k.a....c..."}C.f...cSB.=..&.....C..4....g4.......;d!....{.a4...$}..5....` W..2...zK.....P...wF..+...a...`0..3...U....e...K./....z..T1.tJn.0S.0...<C.+l6.-.fJ.O.@..*.....~XrK5/.`.X..*.=.T.-.B..`.=.@..LM.,9.\o.(....W]E..6q.........p/.....w...........S.P...fZ..]&...<.:...832B+.'.=....3..u..y$.feE....3v.:.n..*F.N:SR..;3C..jk...v2[+|.....yT.../K..11...K.X^^....zA..<.....Un..../.<hm............z"..?..o..u{...sOS..,Y~.B.p.l....D.@..y&Ulu8$..LcyGj*u8....'.!.!.......Wv....0.sfdP..y...../..U.ss...$.k.,o.....O...#.!.3..O.@.#n7U..r..Z.......w.....@..}...MKN......t..QG.k.I]D...U.^r.U.mo.\."cywA.ut<...EE.....6~R*~..se...D.5........Nk.........e..b.@..jk.....\....ee.1.t).}...\...c..........LM..F....._+..f....9cb8.q#U..>....e...F...J..%./..M.sO:rs.r.f..q........e.h..f..P....H.HOg...vX.y0...HL9..N..2.FW..w.>..bb...O

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\ascii.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):308
                                                  Entropy (8bit):6.972327902057909
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPfIoSO1WN6/osdMxpmtT7bllXhBwXvUrgMXQoFNsVh1nXjp:6v/7qO1XZx/XhBIvylNsZnXN
                                                  MD5:349633C4CDC29C02CB34E8B605400B8A
                                                  SHA1:59F0AD012A4BF5F1BF1D3CBF59B19CFEBCBEBE76
                                                  SHA-256:90BF623710CEBBC06AB764E25ED74F6189F3E6B279C75C7EB5C69E8564F0B1E7
                                                  SHA-512:CECE4F47776C4406377E9B5AE54CC4441AE3348B3F55E5B9FAD4B88AC295CE781093D34941F72CADD7A14361600F11A2D09C9FE24F13298DBB6DE5EC64EA72AE
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............(-.S...rPLTE..................M....]......vzz...F.......SUUbde.......EGG......"##........................................k%D*....tRNS.@..f...pIDATx...EB.P....7t...t..z......g...DJ)....t;!b.mfE..C......2.-q.u.....:Y....K{.PZ...qlK.jW......D9....}j./,RH.jp......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\auto.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):396
                                                  Entropy (8bit):7.208882760983336
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7uNpyU6eHtQh8QCBtQuQAlM9fzYsVmWc:nTCeH28QCBtu9rY5Wc
                                                  MD5:434C26E5752C7A86ECA4D6F8452F4ECB
                                                  SHA1:14DBA1F9079EC1BA3BA78B2245D98325F95F1DF6
                                                  SHA-256:FF847AD75181DD4C0A350B43741C5CC6D94258A323A675E406AFDD909F0AE31D
                                                  SHA-512:A6BA4E71BC8F7088E71428AAF8013FF592752CF9D6D97B973E6E501C18582C60FFB48E7CE1650F0375122308291CF1E4742FD9966D8351B50271F130761D920F
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...............h6....tRNS.......}....AIDATx....hEq.._..m.f..3r..S..l.m.m{q....n....;W5:.J......h../........Q.f...$.."u.6k.nr.ZA(.>w..q*[s*]t.N.....b-.\bF<....p6..H.!.Y...j).......<....3.k.4....=B............o.wB...wt......Ja.Dt8..A(-3......YW`iv..[......t.I....*.(....|tqinn.}x..D^I.dj~...qso.|f..Gg.t;.P8../...-oaO.ab~}ne{zqc|n.ieA.S.".P...5.."....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\binary.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):298
                                                  Entropy (8bit):7.0096573424619395
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPfRQzKHa2iCGEALO+Pym0ry2tXhR0cu+CvBmd/VNNm3lMS0p:6v/7azKHa2iCG1LO1ySXhyUWKQ3WS2
                                                  MD5:7145960BCA9C6FADE0613C66A3B936B5
                                                  SHA1:8BAC1ED1D6930D0AA5B20FB72B72831A1987F815
                                                  SHA-256:22E70C98254032BC9533FF40D2F818EFDF9D7790895F27FF8BD14FF4223ED534
                                                  SHA-512:CFE45C72604DC90DBE8BF3335B8131694862C461A3F7F1330C494CCE2A2E00168FAD49E0D7A91A54964C0DA8C94C39F421ECF9209FD01D771C7E7455C71487A3
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............(-.S...{PLTE..................M....]...d..u........F.....v......{......P..O..O..S.....s..Y.JY.L......].k..........................j....tRNS.@..f...]IDATx...1..@...y..o....,.....K.).O..'..1.6CI.^.<.iZ.X<g7.\.'..9.jf.0+.Wo....#.h-.c;.#.../o.,.Ip.V.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\bookmark.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):165
                                                  Entropy (8bit):5.973230255679673
                                                  Encrypted:false
                                                  SSDEEP:3:yionv//thPl9vtt+NTlrRSARBx7jtRi+LeSLJcx4UC/Vn1g0ftYzYgRPrk/lkup:6v/lhPmNpocB5imeSLJA4UC/lq0fS0UC
                                                  MD5:00AF3E61EE2B3FA856AD1B3FAFF8FF8B
                                                  SHA1:35745115917277BA5429707ED830BB45519AD788
                                                  SHA-256:8B58B62E6465CAB168A8F473A888D09C180EE6E54EFA521D3C022085F65D8923
                                                  SHA-512:B37C4B8692A03DA39DD1C494808DE63DDEA6B0B00EFF8640735D757480170DE1B5BA85E17F5BC3F393CD9FF9E912EBBD40FACC4EDA50FC9A8F120DCBC46CF3A5
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...............h6....tRNS......u..7...ZIDATx.c.o=I..........L.S.>.l...q......j..C.i.H.N..k...h...\68.."..+w.....X.@.a......h.Z..(.A.o......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\bookmarks.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):165
                                                  Entropy (8bit):5.973230255679673
                                                  Encrypted:false
                                                  SSDEEP:3:yionv//thPl9vtt+NTlrRSARBx7jtRi+LeSLJcx4UC/Vn1g0ftYzYgRPrk/lkup:6v/lhPmNpocB5imeSLJA4UC/lq0fS0UC
                                                  MD5:00AF3E61EE2B3FA856AD1B3FAFF8FF8B
                                                  SHA1:35745115917277BA5429707ED830BB45519AD788
                                                  SHA-256:8B58B62E6465CAB168A8F473A888D09C180EE6E54EFA521D3C022085F65D8923
                                                  SHA-512:B37C4B8692A03DA39DD1C494808DE63DDEA6B0B00EFF8640735D757480170DE1B5BA85E17F5BC3F393CD9FF9E912EBBD40FACC4EDA50FC9A8F120DCBC46CF3A5
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...............h6....tRNS......u..7...ZIDATx.c.o=I..........L.S.>.l...q......j..C.i.H.N..k...h...\68.."..+w.....X.@.a......h.Z..(.A.o......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\cancel.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):345
                                                  Entropy (8bit):7.067400943510153
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPmNpoXIubB4Qt4sFqHnVIu4f7zIwcbTgw6eh0HHpu+YHtwpHMiLfFGCGm+t:6v/7uNpAIubbt4LVR4QwGgw6ehQxewpm
                                                  MD5:FBC5D88D9F0E29B6ACE7B88109308632
                                                  SHA1:9E7F3529A17E24110302F63DD4D140B00BF2E603
                                                  SHA-256:8B35072F21559F3175583B2F5A90C578DD8583C735D6108657C163ED21813409
                                                  SHA-512:8702B05CFE7E352AED2BA64F82ACA586A365FF26C7551733C7D9A8FE3FDD2B7E06010A94A0FC5D0999454994D6B4EE814999F48638D20B439AC13748FF943109
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...............h6....tRNS......u..7....IDATx.b.o=I.b......>.@..;..X....45.......z.?..L.}.=G..^o..au..Z....,.Z.......`.R..Z.2J.~..0.1..|]..wq....!......n~.|.`#c.0...T.s].\_.4-e.\....V..q.y\[+].[......R&.4...>mm=ml.KH...N.N.......`...H(..O.....)a.:.F...(..S+.,.}.......^.&..o..P.3A..'?._Ff.}j..(..R......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\compare.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):439
                                                  Entropy (8bit):7.393238619174529
                                                  Encrypted:false
                                                  SSDEEP:12:6v/78xi86wjdtcw9ogjaBqt7iXwZEJAFILuU6jRElN1N:NxRdtcSoglwwZEJyU+ilN1N
                                                  MD5:93A6FEEB5D70E5C349E8618C8AA90E4E
                                                  SHA1:29470D41C7AEB3BDCFA7C66862FEB1380FE9677A
                                                  SHA-256:B7F788693DC5EB63A5DDAE21C114EE35E9E8A4629341AC5ACA1C59E6F1892AF1
                                                  SHA-512:CE743D30E9B7F3DA2748B63E083F9BCFA2ADD8A7976432178A8C40B06872D5A2000C98E10D1DC2D32F1A3D4FEE6F81A1FBB2437DA35C0F6155B30774F1BEBE86
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a...~IDATx....G.q..'...*.... ..N03c..YY..F*.O......a.n..l.....FP.n.=.s....yx........p.gR.+....aX...l.:..T6......H..g...C......5MC<.G...f..y.}...{...4.6.P(.$...R.I.PUu. ....Gx{..Su..B!.<.H$b..Nm2R...........b.8=..eY.%...}F.v!?...@Z.(.Z..6....E..X..d..$y.. ..-.^.\^%.`.....f../.i?.t.b[8p...:h.Ro.ZF4.5...p..u(!sUA.R....6w.._./..`..z..2.t.K..(am..g~.=`.S>...PbA.e....W......k.c........IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\disconnect.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):342
                                                  Entropy (8bit):7.190997209876537
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPWjWlso4SdQWv6tDvng6wtWN3Y515FjAhpLLNzAp4EEI+sI17ap:6v/7flJpdQWv6t8kNo5ApL5spxEI0Fw
                                                  MD5:A621D469319033B95EFE33E25B1295A7
                                                  SHA1:C8E209104FFBCA00677ED4D6A5E86D2E967D6917
                                                  SHA-256:8D2D5DD229B5B47F0C48C4128F1A715C1A0BD357C7DBBD65F338A2A8D681C327
                                                  SHA-512:06E2A6D17015497D6CB580D1064CD28008AE06D36447E5CC9DAC2850E065E883BAC0CC98C083A078E04D88263E823E7A69B634017A6476AE26A5B8735CDE68F9
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx....CEQ......l.m.vM..)....=.....;...1...`.3...{...G._.S.&.....'..Z8F..>.v.`...J.........{..:.3.(E.?.w...g.D.....zvlB.t.je}.....b...$.......7...d.._.....3....x#...C......>...2.$...YA.r5.....z..p.......A3....a.!......;.t}.(..3}..g%..?F....!...$..j"@...>.........#RH...|....[....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\download.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):315
                                                  Entropy (8bit):7.053855527232501
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPWHDx7Hvcm4aJICvUA4VHvpZacUJ2BKE4leMpjTihXCeVp:6v/7YDxzcmxICvz4VHhk8BKE4leMN2hn
                                                  MD5:83FE2C7E0C844CC65CB233A4ACF48E42
                                                  SHA1:48BC9B4BEC5C63394E6EC29F284E0C3D22599DE1
                                                  SHA-256:8F49F72F69E489BC19429141CFFE2F4DD55A2E249F87874377B662E6303D375D
                                                  SHA-512:61D7B3F90351BC780FCB3D896DF4AEC6EF102226F93AF78E5D617AF3F7D78589BB121A8766EAC416898947E68E6A0A45663BC18DFE652FAC6A30995E4624DA4E
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx.c.I.?..o..b.$5}..".5,}k..C.....,13..Ab0.........(.WJ6n.z>.....S...1..FX....f.R.q..n.....K6..OZ..?g.....&pW`..$..Q....J...).OZ..?i....5..K....M...a{h...H.p....E.......\......=..8........j...(......@./.OF.`,%...F.......#.?..%.x.2..NP.E.6J.C...0.".............IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\downloadadd.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):418
                                                  Entropy (8bit):7.285508453296903
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7zHP2KHn2Nfh7ShEBLEIr6ky0AXbPB2G/5:HKHSVXVZrA0ilB
                                                  MD5:5FD0886A61D5B2141ECA5630F5617C56
                                                  SHA1:DAA0D7E47EC62CCEFD95EC9570BA632BC2B63877
                                                  SHA-256:4D65E085E8F3E4E287848478A0AEC2AEB2FCFA657C54967726D95DD9DC184641
                                                  SHA-512:EB2195D3520289EFB4B56A2FBDBBA777806C8FBA46C3403F78A0B7EFE596587987BFD4E66789D165FD7C2B10F98739EEB0A4F1C0256999EA4F9A2979D8D7785C
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a...iIDATx...... .E..{...)*.....$.........gx..O}.{.H)AX.N.c..58. |$.sb.1.........K..!.Xk..../4.=b...C..C..9.?.g.43..5...v..5%....=..?B..)....$.....3b....).(o...............l..5...'.m..................{W./...,......O......d.....K...-...dgN^.74.jr.P......f ......-.a.......R>.......R0}...q=+..w,.:w.XST..).9..`'.....m+.....u...%..lq-...R;%.f.).....>y...4L.d....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\file.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):316
                                                  Entropy (8bit):6.917017566145369
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPmNpocbf5uKz0D7rxxbOAUm2+3bcjaRvfLGtTE26podp:6v/7uNpZbfIs0XrxcVaRvfLGGsz
                                                  MD5:A6ED3AAC6C8F8496DDB28B97EA88044A
                                                  SHA1:96A2CAB75854F10D342DFE402232C2338C3F12B6
                                                  SHA-256:E80E754EC1E92B8E65A13AEA3A07DA8556636C97614944B16ED7317B137E4D37
                                                  SHA-512:A98D15CD20B0D6E3C2494172A096FD347AB33332627F34FF4FAE6A539CA70DAB15B32A7A4ACA798E1F8F2878E5B58BB09127EF1A0D6552439E736E948BF47F64
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...............h6....tRNS......u..7....IDATx....v.Q...?.......UN.a.K.....B.S....W....<....s}~.W5l....C.N.......k{..&.i}.Jk..n..v0.U.?..B....6.Vu..om..8..a^......P..8../..\Zv7..I..@R..8|....t...3+..l7.?-.N.:...t.T..Nq..j.....S.E;Lt7...S.Z4.F.;Q.$.;.......N..d.AO....#AA..x.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\filter.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):331
                                                  Entropy (8bit):7.041857638383337
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPWMIBVJkYd9tCvjlaleb77FMORIhRaGybnoxjCmjva0hazICQup:6v/78nVkjlal877FMiIhRDybQCEvSzIy
                                                  MD5:2D4888761F80A01D16A11D2551171731
                                                  SHA1:24F39D187431BBAD880E1D09C12AD34D182F3C05
                                                  SHA-256:F613F0A904B7720813DB8B4C130D2E0ACD7B64D9FD0B4D6F2D36CB96839B69E8
                                                  SHA-512:826D90673BB5B7A0AA159848BA75164046A8F8C96C75CB4C5769AE2D38905DC66D81356104E7914A6E1C6504A8D03021150493A1B880457BCDB2A42D5E5C1C1D
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx.c........s c....^... 6:f@..5s..%.#c........10..^...%-......HXp..F..4...g....0.e.......`E.........I...7h.@.$..(K......$..L...b....$..B.y....@. ...2...s'.f.0..v.g......|..|!:.,...K:..g.....1.%.n.C._q.._...V.a.U~ c.....jD...&....?2...H....7.;.t..d.....zy..>}...YG..V....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\find.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):426
                                                  Entropy (8bit):7.30710414973532
                                                  Encrypted:false
                                                  SSDEEP:12:6v/77dd2VnaZZH8Awt24/nFlOnzoiFomall7:uddUNW3F2/7
                                                  MD5:9E25F52FFB35D68F867EE5F3C534F2FE
                                                  SHA1:B76D5C4DC0DEF4A49D851765CC72318D53E599B5
                                                  SHA-256:504EF10274474F61314ACB86A21EDBF6EC6D7C7BD5EB18ABE380A472D3CC5E58
                                                  SHA-512:9EF9E4B51C96C576601E20593B5242F6541A6D722C8168340214D8F4F246F92FE224AD9ED918AB9121E955D54765BDA4F945962AA26CA6ACA9F4668C35089421
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a...qIDATx.c.....e...k........D....5440..9))iGaQ....[U.W..o.|....urr.&...mn-(,~.....w>.......n$O........%.x....:..2.>Hs..G.;.?Y......'.6..y......7.&,{U....OV/8.y.......M..p..&.].P.r+.... ...y......O...4....`....|M...i....@..:.tY...G..............'.6]J..^.x......3.TTT....;;;.111........(L@4...|.......5.366...sbS.K3....J....p.....P...9HN.@.O....D.a.0...A..6...X....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\folder.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):485
                                                  Entropy (8bit):7.419323000384599
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7esVbhsHh534/AAv9go4eN1jiukbvRFdO13FJPLoVHrHogFnxnT3z:2xhKhp4/AAVseLjhkbXQ3LIHfnT3z
                                                  MD5:2D79689C872BC20DFD4B0538860DEAB9
                                                  SHA1:67E50B998F63713607997BED781B12A60B673061
                                                  SHA-256:FE57D88CE901EE23D92D6D9164F0A6718B9769163301B539F29DEA63268247B0
                                                  SHA-512:29D4FFD2041EF22ECA50AFA4256AA4CC2B5E4ADF0E73E8C47018F685459FC49D549FE08738810471FE815BC7814D4E325977006279C663671F79F5BDD055D86C
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx...3..A.@.3...hbu..:..Ti..4.m;U.....;s.b.1.U"....e..V.....(.ep.!....X..K.Au.E}........m:...c...f..5S.....D.ft1M.j.6...3.=|]v..?.s.w.qYY......D.....r{<...n.s..T...X..g.....GS.....E|J...8oq....m..}P.m\..t.....6.M.(N-....0"1l;D,.X,.1..../.... .........VF4F..N..F^c....H.......CQ.........m....=K\.!.@.(N....(p..x}%l?."....gv.!..aG.......`. ..K..xr..).~..G...<G... ..n.zaU...*(....).D....+..F9...l.=z..o.s#.B...N:h.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\folderback.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):173
                                                  Entropy (8bit):5.976984224745197
                                                  Encrypted:false
                                                  SSDEEP:3:yionv//thPl9vtt+NTlrRSAp9FjGm9GljQwyUWnY9s52GZnup:6v/lhPmNpokjG2w0Y9s52Qup
                                                  MD5:D5372147FC21AD2EDFA1667101CD8C5D
                                                  SHA1:3CCEA50237C3B395B2371614C7F1D84EF1345663
                                                  SHA-256:A37885C0F5116A56D8C0FA7F74F07ED8171A4F027012DA158E5D82D465F2698A
                                                  SHA-512:968682550AD4A9990F89743C308EB923A7B06F905D52B7D207E0420E91C63DF9B6DFCDF6F12DB18B9A7A01127099747932F5CF1172DF629876F3093101346264
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...............h6....tRNS......u..7...bIDATx.c.o=Ihhh.N...S5..h..m.Q.=..@C....f..mh.k...CF85.....s.[sAd.Ps^C+......J..h.......!-......eZ......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\folderclosed.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):411
                                                  Entropy (8bit):7.189269682483944
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7rxOtrN6eHieVoor9mEJHGru0gBRiuH/N:6krUQLoor9mEKgB5H1
                                                  MD5:B248E0142E589D10B1FB9A282464B4D9
                                                  SHA1:82309F4D54284D0FACC41F93E4AB0438349705FB
                                                  SHA-256:3671A40156A7D5D396A40001DDE65CAAA924119115229549487EAC626AA31DB1
                                                  SHA-512:B4714912966A434A1E7607EBA3BEBA62786F2F65454A36E166B23A204B152D1F8559DFA05DBC0FCDC90D2725C2EC86644BD295780D4322B3D0E5D2AC7B301026
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a...bIDATx.b...?E...2.0`.....&..G.W&.$d......TM.....Z....._.W...`............p....... 9lx.$Ov........_......y....].?<....i#....su.6....3..u..QfH.x.E..?H..(.YN....n....8...........},...pA.......C..<}..d..i.(..3.....v.....t.G..2.R.....5M...o].]s.5..6.y.G..e.LM.;...[{Z.d|O....QQV..z./K.5@.U.....K.Q...B]?.}..A...@QB.....!.V.2....B......R.K......-..C.'....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\folderup.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 4-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):152
                                                  Entropy (8bit):5.728713376101426
                                                  Encrypted:false
                                                  SSDEEP:3:yionv//thPl9vhSFZQOVbncgpgh8taQhl/9A1x01xvEqJFHhjg1p:6v/lhPIFZQOxHgShDex0bEuhqp
                                                  MD5:6ECDB906CA7863F3A8FB3BE9C4D960B7
                                                  SHA1:86305E819E93D03421FC42CFA041F5A333A7D644
                                                  SHA-256:FBEE54092BFA8C72A0BC1532871496F64C8FE640694E6E7354A64539D205BEA2
                                                  SHA-512:AF8F7B062C149EACFC31D1C3C5EE7FA89D1709B70EE52DAED0EF54F5FEE6A2FAF41CA45F80BCB28E37D7E4C20B431749EA76612F0B1734CC502B4C76AD46CD43
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................R....PLTE...Sfm.....n..v..n..o..p..eO.K....tRNS.@..f...+IDATx.c....4.".!.*...t..J%2.f..B.ie.Pm.....(U.;...+....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\help.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):130
                                                  Entropy (8bit):5.809885167923778
                                                  Encrypted:false
                                                  SSDEEP:3:yionv//thPl9vt3lNyxdkiFKNqcb1IDth/mrilttuDZkbb0mPxeVp:6v/lhP9+kiFj+1o/dKSQmpOp
                                                  MD5:4D548B980D125421C96220890B963053
                                                  SHA1:9B297F860972BAA1D6F85F34A02AC3E03ED278D1
                                                  SHA-256:1256AB2DCA022092AAA9CBFEDFC35944492614B971EA9D018A994F20F5FF5FAB
                                                  SHA-512:3C6A34FEFDC8332A6512D894573295A0582F901BAC18E1548B7B2A658DC8770481CBCC02E1DF1C4C19C03C46881FCEFD7F6E5E9E9FDFCFE479D47B3FEFD16E2D
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a...IIDATx.c......?......H8..I.v..H#...B.. ..O,.)&...h....@..... .@4...A....j.{.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\localtreeview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):323
                                                  Entropy (8bit):6.996338689643297
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPmNpoc2l2rW3tpUZE9VyiOgGnHvi3oeaRHXKMMMo7/jp:6v/7uNpkYKVGHviYjXKMMMI1
                                                  MD5:FBE18E0818E5E9C3558423C1AEEF1DF5
                                                  SHA1:1AA36E2B49B71193447A97C98F7C433560C236C9
                                                  SHA-256:D8699A29870DA50582B088AE2E69B4E360988C24A294025B023A6D71E3267F69
                                                  SHA-512:EA8B48A7E238A419C813CD5D75F1C699561E9B394CDC17EBBC5A4C0954372F008D5EB26D98D06849F4E201972BDCD5B568243BF6EAEE8D709288C410BE6A3DA6
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...............h6....tRNS......tZ......IDATx.c..=2..r.u+.\L..P..5{.......|i.#[O...j..5.pj(.h...f.....;....).W..s..M...X44M..j+.l/.h..8a.%..o.<.......6 *io-.h+.h+ko.r.8.....v..4............S...X......e...l...`......Oj...!22....k.D..@X.....x;..."""......y.......0..O..t...........IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\lock.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):287
                                                  Entropy (8bit):6.95100077715202
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPoddl4O88/Np4jfPfcVP7Db3+gOuPa0eJG9iup:6v/7Sl18ip4j0VD3Va0EC/
                                                  MD5:DA558196C46B839619A80EE4E98BE91D
                                                  SHA1:524E7F33C70A7CAAC8B3D802411D8F122DD45393
                                                  SHA-256:1B94BD92D4DDE13738C9CFB8CFF9F39A02208888C7D665336E2AA6274E0A8A2A
                                                  SHA-512:995582F0DB3CB16078D9811ECF5D14CBC50C2CCDC70395AC1420B522291F08A9DF639BBAF65E6C484B8B76A851D91E1856C88154949994C91BD30FE8C94C7804
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx..3bDQ.E....._...m..=Ul..&.v..<.......E.%..#..7N.0..Bq...J....h....d...p.].0,..'... .....H.TB...,.g.I(.A.9...C...........e.U(..BC... uw.../..|S<..!.LP...d._......`...M#....EUO'..QFQ...n}A..:...3...w.P"..#}....h._y..9........IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\logview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):247
                                                  Entropy (8bit):6.649761592354371
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPmNpot/7/nbC9TxJKhQfGRQV/jrU4Ae/oJgX/qzPcBHBCOdobdmtVp:6v/7uNpA/nATxJUC5AsXYcXCnbk9
                                                  MD5:5C0F552147EAA7DE4CBA4F81FD5A18CC
                                                  SHA1:7D76C4610A80BADF0D10040106DFFF19DE6BA1AD
                                                  SHA-256:CB66227AB907DF6BB3F09E238CB818EBF11C240879E361C57BAA41834A310CF9
                                                  SHA-512:295691B271F7549135476D29B3209171B15267BD8FB044001CDCD52F0EB3383F621CF3A402CEEC3E1AD1F5DAAE4814AF17B18302D66173ACE085BC2838B6AB75
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...............h6....tRNS......n.......IDATx.c......gG.g..BEh...)..'o.._.T2)z.&..).._.......h0O.... ..^....M..kv.."..\.<..H..?w'2......g...;..m.g.<k..UG.i..[..R..=.svCPd...N....$h.....@<ptt$Z).\=X.a0.V..fy~..n.C....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\processqueue.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):361
                                                  Entropy (8bit):7.098661580738674
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPfYjeqy5BQ8qA+cf+Nc52u1qhHohZHk+I1yhZ3Q96Py56aFUcvy/bp:6v/7p5BQ8V+cccwuvhRk/shsx6aFs1
                                                  MD5:A2DBD027AD3E7BFB8A1D362BA6F14A29
                                                  SHA1:00262B9E428815BA409BBE96A8B01A614C11ED44
                                                  SHA-256:BB98173E1D739761CC52CFC654811340F943631888ECD6E3D6F67966F2868FE2
                                                  SHA-512:30B476C9F46313CBAEC57A6B2096163242E00596447486F944C06E871D440D85D9FC7D6BDC4904772B30F85F0A379E704B0AF72CCBF2A1EA7526F9A227EC66CB
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............(-.S....PLTE...}}}ttt........ZM.............r|...Q..Zd.......z..Uu..........\S}.Ov.Nu.Lw.....y..P..]..^}.N..T..Y......_....Q..[..Qx.Gm.A\.,........|.JN..F......{..R.7o?....tRNS.@..f...uIDATx.]....Q.D...~.m..i1....Ob.D..<. .. I...ds...b.,*..Z....l.E....C....o...:...:iM......r.you........Og...F}.W....7.j.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\queueview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):337
                                                  Entropy (8bit):6.940487392659974
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPWFmtOsEv651bAs7Uxlrk0X7F0jIOtuaUvLXVp:6v/7K3sk65asUDrHOjIOY//
                                                  MD5:895DAFDF31CF7C888160BA98ED646C3D
                                                  SHA1:9FA33AC0AA3FDB783CB8065FB8A3B34D2CAD323F
                                                  SHA-256:0B3AE3F55208E4D443D0289C7BDFEEF0579F757257C5A91F27F1CE71C0BD968E
                                                  SHA-512:8F815B7F9D36D702A8CCD3FFA6E37D7EAC2F792E21A812358190BD1575E812F0C8FF6A4D3EC4851407AC0F57E55AA9D4CE1B4D351EB48690AD40C7E3A95B611E
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx.c ...../)).___.....Q$W/Jf.b.|..O.....'.O^.....S..j...L.......1...I....Oi........n...j.........~.......3.l.....H..3....r....._......}.'....e....+..9..2...d........@..Q.....&....h....0."7 ......<......E05*...+4..@..2--.up......q......_...r...P.8.....y......H.........|O.......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\reconnect.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):437
                                                  Entropy (8bit):7.382078738717652
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7OK/fWIYeOvKEamhL6oHJGU7v8LmCMBX1w0vyP75B:o26PoprqoBF3c7f
                                                  MD5:5ED842E1BB5700A572CF1FBF603E4350
                                                  SHA1:FEB188CDB6FDF59824D65550BF824D8B4B7C6543
                                                  SHA-256:7F2165A969FAE9F109587CB13415D6C4C0BD10073F5AD1DA0E05DA2B30434425
                                                  SHA-512:603E5DC44CFEC975F0842C3CC6F57834CDC7B5E413F394A412B920E37DAE6DCC6D1912F48762B0508FB1DDEF407030BF89DD8B97B1CB131C56A77A9E8307BFAE
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a...|IDATx......Q...SD}.`mE....f..f....m..31g..........=."z<E..fp.).....t........Uh..v..]..'W1yr/$...<....<\/...0CT..&.=..p...Q.....j....0g1....X.;.Y{.&.-Cw....<3@...........g..._....X...3....V......\....../..6.a.D..........rc........V0........N..|..@.nc..;L...;..^...c.)-.:..o.`.v.B[.."u.!v5.|4./~;.h*A.F."Y`..!.R..u..K...>..3....}.!d.P.%...G.S.j@.....u..".|"....}.....P.(.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\refresh.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):245
                                                  Entropy (8bit):6.576576510042608
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPfyTN9sKYZXgSr/tSrKhmxvm/pw+FDWErrKbglljp:6v/720QSDxhmd16tyg1
                                                  MD5:16C03F6FAA711DDCE324AAB2E63FEEB0
                                                  SHA1:6A11E846A2A9213BE5063541481353C427B3982F
                                                  SHA-256:10B4F5F8F02D9ACBF916066FD0F0F4321158E719C8DEBB9BD9FFBE5F21A8A7D8
                                                  SHA-512:8DA9624B3AB9A58F9EA39F4CD3BE3F7D828A39B569F46F8F5D89E9C30653EF12938EB6EA21D2136FC7CE68EAC5D396362213279FEEC1401E9D028A0B5125574A
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............(-.S...QPLTE...Ce....h..L..r.....M..J~....o..{.....c.....g..`..P..X..Y..f..w..]..i....._..P.........tRNS.@..f...RIDATx......Q..^.._...ks...G..\.vi...-.9...3p. d....33YC.B....3gD.,....A.j.<.._.....hh[.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\remotetreeview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):405
                                                  Entropy (8bit):7.187460923868278
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7uGzID7vxxgxAcOO86RgfRfORwDRyj:0zIJ+IRfORw8j
                                                  MD5:9B40B36993E7737C5699ED6E2F469752
                                                  SHA1:839D23D6EA6DDF9370B1426C3B86C6EFB13318E6
                                                  SHA-256:9A6E19A11B938FF5B28D10E880DC3F8BC0F6B09B97CAC3A82DF6AF3737D16250
                                                  SHA-512:D4E6D9F4B3B0049661D16AA86E21CF540B82CE0BEA355AE8F3D2DFC39C01053D1DC162EEC1901E7B08D8B31DEE78EA7E68CF6F871EFF00AC5E2659C00B82A838
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a...\IDATx.b.....P.L.P..m5;.m.m.m.1.....g.l..d..D.\...-.Q.....m.....!.)..?..Z.:4.B8..j..p.7..1.]..H.0..W...[H.....0c..i..Y....H....._.)..xJ.xcj......v.X..lC....K...... ......q.........3..EKK.ELL..o....///..."??....~.0..Ss.......-.L..#(........555a.....Yd.." .... jATT..fp>T}R....|......m....9.11.P..........X....@........c.....M............,.3.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\server.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 4-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):156
                                                  Entropy (8bit):5.7179010050773575
                                                  Encrypted:false
                                                  SSDEEP:3:yionv//thPl9vhSFZ1vF/s2xnldlY3Qhl/OkyfK1DeG+cvsn4l/Vp:6v/lhPIFZ1NRmghAkb16G+esoVp
                                                  MD5:2578435CD4F1B2703C38785A361D79F6
                                                  SHA1:0D38BC97318D1B8CA79B9829883907738AFB04F3
                                                  SHA-256:9FE376C420D461C5E67500510E38E8533E3C60A91F42BEBA85F0AD8E178A52B5
                                                  SHA-512:DF0EA0BECE142B3A11EAC4880CC68A440D86253ED818AE6B097F38CB343D4F22CDE4C9EB308D4AAE585874344ECEF1A38833205EDF9B1950134060E64D299CF4
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................R....PLTE...AAAYok.....Z.....S......l..0....tRNS.@..f.../IDATx.c@.LJJ..FG.D.......&...7....4[....q..@8...J..D......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\showhidden.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):290
                                                  Entropy (8bit):6.825774629495782
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPfIXxUVlT6ieX/Yh0I/7UtJSVQK8sL60+Vu/XhCx/M+j92MZXUOdVF6Yu5p:6v/7exULT6ieX/Yh0RtbKTl+Vu/hCtMT
                                                  MD5:321BAC4AF0CE6A899C144C0EC774816B
                                                  SHA1:C57CB3F149F39FCF310027A2A2ACB5F052B63EE4
                                                  SHA-256:AA4767817BFB63E9D8431E28DBFC95B3055F4239BA1805084C31380AE6289343
                                                  SHA-512:E0C9BCC0B9DE15DFA5C926B05D83860785C1E66C20301C0761FF87221D23AE5451D3FF9629D14571DDD2DD12E0C8393BF0B4F97A2D7060C477ADF4853AEDAE97
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............(-.S...rPLTE...xxx....Q..................................~..{..x..q..j..^..~..r..i..c..]..Y..U..O..{..n..h..d..b..`..I{....tRNS.@..f...^IDATx...A...........[...n,..d2....;.B.ZL...C....8...Y.+....I.kK.....[..S..h.r...4.........O......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\sitemanager.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):509
                                                  Entropy (8bit):7.401768858002121
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7ctd6LhPNvBcd+pNm80mnhwofPXf8NcVEnhzk7DKB1:ULed6N30ehwIkNcqRqKB1
                                                  MD5:39ED5FA30B56A0AEBB0A0EDC3609F7A8
                                                  SHA1:AD45E2AB1E410EB4A0F9B5733B93772589289A80
                                                  SHA-256:F77E5F30AC9CACD3C181706F85D7613B10757A80CDB296BC18B8583A0923F891
                                                  SHA-512:892BED361A39A019C5677962D4B2745CCE90B980FBEBCCAB8E67F9EC63A8664BB05087ECE060874811A0C736453FCC99EA494E93E7367C24881E7984BDB6B1B6
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx.c.."..#c....?...-....Q..Z....gN.?|......c3.n.H../X....p.[...4`.Z..,...m..`...........l?|...L.(..F.d.v.9...P._R .U...... 9f.1..........3..............n..(....F(...."..x.U.B....Z.....`~..GC...L.f\.H@....S..GU..t2g.b.....s;.y...)....Q`..'z...5b....'_.[~.U...z...5b..........d.e.V...3.|.)6*.qL;.U.(&bR...q..[@..NJ..g...V.......n..I....=...........igR:.1P.M...Q .@.Z7....1\..c....U.yaZ....~mV..M.._.j...I.tc ..m.5..}.l.K.6.z..Z....?4......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\speedlimits.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):301
                                                  Entropy (8bit):6.880532369203427
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPfbjSjargTfhr81BoOL7kwVObZETcrtgFNyAf6qVFoGYbp:6v/7Hqjad1u0JTcRgFrFQ
                                                  MD5:A1C73D5A053CB0DE1E50563C9FCD30D3
                                                  SHA1:58D73C51BBCBC15EFFD450F5DC1B5CED73D15109
                                                  SHA-256:A7DCF0626F73A1FAABD673DD740E26E0DA5A6B50A7DF338F8E789CBA58743099
                                                  SHA-512:2622015EB07CB91785AEB9B64A367B3870A7B8BE5F6AC79452B99FE1A9620ECD1E9063B859D79B693F334B6CDEDE0C6FB47B97DBCDA9BA86815B1896372B41A5
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx.c...D.f. >K.J^.....(.....q3P..(.y./.w....s.....`1q>.?.5....{......`....x.',..HZ........#f.....7L#L...y......>...........M...F.p..7@.........o.!.....A4........kjj>aaa...j...4nP..4...5'''.KLL..d..A...a....Pf..a@zz......`... ..5.......L......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\symlink.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit gray+alpha, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):121
                                                  Entropy (8bit):5.575299187668877
                                                  Encrypted:false
                                                  SSDEEP:3:yionv//thPl9vtJK6PtlBxdwlsHYaNP6PlG4MrXnxB4vM4Ea/bp:6v/lhPO6/BiaoltMrXR4Eqbp
                                                  MD5:BB02D9D5C7681D0C0B6D69B4C9D7B488
                                                  SHA1:B851E800CEA88CAB39FC20519846461B1A760C48
                                                  SHA-256:922757556A97089AFDF0F27EC5BD7AA8D805344FE296EA1106E17E98CF1862E3
                                                  SHA-512:B5063E2B4001C7E83BE30DA4DB5B5AC2B449F0EF0755675A79246217D8B906D20FEC56035E50DF94E7576A1C877A5FC5858432644D76081F036D2527657FE48D
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...............7....@IDATx.c.O...........(...._.......^.}.)8....(.....d....... .$........!a.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\synchronize.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):312
                                                  Entropy (8bit):6.95821797429228
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPRmDQUUSN6QuNrUmKPP67ROui2rWSHL0FwFsmT5OpKspuY/ip:6v/7ZmsUUMduZUmKK71CMAFw16KsAYA
                                                  MD5:3FC22CDF6513A6A85C9447D2A1A032A1
                                                  SHA1:42F64379B5072087219D527A3C025114F9804FE0
                                                  SHA-256:C2E0F4D177FB49067CAB48B0FD1975AE26644BF9DAE5BAEB110C988B8C596521
                                                  SHA-512:9B95B893EB9242D27B1128EE92CF22A27AE80E312CF86FF2A97257F309558F8134BEAE5979F143FD852F4ACC43B5714907B8C980CF41705F8BBD49B0DB0555FA
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx.c.A ##.?:vssa$.111^....S...?....`.a... q...4.>|.....,..q:177.<--...oj..... .S.j.r..yy9.0[..;.v.#G...={..G.kV...`.N.<."......].....+A.d;X,..f&..+......,55U. v]]-XQff.`ttd.....a.p./Y..........l!:..[....% .......QI....el.$22<.........@l?....`..P.qq#....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\upload.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):304
                                                  Entropy (8bit):6.9565335061879265
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPW5h5v7PRBhgSIueXHbPwgl0Z8/IvYX2hpqQXp:6v/7u5h5v1B1ID790ZxQXEpqQZ
                                                  MD5:66F6645979AC4E573797BA684B82A6F1
                                                  SHA1:AF76D80F95B0106DDF0B874933F0556714FA3641
                                                  SHA-256:71F84B897ADA3B015FDB5582CC8FED63053799E4C897CA5B8A4040B7C2C40D7C
                                                  SHA-512:F6FB7B0CB0086954314314AA31B156F26AB8C7B4B9F51F67AED2A43F31DBD75753BFEAEB5C717C50F7DD49FB530E8E2B3CDE11F26F0D6E996DB096087F1949BA
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx.c....AF.".|k...p.T...6.Q.0#I.....y.....%.R......).[]/k..J..........O[........BW10.NS.E.-i....y..c.8s..X,.EQ.Cs.,.$....K......H...R...+...,W._y.... ......o6...X....].p.T.5....X..oU..)....|..\c.t.......w..g`D.{.4u=t.F.......~.....>.....F...).g....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\uploadadd.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):400
                                                  Entropy (8bit):7.167492730834389
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPWfm0I+K734L7xsN16wZ94gnE+IB/UNtCUmexdlOloKNlCup:6v/7Vpf43kjH4gnE+IB/+mOdLU
                                                  MD5:D48ABFBB9729A45D99D88839CBF41FF0
                                                  SHA1:DAA1CB349DF097AB5D8E024207F983150AB423F2
                                                  SHA-256:0A39CE70BF4105CFAEC872030221302BE6ED16F25D44D5ABAE668FF9FF7BC931
                                                  SHA-512:64754095979F3BEB624AFD76D410FEA11C861C573A52813D5A9E80F2F5DF07E384C2D9B4FB226E366332044566C41E7113223A042136D63EC0091A0CCD799FC6
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a...WIDATx.c@.L`L&`..........C.....*++.......I1......__....,--.........C.!LIII?CBB~[[[......b'''."..@.9....^..Ab.i.\$.CII./d.....pp........i......{.<..lXL..LB.1..t+.7..........{...?k...!8..g.)..l[.C......l^.?.s9X.l.....).0MkO.........%.#.8{.:..$V...........N._.wI......W.j@`.d'.......'..k.................T.o...d..........>...6Q.z..:...3x......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\ascii.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1502
                                                  Entropy (8bit):7.847642654721642
                                                  Encrypted:false
                                                  SSDEEP:24:r6+W9Ubora2KtKj7dpfK5IkB+CN9KXOp23giSZY3VPwjzsWihVtJLGlUono0/0/G:G+Fbom8TC5IkB+iKXOp23gf64YnooHa
                                                  MD5:8937AE02C0F26EB8444864BC6EC61BA7
                                                  SHA1:603DE24BCFE8872F39C616EE6C513279B0CF9173
                                                  SHA-256:C1A277D56033288A6C4EA17AB3757410D2CFC030D35F8C903A2C5F2EE9D93D70
                                                  SHA-512:B1B46EA96BC417A2D25BF648587C519DEE56CA676D5ED173CA3F31864501F6A7F2F29B28CC3AAADE8A86AD37DB7B14B8F1637002BEAA9356C4CDBDE4DF7CE8C4
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx.....$K.....Bcl{.l....>.m.9.<.....Y.q......_....G....._...\z....MhLo.>|(}..R...qyPWz.e.]../T...._.|f......Z.ZV...[.r..}.......y.......5C/.*}Q]_O.J3a....{.o.........6...K..f.Q...o...........(@IEe...(.k22a....._..uA..8.ay.F.Ln..=>ys..C~;...o/otO.f.W.{~.Q"F...^.HJw..`.bU.(.C...j.L..g.Cd...........@..`c.y....&.3..Y....5q.j.i.C>.. .. .....t.'....d.v"...../L.A....*f|2..!..>....O]PS^UN...m......NMM.3>....B6m.H.Q..b..D.j-.B:..1..n.B._.Q.....F..P.(JGw.z........sY..7......"..5m.D@....~...g..E_....`..KKv>.EL.r.r.........I..T:=...V.XA..l...L.4). S...>.$.M5.m..`p<)...;.x.....#?...... .32...Ri-.....o......&.&L.D........e.Z.2.....W......o\[......P.=..7_....b...|\.e..-..m..*F...z..y-.<.'.}..o....?...?.y.^H..k..A..u.@z_.rU4..k.,<......3.:.D"Ad.Qd.]....Z</.q.d.Qz].N.......f.{.....;.'?.....'..)BNv.....|<k6@..........4`.m...]!..q9.d......yg.y.v...........<.....?.x.....g...Q_W..;...._BViI.w.~;.|.5..v.y.~...1.X.....j

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\auto.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1798
                                                  Entropy (8bit):7.86861907620222
                                                  Encrypted:false
                                                  SSDEEP:48:QHEOgA5wRHF+IZFfK2FVgdW/HezrnnATA:gEM0F+E7FVAnCA
                                                  MD5:0E1DF805D31BCBDB1A9B06D7427FC7A4
                                                  SHA1:224419B0F854D20A34627AF199328F5F437220C5
                                                  SHA-256:3DA003ED224A867F683B533B4651901E48F1154E1007F2FF48C8D0D31BABF191
                                                  SHA-512:D377F38050DCE72D8CE9E5A61C3A6E3D6EB654D9D77BFB6D76435448E539C68D3F2381E259BDA146D3C90FCE6CDFF55241A06F3EE4606F48500505271E9EB559
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx...Ut.Y.....Z.E.C.9L....af..effff..2.3.Lx.;c..buK}k.;.W.'..;*I.t?](]QU.z.G?..E.}s...>p\.dw.eK......[r...].,Z87p...w....p&..p..{.z......a....e....8n.....j...'..!....`bi..i...EG..9g....y..4C....o.0.../........;=L$h....3.%bA...l.!.%.3..r.....T.......Rv......:.8.:PgO....N`._>>.....2..1......T\...%.F9.'....h<.\C..4..h..M..&Z..m..c.......[.....h..X..\7..x.L......D..<..Y<.+....'>..'._..Y...r.b_..9.....f..P.}P\w.z..D..?.-..T. .1.:.......,..[~.<olWQ`.H......../.<..3l....*w.$.*....s...6(b...n..+.co..Ng..>8p...^...u@..I...O......3.R..[=.Tv....Q|.M2..y...~"./c..........hg.i...{.6y....*x. ..0.n8.jy......% ..U...Sh.....v.q..K<...h.....Xo....D0bE,K../8.+.o......~......q.j.F.3....p0.O1.S.m.....l......=}ajc.3M4.=..-...s.#..Vlm..).Fu...;........][.......u...av2..4.|.=B9.W..|<k.l.bYg'oZy..<...366.w...].....f.>.....g....z..b.....s....{..Y.x....^....:.=.K?..E...T.~_.<.V...x..8.......}.......=>#.....<.k....-h.

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\binary.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1436
                                                  Entropy (8bit):7.786160277294313
                                                  Encrypted:false
                                                  SSDEEP:24:vC9HCs+NQmVk4C/jwGRSxF55c/1s1ITOvvboAcVlv+Q0WczUN7YZ+raPTYy9Gddk:Q1+CmOP/jwMsZI4/8BYZ/PTYymH7hW
                                                  MD5:A6A40A9CF3DBF6ED6499A8C941D18964
                                                  SHA1:90A6EB1FFBCE4A8A694FDC65243EC2D69BFB6BC1
                                                  SHA-256:2362E457D25CD18A76A3B8CA564AD4BAAD8E2A7EB89D4F8F9430602BF49A6308
                                                  SHA-512:284F3657A9F39DA147386F2460DB745DEFBBE19AF8181C076483728201B0C8A5FE42C6741F6CA54EDDD0CCD2EEF5D1AB4CE95002277654C45C0BA2BCFB3F9A58
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz....cIDATx....p,].....}.'.`..m...Kk{...m...|.G.....R.T*/oJ._......Yv.|..,...O../.XN0.j.>{n,.4.t...t.O.f.A.322.MW]..>.b........?O..i.#~..v.h......,.R.F...(".2.#.r....T.@.p..nG..s....|.....\...`|z.8I..|..~..G......}....CO.P>..O.....h...X......C...<...u.u.F...]=..{t...(..@..[:.)...m..Q...*.r...~...Mk.;`..4p..?Ng....uU8.V.(!.. ."..@..$.r.g...t{=.V8f]....a..).b..GGVcsD.-...'?...Q...Z<f.]...W..c;.bE..B.../.@.w.....1.^..u|...a ....sz..;...A.^A!O.....VY.....*. (..(....>...V.Q.........?....(..."..MC.(..![..2.Xt.m.}q..[.....`J%.%...;{y.)w...g..mK.......... ..D.q.Ic._.....P.[..F...n5q.......J..$A...4.{.w..[1n.o7...QS..(...0.&../...On..On..&.6.&-... .....N...n.....7.<A. .....".a...v...f.h...>%Y.h8."..b.J.{.h.kW[..s.....f.~..ja.|....t.)...K..nJ!...-a.6L...~Au.V...W.{...........w.. ......]...+..n.a.....^lY.O^......<.....n....|..?...xpx$....)#._zm@...4..Y..C...n.q.I......N.OL.....;.~q.wer|...S...=7.c.:..S.....t:1Y

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\bookmark.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):334
                                                  Entropy (8bit):6.917558448131977
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPkQvKNR08Os/dvwBpDWy+g7/hHA8GgKI2a1dtFiklTMh37Trlbp:6v/7seU2Ttf7/hCgKStIkeh3vrl1
                                                  MD5:5A9DACDC3B1A421121F7FF5588C1D093
                                                  SHA1:131063A64C7CB3CC79D4CAC2DD78B0EEEA9BEFF2
                                                  SHA-256:5F859219D5749258CB921C266BDE4A25825BA3EE36A7606C9904695CDBAF4990
                                                  SHA-512:50083D9DBB7CD16B4CF39CD8A513957712E1909724BA56F29DD3539AC4F61267DFA5CE44C0A8FD0D9F6B642DB823AB7A3B3A611EDB58228AD3116CD075E6189B
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....D......~PLTE...;H..6.We.\j.Zh.Vd.6F.5F.AN.5F.6F.v..KW.Yg.]i.=J.DR.Vd.x..<I.~..kv.Wd....O\.BO.Ve.Wd.Xe.We.@M.Xf.6E.5F.BO.AM.?K.GU.M[.Xg.7G.F.]-....tRNS.@..f...~IDATx^..7..0....;..^..A;B.L......>p../l./....}u...1.......Lg....>.s0....&.....j`.....5p............@".f..K......M.|!...4.u.)...v....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\bookmarks.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):334
                                                  Entropy (8bit):6.917558448131977
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPkQvKNR08Os/dvwBpDWy+g7/hHA8GgKI2a1dtFiklTMh37Trlbp:6v/7seU2Ttf7/hCgKStIkeh3vrl1
                                                  MD5:5A9DACDC3B1A421121F7FF5588C1D093
                                                  SHA1:131063A64C7CB3CC79D4CAC2DD78B0EEEA9BEFF2
                                                  SHA-256:5F859219D5749258CB921C266BDE4A25825BA3EE36A7606C9904695CDBAF4990
                                                  SHA-512:50083D9DBB7CD16B4CF39CD8A513957712E1909724BA56F29DD3539AC4F61267DFA5CE44C0A8FD0D9F6B642DB823AB7A3B3A611EDB58228AD3116CD075E6189B
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....D......~PLTE...;H..6.We.\j.Zh.Vd.6F.5F.AN.5F.6F.v..KW.Yg.]i.=J.DR.Vd.x..<I.~..kv.Wd....O\.BO.Ve.Wd.Xe.We.@M.Xf.6E.5F.BO.AM.?K.GU.M[.Xg.7G.F.]-....tRNS.@..f...~IDATx^..7..0....;..^..A;B.L......>p../l./....}u...1.......Lg....>.s0....&.....j`.....5p............@".f..K......M.|!...4.u.)...v....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\cancel.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGB, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):954
                                                  Entropy (8bit):7.706792407041953
                                                  Encrypted:false
                                                  SSDEEP:12:6v/79/bIPOEQSS1xC5zF6xxhq1HGQ6yRQZpnCO+kp4hznYTnD6VVSx+jm+GJQv0R:+bI2EAUshUmqGZpDD4hzYrDWVO+V06wD
                                                  MD5:B0EE00074CB9D0A3DA4672C658FC88A5
                                                  SHA1:4C5C919F3BB49102859D2A9B5F6D03EBFAE5B77A
                                                  SHA-256:361555AC4D2A9CFB5B68E486A82AE4B37C3EA2F80ABF75DE878C74A0DE121522
                                                  SHA-512:D4B0A05D201F19ED3973E1750233399F4D534FF24BD92CE79C518BF176BBF2CAB9FB273C3A2CF47972B1B88C24FA016132C04C21C64EB13A8F0194FB3F8D5653
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... ............tRNS........y"...oIDATx..V..4I......7..Bw..m.Bg....k........./&..U...4UT....@.?A.EY..J........+_.>..;..?3~.=C11....11... .._......v....E_``_p.@X.PT.u..:...{..:......\\Z...h...uxz....f02...u%zY.F..`.5k4.Je.LV.......m..].........}+=.7<...E..Pw...,kb.....r.........=.K.sR.bb,.....;:..DF.. ....R9q....!.....r...E.....;..:Pz_xa..z&!A'..h.0..u..BA....|.....o0<|..u..._....N"....D.M.]C..t..... .j..:..Y............$iT(jy...b6-..q.z5M.f&9....\.H.0.....<....J...Bq....fb..G.8r..o...q........m`..e.W.(..........X....0 .,z;;.....b.T.A#.....K..g!L.........<....x.W...BO@....n....P..C...\4.k......_$..=w.....lQY.Z(*:.e.....7../3.5.?8..)v....... jX...B...&.....tX.`$6............C..>p..D.....C..'.b1......'.\.T......>>.f...+.....$h.Zu=...........W&X.P.p_....3.t..y....P.........lD^.r.....=.!\....6h.?:==.$8l..3..t1../.QA..I..._&.G.A. ._&\...0.........<.4...8..-........J#f.6I....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\compare.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1177
                                                  Entropy (8bit):7.772586391230063
                                                  Encrypted:false
                                                  SSDEEP:24:otTLKQ+PluSLGS72609fDaVjG+3LCx2EbTVb49uoQ1GTaE18nPF/ckS4r1:YLmPlK+/0NaU+3+5tWuokGTN8N/S2
                                                  MD5:6938C0E57B9071E48BB810C6C83A0D30
                                                  SHA1:81AFD857DC6C727575488EAC050118EA314B43B2
                                                  SHA-256:239BF86478618992BC7739898C69E792632EA2B103245468D87A1E1667AF4FEC
                                                  SHA-512:53E43CF610F8A9B07743529932B6CDBF74D6BB939559B375B6A7F92827610C4E972AD08A1BA3A21DB45E6D3D1AD4C4A04D64FE047BD17632229F960E5D0A2826
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz....`IDATx..S.$I........6.m.{.Qf..]m..1.g.~...\{...*n...+.....~.[.l.~.7@.........Q.....E..@'.D..ht..#hM.X.}......N..@p5.`.O..,.. .g.._."T.>.*..,.....EEE ..=."??..9...abb._\\...xK..W..:....+.+_. .BD.@.n.B..<.-......FFF$t%--.MA.(....)..b....{.V..z......*.j...9...`ii9...eTLL...........TN...c,.@..|.w..n..o..u.5...mgp...M..."^.??..\..cf"S.}...<.k?.8...gq.....g.P........]..+W.`. .Zo....Kdff....i........J~..\.aMo5[.Z...*w..h#*X..Q............} ./(@A.Z{....Q...5..P....Y.P.1.59K..H0......q.7..R..W.............>....>...H.........z.~..`.QQQ1...t.L&..T*..\.jhh....9U..N..F.A..0..Q1`...1....8.......D.......Y.......*.....H=O.l.oG....@............p.?..;+.......n..!..A&6.....q....8q..8...E".tJ/....SSS.LMMA"......8.....j.~...&.F..;8...g...1.....r.8..P...}.\.4.....U-W.[...R.......uh..~a...q..FX...^:....I|.c......[.v.....U.Vt.]....y@...B....!....p.E....&V.0u....t3@S.G...3@...- .......x..cp^c....GlD.}.../8c.......~.....].Q']..I..j.

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\disconnect.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1629
                                                  Entropy (8bit):7.864089076601816
                                                  Encrypted:false
                                                  SSDEEP:48:Xia1MVzPgjRWDJhqUlhvDElymYv+7yoD74I6ZjRfnMgQ:jkkEJhrlFmY2uoDgjMgQ
                                                  MD5:A2F3344E4EE0B29493AC0B8A91D9D901
                                                  SHA1:28E56D253BC9289A697BF2B9485781EE1850A51F
                                                  SHA-256:D91D9890D112C0D7C2D178572A5ABAF29A954011E2FD1E9ADC57EB7B31F7B5D2
                                                  SHA-512:465C6C8B5435FDEBC973C8E0A2C4DFB5F417AAB7303DBE3ACA353636FFBF8D03E59D48F128D3CE26C6E180ACD0DDD683776DC9520E60BEE85A884ED8F34AF884
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz....$IDATx....t.Y...k#X...9I.3.s..Fc.Vl..m;U.F.&..>.{.1..s......r....Zg|..yaxr.?8.3.o.s.Ad...gt....}...l.s..r.".r/.5O.M#....I.0>c..u.g...G.~.U..'..8{%.y.U!u.S$...S]..h..H..B.D*.yF0K..rm.xMm....T....C...8q=..)...k...(.........Q.......G<..b.....z..4U..Q..T.a.Zl>T..#.0.L....|..*.O........T..F%F.N. ..-...?...#.X.S.....W....U..*..C.s/.K*u.j..1..A.p.VG.cYx1L/..Cqf.-R...`...T....Y..X..C.L.6.....R,./...Y....KE!...sz...V....i]..P...b,........o.W..p..e....)...@).....$s@....ZJA..F.(!...ae.E.NJ.In....A.=...n...gTK.-AxJ..."....4..;O4Q.W@.y..S.XA.`..:.E.:...5i.)..e..uN.ex0.m~H.-...e..3*.....{.3xG+.%.w.......N)..4a.d.!.j..F.....Yp*...w..|..N. ...=.f....$...g.~..{..`.e.......A[.]..cI).. .....r....9u.^H...\.^..;....N....*...d..2...e..MZ.3j...!...gfs!.L..8m.n*79....v.".X!..H.t@...U>3u,..6.{.I[.......`.1....G.......X...<.|..\.q.0..=o.G.._..*..._h..l.......Y...7ki.|..>....\..V%.`p*y...s..H......7.!...QA....A..x..2.......iC..Q.U

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\download.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1123
                                                  Entropy (8bit):7.785480870316043
                                                  Encrypted:false
                                                  SSDEEP:24:uOCcm3Cw6IrJTR1PONqnugvYFFI/39yqWJJjqfSrDwTqM8Sxw+DDz:uvPr1POdgue/s9/efSHpkDz
                                                  MD5:7BD1094596464BC3091D9AA2E171D530
                                                  SHA1:E826ED0D672FA9761B84E09AEA1A8E7AC3AF8F76
                                                  SHA-256:213CD61636652F4F97CC5E40DE29852F56804B4D952163DF22153F79FEA6ABFB
                                                  SHA-512:E44BEE97C972EA4F2782546E8A61027CEC474DFEC11391950793D66424E92BEBD1544A4EB34E40105A5578B55B0B97270913250C07A39D4B5038E26E923B2490
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz....*IDATx.....X..s....m{..k...4.m.m.F.K...v.....w.?t.8....L=..w..8.z.]~..N.t.h...n..i,.N....?~.'.D...S.I.'z.....M8......1..v4.R.w..,.....t..b.."nE.z.}.gM%+....|.m^O.^.....B.X.&.....g~.@G..O}...t?..D`..Bq....D3..Y....*].y(..n..G....z.......A....h..n...[;b.pDL*w.}...+......?%/lvo.i+v._....<...D"jZe.O.#qY9$/..D".W"..@q....'.}.g..P......U...^..%..o..0...o...].H.U........7.E.d....E..p...k.CxA3.....~X.&O.>\..[}....qS..*....0hG.2.5#.,|F...Q,.e....zD.)..U....&..T........w.g?..)..q.5W."tr).N.UWA...........>..a...y.M7 f^i$--...U.....G..b.r.MEl]-..{%....>.zg..g.R.y.#....?.d.e......f...@.PEdm...e......].!.....T.. q|..{w...9..s........O.=.s.q.D."g.@..rj..M..7....n.)...T.../.F..P+...R..x<.@"..;..*.>.3x...~$.a..D.,..UF....X..d..w..S..qo..w.5.4.~..2...Ee.4Y..Z..0%......N]Q.]../.VvK.l.S}.z..p"...LEBj..J.r..P..=.4.g......x.."f.@... .}..LW.jO...6..3....h..2W.WTU.*mM%$...%0.sJ#..^.Tw.+dRV.*....lo.I70.1.%...o..L....37TQ.M..w.B...-..

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\downloadadd.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1383
                                                  Entropy (8bit):7.802272783004605
                                                  Encrypted:false
                                                  SSDEEP:24:WkcPnp0l9Kxs/XivK/6rTqhPwZWjkiwsm2VirvbcEniI2dY692uN:UnSYSXiUYZWoiws7ViDdn52d5N
                                                  MD5:454C4F6D1F553429CCEC09E6CB696BC3
                                                  SHA1:F43D1A1969C86D3267503BDFE831CA90FDAB7AD8
                                                  SHA-256:04016DFB34D195D077E8A6FF5BAAC808194B036F78280F07185FC2663352E414
                                                  SHA-512:F3BA490EA189107145B1DE9456FADEF80834A5C2B3D3F446C69F262959EAB11F5099CD62D49E4A8E034637EE9A2078B52AA39B93F4D51EDA3F7DBE87AFF10242
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx..V...I.....m..wv.U2;k{..5...m3.m..;..I......+.p..>.............y..8......_,........I.{d....O.bbb@(...#....$.=l.>..W_}5..>{!::.....C....?E|d.*.0.r..h4.P(@*.B||<.......\..\]]....z...:...@.O...Ann....@vv6899..?.....7...R?...iKK.~.4.77...P022.y......N.~.>.G...:.//..(.IGG................9C.>.:.CX.j...o.C......;E|d...>.......zDmx..KR.(9.9N..9.D.',,.0...0.p._S..s.d...e....6.Pyr.4..Md...+c?.VK..~7..@.p.$0.-..6.2<a.0....M.>.O..}.`..v9)r......c9...X.?.W.+O..e...]W3.\...P3}..2..+.rP.{...S......... .....2[VV.4.R.F.b.....du.I+......o...9-`...qXH.Kw..r.\F..W;.R.g.@....G..a...s&V..._..Qw.b.2..~...^....g.gr.8.+.?..|..O.3.P....0.f....D..h_..b.0.....I.T....[GA'....]..?..lT.`.,.k\.]9x..AX^+.Bb..,...j...:Yi...WL...... .3.!<.....t..u)........l...\......vpS..7....c.F..=.....VC....WE.9.VRi..`.D.....E.......W.....F..l..y.>,.&.._.,.d.?(.*l?7c...MkB.d'+..V.....[c..(.@_.n...s.D..Rj.6:m.W..l.'.....H/[E&m........F]....'+....F.(8.E

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\file.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGB, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):620
                                                  Entropy (8bit):7.505367665097406
                                                  Encrypted:false
                                                  SSDEEP:12:6v/79/t4UPJJi2Dvf4gdRLyeZyHmjw14uKWbpKWKwbsO847MC50gcz:+t46JcAAgdRO+yH2w14uKWBpu4l03
                                                  MD5:1FFF5A25310A2F0E9AADF07D6DBF55B3
                                                  SHA1:BA9767BC9451CFE172891DE766A63461AD2EA4DB
                                                  SHA-256:D2A2EFB6F4F3FAFBDCB6BB91975C69D90000F9DE16DC7C74EA197534074C60D8
                                                  SHA-512:14856B3E1F9E59F2244EEBCE93D5637A79C9845BC38913D3897505EE688C6995342D26833394C07027857FAE14122F79895BD5D8596345E17FB1384F15F389FF
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... ............tRNS........y"...!IDATx.b.w-..M_N....X.PAnj(###....B.".!"/.}...]'......@mU..5../....{.|..W...a.wzMv.I~..g;.T/..T.*..........J<x.r9.MZ.,1...N.....a..g..y.{(p............`..M.N.X.cY....^.|.g\..09vl.Rr....6...gtYSL.........44..|..}.....~.../...Ay.G..6.!..P.h.0.`..Q9ar..3.+.H..../.%.4.0n.$...(`... zg.'.Aa.o....!..3..ne."$E.:X2..A..oSM....e........]Y...U....^.x..E........$i*...j&6r..~.R%3.H......L..d.{..b.iY....._H......yh...N#......V.qH.$.u.!.!@8.).nN.V.rt.s.9........G.!..<V...o.J. %.J..(1PF....$...Xi.U........p#j..8.....a......~bz\.....i...:.G..!/.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\filter.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):617
                                                  Entropy (8bit):7.538330163979
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7i14yU40frCFdr5MCP8bdjbdDF92ogFh0RKEkXRKcJLiqWcgG:gyUBrC1RP8Jj1F92oqheGR1jWc9
                                                  MD5:FB2FDC4B0D0837F0F0CFA7284D9A0327
                                                  SHA1:7FCF5F7A0EC2A558A6F49E679C4299F9A2354B0D
                                                  SHA-256:CE8EDA54D26DDB11D08C134AD97AC3DFE3CA06EB5AA2897F15DCFAE2A6699C07
                                                  SHA-512:91DEF83DB36F9130C84E9B0C29FDC9161197F7B1F2821A1C43F8731209481D9E9EF17625DD18EC6359DBF50AC3B0F6AFEB24199683E01A2642EB4C63B7506678
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz....0IDATx.....\a....0.Y.m.....A.......FP.v;x..^.y./<....Q..-//O..c...+.....l..f.N...g........S.j......%._7..o<k......@..%3n.]).A....di........}.........g.....Pg ).r..R...Q.8A..>/.E.G".^.E.N.w@.F...W..$\.~.>....=.;.....F..7.....?.(P.....jD..(t..B..J[7.....8....B..9.......x...8. X~Xa..m@.m....4.......gt.6.r.>...\'...q+..J...Tg.'1..u....h..8.c.U....A.I_._r..IP.p{.....U1.F.^.Z...Ni.'E.....7...BI...(..H...T~..^v....F...Xx......-.+.h.Lr....b.....0..!._.y.`......F...g.I_......J..(....J.G...M3@S.04....}...t@u.$...07i=jV.* ......@wC..`..)B/.....F......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\find.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1206
                                                  Entropy (8bit):7.770468566040055
                                                  Encrypted:false
                                                  SSDEEP:24:7B9iwQ1FU/LSOmHr/3q/rWvcqz77AYrXd30q5TsFRKCHghWlSv08i6tB:7HiALDIrAccqzoYtWfKCHgha6p9b
                                                  MD5:6E77EA3192EA5B94D370F8F842B192F1
                                                  SHA1:2F6A284504382A063328D6CB91602DF1A70BCE83
                                                  SHA-256:E581D22A48751C063B1A91A2587A5E785CF1BEA2379D0EA55CB337560991E65E
                                                  SHA-512:7AC74CFC4A102F8B7554670D452787F959F8EEB136F9BBA5845BE0675239C9642F2BE8352D9AAC0B1E6A5458C7BD143D250710303C1A867FD0835973E85AED63
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz....}IDATx..W.tdY.]....c.8il....l.m.3.m.m..L.....Qc....Uu...#../]...V.\9m.....7.988.....c.X.b...,\.....?..h...@..f.\....c...t..m .U.@. J..../..".;v4..(z{.M.@...x...x.........V!.....C..s!78.xj.....r.}'3U.?....G.;.IF$.d2.A.oX......>.p..M{[..B"].l..<#R..]..e...B.G<..[.z;.~.H..a..............^OT......Y*.O...?J...%....{...w.)..;..Q........@.......F..3..BE.)K...}....-...^..J.E.a.!^...#M.Re.C.U;v.lAaB..f..:.p8..D5p.%D2..' B.GpV.<.H...L...Y.KG3T79I..XI...*W.U.Y.!j6.''.z.f.d..L../ R..C.....L...."..j..u>Ow.H\.!Q...).w$QU....U.x..v?.I......L..+.:.2....F..E......OV<..eYN.7%....../....2F.....qE.....Ng.."..0^.+.by.6l.p"$$._...B.v<.)|"D%?.....n....^d`b...G.e(.!9...;v...!......m..80..[nW.....!.bT..4.S....4...?.au.....mc...!.....n.{3.^..+\X..#...N..q..(.....G.C.F.+.......'L....2aD.....m#.X(..../R\..#.....2.=.rpv.....ol`f....q..E.=.....=.`..~.4..".:..R9.hJW.Y....=.m...fv3.2e....8w..N.Rb.....ek.IFM.0qt..c<F.D......f..#G..

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\folder.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1386
                                                  Entropy (8bit):7.843106026270757
                                                  Encrypted:false
                                                  SSDEEP:24:vjpl1GP8BjQ8tcMylP0YE+A51NCFWJ9ybAGHVji/t4x3ZuKexOcmFouVNLuvg6HG:vjj1GP8BjQsVkS51IFoyjiexJfexFmWe
                                                  MD5:C5E55C44BA8E4F7B653D45AEC140962A
                                                  SHA1:3E33419D8A4955EF7CE68DB795FE7686431DB2D4
                                                  SHA-256:6A1AC4F6C4C87DEBE4A40E62D153405A2B686BD9A79EC50CD15C5E118C04A200
                                                  SHA-512:FA550CD0654CCB2C4DB2CA7B9DC964ADDE825937A8C382284DC7595FF864DA4DBF6CE50F77D0D3559E3160353BFEACCFF0CD71A33F92EA1E76E2E48F483BBAB4
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz....1IDATx....4M.E...x>[k.m...m....w?...4*3.....m.....7.-f...b..)......O.^.KYD..,..=.k..P.|.}.|..Q.r.T.........w<..|...r.8.Q..0.V....r.u..=.g....f;.Z........x..1..0.......{d.x.{......Y.~.3............)..N...j69Y...-...~.^..l.3...?.gW.,......).@8S.g.G....(..A.W....:3[.p..n.g.@..|...]..)1(fV...s..8'.s$"L...C......r...-..-..*...^s....`.9F@DrA.$.I..0.[....3....Z}...jZUU..d..} .......\...i..U.%..q7x.87M?.........y.K.lP..8..aj.......&..|.........P=..]....`".Qr..$...V...%..e...y.HC.(.Fu..H2p.~.W;.l.?...&..5#.......4....W.v.._.}..l.^y..&.q'..b..\-4.k....g.\..-f.E.h{......FY8.@..a....V..}.&.t.U.~./$..Xlc.+.ns.54[.....=Q3b.h...f.U.3.KH*5...uc..w.....6yz..?....k^m.....z.."..g..2..........!....."...")i.N.>..........:.I%..G..{.A...J...]...fJY..j....>.+...)C.a$...a....7*$I..L...W...S.,..;tx...7.'.........z.r..!t.Y+.Nq...Rc.D..$*....,.o.n..a@M...q..k...m.0........%.\>#jw>L....}..)..."B.P..U.].b.m3..\.lLxI..f8

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\folderback.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGB, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):406
                                                  Entropy (8bit):7.168478964942289
                                                  Encrypted:false
                                                  SSDEEP:12:6v/79/2o6b8abUTTzcQdgKvIzefdHHJjELq:+21bxbATwQgKvIzGnJjE+
                                                  MD5:D47E44124D8496F65F1839BD33D1983F
                                                  SHA1:A89293B03BC1468CD86F7A7FAECCD701F2DEDB2F
                                                  SHA-256:0EB389A2CC721FC85368286409AE1E277CF885A910591EF30170FA60A0742AF6
                                                  SHA-512:AF95D486DA824400805F3457C913B917D415082208F324CE8C18D96F10F88C929204CD041168D7BABBBC79E2CEA54B19075EFF232ADB31B427FA6B0E356BC2B0
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... ............tRNS........y"...KIDATx.b.w-M.0.`.Q.......n.Q.E.wmsl...m...........y.7P......>6.(.r;'go..."@.18z..!v...*....=.|x....+.99,..g.g....o'..G./..O.w..7....[.7...ln.[.....).f\$....$....x?#.$.\........p2rm...'2.'A.LM..o[..&"*...I"..ANr.9.i.P......m.+Ia..........E....pY.E....."..&....x.....F$...M$-&...(_`:<$.W.P.kj:|4..Z.G....{..v...U......I.*.........IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\folderclosed.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1100
                                                  Entropy (8bit):7.770860048666669
                                                  Encrypted:false
                                                  SSDEEP:24:w6RpdrBG6QJlY4hYLtk/RkKdmieus6+L9nyUJhqaN17lx:TybDY4KL2/3sdL9PJhz17/
                                                  MD5:9685762A4B5F435224BD488843F715D7
                                                  SHA1:F4BCF672788E490038CFDED2E5C3E068E59C82F1
                                                  SHA-256:B79FA30E18264EBB5B1CBE23252342C5123E91D3A13E4D66323A40E6B8CBAD4C
                                                  SHA-512:76EE15BDAAC572CEE1391A1228110CED8ED2149EF53B2DCE0AE614E248B3D0397D8EE0E2421E6A6A7F9C14953D1A58B36A901045E6C592FC41A5633F27953075
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx..W..uG.=..>5.m.A.6.m.v..m.......Am.u...{..L..L.P.'ww.v.3..13.......}p.5...e..G0>.?j...;...w.p.5.].l..].,.4.?.O>....k...`....|....x...;f...d.m.[......|..fLi..j..)..X.h.Y....p..... ....s.....&lX.y..X.W....~.ky....%...g.B.b5...fsdhl..N.........w.f.".6P..#....iK<......m{.....%TQ..3......C..(F_B1.....j9v.r.$..k/.".....V~K..r....h.....P......D.(..^}............`q}"....4...BY........rT`...^...HJ.P9.Fv...&,....$...4.B.H..h5G....!. ..1.!3.`...T....J...t.[.........0..E.h@S...0....ss...r0K..}..).F.Q.D.L.#h2....8.&..b."[..b.x...9..k.U..E(.Uc.%..}...m.8FQA2.$|.......P......0.N..M.([cID"..P3H.....+.F......".......#...I.4.l1s........%..B......$.%I.......X..k...E2.D...b..#7.^...,L\#eY..l..Z..ug.n(H.JA.r.>..k......h.J..T.4n.......0n.T..8!...9@...]..Y^A..s...N.......\1.a.r.G.y#.)*(.........Y.P..X$..M......`m.R..Ui{..|.....5.xO...&..B.Y......A.f..'..;.jh....~f....H..uuz.}w4G.rFX.....h.O...P?E....O....(..J.b.

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\folderup.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGB, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):407
                                                  Entropy (8bit):7.168809466358561
                                                  Encrypted:false
                                                  SSDEEP:12:6v/79/9pC5tLkvXV1Fl4+aft7xvpWeP3vwYR9:+9pCjLkvVbizfVxB/I69
                                                  MD5:5B5BABD6635C9D179498A34C986BD4E1
                                                  SHA1:08A9D2EBA83207FE4BB1CF877D45E403CA72D5D4
                                                  SHA-256:039733DD7BDEBDADD267A56A5DAC00E973CF38F44BB7E8E460B5DC44D4918501
                                                  SHA-512:83538E9B2E0EA277B8ABE1F15AD9093A5240C41BFD613156D48EEAE007A412E771657972B38FD080670B8B23BB0B0D2E802B27E791C94D669CD5BCD08FE19545
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... ............tRNS........y"...LIDATx.b.w-M...`..\ .....^.v..}...1.....>#vVQm..m[...$.1.;.4..@t..|vyM.q....Y. 7.....#U=...... .5=G.F*.m5\..M.,..NL..@B.;..>9..8..L..1..z....?.._.:..6)X^..wS.\r..%..m.`.{.L......C....}p...A....sr."|0r..........o.....~...@....G.../............c,K..p..`.t.R...S.d.C...*Q$4....B.I*..v"F.G.."I.P.T....F[..............{.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\help.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):914
                                                  Entropy (8bit):7.659362948134689
                                                  Encrypted:false
                                                  SSDEEP:24:ruk/g0NaQ0UXpXwX+jKSuWaPiCd4246xHs4K0u:Lg0NJfwOjj64KxM4K0u
                                                  MD5:6B0D048126E4DBE97BC6A80BE67ABD00
                                                  SHA1:185F7C09C6FE96A4A13D2E0B635249FA1D3B97F3
                                                  SHA-256:18280E6B773663D224D83F90749BE9A6E7B31D697C9C64EC24140A1A5CA5706F
                                                  SHA-512:09094482663063FA0D9670C037D8280356151E4CFEE7182D2C6BF6C2A17BAAF8205620BB71109EDAAB51A639B2168EB30C0937227EA84D2ABCF05548A5801CE8
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz....YIDATx....dI...u..Zo{m.m..6...ym.c.Skl.........$.\U...{..K........>...%...[....].n.>... ?.Y.....`J...oQe.9.......:P.\...RD....^.C+Y.*..M.;...;.Py.......d. .;.=.J..*f.n..YN4..+.U..L.-=.R...{....a.....7..v....*.........8n.6.d^......nD6...~...3!..F5....(|......f...#n.^..xq.R.>.N.....c....2.]..l....*v......dfc.U..7..E.....y..E...5...w..C.s.?....4o..x..&$|.V\.H..+-..p.p..L.._...HD..'.oaS.S..4T^0.4<.....QE$..Nm~py\.. ....yc./..U.....$*...Q.,..(...0LX..C.V.h...'$...}f.I...t.C~TEv!.:...B.vp@.(....m..;}dP.._N|.........?G.:...V....]...P.T.s....Q.Z..?.-v.e.V/F...~<{|p8.5......."......E.h...!.H.Hb.!`Sf......D..f...H.;....E. ...^o.|...y....v].oEmHH.[.../t..0.>.R:..M...m....-..C...l.Q..kR..4.E..........y|ci]M.J..7O...YR.......f..`.....jn.|&E.M...-.\.|b..n... `S.R.c..L......a.j.Ex~sR...6.|..L..C'...l.Y...I..?./z.Rs...3.../v=.A........IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\localtreeview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1293
                                                  Entropy (8bit):7.810661832642768
                                                  Encrypted:false
                                                  SSDEEP:24:XbKbDTXsjW0P0rfmhqtqXVPT906ts3Kxoln37ZRbq:X0nXWWa0DUVpC3KxozRbq
                                                  MD5:C48D1C49C7A6D89ABD08C8F7A9F78E1C
                                                  SHA1:4316A3CC1501866C9CBDC2D6CB00F546DDDD004A
                                                  SHA-256:1D2FB812EF1899E9BEE80BA138E818EDA6EB75E48CFE25E1262010779E4EB885
                                                  SHA-512:4089BF099D060EF82C24F001AB97110C9B623AE5768A39B262DB4C73FAA3C6AEF1421D638ED0B914788C5C7AC6FB619974FD39071A172E1C48AF31B4C9416ED9
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx...s.H..}LC..w..13.A.a..s..n.....2...333..e...R.:Ug..|b.....g....8..AT.~qb.(!f.....]{..f!..|...b.Z.wn.:RV.u...6...*. f.&..Ld.G....}...........s...[.63........c}-.+..Xm5..j`.Z."J....v#..6d...x.;,hQ....+*.....6.`bz...Q....~....?6..3D.`...W|.-.i. ...IR<..1.ev....nk._T.a.7.]P.."(C..>.."J.=ME....>v..\..%..`sXF.`....j<."...{......e.4.`SN..V.o4BIc=T.......^...|...|.C.p...o....g..x.5.yd.!.J.......^Z.....D......8z...&..c....>........D...K.|.C&.).7......^F;......y.c.z...=..SxY9...H.))..y....1K.`I.......$.`...q.....J..p.F.JQ..R..]...D.Apj.U.....4/H.F....U^|j......H......3..M&...v....|....xm.....\.LH..`....,Zl....Xf..X................\..}...d.q2.2..:..Wg..*..2.EX.9d.&...":3.8.X...w.-u...ju...f...D...{....XC.'...Cv.-...|.,.?......f.4..g-.`....:....{....EQK|>.....[.Sx...I...4...t.\D.>k..S......B....ld....N.....d4.qp...s#R..`...}u?.@./P`....@#..FwY....a`..vW.owf...B....;B.....}......C...(MX..n.c.+##...;...

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\lock.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):953
                                                  Entropy (8bit):7.756432182810883
                                                  Encrypted:false
                                                  SSDEEP:24:aZUcAKDlSPHLiN1zSb78WnyJhH2IbkKUoQL:aZUcAYBS78WQhHlkLzL
                                                  MD5:7EAB972BFFAC70AF18AD32F173C38EE0
                                                  SHA1:77B68A0BE77B8EF049F22400D83A53FF8F17109C
                                                  SHA-256:0139736F1E4A1B9D867C34A97AB343DA4817E5C9B6027859A4CB16DF0443F476
                                                  SHA-512:253D77D11D7FC437E968191A9B3D4D28B66E1C30544D65BB1C2E77C02BF6D6E35579676003FEFFDC63BE83BF2FF408DC970CBADEDB45E9FBFCEC39309A321708
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx...lG..o.M.]V.6.8.@6....6.m.m.o.J.0NF.....;.U}f..._..'p....$..S..N.^=..k.hjy.I.*.......{.'..X...RakHr.qMg;...........<#...7X.w.*p.Iz...oT..@.@....@FI.d..Cq}-."...~.Ho7....w...."p....2.`mW.T.6CTZ..%%@Xr...../..b..G..3q.,.XJ`.m\.R..X.KO*...'.LM...o.Ze.u...+D..7...H.0...o.....%.....d.........T H....K.....j~....E...]...W....A.q_\.P.............e.A.{x*<.`..8!.cCt..-...?.g.4Kv.uX..[...D..0.+.%...4...{M.'tU@...=.\RW.b3.Q.BO.&...U.m.....<x.6....).....l..{.A.=S....Un.s`..^... 4...]...$.l....S. .n..[.[.....].r.....x.,..S..#.,..{.t?....#..r.+!...wI*..ep...@.I..@fE)04..L'..m..TH...B=.h.....E.?>...S..gN..w.[..-...+P\]....$./......_...kY.Sd#6#./n..:.i..C......-Mx....57BFy...a.!...R..A..b.|E....#..c.#._[..d.<.79.P..Y.........j..}.=<.....Kk....le...y...,....).E..@;..]^XU...cl......0...._].8.].e.........t.......t...F.F..U.^.....k<.|$...t6....D..s.........~e4.[."....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\logview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):970
                                                  Entropy (8bit):7.731615254815511
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7io9LBFKgquOLdRq0SQwtlcntjElpmxfLKJw49ve70cln6JMVg69O3To8Gglu:6rDrvtgApcub9vm0c2DDPGglkbBY2
                                                  MD5:88F4D2A39C37B399396E848028C94CA8
                                                  SHA1:16E9EC3070B1412E051F65ACC371F1B1201DC7E1
                                                  SHA-256:8B82DBB8E5F0E61762AA7ABDDB15BFA85567681B519BCFA5CF275F8AB6FE853E
                                                  SHA-512:28AEB5E1A4890BC93309F2B5910CEE451027BA2BD8D94CAA4FE361186CE47C5D51B94D4AE321E0FB00BADE1142D1FD7FCACF9A646922D32D46346122CE3B106D
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx.....kW......j.k..gl;..fl..v.m...n.wsjD..Z.../....nj........L..H..].n.q............G.....FF.....:...QE.....Q.NQ.......{(.......}o.g>......Kl1..$....3Q...7....o...g....?k....SV..gV.J..R;.....1.]aHj......&.....G.UG..%.1c;.$..B..?_..Z.n./..O.3...B....y..`..........1.:4.>N.<.^p.k...B.v.6.o............b.@R....C......]K6...6g.2..ND.!.$.Q;....C.K.f...c.<.km..\n..pND!.1.f........P.KLA.3Qd..(.....[.........j....l.(....W:..(g.T4:......R'.fi.I..x..C..q...[....f...2B.m@.......J.S.y.k....)......z.z.>.M...[..kV..x..<..8!\..:gm..i[.jx...9d....'....IH.x_...x..E4....`....._.q..eI.b.k.f@....-.C.....pxM........U.T/.|UK..@nm.i...W..[..B.b(.........+......\...*......f.....edo.........).@.%?......Ho..Yog#.....q.......Z&d$xk.O...N.{|.YON.4.i|y......%".Y...>.gq)........x.........=...k.H....z..g..@..%P.>...........LJ..+...S.|^l.~..........)>."..TJ....}.8B.{.&.....W&.GL..R.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\processqueue.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):2289
                                                  Entropy (8bit):7.890452388453586
                                                  Encrypted:false
                                                  SSDEEP:48:NxjPgqp06IKLfRX/Lye+nhVsoWci9Kxnhkwx/OZ4yv:Npog9XDye+nYoWx9qkwQaO
                                                  MD5:43E500FE466F958FAE5F9FD29EABCDC3
                                                  SHA1:72A7CCC9D396F64E5096B12576F4F2F4F29BAE4B
                                                  SHA-256:A90FBCFB8449DCF5AB69DD49A7098C07F99869BFACF289B337C7756EECD4E3F0
                                                  SHA-512:FB6B3F79F846F60C7C42989255B9A2A4D77A37D7EC5696209874998508276053A367FCA076B570491B43809FAC2D85CC07B845C0668723B44EE8AED8BA630A15
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx....t..............m.3..mO...m.....L.'....$..5]..x.zc.I..{..pOp.UW.e../.r.Q. .f.0|.?..?../...jR./b..". 1.........#Ggm....(...YU.X.D.`.:9....7o.",......o.....-..Rn...].S...".=...U...P.^..}......s.mgg/...........?.*.....?..k.L*j..}...s...n...-....b.kq].h...p<.....I...!.j.....k.\..y..C.....C..;.....l$......425.^ib..C...o;..7..@D....(.....q.AZ.l(...A&c..^$J.rY.q.......[5..Zl?.....~.v...0.|.;..B...lA.........xZ.&.I'q....N...:...kfh.m,0<<...........I.;...HS.....a.u.-.R..... `X..<s.>.GL.^H.V%..D4:.. v.........h....t..I.h......B!o(.g..9a..j...+.'...:]...3.......H..(P...Qp....I,a.. .4)JR...X"..(5..&&.W].......w3.Z.....=c....?...!".iB...a.....y*..x.*Z'(%.H.(.k+...hi.:.r.j...'...199..iO7.....R..-..y....v.w....wR...TF.o..#..w Z0s.fN......W_.khh.###?.{.......j......,m ..@a....@Q..Y..9.....b(s.i........A(.e.e..A.....6-n=..7V..1.0..?.._....;....r'..>.k....g.Q...4.y..R..6.4......eY..$..33.t..[....^s...f..N".

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\queueview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1680
                                                  Entropy (8bit):7.8410935978420735
                                                  Encrypted:false
                                                  SSDEEP:48:rIur1SBz5n2rErXncs0HT/H5+y/zy+rYjeajJg:rIur1Mz5nfnc5/zy+kjea1g
                                                  MD5:D367B5F46042FF303993E7A1CC309435
                                                  SHA1:61B8BDF88A2EA70BBE06F38271A422CB8B4CC2AB
                                                  SHA-256:4D08ECA18C2DF1852577174569EDC965D4125E91DF590737A7C8CCD3E291C006
                                                  SHA-512:8EA30FE58993BBF950CC474C88D52CB91ADB1D6875B7E7CFD83C9C72024C8995715BB4660E5F4C455030ECE4005A0D50F2A2E9E00EF75318C8D685D3BF839389
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz....WIDATx....t;{....m...bw.m..w8.LR+....m.Jc.v.{.A5.c.9.3......-....x..i.....E........^B..QR...N.K.m..qSR..x..H...(*....U6.9....M.+4..(C.?t?.(.L..i..{....!.!....P..&f...'.m`}....<...GA.i....n.*../VH..R.o3...5...k..3..^k....o\|...Z..i..) (.O...........\e3.)..+.Fv....y....Ur.4J.Z...s...;DP.......~..LKK.JOO.lJJJ.r........Pjx...A...Ye;N]....p....)......u..5.......GauR.K.3../.'.MJJz.N.....w.... -x.........y......(o..F.V....p......L....q........v....)1........^...B;N.#,8..D..<.)N~{.w~.8.d.xS$._2m.2E.....3..:[K.k..X...j..+....:.s.[..W.......:p.c.~..{...7d.w.....y5........8.s..`.~-../....0..?p...p..8._........."..&.....}.p..E....../.....o....|qq.+.U.P.1bii......SG....,o....V....M.c.r]Q..z...(:LI........"..&....bd.b.l./.SN..1Wx..2.F4....{..].?...P.:.`...O.E..;`..3.L........u...F4.}../...?........M....9SjE....Q.F./.j....J.VY......O.............Br_.W_.E.(V...R_. B.O.l.=....r(bD.......w..?H...Bx.|:[j.5biK..I.p5U.

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\reconnect.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1567
                                                  Entropy (8bit):7.835964632176258
                                                  Encrypted:false
                                                  SSDEEP:24:ae1LfmAsJ1MLwO53Pd5sosw2Ca+N8NWcNT6aXyp6AfMYn2Ik0KgO5BM7WHIvG2u/:yGRZPd5f4Ct0WWJXyVRnw0KVfIvk28l
                                                  MD5:2A9777860B33ACC15E7B54F5C0D22981
                                                  SHA1:FCFCD83382460DE3C67DB0B725244322365D402F
                                                  SHA-256:F699822F96B5CE2389D735C3057961D1EDBDC405073DE37F02AC15B1D82E0AE7
                                                  SHA-512:831F5D6DE4801958C4B01AE4CEBAD0F72F4FF7E2FFC521D9815F0CE59690FB472DFDB3F3A8484C62F2321A678837FE27E9B1F33B01A1AC1E292E30DAE081A390
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx..V.tk........m.m...ml...2.m....<.Ig.l.=.}.|.B......N...b.$G.|.#P..#.......n:.jh.3.....{.b..M.....'....^B.:....L.9....Q.Ns8>...{)...]:.=z......{.]S.@z.a.n.Aq....HQe.Y5Q.C*Z.2.x...0><..G=..F.f.....n ^1....j...pS.2...........;.z.>..F...........~.E.>}.{.>$X4.^....x(...:.M.T..m.Hs.=...G......g........sEa...x..a(.'Bz|.+.^918...epeAR.yli.`]..)..'...j.b..........n....:v..`C..k%N.8kD.b.?. ..<..w.IKs|&B..g...*`..C.9......b.........k.d). .4..K.V..:"dS..t....=.N.Z.....W.....\..lj....%$.g@...^.Z....M-nlm.b...`._G..9T\T#w......T.H95.+.H.v.q.....=..:.nu.t.!..@....$i.qlR..1....R.@|.Q..jA......Y..W.8.R.!........,k.T.O%.i....86........:.(s.Qy...V.R..o..._..........T..m.\w.\{|N...c3.......^.s& Q.F..:x....T4Ak.?...[..^z/....L..I.H}....b..fn..[.....u..Z....J.7... ...>........]@z...C':.P..:O..S`..z.v..H.=.....6..9x\.Y.@.?.Ur../...........7.#Cy..#.`..!..h..0...#.|5z.7.|...z..v.-8.n'I7.B]....OU.....%...&O.........o~..].

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\refresh.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1422
                                                  Entropy (8bit):7.853035540830731
                                                  Encrypted:false
                                                  SSDEEP:24:aIRoDlbzkfUhj+v3tVOhbRUuXjnozNtqjB8/JdqMWyOM+7reofZl4UWBhDy:RuDl3EUhj+ftaCuXjnozqjydTWJ7tfbB
                                                  MD5:802F4C28CDF440B5A9804A815783ACB3
                                                  SHA1:BB3CF2C9C7AA96AA73304C18C4B9FD6BE37A62AB
                                                  SHA-256:DD0C339CA4DB44CC41EEC349950A68F994FBB7D15C51CFE5F2BD6A61437F3BFC
                                                  SHA-512:31A5189072AA84BA288D06AC8F522A8033253BF79F4C460109688C848F18063F049FCD07EA0721F36B8E350CDFDA3005136BDE7CF952552F5CFE9E17173F8223
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz....UIDATx..V.t.X......).R.^....h..<$..Q..m.6{.&...Y+.g....T.E`.D.#.zE.x..L.^[x.B..Y.....7.BV....AE<......... ..Y2.r.a(...+..A...[.!+.`d...$..:.y....k.}W.._!.Mmi98.[.............<..y....p.!......W.X`).E5.C. .g...0>.5=...8.....F+.l............p......Jn..s.\.).+.0.@p^.......R~o.x...^.vt..g...g.6..X4g...s=R...l..{.@..~..J..P...)/)...6....MB.u....1....2..8D....-0......at#.F6..W.bp.h.......@.;u/......`..PZ.,...QU0w.$.ph.zd.X.7.al3........|./.F7. m..%..*.4....0\....{.<.....v.Vr5.....'....nD...4.==..t..C.N*.T.O.c.....-k.4...1.u..<\...}k.3....j.)..9..7B....3i.....`-..&..%.T.1~.=URZ. n.tl.7..zm..n.....@............O....m.G,.....A.....IW>...BR.s....=.N.......B.'.q........].... ..4.c.......:.|...\A..d...?...N...u..)..E....h....t"...h.e.b....../...N3.PZ\...L...mS....@......h.e...5.....a....*K*."..u.Q..K.>..I...`.qq9...e.g1..?....^y.9.E.|..H.....Ozh.*.....v....R...u..A7?o,..F}.z..K... ..T=.....-.F.3.....d*K+A)`.eeB..

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\remotetreeview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1323
                                                  Entropy (8bit):7.798057647628363
                                                  Encrypted:false
                                                  SSDEEP:24:HYt2VJWRlcU0cY2n0VDhGLryaLRT7BKx88K0t8k9Eqx71rq3WfkQ71nxBKBOycXa:i2VJKlSHGLrygo88kYr2BQftXE
                                                  MD5:62BC6B0B63E417E0D51C129FCD62DAEF
                                                  SHA1:F41536D73643769C8954E9E3225FACDF5B6425F1
                                                  SHA-256:543FD0958DF96E06F411A6936BB8EDD840507F1485450A077EAA6A9091E54306
                                                  SHA-512:11C07494C17EAEFF8751EA83A3B067A38925F98729656B3324E30D3F6CE96C1678D15328673F0B7C48EB0738474B5124CC4D76DF8A437F8A87EA92C984A29A95
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx....t.i.....=\...........Q.......f;~.K1.$s.y...9.~ybp#e.0..k..\..v.0.>.#&..>..b......>.Q9..R`=.[..a...B....+.....`..G..4.4.d.v... e.....`..DL..,h.yu. Z....1.aL...(.i.wf|{.......8..*C....`[`,....2....=........Y.6......%G..)0.[.YY.N../.....x.........v..F.....W.d..h9.N|...ckaY..mxY.{.1#........f...8d..P...ux?.........2.....H..{f..t........Q..Q.@... @.....@8...R..H..t3.9#.....#.....H..:j`..*...........M...is.H.D.....F..c....T8...iB..Ni..X.....=..p...C....}d.....x.7 |$...-..1..]..<.z&...g].B...L.R_L_<.._..E..t0..d..e..h..5c..2.@?*.-r..9.r.g...aC.d.n.W;.....|....<..>..N..Lx..../s.).y&D....K.G,R.^7.....r.~....Wz...=.0.J.R.G........c.".>(a.').|.be.)Fz.bd.)V..<^%adkE.......v...S.s...l.{.....n.@2.y 0+.....|z...+..%/...... F6l.f.Z.t..........rDI..{'...U.h....A.'((.\"....5#..}.*...[..Q....DS...Kn...+.d..@.<.iC/..j...c.4..<....KW.:.9....G.y....Q9.//.\i.f3*DJr.......\....~.....;..0..6t..i.f........{oy.c..x/...7

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\server.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):767
                                                  Entropy (8bit):7.579296424706097
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7i+DhV1CrWcz6EKiymSWA3tQPwmMo8HdTqTWkhHr7SbK8FpN4mLZfoS3xGp73:8lXoWcz6EKgWdaX85CzSuYnNtfoS3op7
                                                  MD5:1B60EB7C2906BD7BE68F834065CE39C1
                                                  SHA1:B5C79354B84E295146195F40C2BF60F2F5CFE04A
                                                  SHA-256:09FF12506ED2DAE411E54C7FB479DA7F5B06177D30C79B2CEDEFC9652EE7B638
                                                  SHA-512:EC1604C9B1CC43CB85B38AC7B3209F862B210C28AEC93A36EF9E9AED749072FD2DA98734C1A36F1C5A0E80CB9DEA48C62F72C2894F923CD789A527346A88F557
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx...S.#I...m.......T.....m.m>.......[.Z{..>.1.v..B.....4.........a....T..'.<.B...`.f.K..............MUw/Y..........6....j.........R...'.....o...U.....Q.p ...U..'....7n..M.P..I.MA......45.G...;...........xx.......j.=:....._.dP...I..U+..*kn..P.g....?.7/,.'.Nk..|..i.$:7P......((..t....HM#....@.L.7@N)@.?@..J.......J'..?G.RRHt....X`......?i.......-..P"...A..p5e........N|>. .....n...}.B@.N...S."I2.bW.x.8.a.(&~.0&n.?:n./:f. 2......G.f*C.x..es2,7..}....,8.gm.......?....2 ..A...D..y....fAB....u.|..~.V....j7...=...{z..P.....>..ic.B..."..@.P,..........b9.f0....l[K=....(..O..*]aSe.z...!Z.....;...Rl.kRM.U..5TIl.{wL.g.A...}.e8~A..?.........$.[[......JD.......p..G(~0.!*......}....m..D......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\showhidden.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1379
                                                  Entropy (8bit):7.7895027642703605
                                                  Encrypted:false
                                                  SSDEEP:24:OHgg8zrcEeWySrUHvuJsEceRKoSJTq2XthG1jX3e/1wAI0dEjf966z8qF:OV8zrcazi0sJeRgcCmAzdEp664qF
                                                  MD5:9ABC44426E996935DBF2EE24602668C4
                                                  SHA1:C81191F069822AD5E6B259AE04D7D3B90FC05112
                                                  SHA-256:CC9DCD7CC4CF015FC4CFD777494391A32A46A5BA7BAE71EEEEBF0E0F47634D36
                                                  SHA-512:B03218F4191E4DE3BB1258BDE4398EF7A8FD2090D7F03C315E9B94936C4B4C54646986CD3271BD36198C72197EB8E64F5864579BB4457D3D96CFE7185208312A
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz....*IDATx....+y...m{..5^.m$.}kcQ....k...7.f.....s~.I...O..|.~.....R........xRYY..(@.t.g....}.v(//..V.[.neR.Tt.V._.C.....9.gN..[`.M..!.3..F...B....... ..t..C.Z.....,....F..]..B.8....T......".....<..#...4......f.I.."^=.!.\....?....CP....x...x.Ut.W..o?..'...SH..+..Q..c.......{....I|qs\\.+.c.F.xdr....o0s.JJ.......b.@s.........O.)}z......Q....Sz..............Ri1.]...FM.ZhnRAuu5=.{.!...N..777.V..p#..~.>{=......G0K..{.IJJb.111.L.......Q<\..A....{........~~~.`=n...@...SC}..?~............t.+.U(.....m..:..7.w...z...m/.......T*.RH..o...8...M..x.[..L.lK.I......~4W..NII..{w.N.....P.-d.I]..p..n.pDD.0V...yx..F..+.....=..p...t:.0..'..*.,.Q...r...b~.,...)T0.}.B.....fL...8P(..R.tGEE.GFFn..@+.-[`...WO../.2c2jF..`.a0*......!.z.|.........vc..:.W.....,w..{@...s2..z........vB.c..n....h.l.6~-4s+..f18.s.R=...O...l......T.....w%0;#.$Sf.i....Mh....C.y...V..rh@.:.|ph$`.......W........X..E.7<<.......(O......`.1.~...ZjWA.q9F......^..M..,......+>..

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\sitemanager.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1701
                                                  Entropy (8bit):7.850966052992087
                                                  Encrypted:false
                                                  SSDEEP:24:mr+DqtXYOnOe4uqAUtTWHNnlytDHtUyflnzhSsliCyG6R/S7gEXjc:mxfnOe4uF2UnluDmAIiDyGJgr
                                                  MD5:713CC599592756C35BBF45B3299B42BE
                                                  SHA1:6EF0E2B30E7297625CEEAF572B6E252BAD953A72
                                                  SHA-256:4AD63C5835D83E818C21DF08556FEF7BC8377D2FCEFAA67553FEBF1346701C67
                                                  SHA-512:0E093365186A1485634D9CF2BAD0895858E1866D4A3DCF9EF09B72A9B611C8F94EDCC5DCA54E0ABDFC91411CC718427B6009F195DE1904E78AAF850A6ABEC9CB
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz....lIDATx....t$i..s.m;..6O..X..Ng&.............V.]u.o2.L...?....._.........................)...<..QP;;.G,,,...n.{t.....~c^..n.....a.QT..v..'..pQ.JIdf.,fe./d...0S..1...G..8}..H...v...B..ch.%..@..y...I...;9?...Gg$..........s........3..n.ZWQm{+.OO.....u.N.>.m...8U...i.(....a..\......bW..`B.{5.}c.hba~M...x@....7.p.....&..caM..M....Q*....dU......@EK....C....x......@ek3..Ee%.....\......o....e..m.N.T.v./.jX....LM...p..l...5@...j:...8QY...l}.2@*...+.mTV.u....`....(...Q..:PR.....W$...,8...u(.....C.V.V.p.u.#...bgq..t.............I..>\s[..6.#jR.EkOW.M>F......M.YGS....,n........KOW%.....ORd.4h...r.+<d.(.<c......')..[KU.....4..y....c.\.)sV^n.kN*..0..MH.......!{..4o.0......g.K.....7.s..RQ..b.U..K.q..Gnn....z..||B....i.....~.)-......C.....V...[...7....q:....G...(._....r...R..~}-.{..X..&-Z......k...9..2..G......f....g>.............!..Y.W/&cR...!D...........Zt.1..w+.*}3#L...]@....*.@>f..<Z.i.T......BTW.k.....:..&..^.....,........z..

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\speedlimits.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1167
                                                  Entropy (8bit):7.766538782080157
                                                  Encrypted:false
                                                  SSDEEP:24:9PZF5Uj4R9X8uya2xBrUZPbQJSshYWiXswaUTTjnqZbDO77:9P7XpBwB2bQJJ2qwfTWU77
                                                  MD5:239A42D07D720EDA43D6532971027B49
                                                  SHA1:3D90150411805874442066A0358B7980C68F8688
                                                  SHA-256:2E61CF4440B02B404E6FC16865A8604E0F1234290107CBD701660B6A0FA87294
                                                  SHA-512:110CC80523CE6243D1D5F28B5409068D9D9B350AE95806342CFFACC6F37E4C22EA319D3491AD3556AE19F94E72D2231B05C4E6AF82C4342D1F4E28C076980487
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz....VIDATx...xcY..O.m.;..M..dl{.&....m......v..Y.Xo..y.{s.....?P.!U..M.P..9.ob....<..4Q.z......^...G.i6-..^.....No7..A....G.P...v.]a..[....y.nx.J.J..;.oc}.5.].....1.x..n...*W\...Bt......R.:..c6}...._..7/q...X.......X.,......-...K.....g$...5...^5 .......:t...6a.g....@.....I.9.+P.z.F..BWG.c.Z .'}0.c.z.........p"..>}..G. .:.a..X-<.!kc1i{..l...-q..=...5.E..e...].14.%...(.../y.b&4....4* .k_*.&..[..........q...t.../.....qs.qA....I...S.D....@_O..6m.fj.d3s$*.`.G.x..gP.9.......9G.`.}...cp\z..V.}.eL.G..3E.l.u.....h.....H21.z..D.%...JV........1....'..d.' ..x..H....RQ.....Om..|qh...)...}.h=-....jO...R.L...._+/. F-?...H...bzP.SA-...i...S.5Gyb\....MW!...SR...T.~!;....B_..Z.o..f=..0]R1.TP.P..:!|.S.g.R..Z.0{>...s$%.8....)`y..{sw..g....3..).;;...5....PAM...Ds..n.B}....z............|..I0..U.|.1...cR........+.]C...B.F...Y...B...!8M.3..?......`2%...k.C.....=...":..?D....8p.;...8;;C.P@ ..%e.e....^.$....%.....b..R{..P.[l.%.....

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\symlink.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit gray+alpha, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):188
                                                  Entropy (8bit):6.307189258039723
                                                  Encrypted:false
                                                  SSDEEP:3:yionv//thPl37gxIWkVaXkEvZaSumMjlQGasFrWM9pg6JbKja4tlsyeeB1p:6v/lhPa1kVaxvkSxMj/nFrWM9VVKjaUR
                                                  MD5:08295D744D44989A68AC6398CAD3328D
                                                  SHA1:1D5A794A8BCE1C5BE0CA2B3514E2F0D439AEBAE6
                                                  SHA-256:52233AA5BCE166B569A5E95B29F8915441289EEFEC50607BFD24BEDE7618523D
                                                  SHA-512:17916CB6ECC9337BC6ABD2DA9C756659620DC23E6416E03717C7665373935FF0FB63FD8A7484E4CF04E79992C30A2BA60664DB82AA754794FF243407402469FE
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... ......s......IDATx.c.O!.3F..5`.Q.<..@Fb......./.1........?.................j...'...@/e.l..I..+.Z..3.......``.!........j....G.K....|A@..C!/..(.Nc........IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\synchronize.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1176
                                                  Entropy (8bit):7.751035261431217
                                                  Encrypted:false
                                                  SSDEEP:24:xdC5goZhI1MlSSsepVMRbsBvU/KhWl0qjKd3oO5pAaUD7rlm4dessgQq:VoZiMTsbsB8ShWWeepZUDHFdeER
                                                  MD5:F7B283632AA3E62BDAD4C1B435F93F26
                                                  SHA1:A4D9BF01339096CC5A105D3D90DCB6528704D833
                                                  SHA-256:F52C6A7A9F0E0985ACA052C7B24809050C389C9DBE1340A604EB003E8AFA8856
                                                  SHA-512:D30EA364A0562C233FF26B1DF4C13702B573642F6132640BD8DDB27F122249DA76B966A5A752425FA1EA5385AD5ADCB715D2222725166037C15F5C5B061243CF
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz...._IDATx..V.7G../..<..F.m.m.m.~....vj............".K........ //...g.4...rw......8mxyy.......................`kk....[VVBKK....Bsss455A..#...G.........o....pp........Vi~~.:;;.........aa!...........F..k.t....x...==....;7.sp]]...t.ts...........XWWG...%b...Y.,......o..*......@EE....Bff&RmmM...j....8.es..ijj,9...[PII..[[.R.X............*.....x.9.........) .....w55UC...u....8..">5..h?...UV.s...\....411N..e..wtt...|--.'A.bPP.54.s....PHH..FFF/..nmmY......G:..**Jw:8..^RR.B.s..8??....v@.dRR.W##.....)jii........lmEE...]]..sr.....n.............>...../....N(....2.....!...>..5`mm% ...p............p.......{2.../EEEp.677.R1...m...}.2...QI..$C|A..@.n.....p...AB.....l...X....whh...VbJ.B..jKP.k....%Z\\....E.....?XX.....$_..$...}F..e_QQ.(.@.....I....#k..!H77.211....-##s.`u..G.....gff......l.........C@..Hee.yV.VV....?........Z..G'.a..n.A~....(....5b.....Y..1..33.....@..:....K...Naa>.@UU%..........VUU~.A..r?..1....@FF:...I.$...Rx~;((

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\upload.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1106
                                                  Entropy (8bit):7.7526454714778685
                                                  Encrypted:false
                                                  SSDEEP:24:Mf3f8cfu5ft3oC+Drv8Fy3PayhzXYzXSasHJgy019JUfB/m:MfENFtYC+DrUkzp0XSBHJgy01T
                                                  MD5:283073C3DA0BC7EE74EA49E810FA216C
                                                  SHA1:8C6A314D0B693A4D83663EA1A35234FF0F7B64F0
                                                  SHA-256:A2AAFD72FB4CF2C956A8C80D780C552AEB69E5A43C0320E8F587158494650D7E
                                                  SHA-512:3490AC6167CDA5739F9FA5C4D17EFA44655C989FDD2F18631B88C9D8E08CCE78C307C039A97B616DAE600BB700B1DFAEC293205C1C841F57FBD3886C32A6801B
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx..c.3W.....&.L..v.N..mc..~.m.m...S{U.......^j.5@.oT.8..7..X... ....b...2..bN.U/..S/.......R.[..`..Pm..0....O=...~O.....9v...h...PV.}\... .}\1.y..t9.u.....,...K.....,:..#...z....ep..?...-r/.#?.^{.K.h...$F!.u..s...y...O.......|.L<R.....3..vp..c.J~P...s...7.TVJ.........>J....x...!r.&...#..5j.}....W\K......R...k.|YQ..x5.{3..^.^d..I:.......~.....!..L.F.bS.n..w=...M{.....e.....V6.U~.t.w..+.c5H.d@..q.*.^....!@..t....i3.n.V..m..Q...5..s...I!-..s.y...n..3.P......E...5.....x. .D..D.|#.l..w#...x.cm...d...%.hU..=v....;#...@..8..+T.1...o#p.7W...!.8.iD.P..H.ez...ns.*.YW..}9..n.:...WG.k.z..C..9.f..%.!.9D..D......$.z4.&.{c...>...Z.m.p.4...o|...l.6...%#z..(. ...0z..(.N..[.p....."k.)2...p..2..Q.q...D.GT....U.H.f(.....*...#v...f..B..7..l.0..*.........(^o..-..m.:...3........Rg..I.c...Z."a......F.Yb...- B....jd.\JyU..w.:F.78[....K..zV.?q.."....y..P....R.f.Y.".{.=..).....o..x...d1m.........f...2.....U..Zl#z.L5... ?.

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\uploadadd.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1391
                                                  Entropy (8bit):7.835880693565033
                                                  Encrypted:false
                                                  SSDEEP:24:K7h1EXrzSPLvQZhAemVTKjn7qGqOLkuW/mj7fYvAhbKmMccw2zwy8JSeTW/t2WN:nXrePbQHAeiO2GLLzW/mj7fT4Fc2zn8o
                                                  MD5:C2DA077B823D446D6AB5F3AA63BB427F
                                                  SHA1:ED9511230B40FC02E97EFF115AF5C9878025FBF5
                                                  SHA-256:84C53D562B5D1220C722EB128F2CFD6D861114188851E8BA76E8B3811AB6A35B
                                                  SHA-512:830DE8BDE454D479B96E2F574F545A8E7A08F44F5A5C1FE5FB8EC7CA435720359B0FEB94E5F49A7DBDCE96A9D32877FAB12EBA80228194A570091BF78FED3D2F
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz....6IDATx..cxc{...k[...k#....F..O..L..V..m..-.......<......fN...C*..I...__.7.x...T*... <<.$}l.$.x'##.. .....xJ ..=..\]]..j...d...|||N....O......Q|..h....n..........)..q1a........N...L..."22......B!BBB...a4....|...(........UUU...DYY.......?."...PQQ..OKK;..y..........={.,....?...?svv......E6.........6??.6R....Y.<$..........Qkv>...fN.q#.>f=..;.//.3..[.F.'..c. .Y.r..Ed}.........(R...l..2...S7B....&R....2c.c.......9...C...\.V.~..U|...:Di..R..p.|dY&.?..$1..Pa........B:h.......].E.Y..X....o9...7.`.<D....Z._.0.%.J{Gh........k..,.PC....0y...\...9.%;.`....iM....?&U....r.(7....v...E.I.GcJG..0...../...:... .b44.S.i......1:..S.. .......Mi..fj>.[:.!.C1@......).3..'....VD..@B.8....<........)rK.*..U.....c...../....P......f6....r.Z.p.U...O.a.(....\?.#..@.e..c.n..{.=x.|......LB.%.X.3.......y.h....?./...9)......MaX.Qu.`.<L]....<.;J.{.A..d.;{.l.Pp7|.7Q.`C...8C...."...*.."..gj&/.M....MX.?...'..<.{.\..=.~..w.{O.......

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\ascii.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):2418
                                                  Entropy (8bit):7.909236924067308
                                                  Encrypted:false
                                                  SSDEEP:48:3dFFKHCJfMPRNU4S9/gKrE6IqghyrIF7QUryLUMtF7HRWllm87:3dP3JfuNOjjIqCyrISI2UM7xWllm87
                                                  MD5:F0F5758E14405F8C8BF3FCB1085FE95C
                                                  SHA1:8F5D5FA5D1FBBB9BC612D594EABE0B54679F3AFB
                                                  SHA-256:F0E65D482B65359CFC9357BF0E780238888ED77253011EEEA8C3AD00B9544502
                                                  SHA-512:48BAFC6DD5399BB831406C03BC5374B6D7C2BD68D572C2686EC7949DAFB66A379DA9EE9135A2A7A774EDF292778B9ED9B4800463BEACBD9931CE359C5EB0E787
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W......9IDATx...p.I.@_.d....13333333.9ff.....<f..s...jg..T.r......v...7..EU..................S.Lp.U...c.n..{.{..m.e....G,........x..Ba......-..=....9../.BE...$.,...-....o.._n8s..O3...&..5......6I'<..I.!......v.a........On..D...&.?xF..|/.....$.Z..P:......I.....3f.......$i..v^k.xh..?..f.....Zr..0r$..:..?.^..G.R.B.}8..R,/.Df8....&3g..g>).,...AY.11v....r..C.ML}.GM....P7...[]..W....$P.,..B.C...x64[..,..g.b..Q.`.9.n%6.d....'.9kV..@s.x....X...cT]..I.os...s...^#d.Uv.x&...J..9....7/zD.R.T_{..>...=..........\z..%..M....#.~..d@....^M..MN}...[.Opuuu.>.%.6....#...YM/B....3:.|....{.H..<....7...........V..S^7!..(b.Sl...7.]....w.0...j6.rK...k.f..&.nJO.%BU..g.ud..h.."..|.4.5yBa.CX........0.@Y..~..**+9....M.FO.@. ....Bh..8|#....,.............<.T.nS..<|..A.JO...c.=.+o.....Tz.Y.?1.{......"...2..g..$t;}pk...j.......^...@.H.P.Vb...-.|..u....9...X}.5I&.......BO.I,*n..%b......+.O(.`..{2.Xgg......g..E..B.........v.BBk......c.....$..

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\auto.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):2733
                                                  Entropy (8bit):7.904291926606656
                                                  Encrypted:false
                                                  SSDEEP:48:b97qz8/dKdKgEu3RtDFR1ClZF3zRv/a/EP1s8vkf6NwG6dJHK7Vbq5EKzUVLijft:bJk4dcK7KxR1ClHzpSqcfDG6dh+M5uJa
                                                  MD5:924347274EBA9CBF4B63FC26726A1D8B
                                                  SHA1:DA095A7540A58DF1DD6425A63C5916E0E6D397D2
                                                  SHA-256:095DD0FBAD7491167D397DDF6441931D2CB5A084FAA223BD136D759380778BCA
                                                  SHA-512:C0130398EA991135F8E597F00B31D3D90D71E3C8B65C138A35559DD69EF5CC752ACDC7521F456FF4B4694B7183D4BC9482CDE6EE8E5B543FE9A89BA3C92A564F
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W......tIDATx...t.I.......\.aZff..3..33.2.33..2c..?.L..df[4.]..............a}.......\|..oy..X..x.."...3?.0{.Z.R@.3.}..d.......kq[.....=qoI.j$.JQ.N..r. ....0'...L..6.}0..}.) .,}....o/K...3...F.DwVSy|...A............(..H6K6.g..Hlj.c.D....2.jn~2"t..3.%=.f.........u..H..t.\ ..S...d...,yK5.^>.S.N#F [t..-....Yi......k..L.`Rni..W..3..`.t.t.l....3..;......]{qGa.j`...O8{u#N....BL.p..-....>...q..@..._).......O....S.U.S..7.S..R...o.c.........R+.5...$...Z...../.l.7|..." c.{....H...U.k...C'|..|.~.,&.R.J>R..).;...Z>wL.........\,%...J.4L.../^.6.G...{[.....p...vv../9.......n4.".?gA..&..EKAE.R&......".../.@D(#..G..w?s.hA..1hi....Y..9...Z]....:&q..D..N_r..Vp..Ub... .........9:zzw..0.g>.>2.....30.=.?(....|.%]..ln..n...o..y[`Fc".aa_[.u.&..A...Y...w.y.:v@.Y.'...F..... H$H%.v............m.5.'"...D@P..Y.J.c..o<...xq....U.e....PU.2r+....e7.........G.6h..OA.Q.XB-8.b.E....a......H..f.D..Z%.>.R...0....Vf...0br..d..{UKp.t......*.H......t...u?....5.

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\binary.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):2277
                                                  Entropy (8bit):7.8762797330707555
                                                  Encrypted:false
                                                  SSDEEP:48:XILAWNE6dHZ/a8cLzffDRMbeiqoGhVToxmhu06GYhTpb/eUCa:XPje7cPjRM0oooxv0C5pDeUCa
                                                  MD5:23A970B367AD89FE98FD71BABF791094
                                                  SHA1:931FE4C1DA95C9E3FA75683722914AA547D568B8
                                                  SHA-256:BB91A6D5EABF4AB5B376F7AD578CFE4879B19650F1DC3389903B0FE9D1C11988
                                                  SHA-512:BF22525D419F0B6ADEE1344AE7CA67DBCC28860CA498B2BE36B5763121A401D5D45615FB68A33D9180FBE3BA0DBCBC4B5BB3A9D40C225ADE69D78F0B543EE184
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx.....cO.....d2;;Z.c.m.m.m.o.m{....}.L.V*...fSx1.....t.:,..m...MO...[.......U.8:$g....:trC..;. ......n:..d.Q.&...^.\.{{.P...l...5...j..I...P."....D.Z#.2nq.....|Bl......Exf'.[.;.P.{F''i8w...{.."1r.[..0.....Z.2?.Y5I.!.vB<.&w\.[......5.......\...3...ax*....BU...jL..t$....\.....`...k0g..e...X.v.G....z#..k3......q.|..Y...c....."P...g..n..=...(......."f.....a7...a.......-.8.b...P..X.M7..-.^..cG..L...P.=/..Co.u..=...*".....2...gE.9..q.{.....K<....2.x.j...3V....X.1J.1......qIi.\......^.+.+Uz......=....."........*.UP...n...T...Y..R.....t..Co....8....WP.(.^=.../.A..0G(.g.......V.1.jd.ze....y.U...G....u._........rl*...'91..`..4.....l.'e.@...xUT=63.Sz....>].".(6Ho.-yPA[*U.G......sW.4.O!0.C.?.".cn..;.*!@.M...@w_..B.T.;.J...E.....v$e.<54..c..OETe...y..n.XUiU..o..2.yU...R...*{G.>u.P}....Q(.r...lf..P...E}+#.@m....f.....|..s......+v.2/......_U....y>p.i..).S?.....B/....w..i{e>.b.s....=KB..&..1;...@.....[..&

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\bookmark.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGB, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):648
                                                  Entropy (8bit):7.482731600175207
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7r7mYuYPUJs/0AQHdMmxmKzVHdWrgzPWBtJRzMCCNMJGr0OEhyN9/+kXahopF:cEYPoU0AQHdMmxZztwszeBtGYhk95Xai
                                                  MD5:BA95DC4223903C4D79221308B9933527
                                                  SHA1:70BA3062582D584605897B25A00F1D2AB59625DC
                                                  SHA-256:073A415017A07653662CA8D62A23EC8B96FE0A306225DEEE608BD4922E5C89CC
                                                  SHA-512:2D6F6668FF002CFAD46EF20EE0D548CAC04B97F4B9A92B6BA5F86045B295C19A232A793652FD1FFFD02D95BF48BD89814A52E3DA8094A1E28142B911482CF8AE
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0......`n.....tRNS........y"...=IDATx...c.\A....m..+..9A... ....X.{.f....*z.g|mxn......c..........+;...5...n.2`..?~.C.$ TWU#" .RBZ..*......Hk6..xv......U.W\.jim.....D#a..+K.f.@Z.[...._.E_.......Mh...f.])....f.@Z.V.y..>"x...>...[ZZ..m.D..>f^.h.2u..c..k7...>....q.DD.*.2R.**_(.zvB...].`...\^.u..C$Ea..^1.....=.U| ..$...-.L D.....4.c.CB.....b.. +..N.&..(......-..,I......q.O.....}j..?S#.[..........L=.%.c...SS.a......Q.i7k[f.RJ.B.......;jj$.4....vv...._[f.(...........jjn...Rfh.....H.x.)...%.Y...5.0fr.j..9S.i.m.Cwm..P.el...(k..bRc...6..~....2..jh.S_.F&.,.$.1L|14.Y#.g.5....r@C,.....;<....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\bookmarks.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGB, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):648
                                                  Entropy (8bit):7.482731600175207
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7r7mYuYPUJs/0AQHdMmxmKzVHdWrgzPWBtJRzMCCNMJGr0OEhyN9/+kXahopF:cEYPoU0AQHdMmxZztwszeBtGYhk95Xai
                                                  MD5:BA95DC4223903C4D79221308B9933527
                                                  SHA1:70BA3062582D584605897B25A00F1D2AB59625DC
                                                  SHA-256:073A415017A07653662CA8D62A23EC8B96FE0A306225DEEE608BD4922E5C89CC
                                                  SHA-512:2D6F6668FF002CFAD46EF20EE0D548CAC04B97F4B9A92B6BA5F86045B295C19A232A793652FD1FFFD02D95BF48BD89814A52E3DA8094A1E28142B911482CF8AE
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0......`n.....tRNS........y"...=IDATx...c.\A....m..+..9A... ....X.{.f....*z.g|mxn......c..........+;...5...n.2`..?~.C.$ TWU#" .RBZ..*......Hk6..xv......U.W\.jim.....D#a..+K.f.@Z.[...._.E_.......Mh...f.])....f.@Z.V.y..>"x...>...[ZZ..m.D..>f^.h.2u..c..k7...>....q.DD.*.2R.**_(.zvB...].`...\^.u..C$Ea..^1.....=.U| ..$...-.L D.....4.c.CB.....b.. +..N.&..(......-..,I......q.O.....}j..?S#.[..........L=.%.c...SS.a......Q.i7k[f.RJ.B.......;jj$.4....vv...._[f.(...........jjn...Rfh.....H.x.)...%.Y...5.0fr.j..9S.i.m.Cwm..P.el...(k..bRc...6..~....2..jh.S_.F&.,.$.1L|14.Y#.g.5....r@C,.....;<....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\cancel.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGB, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1983
                                                  Entropy (8bit):7.879204797755092
                                                  Encrypted:false
                                                  SSDEEP:48:OHfRrGBgbZWmI5JZWJrNidcNeRd1QHnfHkcHOgxhT:0Rrigbr88zi2e1QHfHkk3T
                                                  MD5:6136C1F640BCC18CBBD83ECBB2B5B829
                                                  SHA1:ED838F8D92B401AB21C540D1F207583548BED1EE
                                                  SHA-256:1DDDA9311F9C70C3A4029A274E9B68E252489260742B9A4B4B4D327C600E6041
                                                  SHA-512:0B11C1E6D92510193AA70F9D2EA1CEB3F42151220CEC5B6373D5879D9C5969A58348BA133E42AC7C3A831414A5EE0A0A6F780EF107044EC6B56BA069D156032A
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0......`n.....tRNS......n......tIDATx............^..:6js.g...l.......6k..%....W.Y{e%.'9....{........vs.p0...$a...'.%....}...%.....ph..I...c+............~`..)=..K..w..._*.4.../.:..t4;.H...~....._~a.....<.31.#:.#&.=&.}gllW||wbb..w.`J.i[...2..o>c.....0.y..^....o...........E..._.f%C...7.....&4...0zt.Q.*.Mc.6....X...J...Z..u....]..X0.-6.q....#....2.z....kz...!Cj....1.ap.-B...wq..M...y4+..C...%&.....24."8."(.<0.< ..@:.......4.a.#G6......S........j.'.G..p......P..Z..T.._..[..]..S....\.'.*...\.b.O......tL...9........L...vv.^^..{z.yx..Z....E..X,i..C..{.....U.&.D..v..4.v..&..2.g.Thxt..W..S...g..W..V......B.{..|.)..a...8....:..COT...v..3.9:tN.......&R.7.l].l.U]o.)1Y....{a..1....-K.0l{z.J.....&IO.....D)vvw\.P..~vp......G..A.Hx..c.)L#....a.Z.zi8Xc2qq.9...3.......w.*..........\.........Sd...5..zJ...l{{..|.9..~.._.....z=2G.U....EF.q..fw.@.d.m/=...{H...>rt..W^Q.l~.A\...M...+?u..F.F.-......Ic.n.K_...A.E=..).I"w.5Vk.V...{..w...4

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\compare.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1996
                                                  Entropy (8bit):7.857779041794649
                                                  Encrypted:false
                                                  SSDEEP:48:LYxO86YmmFIRqy70n4Tpve4RcvNJAGhVAtNHLHI5qF5:kQrmSTpe4AJAGPyJLo5g
                                                  MD5:C55F018B6ED23C4F94600EC41CF3C0D5
                                                  SHA1:80C39C4C62EC96231BB882782BCB2F625FBE0F26
                                                  SHA-256:C74AF9EBA87BD964B7564B98C0BE0A50461B2B9DB79B817402D25BE4974A88A1
                                                  SHA-512:B881AD1334A9BCBF8D724F7BDD4947AFEE8F5C41BC2EA1DF30CA7384AE4C284CAE62A6D1CA68CCE18DBFA0C9D14813915A5FC247D0EB14CBECC89867D406F0B4
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx...p$[..m.m..>...mM4.d..^.mg....;.........=}g.../....y..7.|..\.b'...^@/p..t^2LL./N......B`..r.l..c...!pvUU.U...W2...n....144...K.../......"......../....A..5"..c..$...p..F]].6m..Q]]..WTT...D..'"T.&...=.FF..P.....kQ[..q!.....=Ew...6.v...a...........=..F..b.---...PK>G..gD*...4@..ZCj.FH.....?#I./H...2.0Pz.......gff>)H \.)..Gcn..sS.j.j8f.f.......a.d>_..$''.oii.......C.T....r]pp...q.........%%%GI:99].H..$`..(.0{.....0.K.C..80h.=.[....."~.....&.7.i./...dy."d...0;Q.........q...:..C#.....;.b..?.k_../........^u.......-...I.V3dF.o....k.Sk....0..&.7044. .h....4.E...-((....p.O.....Zha.W ....,..;R......`o.9vuo.H.RtW.....V.%......kA..IL......._@...Z......v.n....m_..............4.~.../0.X..[}....M...M..<..]........8Z.1..(..u....4.....Do....~.!.=..F{.W...............i....m....l...g;7.@..c.6.....m+1..C-.....>L.6/&..Vsmg.f.y... ...._...~W ...f^..w....*....|NP.@m......A.u..+........).. ...n..`.uPK.......

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\disconnect.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):2905
                                                  Entropy (8bit):7.933926612224345
                                                  Encrypted:false
                                                  SSDEEP:48:3DbBoHfCMr0S0Vf3IYHLyH5tUMDQZrh3k+nQ57GY2T26ApWVSXAtmkxsTIn9z:3DNojqxIqL8muQZreVGY2T26ApWwQEkB
                                                  MD5:C38C1EF6EF5643A869E4D19F08066A68
                                                  SHA1:D094EB4D1211D2185927AC8991520212F54837E2
                                                  SHA-256:C3AE3774EBD8E3266140102F8AE4AE67BF6327F4C5B077C18D3886E945139E94
                                                  SHA-512:9D55740B9E24807B8DCB8C5AECCF0E49CF6CEACEB8F3A5EE59C0A6D33B3E34A37E0AED732D63DD6AA07F4B8CC8C1F8204D8A473CD6CA24E9D6D0D603BDD0B345
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W...... IDATx..W.p.Y...V.X..&..c..m[....v..x6.............?.....o.C4.... ._N..'.w.}......)2e.......*:...._.V...)..0..a..NP>l..`...n....i..`..~mU(.$..ygU..5..,5...G./. h(...7.Yx....rO@.. .i..R.p...$..%.8.v%...3..j..7E....(.Y..[-(.....{....1y.>..o..V.B'.a...v....\.VB.c.6g.^.>.r..p*..o.......r..u'.....d...).t.".\.R..".t.l.Y.fN..YV...w,.y.sS.!.d...".'..`.... .<N..;c... 8.~......&.z..<.Z..l{..s..n. .L.\f.P...H|7..t.@L;.Gw.Pl.....8%.....!kp...l.~........'Y.N...& }....B...YG8.}......V..k.`.g@....i)%.{.7.S+.+<\.<....4.H.Z3.......9...^.....o........Y..%.Wp..P..R.....c.BW." ....kO.<w.F..b;..D~k..l.h...:8LP..-.'....h[..X...F.Y.l>..f.&..P....#............aR...;M.`......K...}..V.y...........N...D.z.:"..;......).xK..S[..J...........W@V>...).F~G@=....@J..Z./..EX..k.|...{e.-Tk.C.._.s.u`;..9........3Z.....GU?.fZ.eW.D.SP..2...Z..[..X.-bI...E30.....+..[.O`.u@.......C.u.Mn...`...9(*.A6X..s:..%n...m....q.,!1.N.0t.h..3..;

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\download.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):2005
                                                  Entropy (8bit):7.877373103536374
                                                  Encrypted:false
                                                  SSDEEP:48:+h0Tl+ek5SeK3GEGrhrYW2J+4EEsIwUR6kL/BqUMMc4CHsEDXTqx:+mh+ek43GvrhrYW2J+4MUwcqUMMc/H/G
                                                  MD5:309698AFE2B6DDEF3E1117EB53D969C3
                                                  SHA1:286F1832883CE58576A221CF42FAE815307C0C1C
                                                  SHA-256:869ACB4262F5792007870D5A6D58AD687B750F7D8DA23309BF3FFA9DAB949187
                                                  SHA-512:1979ECE952EA589CAE052959C53038EE8B8BC676D82F1662EC33EC9954D8589BBD944C5E82D8667B8CC97F83A5B2EBD8DAB2CFB24AB1B66AB21E9E5D8E82501A
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx.....i.....$.3.....e....h..m..n.F..X...3;..z.9.....}..F..9r........U,..|......8h\:...........+....Ykt...^/.9.=^Y.@g]....<x*...4.-......9.`E......tm..k.z...._".......dBP.&\.7..8.:... ^.`.....*.....q8\.}p.u.-...(t.%.>..\.myS4...u........xY..0Vw.[..:.L\......m.....us....._}......>..pIe..l..Q.......*..E.. n+[$yCI}.."..]....:.V)...Hx.I,.R0..o.L......y3.DsEK.7w..tN.....G...?..0Q...}.g.".T.....$...p...k.H......_.......[&.Z...&.....n..h..H.pdT>.0..p..W....h...%7#._.............B.R....*|r.?.<..^G....H...t.O.U..:k)...!..6.....k..w...........iK.........@c.G...C.A..a65...4...:L.BEs.?5.y.e%.}`..d............x]u4..\p......6..!}.P.E..k(.....D4z1.S.....d21..#.A...`t...VG.0..o...>.*..x................X.b/)(.......b...T2.....E4.."%:*.Q\..l.".dv.....i.......j6 .q.0....)..1..W.E..6.o.._..k@.......+..sK.i.H.f.8C..r. .Hc..F.=....j...5<.n..q..PF.8Q.+......(...~.....8..4.<.~v.x^.X.j..0X.df.[.......L.....a[

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\downloadadd.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):2577
                                                  Entropy (8bit):7.913838494207273
                                                  Encrypted:false
                                                  SSDEEP:48:P4FKEWyPnIVef+8cJJ/qxnUG5apR3/Cx3TDwEUbVvPh4+qu9zBj6G2fl0AFAHsaA:P0KEW+nIUfeJdSVapR6huNhbBT6GHAFh
                                                  MD5:5C23C4F4A5BA59F1D3FA273AB1A7C13D
                                                  SHA1:EEAF8C9C2D0C6F79094B40A0EE6C6F9364AE4168
                                                  SHA-256:641DAD2CA989390408618D30137422CA5455B874D794C3BD0DE361F150003549
                                                  SHA-512:04A99722A9E138A7A981A4F00F9D233A5F89B003CE010CE62ED8B1CC69ED643392A0ED1581E1E278063A249B8313E3F5F4B84CC7B7EA6B2B71E6E00D16DF19F4
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx.....A...............5.8<....W.xr{.T.+.n..0.U.t..y....p<{.L..........FFF.`.6.<cbbNNMM9....\..............233...#@mmm*//G.'a.........E....UPP...:...X`v.@@......p...z....Z.........A..y...t6$$...%....}..jkk.............>....M.;.........YMOO...BB@ee.RSS...".oqqQ..{W.._.M...E.........)--M...*++....O....w..O....GGG......vvv...M....Tvv."##......@e....~...{kR.[........*...)//...q...+::.c.;08p.!.....&.LZGoo.....@..........X....\...CCC..[R..K.........]]]...]f.1......|.7......C..O.s..x...u.2......\|.....f....Ma...0......`6.b...ZZZr....?^%.l.."=VWW]...b.a---.2.fw.......:..t...(X08v.<.......0.......(................C_....|l...$Y.(<^.>X....]].Oc.V!.\......R..m<.....a..8..(../..?i.$I.$..%tu-.[......,?..$..}...(.,..3z...t.p...c.........y.-<...zb......JK.e.k5t..~.=|\/....&D..'Ig..U...I..B....kE..q5Gv.(.,..S..o..O.....#$0.[?FZ...>..L...Xl.>..G..t....._...........k...*'....I.r.rNk..U..{.p.`Q*..j.+.g..9...|..

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\file.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGB, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1045
                                                  Entropy (8bit):7.717189259773399
                                                  Encrypted:false
                                                  SSDEEP:24:cB8EMWnAh4+jSRCSQAPIHavnNtcj0vJa+koKUnp6GmaSMSW8Y:c8EMUE4+JSQYvnHDdTdpbmaSS
                                                  MD5:C8272BDFD0F4C8759C7139D62FA4CAEE
                                                  SHA1:563B4E4FE108AE13EAD88B7415C12947E528045F
                                                  SHA-256:F42580F26340DF3B102BEDBE96F261532D544B9D63792EFA4823A07362BA7DFF
                                                  SHA-512:77DB9233BFAF9FF35617E8AA004DDE5ED3EF69352FE08A3C4B0F6CA768E9230B36C6C6102E3146255B425D0CB0713FFDA45FC2D749FC64763F5180F2E5A871BD
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0......`n.....tRNS........y"....IDATx.b.w-.yzJ.+....vj.m...q.\]..1.}...w...........#...Q........v.D.Z_..>0...4"....0lg.....3U.h..G..D. 0....}..>...o)..r#TM1./-c..C..._.`...E...v........$Jo..6..R...[..t'O.y..f.L[Q0.a....9{.x.....'...x.....@3\.r...93mEa....KK......+..@.|.tO.h.-..3.K%...W..z.....#.......2....N....n..*c.t...q...D%....9"f.*h!..\.G.0.z8.*3P.....1f".....R<.....q$....io:....q.M..Q.e....(.-...l.#b:...W...:~..r%....V.6..."T.Ux..LE.Z. ..T.<.B..Z...6$d..j.. ..lm[.>....Ck......t.XC..l..Z...g.im;3.~X...(...\(..R...<.....f..%.7.".!R.:.^%i..P.KvC.g.}.Ru..........#.;%..QDw..d.....[..........k.l...H.m...-.5Yw@S.H..|...?..3o./...VPIn6.3........{..} ..).j.v..k:.^.+...:.ZY$K..@6.3.V.@.c...k....U..&...W].....d-".1.Y..z.T..HuW2.....HP.74......&!d%.#WT8.i........m.T......+[...$...*v:U7.0s... ....*..YJ...(.Q...S...XI.T......h..e..)\......VE...w..k...........;..XU........$.$B,....!.AnX.$.H...m..mA(.F...H".[$.w...*.......|....Qq.

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\filter.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):699
                                                  Entropy (8bit):7.575025168250253
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7/todEj/+X/MeXivlElyvIcFweINNRybVuDP6xCleUrngFptJ/S66d3cCvhJp:Ktoa/x7veyvIcfIb2yvr0p//uz5gPw
                                                  MD5:A8CAF932ED171295A67BEEB2EEBC7B93
                                                  SHA1:CBA717C7961ECA3E52B775CC1D989BB735F3D2E4
                                                  SHA-256:5B7DB20B2E748D94FCFFCA77DB0D82378702A16889FBC69BDC3EDEBED8FBCB51
                                                  SHA-512:503E22FE2217CD33AA2170DEC76456ADF3327CF400D5C5833BC56CF274CC30318FF3C1D18D16F4BF86CF79BCB33A245145B55DB1BF304F88010320BD9DB27E76
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx......Q.......m....m...m...tt3.[...]...:..(U.n.........."...D.i$.?.Zb0.V.M.8U.j4._Q..g..^8W....=.....hr.).I..@.0...........`.2..!...&...G.#..qR.0.%...[.}......I.,...%.yD.{..$.#i/....>U..V{...|.......Q....M.....;...q.....+"(.4.J.]H.... ...Q.......)..k..[...................X.>.D..."bUg@W<...w......K......t.....J.`.)...$.....fY}...f.E[.....#..i"`..Z{.qT.$.ejQ..Mn(..0y.p.+bz....B....{.?...o..,.....F..>.m..c-#ai...%.%...Rq..%q._.......I.:,].g....~.^.j....>s~.C...H.x..Gq.]...8W..../r......Bl..A@7.G..U}..$.{M5:..k.2...\..t7.z..E5@..#..[.$..Z.......z..8..&..I....5...Z.z.F.l..}.H....A....q..U.............n.._.H.c.;hD....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\find.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):2109
                                                  Entropy (8bit):7.88500819090751
                                                  Encrypted:false
                                                  SSDEEP:48:aUsIx8E6plzjLrrn5FPh+1Au4bqdpZL8T3qoh8USl1:FmE6fzjLXvPh+bdpZL8fHSz
                                                  MD5:0FE36310805B6D56D29151678759786E
                                                  SHA1:538A9AC41C6A4EAC43DFDC0B2B9FDF3F5681F2BB
                                                  SHA-256:CD779BEC0F09E1C7A2CC61E17A0ED6885A3088F44CEF8AE48BBAA0EB0DB8B286
                                                  SHA-512:215C092CDEFA86D8D90CDCCA3A0F4CEBE7154E899B5F72C467932FB4E02C4F2297C1341C10346785DFCB16B4F4756538017FFE18698983E9E7274D128E55F619
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx...p$...sm[.m..0.m......z7....'...;{;W.R..V...=....GG...Z]...?...O?.........7..g........|.../.........iK.|.....b@@........h.....q..C.....p...iW..<@..........7O.+!...[...aM..:!!A.....xzz2...J.@(...[..M..66J///&22Rs.....W..Y.+.o.....P........glm.T..Fj#[.%/h.c.r.1.P.$.`x.9....\..Pegg....]HH.c`` ..}.b..}..=.w.>88.12.+.l.U.[....>fW..Ri..Ru..Rm......kkD*.]mJ#k..1..xV.<.R....X.%..........L..^..{.9?"_.......S=b.....]....2a..[.....|..6..W"t\....1.002.).q......o.......x...}..f...q.....^.#2..2....8.6......._....P...jckk.xW%..,.....-...g.....k.:....._K.&8....L_.......W\.t....0...f........8.@.1411... ..k...i..j.....a...v..................................!]}.UTT..(.....9.@I....u.....`x.....b.............<.x.Tr....r......r...R.q....,.7.b...&||| @..(.6p"..KAAA..YYY..!.....L.....3."..=.ay./.hZ.xov.x.:.u.s.G6gV.wATl.@nX.@%y.."0}.......g0vp.u'.F.&e..........c.]..{ZaYX>.\.wm....c.[...5.%ni.M[[7.6.J.#.l.(..t...6...........@..

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\folder.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):2386
                                                  Entropy (8bit):7.897825550427399
                                                  Encrypted:false
                                                  SSDEEP:48:X8wYZs+zHYmu7y5p3HaZ7KkCz54uYYIOxUQzWluMYvlOQFuAlSr0e:X7CLvx3M7vgeY9WliNOQ7l00e
                                                  MD5:4631391B6F8FA1B0BFF28FC2F675F35B
                                                  SHA1:DFA697B89B0F7EB50AAD6138FBAA88A92EB5FCFE
                                                  SHA-256:F5B3CC02279C119BFC0A40D461C0F49C089F7B826DD288E841D26D918D2464D5
                                                  SHA-512:89F4E8273D88B3825247692FA2BB7798D8A219440556EA52B0EA0FA5AEA977485EBFC48072FDD547C7EF197333F1B4C073F802BCBB901698E752C7CCC0640397
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx...l%Ks........1..afff.+ .'...$.33333s...l_.....N.,K.....|V.U...Su./.$..x...m...J^...;?.W...;......|..}.......J..Y......t...7cS.......y.$...U@*..".W..r..gl.c..%U7n..1.~I....R..m..<..=...6`.x.i./-.....h.^.....?.3..~..,.Z.3.c+p..<.....,..._..Q.._..@.[..C..i_...y..a~a.$. D..q..u.qTcw...........J.>......C...[.t..(..H.-.....l..[..HX....R.Xmnf<.Fc8zJ.k..%..20.mn0........=......O......+\..q;Z..W...ft9.Yb0V...Y.f|......_.u(..,...Cvd~.B..&...Mb.u.P7..........=.2.X..8..s..........,...'....{.....Y...q.L..<......n{.F.@..XP.)......9.,...../..~.{?S.b(.s.&...,B).0....&.Y+..Ea......`.Z6^z..N](~....td.W-1........b.G.ua...a..w....X....P..*-....w.3......ZH..]".P...,-.%d.e..W.....~.eb... p...}.].......s..onH.....w...p."81..E."Q.@.d.D._iF...0....e6{....[7maf|.=..o.9}.`y....q...d..$.it;^.......>.................Pw.l&.}..Yv.......u.........3.....y@...o...I$.".Sb}........).ME...5.Sl.c.....K.XZ.2m.....&.E..U....;....;

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\folderback.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGB, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):712
                                                  Entropy (8bit):7.562986130951774
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7r96Aja4B8pVuylMzGAtUGpn3B+QMi1nNP4SOWoH3WTH:c96Zr3yZytWfD
                                                  MD5:AAD279CD9C16D2B8D4B495565BD0070E
                                                  SHA1:EA7364198A3C28A8268F9BA66F7E8D08AE439B90
                                                  SHA-256:7E5DF7EDB5AC19FF5B373193C0F3779637A8197FFC5CBE81EA39167430309794
                                                  SHA-512:F895A1955FC471E32CFD9CAD8C19A2504350443364482979091763B0CFEB20C2B792DDB25B4FB871DDE31B4C14FB88E0183D1DA9941577299CD779ABA167FB34
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0......`n.....tRNS........y"...}IDATx.b.w-.`.,t.k.A...u..F.4.i+.d.;....I. ......1.7:.g......m...{.........a. ..5..MIQ...5~.j*.J2.d. .....O....{.-SM.N.;u2......8A.I'.>q<.J>~....q./m}o...5..=~...k._..?..@]u%..tyi.......B.K....-...y...R.5...._P..x............].5.D^....%!.....U.T.f..=.v....~...........LNM.s.....M..08[A`....T.z..[7www...E...Z...%..H'...HQn.......y. .X.......gtt....+...,.@..B.r3..U.n......&.....D.@..h..j.>.|..)C.yP..3..3.RSsKq....sdX..c..@...&.F...ef0i\3.ySsKkaQ....(......8.s...'..B..a.0+.7.....L"..f....*...I.^.....g.....L*..X....q...nx...m..A.....fR..}.?...S..wf.4......M.I'..o...R.1.rL&nP.)..M1......AyP....]..^3A.........IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\folderclosed.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1900
                                                  Entropy (8bit):7.877312215614868
                                                  Encrypted:false
                                                  SSDEEP:48:hHEAOglNsfOil3HfhfkIL/YK+tK2YBXqLWhQm0:hDOgyfpB/h4kHsRm0
                                                  MD5:8E64A8233007A4A79644A2886EDCBE14
                                                  SHA1:B2EE0ECB8B4D361D3D22E8482889F178BCBCEF88
                                                  SHA-256:24D2E3A7D7449F4A22BC2D10BEA0200EDD13D86682E86400F37D97094E1CE076
                                                  SHA-512:8A77C222ECD93D5FFA6E3A78BB5F4C9FA0419A4745E5F5C1F5CD35CFA2CA0EBCB27CBE3AFA420912B1482BD512E51AFDBAF5F811149F4F37FC1BE03BCBC99947
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W......3IDATx.....A...3;.}...m..e\.Auc.m..S+vR....}..%.X.f...:..2.2.2....Bb...;7G..Nvm.~.a.J..P......o...+...(._.BSCj.w......!._N........,.e.........B..)r...........D@.....O..cK.....>j.&......>...i...E.o.86.@.....#%.u..@.Q.....\....r..uQ]....$$L.{.9....].d...........p|.[.....j....`3..M.(|7%....D.:S...6..=.9S...#.1.[KM....PU.1.Qu...*..1J.$...8l..=.......W?...9./.U.......wJl']....f.Xu={:.v...<.w.~...W?-..7c...)%d.....*....9..M.d?'<.1....{`......pS.Z...6..y.....c"g........&..F...8.w..z..[.c..I...4...Q...~M.7.:.msT.go.-@`.. .`U..`..a.x.....T.....`.C.]$.Wu%.4..z..$....ne....P.../...P....3.....d#.D>..J..n...8](.X..*..).nw..<.i!...H..|........^....v..|.vh..5u...u ........|......1..+.~.l...E.h...+...Q.....m...6W...M.....2...3...q^.,\..]HE.3h.mY&F+s.7).=....vC.t.U..N..=Xz|...21-$Pl..~.Pu./`..1.......~.S.K.9..t..f..&.'...7,..9O....."c.l..U...D..=.....R.....Ab.....S.36,.\...&H2.....`..cQ~.C.......;.......f*o`T....,8RH

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\folderup.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGB, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):732
                                                  Entropy (8bit):7.593952374875707
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7rHZNvQE3gGfio3hjR05/BDVrdhI0ztw6S592wYTmMyH2Kjs4oIfBVqKnC0u6:c1gGKo3QVZhPBPS5IwYTa2n8HC8Jx
                                                  MD5:C0942E80E6096D2FBEE61770401FC47B
                                                  SHA1:48355134926633765D208DEC68BEE5654C742CDE
                                                  SHA-256:53A802EE16C72B7E5F82A5C5B70EB44B6428F2B4751FD282DCA08733A51159CC
                                                  SHA-512:1D49CFD5AB9CC5BE2B8954A14B024E9E873D69331BEF8B3A1B792A444F4625429F9570C39A78ECFD0B9B400E5AD5FDE91DA190D6B98178BC1D96E92658F8AE4B
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0......`n.....tRNS........y"....IDATx.b.w-.`.L.U.:h....F.4m..z:..k..=h.&&.\...mgc...Ju71...w.GKs..7n~..5)...nb".5.V...6....w....G.?ol..h..... ...,......@....v8t...........=.4;{.o..'6.9.5+.5{j...O....'.<y.`.l...d.....Y.{......%K.w...-.7.!.Y3...s..:|....\B...Db...6...f..)cF.>}.L]J......2.%a.<..@.L.4a....=..)..*.`...O@.....0g...1..4G.>.93.....?q...b/.R.NK..[7.{. A..7.....mY.......MBP.....'..%:.}.".\.IH...F..G..3.l..O>..x.}..r.....\Bbg +h.q..C.?..?....Si....._f[...P...O6..qc.].:Hz."..]8v...=...B..G....%...;'..^...q+O.ME..n........J....<s..(|.....zm.Hk..d"H.R.@J..M.*L....#"+T....G....+T.hB....`T .`.,x |..@..F.Dk....o.#H9..%.,".%A..:w........4..@.f......f.Y.........IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\help.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1621
                                                  Entropy (8bit):7.830389338350691
                                                  Encrypted:false
                                                  SSDEEP:48:Nu7xSyxkeE6uHKs17iyNbGCm9jL0s35N1+:Nu79xkeOqaGyJ7AjL0s3h+
                                                  MD5:1060C960DA64CD56FAD45F93A518E61E
                                                  SHA1:BE37F6B3949EB6E9340B966EB8E26550041C9929
                                                  SHA-256:7578FE340FAF90D1B816A62DB9BA172B8F8C89807DBA403499859FC5F5FCD665
                                                  SHA-512:62318439DDD0C62D98DFD2F0068E3FAEC4E24377A7E4EBF90D71CC194CCCF1DE934E0AC1D5EAD65F8D2B6C8C5A6C004DD445E4ABFD0B1693FD130478734B564C
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx..YSxdi.].......m;7.rl.m{...t.FX{...O..s.}..V..s.._................(...#....f..K.QIi.jmv....X!!1B.?3.....@..~,5Z....2...G{.._Ky.<..S]a".8.J.6.m..KWm...L......@....u..=$.b.5..S.v3I.!....<{.i\.P.I.R..td|Kz.......R"...t._96...G.Q:@Uw&Q..Tt...^.-_./...k....8..zP.m7...Q.)Zg.7....C....{&47.O..z..x...........w'......PT..s<(=.......H....N."5.,&C.b..G...r_*.1...KUw.S..QTru..^....d .W..T.F.v.m..>kv....M..L..<.T.V.:.\7*..js&.....2........1....s].*x<..y...N:t......:L..Pg.H..c8...g..z..#..L.^..d.....q-.bO..5....g]@..tj..B..gV..<.....s....*SH.L..<...>..a5X.Q..]*]T..8=...g...WK.TM.$..HY..W....c..=.X.,L......mdJ.B.]Z.n.va_.X.n4.42....X..x....a<h6......I.. S..bo..9.L.=DiH...k.B.{..d,.......;..*o....I...o....\.j.X......a.!5.t.....'F..3..ETzm.w".B.....Rc.zQ....5`....r.8b..r.A'/.-......{....qPn.........B.../t'.$*z..s 1\...d./..S.@.....2..LQ}c....Sy.5.O.fP.AL?T....U..!L1'.V....N.`..Zr...<.....M.U3....U...X....G.W.2...`.

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\localtreeview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):2260
                                                  Entropy (8bit):7.9077953868133095
                                                  Encrypted:false
                                                  SSDEEP:48:72kHDtR50gyxNdG8CKIeUHKWw89pyTvxHmoFRm3dkNJCqpj:ZRR5TyjdhCK3UHKgGxHmEJR
                                                  MD5:F224EBF437ED8CFBCB9FE5405866C9F1
                                                  SHA1:75E17A12A7C49076CF97546CAACE035BF18A8144
                                                  SHA-256:A921F04A8C9B9C28A51372939A5074895B507DD4FD4BB7AED9C1B08780440EA2
                                                  SHA-512:08A72990B2B49B7A0B4D2B412DEF3AB2D4753A0878676BE71E414AED474CC6A09413A5A7E7A139353EFD67944989EAAA8C0A8C5D7540F7BE32F0E12F02E10F35
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx..UX.......?]w.O.wG:......L...%...H<...I.YwWuj.......J8..Zg.sj......<..d;.DC.N.I:...$.y.eD..N.)!.u.....\..q..5..e.6..C....b.....0@B>O.pVJO;..#...#.....,.O..Im..W.....q...a.KU.......(......3...."...M.....GES#J*.p.....^.+.p..q..m.x....M...U..W...,...2.H#..DDF..8..f..;....;8...:$xZ....F..Ud.0S.g.*|......N...a.V....8_t.5PZ...PDG.7c..1H....\@\~.....We2.B...~uD.$!Ap...Q.FPb..\<..N.vw.e.%..Il..D..#...~..;O..&*l.Zt.I!.m+...k1`#...^.5...P.m...7..d*.'H...\{p.g..p......."2..Bhv...(<v..........4....P5. .........8zx|......Qx.....Q%Gln...Z8q.....v.BDV..v..!Z.K..'....-(..b.r....*..S..C;..P..W6. ...F$.{..L..C1...`..j...."..k...%a...w..3....?...../..F.......&.Yc.._p.A.._....D.o{..>;.p.E..%...Q.o....;......R...<..Q9..M.wL.UN.-.%DA...........6b.7-..'.d.+.oR#.....x.A/=Df....s..d..[.4$.#C...iT ....(....9...j;....>hgz..}{R#.....j...F..|[....~{..}k/...g!.[/..PE.i.6.dC...).2.pz.<...b~..$.vq....s...v...D..:3...#[.p).an.

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\lock.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1389
                                                  Entropy (8bit):7.800662260474723
                                                  Encrypted:false
                                                  SSDEEP:24:e/BpS+S4YVl9iKI/+spQxShfcm+u9Q4t/7RvuIkZEJdE/tvpuVGs1fc0I9DfY:e/Bp/EQT/+syIPZElv0VGk00Qg
                                                  MD5:178717849AFEAA3CC9F6609E85599D3A
                                                  SHA1:9720820E56F4BFFE73CAF41CC0AFBEB046E048BD
                                                  SHA-256:C8A8DD1550497C1AF893F987FC4F7474FC786CD106F427BFEA45119585C05F26
                                                  SHA-512:E16DD9EC10507264648ED297F18C9E7AC3E8042B00F782C1F112C16063CE888271C46637CFFCB7217582220572F49EAD5D59673872FDB273D3A60EE33101E908
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W......4IDATx..C|$Y.......^....b.......9....m..Ll'..:.....9........`Z.H`......P..T.S.F*h........u.{.......U..:..sh..)% .._.L....S.g...d.\_.[..m..@........!-:/.."V..k..t..V...HE+..........Q..q=(..dfz.@.yoR..j..dx<...j.JZ.+.....o..l...%E.UV.y..7..5@..6"#.Kj.7....x. .W.*&...P...............7....L...p...o..Z=.....G.3.H/..V441...Dvz..m6.x.9..o...n......%......&seedX..L.." T*_....m[..L.b.C...?<.Ma.k..,.._.0....).. .S...VEE...b...oe..>...i.g..........w.9..gp.X."3.qr.....Q.^...$.U+..^../#....%..F.....{@b\'.^.c.e.$%..H....x|...7r.u 8%...........R......$.`..iP.-`u..R.=.<p....^D"S..|.8..r.@...F.*....l.`..K..V.;.<.......#.#`gh].d.S..!m..},8!'.G..~>.......E..f.C...gg.T`.#.....6...Hc.Y.d...l...!.:..+.]oS.g..^.0..B .+."....@DJ.M..`...........C.^..n..)..Y..3K......`.,.(M;B...d;. .AL~.b.....V....E...Z........7..X.]kXR....$.[Yho.S.6....(iE.8TF..H)...Iy9........o...n..`..2.....rs..:!0....!06...<..),...4.......q...t..WV@u]....Oyu..{.

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\logview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1482
                                                  Entropy (8bit):7.815257026603366
                                                  Encrypted:false
                                                  SSDEEP:24:I7JgCOz7VugLOfnx4+94D2J+vI+vzhf2FFCcX3NYn6OmsnobKKOyPGW0wX9Z9j23:I7JKVuoa9K0+vIKzhi9OeKKOMGW77h23
                                                  MD5:07FDA58F24AF0B428458056D5720ECA9
                                                  SHA1:1AEE091B27B0FD8B5C747F77560D60D4B986C93E
                                                  SHA-256:5987428EFEC9E5B470A37DE7EA85F190C8C761EACC5C11B9A70F7D8FEC212E19
                                                  SHA-512:D108CCB08B7CAD8C151FC38352BD9E07086135F93EAFB72D46F446956755DA5F54482E8A013A095EAA48EED5484BC5809D5C150552218189E2971B1A32C910B8
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx..cx#k....m..NS.Iw.........*V...m+u..9w..e1.[<O~....|g...#...F@#....f...xGvj....F.e.S:.f..t..(.... ..U@.W@......(u..Z......./..!$.....p..-.&...z.....&.oi.F...H.b0.eA...p...{r?....P.............}W.+.m]:.-.<..<.o|C.z.{<.5}..Wt...cS2 ...N..R.2xe..0.a}n...p..%P..?..6..I .....d..Y..+I..!......y`.......o..=Ii..4..+...T:...\.M..os./...../.N.k./*]:..........mkN..=G..Q.=Q.B..E..+.U....d.=.+I....)......s......#...."+!.S..?hkQMm..*=!\...OA....V..?U.B%..G...Ao...=#M..._..5.`...=..(.(@..)A....Y...FJ.G..(.(.*.mv.]<...6..q....h..&...........c.P..*.....G."P\IP.......v...P....-d%..t..%U..+....Y.R..3....4mD..2....LAf~..?P....G#@....b.Z....8D....H..RU\.V..-............Oc.-Qm:u.....ZLAs_.L .....'...).ME`qm5u........;..a.... :..q..|.-:...n.... ............4tH.v.-..G..&@.....J...rXu.:.o<....(>.s.. }.a....{...^.}..`?...p.r#..r7.q.]....X".......CLA{..*;...(.kO@....BC.P......XL..Y4Db..(.G..V8N<>(.....&9..q..G$...0

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\processqueue.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):4194
                                                  Entropy (8bit):7.936067716270614
                                                  Encrypted:false
                                                  SSDEEP:96:I2wtG78rtCoBV2JPOqLbrCL8zadRWaKFUF6K/B5Iaz+8cQ+Jl:oGO5sLbU44PKCnB53z+FQ+Jl
                                                  MD5:02B8F7AD4757D634DD02AD99C5FA51D7
                                                  SHA1:F16D5A3E1E2F7C61EABF39F0C1F2512C9A9C4619
                                                  SHA-256:225D7824698CFFCF5C909356AAB0E825A0B6B0C68CD839505EFD0E37440CB22E
                                                  SHA-512:D8CF5F042719BA6485085D38CAC197A56F07AAE168BC74D18986A4578741EE4B50C06FA9B92CD215293D890317676ADD85EB80685C6EC10272ED6250E8EC771F
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W......)IDATx....p.W...s.{F,...0......{.3.{.,y).......N.Q.lE8..L...~]].../d.Wu<..../...QU.?..........z.."r.9w.s.....%!w#R@.Z@..]v.vc......W...c.....5.._....1&)..@!TTu.......V`..1.....N..n..f/|../<...........,...B.T/..`.>'M....Ic.}.w.`+p..O.A.....i..6..Q.......y....Rk=...7.N>... t1...N.=.....u..>..+O....^...."O......O=.....G39.M._..K...I.<M..$..D=....M.[Z.VQ..[m..MR.....B2.....XY.[^..^`.#....?c9..;..j\S...r.{.g.\...D}.*........bBM...\f..)...fY...:G...i....t\...p..j......a . .{=X|~a!b.c`s.....d.....I.rH.P...6.%..|..X#...,.w...U-.YG...l,..1....o.I.G#|.k/}.1...N.1kG......sg...-D.;..r....`.x....C.I...G.70.p..j!..'....g.9..Hs...h5.^q.a.$..j....PSH.... ....{|c.ST,..?2.....|T./.....B....f.u.7."../.&Y.z....9.*.~L...~..v\....!.=.Y.s..X..g.i.)g=M....Q.% .$...@D.'<q....X.!.og.....3..................i.....j!......}a ".q.}..$N...dY....9.+..z.....H.j.le#..^. ..Q....q.B)...k.........<.........i[O}$.......D..U'.....D.i@h...Q..P..'

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\queueview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):3098
                                                  Entropy (8bit):7.902323935241318
                                                  Encrypted:false
                                                  SSDEEP:96:lN3uFsx/S/HmmKuQZT9VkwpO1yJz8K9DHTN:lN3uFsA/HmmFwpO1YzhHTN
                                                  MD5:1BF26B8AE1745420322A8F53602CDE98
                                                  SHA1:D4C9F5125F278C38FC2BFA8962BA09A9742E303D
                                                  SHA-256:FD48956A0EC43D12B3E6672F551D64DD0C1A50661B3C942AE2C92F1C4CFDFDE4
                                                  SHA-512:6ACA700A0AAAF5DE2747C6B71C1153D5D57B5720606D4B65E849D70F308B65CF751088FEA23D5A17626034F171BA8A419D041AEAB644CD84FE70EFAFB2A42489
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx..uXb[.........M...n..8....y%...7cO...(...#.W..>.....A.....e..S...{..........^<...\oJ..b....a.X..H$ ..@..CHH.0.....a.g<<<.%.92.............y..............1........e..Q.../;.U.J......qZ.PVQ...{A.}.D....|..e.`.@.*<U.m...hj...p.D..=\..].!9{7..r !c..v..1@...:.v3....V.D..cUp.Q..O...c ;p..w.k"i.!......'N.a......lll,.3^..a..@.!Bx..pd...<....0.....u..v.O"vG..l.........a.......0.5.>@...3.5.?g).....p.`.$.......0.g.'..j.....`0V Y..i....\..,@..D...m.....Iw.WB....`.W(l...^..l]E....,]J.QD..3CGH..I.#...Y].......D....z0.........o.-.....d~....Mc.R[|3. (+..3...t.....A.v..+...d......!..=..y..7F.?sb.}..Q..N.."e....h...@6..x0.t..G6.E.....hggw3....&....\.....C...i{......rp.I`KX*l.N.u.1..G...".....N|.|.l5..n._..zs...@.k..0.%.!...[]..........".`...`.!........Ph.a_.2.9.|p...8'..........b...,..F.&.{n.C.1WB.......n...a.Y0.....?.V.(.X<..[\..f-..\.m.k :..r...a....p..2[..?...C.........s...f...*3..Gj...{n..os..6..}.I.T.........;...

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\reconnect.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):2853
                                                  Entropy (8bit):7.916303130465067
                                                  Encrypted:false
                                                  SSDEEP:48:xaovtLzk0yHo3S8Z1wjdgGmyMUZB8U35jvwBIApIWzYx+e5jNY8FVnKeW:xaovtLzk0v3LZygG/dZ+UvKmIDe5jNJm
                                                  MD5:CB903BCAA781B39524043E771629B1CC
                                                  SHA1:DCFF8ED0421C98818098263464C9DF32091E1F3A
                                                  SHA-256:6072651A62E89333C4F9C8135E9DEBD5E9F4BF8492964C1C9B85239C2DAA1561
                                                  SHA-512:ED348867899B5CD0C793E2415E6D3CC650F0B68002FFFA22EC9DF1C0D587AE65336A5674B5C9E8A10FD141E2AE5A7FA9B55A9FE24835065FBB8AF1124FF17943
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx..X.x.}.}..m.om.m.q5$).T.Km.}m.^g......s..yn..9......:.....3...i.....G.R.~5O...<m..U..j.l..uj...dg.g..d.M...E..1...`.\...z.H..t....U.4IB......>uo.....u....N...[......)96,|..7..|.......G.......Z.....}^uY.k....TF5..`_e....(....H...t.{lZ......2.y.....D.\.....J`.Wi..Z.X..-*.Fb..Z.T|P...j.........m....?.".kg.F..B.{..}$B.;9pWY.h.t.u..}.w8...J.!y...........Q...a".bf&..e..BGR...}..X$.."...t.}.E.....Cq...&..@...B........n.R...zaR.F......+..G..:AoW...2?f.#...s.B4.)|Z...U...4.JZ.B....u...6X5..?.O...S.w..#...u...+.M.%.TMA<..<..`]=.#....s...Tv...jG.X..._Y....z."5Z.<.Y..&D ..#.6..q...$.x.....o.9.x..?...Y....f6..n.2~".)...x.......1....<Ci.D.V<.....o.Ck...|.L$..`.Z...X........ej....!../.u.i......@..+..N.._..Ap.6...0O.....v...|...NE@}....^.. r&..BzE.l|.. .K...37.R......1../..S[.B.C.x.H.#@#..b.....@....w.^.9."..........x....4G.......cD..JO.i&tP..a]5...,|..,..YXenl.z...WYrm.s..|...*.c`...x...h>....J....lg.)*...

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\refresh.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):2529
                                                  Entropy (8bit):7.918490184742482
                                                  Encrypted:false
                                                  SSDEEP:48:XWurA7yJJ+6hnQ2cyLqOD1AiUEHxRRIDfJftIZLlO9JflNM7rtS0ass:XWu07yJJPhnIa5D1A8iftIZZO3WrtSP1
                                                  MD5:785F5D73E9E92E8206AEB170BEDC0AB1
                                                  SHA1:6246414D02BDADF41D1958DB519C1BE7D449FBDF
                                                  SHA-256:49FD712F53751F8B0F124CB5B83C0EA48E2E279EB4B544CDA01ECCA03686AF09
                                                  SHA-512:2AEFB302B947AD69E47DAEBA2878445F05D6177335D382A1A9B89A81DBE4B52464B4072E274F21633DC35203E1F4FCF49BF205B0C98A505F6335C505F7B264BC
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx..Y.T....wwww.|.........Qt.gHp...fqwg..5.$H..._=..b..y1..n.[.nU....s.Qkc~...t.].?..<X.....2....+....".3.....Z.-.[.U./BF.......y'.x..3.oIWqF...O....1.YH...x/........'.t....i.O.......\..4O.........E|...u.<..!y..O.l2....m`-.....R:....P..^R......\..vF|..........q..\x....EX.,.....6.......88.<..-../..3.......@....R...V.zK#h...+s..[..S..o...'.:...F.~. {.-."4...-...U..P..i}..5.....2.q....&..s...S.G... .`..a..rXgn..I. d....fP..n)e.....l....)....8......#}.{J`i.}.9..t.}D.eaY..:..../....(..&R.....?C'2....C..u(.JT....a...v&t..1.....Y.,...M.~..O)9.^..9Q.....x..X.@..P..2/...ux.,.<.........}y#.g.......6.y..O.t=K.7?......(.....J..... ...e..P..).. .....\Pq.?..Z.?............O..o...?..8,.(.%..jc.l..H&..T...e.<..$..l.6.6....>.d.....RSgr...kc+@.Y.)t..U.2.....V..R:..X..0..b#eX.......X...cS.B...T.........BK.1...fX......4Aj.c.*.xR-.u.W.Z.J...X..o...'.3......Asi.$.k".&..#. f)Y.=.o.Em.....U......0.Yg..I...gOCv...5..<...g...

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\remotetreeview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):2409
                                                  Entropy (8bit):7.901591130843325
                                                  Encrypted:false
                                                  SSDEEP:48:WKFiWzAR1CHj978lUcmgY2XaBxIFMe5quvVGxdJZF:vfzAY9gpgIqeIuvVGxdJZF
                                                  MD5:65EB2BB0526D972D020B025D5D34A386
                                                  SHA1:F60414789F8A919C9F9E58D45A70CD56C3CCE73B
                                                  SHA-256:019B044CADAC109696C2C21F742125406039E27FDE582156CDCBE54C0F0C964D
                                                  SHA-512:15BE3C9982CE18A47FEA85D1CB7204CCE9954F11E8ACCB47C8139D3F2BE4606439B49A78CDC110DA10097B8F151DCA9C6CEC17BE40F5DFD3BBA03A966CFB699C
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W......0IDATx....dI....<...=X.Y.o.m..]...m........k."...6..x....|?a.eo.9._..c........9..}(B.I..Epo.7...?...0G......f.7..~{6u.(........G..4jS..:..n+.m.Qv.......yN.x..}..Y...4.....CXv..(f/.,... JX7..<...X..R......?...x.?.....O^.xV.....~G..`.d.....Q.I..R....q.....v......G...|... .>u...F...........R....y.).I..$..bp.........{..NE,9.....[...%..n.....U+.t.Y......M\..[63.h..c.A.V+.p....lBl...?..0.i..>r.G.y5p.>Pi../.-...{?.S.V...:.S.6?s.A..G1FN1x.C...RJ..t...K..&.7..c._0K8.|..yf.t....b.o.xbS.?:. L....d..S........YZ.yR.u.....2.".U....R..5..Z...I..7...!.N.;.+.S_{X,r.i.Y.0'..=l..X,Z[2...`.,S..4j...k...u.T..../.`.9.-U...cm.....X...6..#.e...h..q.....O|.^<o......G .bZ..u...'..S..{..i.... .~*Y.p...j=...jt.6.@...A.-`.E+%p.B.......#.F/.......&....~.r..'H.:B9O._[...........az..%q..s.<..U.r%.....h.r..fe...d.....-6p..'.wQ..Cbs......;.:..fsdc.......p..0..:..<r.K...(%....K..Xr...$...."....l....#.O[c....x..RI9t..y.k......~.r..R(P.y....S

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\server.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1104
                                                  Entropy (8bit):7.7511874951879065
                                                  Encrypted:false
                                                  SSDEEP:24:3pxJIBlF6YAY9vcBsHLX7c0qOqPY8Vb9joh2CsDzYIynUmlW76rXvIz:3pbUFwBsrX5BqPruhgDzNyUmYz
                                                  MD5:76E98F56F5327E70852A7D5765D9B1DE
                                                  SHA1:532045611207D80572F77657788A65E41342AA03
                                                  SHA-256:A450278FF8D5DB0EB5A705E9DB979CF6C76E4103ED561B35778B6BD5D6D04574
                                                  SHA-512:2920B840AE52E5BE33FADE1646D00A7351BED30AA9FABA3002091E868D84FADC3D795B609F61BD862C19FBC76201667FEE96A887B95B26BCF11597DD7AEA4623
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx....%G.... .m.m.(.....Q..m..7o.o..O.k.tj......E....V.....]w.&..L....g.f..T.a..}_.\..W.z...C..[.....B.p0..(I..HP)Q..1.....X..D.x.UEX....wPa....g....3.t.6\.].....o.6..>.....C....'/=.......c&N..c 0t}_....w.}dA....W.8...<.3.......].g.}.1.n......".....u.6......{...........nG.z(.Ak.6.; .",G.8a(..a.5....=....".)..xK...!.O.5..Q..B....Y.<.0.)@(b`.AZ.EE.B..."-....s.......E.)!(..% .d...0.m.4..g.q.,..V...u..^{..@..&"..@c.....O8.j.M.......d.Q$6..p....v..Y.U...[...AZ...`z......DZ.v.$pk..I.....!.T..yp.'k=.....z..cilr7X}.+...~..;t...;.6..{....u.[.....6..v3.J.Z(.C....3...._.N.U.^.....k.....}.n.....|...fz... ..F..o..(.(0.b.D`.."4".s..{...f.B.;r\eT...}....t`.X..q%.c..y..+......f."..I...L...ZE...S..5J..`....p.(..L.b@...;>....2V...^..H.).*bU....B.0....f.k....R.*L.4...@.......Z.z.v..@.C....1.G.p.........\u.|..|.x...v...t......V.q.....,...._m{.....?....$U..F.(........:...qV......$m..M.u Xe;..V.......)c

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\showhidden.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):2340
                                                  Entropy (8bit):7.866140824505384
                                                  Encrypted:false
                                                  SSDEEP:48:vhJ1g+b8Sb8pMZnyO4bzjIbQ7QraBAxMT23lXvYy8LFlOwR2FUWFMAW1Zi:Bgm8Sb8eZyjjIoQuBGMiVgLrWFMAqc
                                                  MD5:6F6A4F0371895B25975608FD5C57C44B
                                                  SHA1:FDDF5127F84D06D9690073427B533F1AFD390650
                                                  SHA-256:D774BA8CE3FFE911DC9A3C235B58B73199DA930D3C7E72664F6C3C4462BD455C
                                                  SHA-512:4AA31D91AA39EBF434B51B1C484D46A226615A8534A2E3323FBA1D3CC986DD981C28A2DC234EE4EF0683F32FD9274A1F79108B9071701C13B6865ABA708EDA7C
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx..sx$k...m...6.6c.5.2.^.;6c...I....{..j+........>.W_U.5Dt]........PVV...:y....).m..6!!....YYYYTRRB....t.RU8..P..k.`e..~..n.Y.|9-Z...........;p..'.*..d.a..t).....t..v.5....v..._...V....K.%..1.2...gY....U.}...V$....'Y.V.j..."z....j...i.T..g.BA..my.k./t8........(.U.Xg3F.......S.k9.x...A~..6.3.....X_h.X^...\...*..s.O.0..Z..r.^'..2.F|.M~....X7..........t&...[.lyn..<..o......C-)....eh@.?yyy......l.2...Q...r.....f....l......M.J...?.>.3.@..h...\P.EDDh......8~0..t...y..~.j=.(..o............U....`..U+....|.:....3..o.m..{.~....w............~4...[...;w~.5.n....C..........HJJ."~.0.i....."|..0^..@...!.(...AM&.Z+-.`F6......}...t.......-~mM."2o.. .z..###)--M.v.N......2.x\<J...G[.n..j......T....p..Z....g..N...8NeXX. ..'...................R]UU..W..M.%1@..C..6...`p.;....s.........d..+....M..E..2:@....J.\.@...{..w=C.m.....r3y.kU.Qx?..\U....M..5.y.Ju..X%)<<..Ng.={R.....w......C?@e....m.v..TR........]X..h._.X

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\sitemanager.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):2527
                                                  Entropy (8bit):7.8712405818582045
                                                  Encrypted:false
                                                  SSDEEP:48:OFzDSHCuzyW7CEC92cZHY3OvJ4JCoh0Q3dMrSM1wLjmJ:MiHAX9VZ4Z70Q3urPwmJ
                                                  MD5:A556BA848F4C875F1DA4DE20BE1C9C82
                                                  SHA1:E61F1D64BF25F1212A7ED6247D8DD68744D360E5
                                                  SHA-256:DE598608E5ECC148A61434267BC9A08C2FF36DD24AE64D0D1FE895F4147DFF3A
                                                  SHA-512:4E50915ADD55CB0957E9943B9AC65C5B29B8754F896EBA2E01A767D60DEB9D2BD389CC2F2E6F4807CC00B2DF8F3D6711ACB91D59C2D05D42063FE34C7ED3881D
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx..uT[K..y_...+Z..S...Zu.nP$....k($....{.....IB(r...)$....?...9gf.f...."j...3........rmr..vH.q...W...3./...R.WRBw..9.)*...........]..8;......6...<...o...C'...WW.&....3....8.-.........&Mps.q.....C..-......*...Z.i..JR))#......h/..:.F.P.7.H..p....#/...I!.2.-....z.....i.|....f.v.;B{.:.Q0.*.....St..%*.....rzX^F....Ai)..6..I.\g...:.t...!A..w...3)1+C'.8... S3........?..:.`\..1.....8..*..F%..-t..-...81;]'.......d..vuu.W.-.r.&.?^.`..lK7..bm...r!I/.......7....h.}Z.....`..].kW.....@..8...........W....`|.....~\B..d.. z6.=z..eg.....?...{..P.N.0....*..Y....C}.,.....ef<.....l=._o.8%W7..<........z.H..Q..,...9.....@.....8?....&.~....$...b.%u.s.N..@~....G..m...@Bfz=.....|.....o.G........../X<...g.8..y......s<...%..<...|.J.I.....T.)..."..^... }Ea......6..:v.3.(,H.(pMj.}.u..&-K..9bx.....Z...+,N..........m......W.-)W.>.FeH#...ly..u.WM.71...]Ja.P.N<......v...FUc...n\k.k[v-p[?j..,.=..6v.eW1y..2....)'/.T.7..f.c..r...QB.M_....:I...

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\speedlimits.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1984
                                                  Entropy (8bit):7.8942562110046754
                                                  Encrypted:false
                                                  SSDEEP:24:XehTCSTHemCvYHwkjQmujOklGvcEtq53g7y4xaoSkIuu8/1XsFovy2sa9zikmwk:0x+1J+Q5SklCcEtq671aok989m698
                                                  MD5:0DDD43DDF579002F9163888176D02CD2
                                                  SHA1:AF8C2449274CA458AC12DB3C292E2D16486C0C85
                                                  SHA-256:1D1E8B9203A09D2BFEA82D68CB28C5092C602872DD08F470B2EB1D15B0B4AE2D
                                                  SHA-512:5EEB9763752B3F9629449150EADD735A55089B646EC64B3191F4708824AAAF729C0E3EE394B025B29CBF6E4BB0A28DBA270E4845D65AC6766CCBCDABED13CDE9
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx...T.i..?.....G....um...#L0A/H...M..nww7.....s.....`..z.~.e~.(..2*...M..H..'...U..O..C...@..s.?/.\..MwA...4.....=o.7...:mOQ............\A..O..<.`....&..G.)DO.'L....%...m.^..,B._.,.......G../...B.^....5eZ..Z}...u......j.QN............(F.+..Q..:..ul*..G_..g.....jq......'....n}..3o`..,;|.b*j..\..f.Q._...`.N-.H....j....oMC.V$../...$...d..3./|..v.........c.c...r....4....<TTTj...c.....).2dvT...u.-..._...y.{D.{..[n.>.b..M:..j...=TT`2@.s.\v....n!.:>.b..ZEr.8../.........W1.....z7..[....D.b.A......z...ZN.Z:..c.Tg\~.E.V...5..}.Z..6i..p].................;|.......2l[?g.b...*.ik.......q...QFV?.ZZ..m.NI=i..s..[.P.:.?...;..m.%X'..M.....!=Y.....N........,..S...l._....O?D....;..U.....+.'....u3+.Y.LW7...?.M..>...d..{........`.t.../...6.......B...A....j\.../.}.....~..\.......k..C..zz.7i....f(IZ...M.3.~..mL..Q....;."./....o.".)...z...'.H.R.C..X..b:K......:V.E._...v...W$.f.J.S.a.8xY...Z.MR....X....s_.E.)9S.r.?V.....u.%

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\symlink.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):242
                                                  Entropy (8bit):6.739093803352361
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPmj8cSKxqMGU2IgcLFcndvfqlXNw4IlPlmSQmMUMlVp:6v/7O8M2U2kF6feXPINcsM1
                                                  MD5:205E3AF9DD4D57B8C20A2C64C76858ED
                                                  SHA1:2EFFA06F1971D5AC5561FD30150F8D00BFFAD981
                                                  SHA-256:F8AC90F8CE2F520A1FDE4660652AE9BBAAF3FD2BD5688120C3D23196C65DB6CA
                                                  SHA-512:71E9C0B3CA82A297506C64222CC1EFE15401F909D464592F5107CB6032A858428448525415BE36BE2BF3A365297E93EFA4B4B1D46AB987B07431F3296A1C8AC7
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.......1.....IDATx...1..@.Fa..9.&.E...&.P.....i.)..`#.....<...E.2#.3...."....`....`....\..{.....H.....M....\...:&.....$P...TJO4...$...$...Xs....^....M....Q......KO.g.cN.~g.T...X.t>.G..R...?.7.......:....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\synchronize.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1915
                                                  Entropy (8bit):7.8644908150916795
                                                  Encrypted:false
                                                  SSDEEP:48:YjMC3vrpS6jngDNJ0ycHkmQ1VW+WVXkHqc:iMiS4gRNOkXD+0HP
                                                  MD5:E0B07495846284FD7B641BDF4BF2B589
                                                  SHA1:658CC83A8F5911F71583F90569E7F1D052BCF9CC
                                                  SHA-256:963FBC54B22B6BF45F6815699DC3309F101A80AA6F5A309DDDBB6E0B652BFC98
                                                  SHA-512:41B775CDFA0E33EB2882FF7929A846D10D5336C0EB99552B29BAF33F8208E2A97A68583D9D89426BB67593F2F878B1F1613D794639F1B919CE4CB0DA590814AE
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W......BIDATx..Y..$]..m.mcm.6...m.l.m...t...lw........{.Y/....."r_........E.D.D...?.............N....>...{%**B......`........8.......S.|}.Scb....Inn...t.];...r..Y9}....C..Z%;{......}.....w..3.......b...VN.<!.. .....-....O...}.u...c.,^..'s.....w.....7.....V2.....I__...TKUU.A.s..R..|..+..........+,,..9rXZ[[....\@@.d4.1.>>^........}........H.OOw....cw.@...z...Juu.$`k...S%22B...t..>......'].=u..v.w.@hh...2...w..)**...x! ooO..}....1WW.-0|....F//..9...u....^...q.o...8q.U.F$.!!.y.......d..S..2.FWVV....Z.u.U. ..........<..Pdd..9(.y855.y..f{{[.&cxs.......c.......KaD_..\...kI.....t....5.............*......2.....)W.\A..{.hkk..)..7o.RYY......G...ep) ..a__.._..~..x...innRI..n....7.........78z....K2d..w.....R..o......Sd....4........h.!.F..'.y.y.'.5.......c.E.......:tPz{{f*{ [/.Wg.......6+0...f.......z.A-...9.k.6....E.~.3Qz.J9s.4.*....C.!{Y..;.v3f.....jsII1Z.".z.Y.l..y.&..~......H?....l..v..f..g...{.<x@+.,...nc.1YQ.z1.t-.....

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\upload.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1969
                                                  Entropy (8bit):7.880273035206474
                                                  Encrypted:false
                                                  SSDEEP:48:JE5HzrraFnBBEW2+590s7nF1vf5yUDOabjERAvEA:JEVzrraBBOWz0QHvf56aHWAvEA
                                                  MD5:020C44F480B87CE1F3EA678741B65539
                                                  SHA1:EAE27329F6898C8EFAE13183F7A3F6B4DD814168
                                                  SHA-256:31CB3F50B32D107ED709E227D4983897E9C4A9EC0BF6C30DEFCB3C4C32125C47
                                                  SHA-512:199928D5D691219CF04232049DAC460A4C89DFF43B7481AD0739B3C542CD2499386ECF923B138F5465582732189BEC0081EF23FC499F8FAD545957ECB3C194F4
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W......xIDATx..X.p...U..[Kw2..l..$.(.fv.!.r"S.......gf4;..+w..6.......o.}.}R.`..W....p.+\!..j..&ebx....(.....S...Gw..?.Tw{V.7he.1...Y..U..^.....+.._.......$..{....R..v."y.O.d.....[:.8M..:.V...Y...:..........Y;....X.x...v.....Y.p..X.:.Uh.......6..~.b.x.t.....*|a>..eo......<Y....6c....O.xK0Rf{7&9....J.q..K.._}.y....dUM.\...z:..>...<...6`....\.\.@_'........Q...f*.`7...=.L.3s.3...T....x$l..b..|,.V.U/.....v.;..>.../....8...lx.Y..C.D.....5.-ZY.|&.3p./.....J....C.i..@...@../.-sG.b.)..H...........1..B...p.......Ml.j.|.:p.L...o.W.}G..'..l$.iI...R.'...}.`....4_........P@..52Wy.....?..Hr...Q.!..*.xj2a..8.Gj.......H...{V.M9+..?/A>......2......u.Tr................r......!6.L.....`...S._km......8uC.............#...R..........:....(....`;...;........L....V.....Mh.4..|_...:....b.:,.:.C6. c.'R.. .9.!..<...........a:....8. .i..?.`{.xwjLr...i.$U....}o.O...7.N.W.7a..#...X.."i^ ..Zu?...s...E...![}1.P(......H....K?.v..R.W..H++s

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\uploadadd.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):2536
                                                  Entropy (8bit):7.893504377549183
                                                  Encrypted:false
                                                  SSDEEP:48:k8Y7pp1+CXT9H7DTnVUJ4aIDXlDwY2QSXpp5m2Tq8tdBGeoYmHUn964FHX:kNBLJVUurDl0YFSZjX+8VGelQg64p
                                                  MD5:83A1907B8C025A93348079A25EB689C2
                                                  SHA1:20BB4E5F58B6A0B37CBFC453319289FB70FF0F6B
                                                  SHA-256:0AF2E5DB00AAE887A3854B5575502B27B6EF16B6693DB2EA427FA69D15D49837
                                                  SHA-512:135A88093F6908F4B97DEAE5C6B86682A9FB1270FB754202EDA71EFD9A84D8A3FF59A0D752620FFDF2DD59B4D8643E05387F4559791F53219B9DEC2C6F4A1768
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx..Y.xdY....m..V:..V....N;..qz6..k....?...w......}..{.T...M......R.<T&...P(.....}.J.:.o.^.....r.(%%.....{zz.W.=~.g_d;33.:::(!!....(66V..z...........m0..@HH.....N.BV..y..M;..b....$.H.....{.-.......'.z.'j.Z&...C D.......{.e...5.x...6.....7.t.I.~qFF...}.2e........y...w./.RXXHyyy...M&..t:.y.....n..H..u...TPP..b....w.w.u.M....K1}.t.......o..3g..7..krrr>bw.i....A.6..={6...r...Puu5UVV2...n.........{bM]]...>...z.i.III...A.N.J.4c...:u*.q..t.7..^.....P.+b-..%..........&."##..s.&....b...G.R@@.......p.KMM}..i4\.n..H|-..hT...u...d..~.w.BLP..k.Z.xV.V?;.v./. $..?...O?...4.c......(::..k.=....k.3.~0......I..G.B:qqq..}(...#.x......h4.u.)...q'......J. I-R...#.&)..tq.m6........a..c........E3$..}2.u.....<.+..V....9.{.. .s..&..9.j.REE..$..F.,....\.4o.\c..[.....).6oH.w.)4./.t.6...*S;N.l.:..<..g.bbb.Fsb..Er..q.y..^.P.j...v...O.._...({a.%.5.S.V..4.] .Tc/T.YnP...N6.'...OAO.!~...LS;...9...6.........~.S.~......*l.@.v.......(../

                                                  C:\Program Files\FileZilla FTP Client\resources\blukis\theme.xml

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:XML 1.0 document, ASCII text
                                                  Category:dropped
                                                  Size (bytes):234
                                                  Entropy (8bit):5.023820490711871
                                                  Encrypted:false
                                                  SSDEEP:6:TMVBd6OjzwgK00caQmnFuNKLOHUTUZBOHWXdQUGOH1QIKe:TMHdtAgZmFuwOHKABOHW+LOH1QIh
                                                  MD5:87F80751EC8504AF3D9C5B31F6F6A836
                                                  SHA1:E27E76F4CC00A08F77560356886CEA3E00263D12
                                                  SHA-256:AFB7D60E759AB43AE973EF1CEB8409E4F3DB135B9979D30CE9D2462F670AA250
                                                  SHA-512:29B5DF6E1E3863DFE7390AD2BAC0FD85C0AF741EF0DA79FFB58E9F0AF8F686DB0C6F9825ED02FB2C22F2A4CB99AE32CE66E1BD7187C250CD3E8BAB123D556751
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>.<FileZilla3><Theme><Name>Blukis</Name><Author>Brian Lukis</Author><size primary="1">16x16</size><size primary="1">32x32</size><size primary="1">48x48</size></Theme></FileZilla3>.

                                                  C:\Program Files\FileZilla FTP Client\resources\classic\16x16\ascii.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):374
                                                  Entropy (8bit):7.210821933737175
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPmNpoTHKu2u5/wblEBqlJZIF9nJtFZSZWFSzAG1XIqaQ4OY6Ft9l9k9p:6v/7uNpiHKC5/MEBqa3/qoSMwXPa2ndc
                                                  MD5:97407AE8A1175FCB69A574DF8FE77F04
                                                  SHA1:C83224DB654DF03542BC9058E3D961919185F42B
                                                  SHA-256:3F4E4CA112F41B673FE236A8792E3056899AF6A503ABEC488DEAB2128595892B
                                                  SHA-512:9B84B6B93C58BAA113A8BE2CED7234A33A22965C668D1C80B7D2FA688D8076760B30F112B32B77BAE08780F2FEF9A8CE4C873D460E6088305792B7ED5038DCF0
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...............h6....tRNS......H.....+IDATx.c.o=I.2.}3.b"..>~....'.z......z|...4...JZ../ey.P......<......S...@...a.......!d..[.......5.;|$844)%....O.O.W....I...vv.^......Fs.....%+V.5.tt*)+.5 <......%..@uw.=...v...........:q...r..n.6k.P..C..z.v.<..LY....?q.o.,....>u..m.^m...?....O].v..E..[..K..K.v.$[t'.=u.....+@....$-..h ....=....S....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\classic\16x16\auto.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):440
                                                  Entropy (8bit):7.333155116632501
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7uNpygCXejKu2EYk3FpgeBiZzrMvMUj7:nTMOjYk3FpVQBj4
                                                  MD5:D998D4123DD00B840C51370798733B2C
                                                  SHA1:394CB5BF8F47B5CEAF63D7CD24A1EE59E6EB35E1
                                                  SHA-256:10525319023C17576553C8E8BBF9DDE041202F7F3CFC9EA53FB8DBB5990F14DB
                                                  SHA-512:E23FB7FAFE22AB42220BCD5BE0BFE9576653118DC81C19230A2133E015AA9A3BFF98C69D76ECE1F29D20F4B4E691B473D600BB87890EAA22A65756862CFEEAF1
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...............h6....tRNS.......}....mIDATx......Q..7....p.m...m.X.m#.........By...q...*.L.%..X.q..&.....3.}............u5.n.lS.'?.N./.q...UY.q.{...SW<......c5k..qk.....!.<|.n.\.yw..L6.L...8...:.f..6 ....+.N.................sx.A..N.4i.-..!....l...r.......q.).....~...C...b...u.../v...../.....'..'Z.=..?..]...h.;.d..`..!...>.v.....c..O_.Vhu46......= ..hw./.,6.H.u6..<.W.b..4..^7..i 4.?.....(......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\classic\16x16\binary.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):369
                                                  Entropy (8bit):7.181429941801986
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPmNpohWtEFBvxcR2q+2FHyJWDnmXfEFGvQP9ha1e7dImo16NRTp:6v/7uNppSvxcR2F2F6LXs4U9J7dsER9
                                                  MD5:ACD5B09B303ABB67E1333FCFEE30D30F
                                                  SHA1:E38FDFFEBD6C03A166B6CC0FA7F6703CBB8FCB2E
                                                  SHA-256:4DE4E8E49009B462494AB9065AFA606A5BFEED945B6B0B4F35A4F4C92FC52F04
                                                  SHA-512:CAB58C9A7CA505F80D2D5FD94BBBF8B214589FBAC7228C7F45696FB0972E69DE68EAD60B318695F16190E32A859470CE796DE73C9A9C29BE33CA5BA954EE7EEB
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...............h6....tRNS......u..7...&IDATx.c.o=I.2.}3.b"..>~....'.z......z|...4...JY., uy Pn...)k.n{.{.....v^}...Z..........'......I...>*..l.7S.....l...@A.^=.>-..e..t'..x.....s../.O..u=...5./.....F>@.k.J4.3@..54.].;%..f.....:}e.s.N.|/..'O...7..).....'..................\;|."P.W..0.A.l.t..%..cg/..B.P..... ....H...........IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\classic\16x16\bookmark.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):268
                                                  Entropy (8bit):6.866829815207507
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPSj7SFLdjYnHyRxFJwhsYLSdSyypSKIr++/bp:6v/7qodjWQQGRKt+9
                                                  MD5:481C496B10838B0985C58162733C0F15
                                                  SHA1:1DE798D52F600431BE816FE434D63BD1B3509BDC
                                                  SHA-256:5A9C5658CC4B82DCDB423D580054103C6AC7A40A93ACE1D141DA70C00E51EBD1
                                                  SHA-512:02C1085A775028BAD027AAF8408C9AE1364CA794CC5AC54821A2DDD0A8DD70C489DD4CDA669D81AD16C489AE15F177A0DB9BA2460A06FA5721881EACD76338DA
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx....a.0.EO.....`.......g..?C-..z.$:n......g..-..>.n...Z&'..k...L..._Y?<3.6.b..W......3.k.\"A......O......`...I..w.`u.g......=aC.0.W.]N..Klt~x...7..Y.........H..f=....e......`............=.RR.`.[.as...?.^..Q.......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\classic\16x16\cancel.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):133
                                                  Entropy (8bit):5.808495669463587
                                                  Encrypted:false
                                                  SSDEEP:3:yionv//thPl9vt3lCyxdEl1J1pxs7CEdoFcJ0rzv5F/LpHl2up:6v/lhP34r1pxH7cKrzPLpHlVp
                                                  MD5:BEAC4629ABB60901283963C2904F8CFA
                                                  SHA1:DFAE3D023AB995784B45C2D4FFA0D9C50A1A8FDE
                                                  SHA-256:188A49C693FBF3495B5DF7580E0E4F7856CACB3D6A0D57251125AA883D894D54
                                                  SHA-512:8C8CA2F316ED17544E4FA20BC5F0A46347CF7D3087FF669091D5C2E896E82C390E93D8A24006527455B3A019A51696BA9DF700240CD182B696D0F515E66E352B
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a...LIDATx...A.........3.K.@.."$}....a1..v..$.K...... .......A....P....(&........t...K....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\classic\16x16\compare.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):98
                                                  Entropy (8bit):5.405492207535168
                                                  Encrypted:false
                                                  SSDEEP:3:yionv//thPl9vt3lthe23Y2ueuCNVd8U2up:6v/lhPdheBsvd9Vp
                                                  MD5:DFBB80F1017873587B8E08802610A3BE
                                                  SHA1:29FA21434C2837D2AF761977F3FC0ADC809422F8
                                                  SHA-256:DE2D0FFB20682B52542772580E766A112825E308E21F806996F1936C2A9B3D15
                                                  SHA-512:2BA914E35A83FAA32064E2A22449D7FD8C5C68130E17BDA9979F9E46E07D434FBC42F51107509594311442A3135D3B35D368B2014C18C9F41457D195E5FEE705
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a...)IDATx.c.............@.a..0.....l.J.......tY.......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\classic\16x16\disconnect.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):221
                                                  Entropy (8bit):6.6935339507152385
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhP6TgKJ2NcD6bx7wGx4wZvZnueg6up:6v/71KAOebx7wGjvtuegB
                                                  MD5:C085C91B1497549AC3031B9403274E70
                                                  SHA1:AE6BBAF8E7F9B367B17E527521F0052B9FF956DF
                                                  SHA-256:C26F93A095D5474D349E6EA60F474AE71457C34944B7538567F7886DFEB05510
                                                  SHA-512:F7D29F79F092F081395173DF9644F415EFD9CAAFEB898113845CA460E7585CBA417F67ED835B30A9ADD184E999E601DC11C4D2D4EC630A8362FDCA027DFC9B44
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx.....Ba..=.G{73.$.A%..o~.cX.T..$...y.A`.y...zH..7..........l..p8...........9.D...Z.nK.u%..0.p..........@Nx!...t_.....[.Mr.......L ....4...?E%y..,.Gn..C/.m.,...V....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\classic\16x16\download.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):123
                                                  Entropy (8bit):5.6207970256458015
                                                  Encrypted:false
                                                  SSDEEP:3:yionv//thPl9vt3lAkxHl/wc2J+cdLMS2YddlWlDZJ5lp1p:6v/lhPQk1lcdIS2wdlYL5lbp
                                                  MD5:1F9145F1B12133F3AC3D5F66DAFC0F15
                                                  SHA1:F7D659948ACC84379A7C7E20D2B8D559F23C76C9
                                                  SHA-256:595C06A53B6C8174B2E2D8F6ECE83418A3C6D92F96A833D5F50C4A32C0A93BA1
                                                  SHA-512:AA8693F77471F59E2E89AEB7A691678AF80C0E1AC52B7AF0946D1D0A914E6B4E4E1E2432091B7813A7EB3E504019CD06C599214E69061B12334E40CFE13978F9
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a...BIDATx.c...q....4.0.6_......l...Lcb..N8..k.Q..g.!/8...N81!.7.>`....:T.........IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\classic\16x16\downloadadd.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):148
                                                  Entropy (8bit):5.833808023352445
                                                  Encrypted:false
                                                  SSDEEP:3:yionv//thPl9vt3lalOV9Yf3pqllQ0pn1BdbDXvG0NQVFfEpflyoDCl/ljp:6v/lhPql33UllHtDXvG0Ngepso6dp
                                                  MD5:806DC11465F984DF1BB17F449B626AFE
                                                  SHA1:AC7910B3708342E10AECA283176C10B2AD04D077
                                                  SHA-256:6408D2F47E8D61039FB16701C38DCC604D3F9819FB54EE8D8B24A4F5A5A9F59F
                                                  SHA-512:542E5B95381FF2D6A5DAD47BA609B99C15307990CF88A9367411CF7936CD906FA0105DE3CA86BE433CE9CEDBC7258E7FCB81DDD13720A76D2AA471BCCB80D0F1
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a...[IDATx.c...+p.......dh...0..l/.1!....?.a.....b..|.d.nLP..20....8.0....F1..!...Dl :.....z..5.~.........IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\classic\16x16\file.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):254
                                                  Entropy (8bit):6.310654944693122
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPfWfaQeykz6573LhzqhfwI0gnQIwjQGnC6iup:6v/74aQ59HhzqhYJg5GnC1c
                                                  MD5:BDB31C0053525F014B142A7FE375E15B
                                                  SHA1:E10CCC8AB48758426EF97536D272A6190EB49B22
                                                  SHA-256:D6348FA61CDD5CA0118609D8690F3451AF8B2BD80012E02CED2307FD74A273D1
                                                  SHA-512:716962290731DA9653A390D6F1691121708DD33658BE978DA6889257413959DE753BC74A39F5EC3369C7D076DB7F443D87D62497EDEF911F6CD4FCDAC7029FA4
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............(-.S...EPLTE......RRR...kkk...)))BBB111{{{...!!!JJJ...ZZZ......ccc999............vG....tRNS.@..f...gIDATx.u...0...8e...g..?.D$.-.%p.B<@9w..;.................!..{.Oxt....t.y.QI...%h.....X8m..Iy..J..KDG|..tX.......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\classic\16x16\filter.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):130
                                                  Entropy (8bit):5.736141183559885
                                                  Encrypted:false
                                                  SSDEEP:3:yionv//thPl9vt3lNyxdkOFP5AcIJLu/CcRmkkaFWCDCYUh/1p:6v/lhP9+kS5ApuKQm1OWKRIp
                                                  MD5:D2532067959BB2DB3A6EDC469AF4F114
                                                  SHA1:EE5F8CFA30B8FD1AC0ED57AF136D2FDE00DBB70F
                                                  SHA-256:A6E11C733726B32BFA967242C04B916BB4D4B31F1B3D348D8EF67C5A64BE183C
                                                  SHA-512:33A72EFAC30CB8D879CEDB105651D1826452396B47827C12A0DB8DAA97CE12CD71533EF2C438ED28C80063F2666FEFF01AC3380C761F98CB4E495B2C39CDC759
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a...IIDATx...... .......X..,...@;.P.. .l% .._ ?..'By..4 .O......(% ... ?..Dg..g..I..+....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\classic\16x16\find.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):720
                                                  Entropy (8bit):7.535273923212619
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7p+fyUFNbPBHrI0Lk+iemqvvGkT2KKiaqO4MvenaEo02U3Q1vpxPk:OMLBLI0oz63+KPaqSeFz2JtpBk
                                                  MD5:67011F382FD217C10690AE63599E3D34
                                                  SHA1:EF4F9182075DEEBAD12038EA5AA16EF8FECE15F8
                                                  SHA-256:878DC6515328A10C7C0B7522ACFF32FF62B065646E7A3DC916DF6F96134A3FF4
                                                  SHA-512:5ABB89BEFD99A66E56DAF68C272F8BE491F6CF65114EF010BB5C76B845E546659964B2CD3A184EB94FB0DC7B9AEA932CE2A6AFBA52501DC7889C75FAEE83675B
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx.b.:.......O.......7...Puss.LII....3..YAA........I.&},//................rrr|X5...qfgg..0a..Uj..+...m.m.m..m'].:.3ml.8...(............9..@OO....@D..../Acc...~...3Pzz:\]]....}...@~~>...0<<.i..L..I.sNN.(^.......:::'..M'''... !!.....]!..'..h...@ff&...9 ...!...E".)........(......I@.3.8f/44......-m..[+.. .J.9,--EJJ.LLL...E........+++hjjBWW.....JlmmW..b.Fmm-sJ..1tRR..%.EVv6J......emm.....6...... v.........&5Js..5.9.......kg...........R=].'......d..D?OP.9....w.#t.$..O.l.0....5.....T.NN..E[.s..P..E.....[...../..o.../.o.0.h.*_.O.G.-'3..e..X,..z..m...^.H$.v6.w...1U...h_....)iZ?.('..^.Oz.c1.P...?XXX\...j.P(.".Qj.....}._.....Y*.z.P.-i....8N.A#.?.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\classic\16x16\folder.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):214
                                                  Entropy (8bit):6.440581480903966
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPf89J6HdYLMH8dy8aVcFthXsaVJL6UJ6Rfp:6v/7qsaOMyaFthcaTL6Vx
                                                  MD5:CD9F4139C278266D430ACA09E4BD0785
                                                  SHA1:22A8C0A2012A16A03ABB5C783C0C95832D0954C2
                                                  SHA-256:365DAAF42471778B2A53A70EB9A535D9E0D586A1CDAC7694984BFBA4F27079A6
                                                  SHA-512:B6CBDDB54265721E41FFB766B2B65838554594E36937E8069323E401A7B0C19E90C272EC83424DF00FB1519CDE835E2E41FE6A73D5308E180B1A460850B3E0CB
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............(-.S...6PLTE...HA...:. ..'..@.....-..>..C....6..1kkk..8..4.s...:..8.....tRNS.@..f...NIDATx......P...#..,1.....|P...J............@.2......`o3..\/L..rw(XN....\.?l...`%.......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\classic\16x16\folderclosed.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):199
                                                  Entropy (8bit):6.3061945055190805
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPf89JjKKqDA7EzghvMVGJsrDY1NaprD2p:6v/7qjyUcghd1IprDU
                                                  MD5:3E39A240C29CCE9B942AA4741BDA3848
                                                  SHA1:796E0E0B657165816EE2724CF59A5ECD4DB5E63C
                                                  SHA-256:92CAEF64BA5E710A398E7A929988512396955C9D6C141D887CA655C696620EEB
                                                  SHA-512:D0EF391248FF262C801141990A922DACAB071DC530126EF2AD5F99730F0C0AA973F32E45FEB8DE8862E8B7C4DA5BDDA1D4D287F0BF5C08925C6167AB50C8826F
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............(-.S...6PLTE...HA...C..A..=.....*..9..6..2.....&.".............ka.....tRNS.@..f...?IDATx.L...@..1_.....i..l.p..p.@.[P....U}.......f?..0....ad.....e(;......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\classic\16x16\localtreeview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 1-bit grayscale, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):122
                                                  Entropy (8bit):5.3111020043094275
                                                  Encrypted:false
                                                  SSDEEP:3:yionv//thPl9vk/mnplJYBx2SIFh54kJapVUWczyZ66lbp:6v/lhPcupE+fBa7UvuZ1p
                                                  MD5:BD5ED94432755D841D9A9B1C6883342D
                                                  SHA1:837C9DB77F1CA59BE2AE21194F67A601375F23BD
                                                  SHA-256:9437690465658A81FB5FAEB851D189704D744E6747AB6BB0B939654E582600B1
                                                  SHA-512:6AFF0DD67E564FB196A32A76D5B64440DA50BB6FD745C452CEFBE4D0166085FF36DDED9652DA715BFB1D0A329F7D8BE442AD26C52DCF6EC1A6BB68A4BDFA0BCA
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............7.......tRNS.........3IDATx.c......D....?C+...D..;....3....3C.g.........W.L|.x;....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\classic\16x16\lock.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):493
                                                  Entropy (8bit):7.39938844524375
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7dDpLymMY8rEQMUqcX3V/y7SWYPYfTuU7HJmRvbCXioXrx/:2DJygsSU5nN0SWY2u4p6vM/
                                                  MD5:A6EF7A770F2A3F26988F6AFE917DF8FD
                                                  SHA1:A5EE3056FC2824B44D1DFE35FB1D2BB1E1A89C42
                                                  SHA-256:35A9435E2D94F76B78B5519EDE1383CAE18205996F628504325A39314BE0AD8F
                                                  SHA-512:22BEB756BD5F1649F24C8B8DA8C3FEA64C689081C66D67160F76CFD9206102AC6070DAD9AA8A32F69E44E804F184EB1A90305DBC004A83E07CF65AC89DACE5AA
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx...3..Q.....l.......%.M.my..l..|.>..7.;6.W......jQ....+....m..W.67n.p..>.O.N......^..f .G.5j.~....3....[.n.........].X.X...........5j<...}..{..p.R|J...".2..P.w.Y....G...~a....m.S..\....J....kTy......l..(.y.p;..g....h..Hd...s..8..-O.< .)e....H~....q.5.s`u..M".w.4/,..<..y.V.w.....<G.S.?..g)..>..S.l.p..5.R..6M.....m.E..|..............9|..x.q>U..S....DZ.....4.[.*5..o..r.l..i..A-.....0.. ....,?...o.../9............IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\classic\16x16\logview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):128
                                                  Entropy (8bit):5.880014989397518
                                                  Encrypted:false
                                                  SSDEEP:3:yionv//thPl9vtt+NTlqs+kqjPtOi9ZFdnR84l3TPfDEijgGxll/sup:6v/lhPmNpq9kqxOA64tTPrEagGjeup
                                                  MD5:C41627853F97292EED3C268271BFBC03
                                                  SHA1:80B89B4FB53A806AE42C2ABE2B63A1B5B1731C3F
                                                  SHA-256:90BCA1916A70407BE7FB28666AC1F28CBD9113EA1E2F8A5E471AD116CE741CDA
                                                  SHA-512:56F67F991B929EAE1D7839FB864AFA8C4702E10CD1F31C9AF04E920FE14842DEC89FAEA60E91C6E080DB7367DE9D9BC2902779DBDB848F681A282331D1B7716D
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...............h6...GIDATx......0.B....6.h1'..c..2.. ....u......3.IX({.....Ij.$Y.&...'..@1\....8....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\classic\16x16\processqueue.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):141
                                                  Entropy (8bit):5.440948078530047
                                                  Encrypted:false
                                                  SSDEEP:3:yionv//thPl9vtt/6lXFk+Rghl/NwBhIdSvIVEaqmlWGEBSt2g1p:6v/lhPf61XqhgviEadHEBGp
                                                  MD5:16712A5C7C7E89DB36FA205315F900DD
                                                  SHA1:82EA45047B48C8571917F57CFE551D00339C92AA
                                                  SHA-256:69E8A527253DD38DAEC908AD74F3AD24A7BF5E29F0AFD1E5E7A89F7CE1ED6AAD
                                                  SHA-512:1BC434FE0E653C458FC9D219262BB0B57E3DA9D72811B34E0CC4E9934896F93F678808B0A1AE3A2A8BD3F36F4A30D43528BF94431A737E000DF97B6206C3468C
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............(-.S....PLTE............w....tRNS.@..f...2IDATx...1..0..P..?tu.....Q\...~..p.JfQ...:.<....^<GC.sc..7....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\classic\16x16\queueview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 1-bit grayscale, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):117
                                                  Entropy (8bit):5.372664012913981
                                                  Encrypted:false
                                                  SSDEEP:3:yionv//thPl9vk/mnplJYBxfqViEMmE6N+oiHar+YUdmLljp:6v/lhPcupEBxChnEk+oyG+YEkjp
                                                  MD5:A64022375CC978969CB46B4F775F86B4
                                                  SHA1:1F6EE2E92AA52A9CC030BB46FCA7C267EF3B719E
                                                  SHA-256:59EFD19F7C4A4332BCED0F51EB997D283589BA57CFB3DCF7E4678C02E254E0C0
                                                  SHA-512:CB71011448E20A6A3F741544E6CECCF2AAC7FDC6D29C39A19562F25F81C817009B5E42C9F714A2461D0C555E83F6024DCB46EDE17369945E9D298BA9EDB48A7B
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............7.......tRNS..........IDATx.c.!......3........?".B.6E... ....?.........8..=....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\classic\16x16\reconnect.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit gray+alpha, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):103
                                                  Entropy (8bit):5.341808018592505
                                                  Encrypted:false
                                                  SSDEEP:3:yionv//thPl9vtJK6PtLshxGh6satlMDHl9ilVhxup:6v/lhPO6RshxGh6bwHvlp
                                                  MD5:3040CFFEDC34A0183C4183AC0C8F8FB0
                                                  SHA1:F0BE3EEB8086F9FBB832C58EFBBB42E372199181
                                                  SHA-256:8101A4842D2688CAE24D1CB12BBA6F23E265E3AFDBBF713EA13CBF1A28BA3D6D
                                                  SHA-512:EA9743D5D97C1116C41597B87E6A263A951B00AC230D142EA34F5A95199F31FEEF1851607ECE987F7F2CBEE5F710A9A7A54D36FB8B6C71773891D804448A1919
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...............7.....IDATx.c ..G....GS@@.....`BJ|.#...x....G......UEq.........IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\classic\16x16\refresh.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):135
                                                  Entropy (8bit):5.683219265482871
                                                  Encrypted:false
                                                  SSDEEP:3:yionv//thPl9vt3lskxeF0LPRTpJgu0Ktm7AAqb2Ab4dlldll/sup:6v/lhP8kemV7PzwUVLUdlllkup
                                                  MD5:CF546B0EECBA2FE00DB8E684DD5D188C
                                                  SHA1:8084CD9B696BD829A0C16965ED50C66890646916
                                                  SHA-256:C9691E19B1D819764731085B45D7FC755D6EE5159D051A70238F5BC8B10F8EDB
                                                  SHA-512:6861A2DCDE5867C26B7235A7E5B78AE49701F27F5E82541ADCB4190144FFE71FCA1849DE3BEE6F9D2056F6B4E96FDA1FE4ADACD1670F96675BEC45E9C360C496
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a...NIDATx.....0...>~.. ..n:..d.*...#...d.8./`..B..b...,...y@=.....e...A\..Z.....d8c........IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\classic\16x16\remotetreeview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 2-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):139
                                                  Entropy (8bit):5.432796661633841
                                                  Encrypted:false
                                                  SSDEEP:3:yionv//thPl9vn0Xl/E0h/+RQhl/2xglXKNpmknavnaywnYllVp:6v/lhP2l/E0h/+qhAxpVk5wnY/Vp
                                                  MD5:D6F0AE8BCBDCA7871BC5EEF3138B7074
                                                  SHA1:AA54F84E30FE76AD671F6D28589A2D3E94B78E88
                                                  SHA-256:AD7A6C6E5D25F5400B17B5A7A920C76C4BC2C735FCE9D7681D8E35A66993228A
                                                  SHA-512:9B7EFD5E5F4BC7032726C94D353E55F3A74493012F6348B00D416FF7D59A25068450FFA047344E328CF6CAE6AA1727E1EF7161D73436BF2C99E78F72E64BDC8E
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............b.......PLTE.........'.......tRNS.@..f...0IDATx...1..........PR...*9..B .,R$HJf..O8...:.............IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\classic\16x16\server.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):188
                                                  Entropy (8bit):6.3217907636794095
                                                  Encrypted:false
                                                  SSDEEP:3:yionv//thPl9vtt+NTlrRSAllglj9+/BNx7Eqntws0nnZxIIUQFC/GY8lfstvPLN:6v/lhPmNpozj2BNCRnnZxIuiGYNvj/jp
                                                  MD5:2AE57E91F5E79B79A5FB3A3DAB0941C9
                                                  SHA1:8AC9369B08F55DE18B9FF994D2395C4320ECDFEC
                                                  SHA-256:8FC76E8D13B0F5C554F28872907F804425F9A833D8AA4277E104B19839A0D04B
                                                  SHA-512:05CB73CF5267020FC75553BB6666D0FE0ECE054626CB3CB366E3C9E3794FC4405FD0B9834CB16C03D15B0DE41227AA686CE89A8B169091967260EA1220E9F927
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...............h6....tRNS......../....qIDATx...1.. .....~.O...~..v1....&..$.S....../*..P..Z.Q...s.!.N .!.N(T........%..p..5..0Z...Y...%...x.............IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\classic\16x16\sitemanager.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):226
                                                  Entropy (8bit):6.5109975094565575
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPmNpozeFQtmnnnN/hDsAcKN5wiLLDPi3p:6v/7uNpmeF4oDtVL65
                                                  MD5:9CD1CF88890AF5DFBF98BA34629FB846
                                                  SHA1:328ADEB234BFF5DD2395493A3B4B749FADDFC1EC
                                                  SHA-256:D6DEB4EA6594DB052C166BED17924D5C8ED402E055609C4141DE1A66275C5C4D
                                                  SHA-512:E4A6BF81F5D6BB29563F2FF99BBB72CBD384CD387B436A1016A93B777DCD4B2D945DBDDE626355FE6A12BD732FDB8B0C818BB6282E7BCAC221260782C72C22BC
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...............h6....tRNS......../.....IDATx.m....0..o..-..>V.*..H.@.RT.G.^...H.I.....<......t.UQ.......s.K..UbJ...u.0..;.p:9..j.o .e...r..t...................K"E3[f.N.F.&sUA........A.^..@.`..C.l....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\classic\16x16\speedlimits.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):301
                                                  Entropy (8bit):6.880532369203427
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPfbjSjargTfhr81BoOL7kwVObZETcrtgFNyAf6qVFoGYbp:6v/7Hqjad1u0JTcRgFrFQ
                                                  MD5:A1C73D5A053CB0DE1E50563C9FCD30D3
                                                  SHA1:58D73C51BBCBC15EFFD450F5DC1B5CED73D15109
                                                  SHA-256:A7DCF0626F73A1FAABD673DD740E26E0DA5A6B50A7DF338F8E789CBA58743099
                                                  SHA-512:2622015EB07CB91785AEB9B64A367B3870A7B8BE5F6AC79452B99FE1A9620ECD1E9063B859D79B693F334B6CDEDE0C6FB47B97DBCDA9BA86815B1896372B41A5
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx.c...D.f. >K.J^.....(.....q3P..(.y./.w....s.....`1q>.?.5....{......`....x.',..HZ........#f.....7L#L...y......>...........M...F.p..7@.........o.!.....A4........kjj>aaa...j...4nP..4...5'''.KLL..d..A...a....Pf..a@zz......`... ..5.......L......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\classic\16x16\symlink.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit gray+alpha, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):103
                                                  Entropy (8bit):5.32971954773972
                                                  Encrypted:false
                                                  SSDEEP:3:yionv//thPl9vtJK6PtLshxfZlR8w4bYBaXw15xp6Xsup:6v/lhPO6RshxBLz40BnxIXsup
                                                  MD5:E872DF7FA5DD21588A72F76200C20816
                                                  SHA1:819D98721298F91B4DE5DA0A836C4BA69272D896
                                                  SHA-256:8A3B48F221FD4D5CD4376968B4B28BBBCFF254A4EB3632F656DEF088E2BDE023
                                                  SHA-512:51BCC676DB0C89FF8D2C29FDC439C328117BD5AD24F3DCFF4DC88F56D67B930029FA2412E9DE5B77940C0AFEE3FA71C3CFBF4CBDBFCF389FCB5CC7D67EAD0CEA
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...............7.....IDATx.c.A@.?......4..%0...%..0...2L.t.._......b.p..t....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\classic\16x16\synchronize.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):207
                                                  Entropy (8bit):6.672332787181316
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhP0kzh77nT4UURmE1CwZslu5xLck6f3jp:6v/7f77nyRmE1CtM5d6fd
                                                  MD5:64A1BAB17BA5EDFE9261537E63AFA507
                                                  SHA1:608F951287229E7A34FDF0C8B938430258AA780E
                                                  SHA-256:C42A4DC0C115E109CB4A77B845CD1134AFFAD6117CF34B2DCDF107F3ADC288E3
                                                  SHA-512:3A59F8C9B322A944775B0312770C593DEE9321F518BEFC3AF98D951792894343C23AF76B7276291E4A864FB9CAD4DF7BC74AB7336F6BE26027267238FF3614C4
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx..Q...0..;e.8q..i_.2...._>1............|.ek..?>.q..s.u}Vk/......Wc*....es..R.....:.DA.6MO....=...X.6...@..,..1.~..4F..`)...a.{AF...........pk.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\classic\16x16\upload.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):124
                                                  Entropy (8bit):5.7031717489459455
                                                  Encrypted:false
                                                  SSDEEP:3:yionv//thPl9vt3lyFhDmkolERqglE94kWk/WDNF4OILll/Vp:6v/lhPiFhDmkVA4ktOIxl/Vp
                                                  MD5:86616009BCB357544B0056012333E23B
                                                  SHA1:574A6A7249E7B2FBEB343438A956A14786EA9FF2
                                                  SHA-256:83940C38223C617478A6BE4993298CACE9A60657DCB3B48ABED9EB4892CE80BC
                                                  SHA-512:AD95EAEC6CB16443D1B2DEDEA930C66B17EA017D1368E992E82697BBFEFF91EF963E7B9F7D08802B8389971ED27247D1AF7EA8C68C5B995A6B8CAA629F3C2709
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a...CIDATx.c...D&.....a.......6....&l.H..4'|...80.f'BA....j&h \. ......n.4.......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\classic\16x16\uploadadd.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):179
                                                  Entropy (8bit):6.352097747179528
                                                  Encrypted:false
                                                  SSDEEP:3:yionv//thPl9vt3llWebPfgXS7VJuQXb1FvE7rcm3Qr/qb7FH8VW5GY+kg1p:6v/lhPbb3gXSRJBXpScm3QGNH8VgGbbp
                                                  MD5:A30DF9F34DC7814120BA50F5DD0CE35A
                                                  SHA1:97B36BCC8CA676C45E125D6041E1C7179EFC2E0E
                                                  SHA-256:297B35A7D181F05BA6DD330DD4E39F4FEA7AD6F01A22213CE14E3CDECB164CD3
                                                  SHA-512:BB495C7962BDD98FA13F5CD5041F32768B4229ECD42E896A2130318B26DEE39CAC68E417291FAE057E968C4AF679D5F573833CF4D96F9D007D333E5BE52F4F0D
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a...zIDATx.b.|.+p!..20........6-.$..BQ.j_Q..;.><....,0...OY+z.r..`.#0.....]..,/.8E.T .L.5p..\..fe.......q2.N...|P....O 22.d...=s....=.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\classic\theme.xml

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:XML 1.0 document, ASCII text
                                                  Category:dropped
                                                  Size (bytes):217
                                                  Entropy (8bit):5.032428637420828
                                                  Encrypted:false
                                                  SSDEEP:6:TMVBd6OjzwgKtrcaQmxBucKLDW5kJR3oHUTUZBQIKe:TMHdtAg9mxoDW5sR4HKABQIh
                                                  MD5:3FE381E8906640CC0CFE3AA44C32477E
                                                  SHA1:7B2D8175BAE69FB8E4FAB45F52874495BF2F49FA
                                                  SHA-256:D390CAA668232F9E52AE01E77081BD26A93FEC0BC0718DEFC2671DC6DCE317E4
                                                  SHA-512:D538091FC50912463BDFB14320DFAA00D5FC8CBBE79296D26DD9E3C61A59D4F759059EB1757A3A9B708389F26872B96A8D98B91706816B7C2717815146740300
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>.<FileZilla3><Theme><Name>Classic</Name><Author>Tim Kosse</Author><Mail>tim.kosse@filezilla-project.org</Mail><size primary="1">16x16</size></Theme></FileZilla3>.

                                                  C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\ascii.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):275
                                                  Entropy (8bit):6.763272539860218
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPmNpo/lDtC01NitUXT2JygeUDWrzIdXDZ+4HSF4lthup:6v/7uNpQzC01NitUXT2MgsolFyylzc
                                                  MD5:EB40D1EB8B7425F6996ADD48915746BD
                                                  SHA1:0DAE7CF917F1B8113C155A60E88EB83F9B085770
                                                  SHA-256:809F073C5C3B0BC82192536DD2A0D6F5B4DC18535D8B4018D0B0911558FE80F1
                                                  SHA-512:3118283C9DDA19A22F9FBC2694207B57C50585B513A0EED3E6700E60425BBC6E584AC8C4CB7980BC3B4286F212F6F92E24019DC0D61E571AE5597B80DC2AA5B2
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...............h6....tRNS......7X.}....IDATx.b.O"..>...F....!.5..d....6....6hC".(0...T....1..lV7.. B.)......z8A#..>.g.....|~.?8.Gh2G..."bp..v.hp....7.U..-w<.=..]7.""..e...S.4xY.W(....O.....R.\.]nK.C..9............r...d~^1......h@.....aU{h.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\auto.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):495
                                                  Entropy (8bit):7.316989679243467
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7uNpQK4MToGp9HzBeUDbCj+b5XMLErs094dnq4:nTmw/zBvbCuMws0wq4
                                                  MD5:3E33267FA0F6AB1BAA7512E44C432610
                                                  SHA1:0B2C28F9882520EC162F7878E11C714B2A4B80FE
                                                  SHA-256:27634804AC1D3513B661B41FA04A33AC8689E80347F2AD1A2848B25975101394
                                                  SHA-512:B71DECB9EE3B9510B329BEDE5BA2D98FAAE4CBE111C7F599018C7D4F889BB0F463624F604AB72C19001219E240B19A9483E8FB5AC02D9B0EC9108B182B53F215
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...............h6....tRNS......7X.}....IDATx.c.O".i.}.~0.m..;...0.......~......G..NCh.=g........w...}.r..)..?~....w.~....a.;.+7.....[.P.=.c.e...._.k.3w:P..O.K..f.[....f.|.r....5.n=z..a.,..Kw]-.~X5i...|....C...-...?..a.@....B..lz..+.E....-..Z........S=.B..g....r.-..q.{...a..@.o>~+.r.-`.o.B..QKX|.{Vn.r..?..5...../.-........\..#.c.i..3.^`j....D7........wU..M].......y....?P==w.._.......F .x.3.......J...(..0.H......Y.`...dj....k....r....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\binary.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):270
                                                  Entropy (8bit):6.865999338064653
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPp+IOreikJvHi8enlUVB1oGnyjkO3p9IF0A7Rcldup:6v/7ireikx+n2bqwU3UyURcldc
                                                  MD5:A54567E2436DBB522431A51C00056099
                                                  SHA1:8FABD540D8333A5A1976B04B16033C28A03C9560
                                                  SHA-256:19D2E09FB051AF2E7C43A3278D534794A45AF49709DA2ADFA1089CA103F8DD53
                                                  SHA-512:98D40EBC8818814B99124F52C4A899E2DD76BE4CAB4B4A3246FCB7698982F4FC008F7A11B4D9160229D570E86F6DF9799BDE4EE967718B062333D60E28C53506
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx..a..0...d.(..t..3...R......(...t8..x|_..G...M..$I.(...1.iJb-.2I.E.<.I..aH....N[U.q..s...w.@....T.........{.`A....G.`.%...;>.........nb]'....F#@..\\..C./.A........ly...w........X....L.@.....`..._..:.. . ....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\bookmark.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):268
                                                  Entropy (8bit):6.866829815207507
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPSj7SFLdjYnHyRxFJwhsYLSdSyypSKIr++/bp:6v/7qodjWQQGRKt+9
                                                  MD5:481C496B10838B0985C58162733C0F15
                                                  SHA1:1DE798D52F600431BE816FE434D63BD1B3509BDC
                                                  SHA-256:5A9C5658CC4B82DCDB423D580054103C6AC7A40A93ACE1D141DA70C00E51EBD1
                                                  SHA-512:02C1085A775028BAD027AAF8408C9AE1364CA794CC5AC54821A2DDD0A8DD70C489DD4CDA669D81AD16C489AE15F177A0DB9BA2460A06FA5721881EACD76338DA
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx....a.0.EO.....`.......g..?C-..z.$:n......g..-..>.n...Z&'..k...L..._Y?<3.6.b..W......3.k.\"A......O......`...I..w.`u.g......=aC.0.W.]N..Klt~x...7..Y.........H..f=....e......`............=.RR.`.[.as...?.^..Q.......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\cancel.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):298
                                                  Entropy (8bit):6.929556212034225
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPmNpot/7/eYhwordWi3XIZ+1aoLH90MpVw7/LrFOQcw9TM9Egjp:6v/7uNpA/eYm7ZCtL9ZwzgQ/9A97N
                                                  MD5:97796311160C86A57A37E3428D8533FC
                                                  SHA1:67E8A651CE8F32DFCA6C96043D9D0470914332CA
                                                  SHA-256:48011CE297F5D44836D4DB4B8C37A9D17532EC69C9FD1889F78632B14902E4C8
                                                  SHA-512:AE2E06E7B5FFE82DBCE0EDD497E05BD95EE4FB000FB376AA7519A52F4ABFF1785D53CF2DE80DE8A2D5E339893738495F4457E2A103C13BEDC830AF04519F8946
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...............h6....tRNS......n.......IDATx....q.1..W.Z.'.g. ...6......Cb...$.5.f.dz.{....=2J.<f......4r.,..8.0..t.......0...."...S.K.C.t.8..D..8...9....%.}.je......Q...<.BM.!.MoG.C...V.........[....o&...V]..f/.S....N..>_#^...>#U..)O.g...3/.../i...n..2K.'.......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\compare.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):302
                                                  Entropy (8bit):6.707035762300667
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPfMcINYO2vEXyjdyVCgEbMUGAll/hKxS7sM1eSfDI5Ys1Ad9Xzp:6v/7Z7sCjhcu/hKosbUO+dP
                                                  MD5:ACF0B5DD79A6E543CB868A816D3A07FE
                                                  SHA1:0546FF0B9709EB466C3A0C4FB1BC9CD1B413500E
                                                  SHA-256:F7FAAF7EDE3CA7BDB0BF0D77F19FD010E59EE30B8118A700ADD8B8CF13F2506C
                                                  SHA-512:F76F41C037170116323102CAAE289DD09CC06F321A29C52F895AC49BC98EDA4B8A9677BDC850F0FAFC7D7568157C4DA39EBCAF2ACD4758B34F6632539F065CD9
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............(-.S...fPLTE.......B.Ht='.........?..J..W..d.R4...fA.......d..d.....q..q..r..~..~..~......J..V..5....>..V.5.8....tRNS.@..f...vIDATx.U.U.. .CQ.W.6..M....9...*.f.....YB^x}....t..).p.m.a?.e...a...V..P.}.f.....o..#.Ih.#...Ygh.p.......:..e....J.?.j.b..^.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\disconnect.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):546
                                                  Entropy (8bit):7.4628257710734465
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7uNpQ5m+lqmazIALrYRzOvfomzZyiHEVlAiC5/wj7C3+:nTWmA+zo63xHBj54qO
                                                  MD5:66701BD8596312113E0042F0D730B45F
                                                  SHA1:0F146138E66E86B5714E5615E6AC8EEF29042F57
                                                  SHA-256:BFAEA2A65007C0EAE72F778E471D7F024CC00469FF0F087BCEAE338DA190717F
                                                  SHA-512:89AB5F6C1A1816EBCB6B969616F9891B3FBAE5D047C8BCA90444681A30172667D54CFC5BAB8739E8D9D3A33A6695A5634DB2B0815B0F7E8559006AA64EFB4DDA
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...............h6....tRNS......7X.}....IDATx....rdQ...s{..Z[i&......6.z..V!.Y... .yc4.........).j.....u.N^e<..o6...P.._.])y.[.........~.q!.]*.7J....b....E..7)G.R._......\....5..o+UX.....@..*x$I[......l.Z....R.P.....Z.2..yk..R....)....(...T..B....Wj... @.v.`.....;..../.>2.6....P.T..*.........)..M..}......L......>a..(..h...r.....OrWt..O.f@...G.......f...%..m..:Z.ac.z..0..h#M......(.V..Hx.M..R....*cf"<|.0.....?....#.E.w.w....t<.z.`...$..t...j.4...!..F.i......M...Z.......[..{.....w......'..h'K......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\download.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):123
                                                  Entropy (8bit):5.6207970256458015
                                                  Encrypted:false
                                                  SSDEEP:3:yionv//thPl9vt3lAkxHl/wc2J+cdLMS2YddlWlDZJ5lp1p:6v/lhPQk1lcdIS2wdlYL5lbp
                                                  MD5:1F9145F1B12133F3AC3D5F66DAFC0F15
                                                  SHA1:F7D659948ACC84379A7C7E20D2B8D559F23C76C9
                                                  SHA-256:595C06A53B6C8174B2E2D8F6ECE83418A3C6D92F96A833D5F50C4A32C0A93BA1
                                                  SHA-512:AA8693F77471F59E2E89AEB7A691678AF80C0E1AC52B7AF0946D1D0A914E6B4E4E1E2432091B7813A7EB3E504019CD06C599214E69061B12334E40CFE13978F9
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a...BIDATx.c...q....4.0.6_......l...Lcb..N8..k.Q..g.!/8...N81!.7.>`....:T.........IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\downloadadd.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):148
                                                  Entropy (8bit):5.833808023352445
                                                  Encrypted:false
                                                  SSDEEP:3:yionv//thPl9vt3lalOV9Yf3pqllQ0pn1BdbDXvG0NQVFfEpflyoDCl/ljp:6v/lhPql33UllHtDXvG0Ngepso6dp
                                                  MD5:806DC11465F984DF1BB17F449B626AFE
                                                  SHA1:AC7910B3708342E10AECA283176C10B2AD04D077
                                                  SHA-256:6408D2F47E8D61039FB16701C38DCC604D3F9819FB54EE8D8B24A4F5A5A9F59F
                                                  SHA-512:542E5B95381FF2D6A5DAD47BA609B99C15307990CF88A9367411CF7936CD906FA0105DE3CA86BE433CE9CEDBC7258E7FCB81DDD13720A76D2AA471BCCB80D0F1
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a...[IDATx.c...+p.......dh...0..l/.1!....?.a.....b..|.d.nLP..20....8.0....F1..!...Dl :.....z..5.~.........IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\file.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 4-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):157
                                                  Entropy (8bit):5.714748364466332
                                                  Encrypted:false
                                                  SSDEEP:3:yionv//thPl9vhSFZo3Savmqnx7N5hl/2xy5kpl0zZmXCGgFMflek2clllVp:6v/lhPIFZpgmqxJ5hAxEOIYXCJglekd9
                                                  MD5:B39FEB65E483D91B36EB70E0E5733F3D
                                                  SHA1:74AD2D15DE04D121BF6AC8FBE10387B1C06FF7B5
                                                  SHA-256:ED964193D53FFEAF2EF8B45B61ED04084C46AEB74BA1DD614A3967EDA160CBA0
                                                  SHA-512:38A169CAEFC73E75BB24E90BABFCC361B45F8D23487D1D0E0A5ED03D7353FBADA796C94F9BDC6F28AB3BB8C254FB9C04CA9CF3CC2E49D460B3D69230375E38DF
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................R....PLTE...\.._..^.............}...%M....tRNS.@..f...0IDATx.c@.FAAE...%440..`.2B..". .{(.....3:..........NO.......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\folder.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):328
                                                  Entropy (8bit):7.066917297198438
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPmNpo/lDth42ycCqMpRVkXrfCr/8iE5c6JS4OG/56hbn+XePup:6v/7uNpQzhRCJ2Xrfuywhbntc
                                                  MD5:0BB0DE6B3E559B082358BAA36963D09C
                                                  SHA1:672A797FA418B6BD03047FB3C7C82AD9791BD352
                                                  SHA-256:B1EAD50B331051C8BD05834B9F828DB981934A92850EB80AA2749337728C7258
                                                  SHA-512:F6C5474BE710C084BC8C93FE8AB46052C67533A3952F27535252B89A5B8F04C9194A56432A3D3B0CDBA4855478EBBFFFDB913439BB00AA6F9E402D998697ED8C
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...............h6....tRNS......7X.}....IDATx...._.Q....]KX.m...\kX.....z...w|......:...c.................f..w#.....e...d...$.1{N....r.ZIR.)j5...Q.g...H.I.\.......d+T;......$..$..P}....\TC4B.@.A...a4.[...g.Z..K.q>/.."...0...j.....8-.y5.. n.!.H..Ka.[.F..d.q.r\..q.....&.....P+~.k.Z..........IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\folderback.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):226
                                                  Entropy (8bit):6.428633105572263
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPflNqAANg2T+/VYBFX0hlVf7zEjs2FzffPYNdp:6v/7/ncTFHX0hTEjJR3PYNz
                                                  MD5:D024C1DAD2299A850DD999210210CA53
                                                  SHA1:BCE2CCAE92B36F6CDBEF6A6AD0A8335467E7AB1F
                                                  SHA-256:B1D5DBB7AAD95066A0840E603F82EB7F29D09439CF5A148DF30E3CD0D5527B95
                                                  SHA-512:141DEA32F37B77AFC0D135F6AC08BCF0F1F5AFA278CEF5D2FC7AD681783128AFC63EA561F10A8891147956EF812B69B38185EE39A3360CAFB28561B6214D8FEA
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............(-.S...?PLTE.......B.H.%...~.........-.......q..q......~....d..~V.BQ....tRNS.@..f...QIDATx^..G.. .....n/.?.H.)........pQ_.=V:l]....6....n}.0.1<.....I7..F...:(8#..G......6I.q....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\folderclosed.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):245
                                                  Entropy (8bit):6.697087897627219
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPCtmVMLVq4hFmDFFYC+qKF0DzZrYV/wfbKXfp:6v/7INVq6F03Yvyvfbm
                                                  MD5:E69DDF7AF6005A76C8A177C0B3556FD3
                                                  SHA1:33A58656D5BB574A4D84F6D50F1829E21624F4B0
                                                  SHA-256:E7916A860DDCB853922631780B95B9E0A4A017EB96C4191B404C56DFE7BD1DDE
                                                  SHA-512:B53A51728D37AD283A10F22F8B88CC19CB49BD02BFACC22DA7A23737FCB7F2639703985521EE8AEAE885FB3EED908F1A01AD2CF576E434812354FA7FEAB02A7A
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx.c`........,.>......Y`...v.q.........S....X.....Y...`C&.5...........2.u'.;..p;.hH.....y?.4.>^.......]X....^.?^....V..; C.`....|8i......KnA..6..%Lp.p..h...%...A..y..%X...x......s.....6g....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\folderup.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):277
                                                  Entropy (8bit):6.759722232738163
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPmNpo/lDtYxzG/w2PXGaglT/QCWWWZCtqDyMIzGO89dE8rnbp:6v/7uNpQzQG7OFQJ8sIzGOU1
                                                  MD5:80FBDF824F1570176A0B6294452E5D93
                                                  SHA1:080B426047F3ABC70489437CCA67690EA170F872
                                                  SHA-256:4BC9F7B25AFCB1E34308CC4DCC21E70AB139648DC8526FB06100965D83CBF8E4
                                                  SHA-512:6092B3BE2C696513192286F5DDAE48D22B2B65262C6C9596299CDCBD433917923D1DF2C7CF4AC513D3CE012C06C2FC865F997D3572563ED82BCC5D003F460DC5
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...............h6....tRNS......7X.}....IDATx.c.O"...'.<..Mz... ...._>..2..v.#..k..~.>.2.5|y.......8...".....a...}...W.Ap......a.'.....A....4.N.....s.=.'....J8H... {..n#....a.o........>..N........S.....+6.GM?......J.H.B.p.*@....~D......{........IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\help.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):360
                                                  Entropy (8bit):7.302846014752738
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPW3bdUdW2OOp+uKfFCXq1EoujBdafDvC6zjgvuZLrLaXkuNRHLzOeep:6v/7MNduKf+qaoeQDK0gvuZLreXHzbM
                                                  MD5:38F7CDE82901278A2140FBEF28BABE4A
                                                  SHA1:E6982F14483950ED729453C884B6697B3BC88891
                                                  SHA-256:EBDF04DCF41ECF5641AACCE965275D2C4C8CA473E2300E986BDC9ACF9E9A9151
                                                  SHA-512:027223BBD8BDD9976F5E71C051FAA8393133F45F997DBEB9ABCDEA76B4C9AF4D256D5758B7322B895CA6BBD076B03E30B3259BD84DC27093E0714BABAC733529
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a.../IDATx..R.AGq.o.l.I."O....1..7..m.B..S.r.......O....B..B>.f@d.....<(<...h@..M.m...9..kxNT #...I.6..e..:.$......Tc.i..7.u.|0B.......>.(.}_'.....Eu..w...@..[.F.X...uJ.. ..wW.?^C}.M.n.)QQ......~..'..1X.......0...`+.Y...}.3..'.O<.a...h.Q.M.,....3..j.\..?.zuB.@.\.....1.m.Tp..mU.b....o.G....Q..#..X........IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\localtreeview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):216
                                                  Entropy (8bit):6.333576096494228
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPfWKbo73s3a8ncCgMNOT1NB3IwM1/bp:6v/7mKELsqFQOT1j+9
                                                  MD5:8F42C78DC1738E14792FEB10E6F1DBB8
                                                  SHA1:1F85A93B819C9FD2DFBFBBC70933F2BFBAB1F82E
                                                  SHA-256:F2FFF7111CF4D8FB6282F621D712A6CB766F8E1D88F06B2695DE5F5148EFAD69
                                                  SHA-512:B2E4010139FA0B36E8E6CEBD839470E66797A2E32DD9272C5EF7E53355597FC7FAF5A324927B0EDF50D8682919B643E7884CAC56F4FAE56359FA7707304FC849
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............(-.S...$PLTE.......F.A.>.C.>............W..p....tRNS.@.O.....aIDATx.U....0...h....J.....\.L.=.Vh...N.h.H.(.d..$...x.Q!...I/..o.B.Isd$.......9.....u......j\Y..x...@....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\logview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):127
                                                  Entropy (8bit):5.704219760640863
                                                  Encrypted:false
                                                  SSDEEP:3:yionv//thPl9vt3l52RzZV7qWDHDzUHNyOoHTkup:6v/lhPoVnUrgTbp
                                                  MD5:0B2ABEB72B48D34FDB051107A873F246
                                                  SHA1:2F27AF9574F775CE2798C5836B73169A0AECC61E
                                                  SHA-256:B1FACD3651A831DB0B013C41C68A287FA0BEA4C871D2A19DDC63451F22391209
                                                  SHA-512:F44381BBD62D9C99C902E526C0C9EDC1FF316244D541556ABCF183B52928C6D8530494DFDD94E2DD72774A3E4FE88F06D3B40EBDA0D8F7710211CD836957ED0C
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a...FIDATx.c`...{..R0....L......0H-N.b&m..2... ...]`|../...F...E.Da............g=....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\processqueue.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):174
                                                  Entropy (8bit):5.980276220238739
                                                  Encrypted:false
                                                  SSDEEP:3:yionv//thPl9vtt/NM+TNS8GDRbI0trnU3eGYMHTDFH4qUVtt9i9eup:6v/lhPfPMpIGnUYMHTDFYqUR/up
                                                  MD5:D0351FFBFCE212DF95D53C7E32C20DB2
                                                  SHA1:9755C68DB479CD2A181624E8F010F193EA7E2BE2
                                                  SHA-256:F85E2C8403D2D89A5A93455C4D1E1DDE6EFA0F23A43A1AD3E0DECA8514AE973B
                                                  SHA-512:6D84FD8F5E8FF4913983977C5CEB4B6D655967A0D7F7A6AD9C53C3763CDCB095B8A51E8E7FC6829501B16216E7B16E2771BF9967DC6CA5C153AC58C5B6B97657
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............(-.S....PLTE............<.v.i...B..?.p.....tRNS.B.A....CIDATx.].... ..Q....83B<.w.EM.....z..cU.9..$.~".......#........l.....O'y.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\queueview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):286
                                                  Entropy (8bit):6.516672130396907
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPfyL7nxJdebSowiyotXhp7GstKvBILkO5fcE6V5KTp:6v/7o7rdzoY4Xhp7Gs4Qlhcr5s
                                                  MD5:0A26CE3CE82CEBF58455C26A9CC8C4E6
                                                  SHA1:1B271A71A9F915DEFE99EE048925425F15BE472A
                                                  SHA-256:B2B5A8102F51DF20748227CBFF5A9E12C788EE71F74628A97223D2A8F4A808C7
                                                  SHA-512:E1EC824394EB9E7C4A6A3B52AF145529B06BDB51B2A84779A65A3A7C2E2195BB7573FF9423EB7A61FBBE30881E0BC04270A82250EDE59833F6056E6475A6A2AF
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............(-.S...QPLTE....i............}.............B.................................................U.f....tRNS.@..f...{IDATx.U....P.E..4....N.xi.(Y.k.......a|]keE.d.Y~.d^..h.WN.u.Dm....uZh$...m.1"._......_n..U^....R.........!...."......7...J.......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\reconnect.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):500
                                                  Entropy (8bit):7.39550370859088
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7uNpQlktGQ5FWuoKcqH6UPdxLTNr/4BGFZdfHuVT10s:nT4MAu/76Uf1/4BLVh0s
                                                  MD5:A5DBA22BD5B2DB3D7CB458975836EA6B
                                                  SHA1:A4FD0465B101463248B38CCD68FF64F0B9F32899
                                                  SHA-256:13AF05EED207A88E66D98DBBF58062CAA0F940BDB31A8A761D498B60D3CE744C
                                                  SHA-512:B8BE64EB4FDACBBD999031EE5AFA8F35F2F754555E5914BA05FE1F2E1B5D208342364771A9B2703B5FA48EE426D339AA8AC2E036E8F4E98592E12B5688C9D164
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...............h6....tRNS......7X.}....IDATx...C.cQ.....M....M4c{.e?.gmD.m.....<..../...`9FE..H.....Jp=$*.7....^+...]...j.......r..q.t_K.l....o-Ug...-g.-......_.-....<...B.T....|%.......l.zn.........w..@........S.c....{...-.K..Zj......P.m.8.q..^......]O.0..j..y.<...[0.]:>..}......8.j...h..f.@.v@.0%....t...............:....2a.....[....}...xX..u.y.X....].P.qpy.P.I..vm.O8...9.c..@...%..-.$3.cpz.... ..Q.}....mN.....h......7L.....%...M......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\refresh.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):480
                                                  Entropy (8bit):7.3935707713424605
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7URlqI5Nj2xE+U2TpA5f7sggppbIpbp/QjWCqML3E2tzwMYwaYMr4BBF:5RnYxE+1TpAB4ggy6j5uZ9Vrg
                                                  MD5:D911483C65C7556F06D90057BDB5AD6C
                                                  SHA1:B21741EEB1F8360C4B9737033B700F4C57892C77
                                                  SHA-256:1260048FCF3FD414BD68C61EAF281A3746C4CF29AF0DFBAC1BA6E0290C18F150
                                                  SHA-512:5D297CBA7E6D0885184935C2F16437FA2CB64B3415179F925EF649A23F2168E0218E06C560ED0A980CDE860836856C515FFD94614ADDC1F6B2F0D6C92A89A01B
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx..R%..a...j..WoZoV?T.\.j...........8fftY.en..0w_r9ED...1X..,......t.^.Yn...71...Z.........:H.n.j...fC.[R..d...."....cL..M....@..K....,|.N....e...&....i2.j@..o.1T.{R..i..;|...q.....wB>....<........~.j.E.......Si.6.V..c z...u.A...R%;.>.d..@d!.....M>.!.s...<.......o..AC.;.N'...C..I......w..W..y.B.;L.'...U.K.H..F..-..G|.>......[.#.....L.e.+_..s.qw.HDP......I..].U....I.9].-.". `..z@..Tz..-..Y.......!.fe.$.?'k..8......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\remotetreeview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):194
                                                  Entropy (8bit):6.446368816929445
                                                  Encrypted:false
                                                  SSDEEP:3:yionv//thPl9vt3lNhTcgASjKWpyjoxUl776Kgc8i3MzDQ1nGEBG02up:6v/lhP9hTDASbhUl/6FLk8Cp
                                                  MD5:0E2BFFD4BDFE5A992268C493AD21C92C
                                                  SHA1:667F7EDB30A816FEDD5AC544E30CD0E94C6364D1
                                                  SHA-256:5111661D61CFDA750D19E7DE4243A6A996178FBE98501C2C5C604A17FF0B67A8
                                                  SHA-512:C4064F8676D89C8CBE2BE87A6E7CF3478E829F90C3B705A4FB075FBC0972FFCC6A41259601583ABD68D93F12889A59D8C5FEAC47FA6749339A1B92EFFE9D5825
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx.b..n.t..C....1....3.N.('].(.....Y.I.....;.....B.ZcZ.Tw.7WA'.......;.....\;l...1HA...E...~].w....g...LR..$.d@.W..>.....J.r...;#..:...VZ.q.w....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\server.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit grayscale, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):207
                                                  Entropy (8bit):6.442663049885758
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPmJwPd/chkGX2FY6bOIM43J22CtgHrrD/Wdp:6v/7OiPlchkGmFVbOwQgDk
                                                  MD5:65C2A73ECD3447EABF03082C934EE5F7
                                                  SHA1:AFE1D0408000C047A2E3DA32179E68E833EB5F7D
                                                  SHA-256:76A825581BC97A70767B23C2B7C024DB5F2BFCFA296411ABAE2D8592EFA88D2D
                                                  SHA-512:A05BCC9553E7A99A190596C467173F13D5BC323937204BF9122906E16D38C1EA0E7ACFDF1145D82608551F1907E12A044A0A79BD6F1335538D18CFAF784B3885
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............:.......tRNS..v..8....IDATx.b...MK...!..QeM.+..8.%.NW...../.hm.1.?...i........G....M....)...=.^.1....J_,.....!G....'...d$$Eb....13.r...).....o..""....;...L.<.......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\showhidden.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):167
                                                  Entropy (8bit):6.132608765486688
                                                  Encrypted:false
                                                  SSDEEP:3:yionv//thPl9vt3lJu4Rdj5xEjqeplU87lSPm/Zj41xmz31iOg3/lH1p:6v/lhP/5x4pll+m/ZjU3Z3tVp
                                                  MD5:EBE775CC3289F84FFC82B81583CE11C9
                                                  SHA1:96E5F11375E3E52CB1B9BBDA794F6D2B4BC4901B
                                                  SHA-256:F133AE3DEEEB584B6C5AB7E2FA74DFAEF9AB4C48D7F25127EA854BB14CF5C9BA
                                                  SHA-512:D63D505C6D2BC6A4EF35F8F4F10CA51900BB6C5B6C644557FF6CDF80DDC7A7AA5ABBB68A0CF699EBFFC066F924F79AF235E63D9FCAE1C0A6AF2832E05D643D89
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a...nIDATx.c.*.s....I..#..Sv..8 M...'..........{....9.4..........0.!$...-.+.....sA......F]P..(..x..d....r.J......U..........IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\sitemanager.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):321
                                                  Entropy (8bit):6.731862752490998
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPfMcJO9pToTWZXhynYaUMp/FE7v+F5br6uuAMcIIgZtPH9p:6v/7rJO9aiZhgEg/FEyF5br62Mcrg/Pz
                                                  MD5:1C919B44BB21DB7B15736F380503FED3
                                                  SHA1:61AFEC3FC34F3C222EC52B6679C2210A7E77363B
                                                  SHA-256:1117E4F7B7B88E0DAEC3C27076788ED31216A5C02C7301D02312E8A3C9E4CC9B
                                                  SHA-512:3041C2682210570C857EF1C8BB5FE9A1CEE4A81D73EB7A4359CA9197D0587AE91FA0E8F6E1AA8DA3EF46070BCA362047C6463F6C9F51E7E0E30B65FF9234B3B1
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............(-.S...fPLTE...aaa...kkk```...jjj.>.....................lll.........xxx......ttt..................www.........vvv.:.....tRNS.@..f....IDATx.ML...1.k2.Zg...k..Fj.....V..y....T0.^.g#..c|f. .......8.4M........M...MK8..\..1....B..ju.].........H.1.3..kS(+...+.2.ZY.".:......^J.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\speedlimits.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):155
                                                  Entropy (8bit):5.7759352116421105
                                                  Encrypted:false
                                                  SSDEEP:3:yionv//thPl9vtt/V1lQm8UenRLIT/oVZpBS8js9aJmp+tljp:6v/lhPfVvQmF4VITW3A9aUQTp
                                                  MD5:34C636AE220B1D3E367DFE06BAFC91E9
                                                  SHA1:DB3D89CAD6070B8ED004DEEE893B6B9B3637FD34
                                                  SHA-256:A4AF127C014532AC9DAEAB45212ABF75C2053F9641C3DF77DB1E8697D1A63247
                                                  SHA-512:3D8D620F1F50808BB4D42C1DA8A802E16CF03B7A8C4412B9BF0466A4020EF52FF390ED9FF611828B633B4B452E6A2AE3E14AD63D883CDCD0CED8C1E9A0796F71
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............(-.S....PLTE.......i...B..?1..H....tRNS.B.A....9IDATx.....0..8...M...U$cC.L...p...FF..2..@.....J....g....a4.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\synchronize.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):279
                                                  Entropy (8bit):6.673079365590357
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPfQsNggUz8HyX6R12aFhMklTqMz/+RwNhcj7vim1gWaqp:6v/7DWjAkA2aFhMkXjLEjn
                                                  MD5:020253E72AE67390D60D7CA57FA77945
                                                  SHA1:607BFB3D0862085C6367B07007BA272E1D5F9081
                                                  SHA-256:294163290886B12F22094C3AECD042CA203A4FFD441A7C384926FE0088FE60E5
                                                  SHA-512:727251BA96CB0BCAC1F03E1A5606493F38A139B93B489FFB58A6D53CC80E2D5C167CCC6714A343D808E181BAF29DB31D166B9F7CD439097C6C25A5B4BF9AB167
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............(-.S...ZPLTE....u..B.Hy....5......J..W..V..?..q..d..>..V..d..~..q..r..~..~......d..........J...?....tRNS.@..f...kIDATx.].U.. .D..Re......sT.C........oLD.n.o.(....U..{.C......n...p;.H......... >...`../..v..l.+.L...../.3.+.k....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\upload.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):124
                                                  Entropy (8bit):5.7031717489459455
                                                  Encrypted:false
                                                  SSDEEP:3:yionv//thPl9vt3lyFhDmkolERqglE94kWk/WDNF4OILll/Vp:6v/lhPiFhDmkVA4ktOIxl/Vp
                                                  MD5:86616009BCB357544B0056012333E23B
                                                  SHA1:574A6A7249E7B2FBEB343438A956A14786EA9FF2
                                                  SHA-256:83940C38223C617478A6BE4993298CACE9A60657DCB3B48ABED9EB4892CE80BC
                                                  SHA-512:AD95EAEC6CB16443D1B2DEDEA930C66B17EA017D1368E992E82697BBFEFF91EF963E7B9F7D08802B8389971ED27247D1AF7EA8C68C5B995A6B8CAA629F3C2709
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a...CIDATx.c...D&.....a.......6....&l.H..4'|...80.f'BA....j&h \. ......n.4.......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\uploadadd.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):179
                                                  Entropy (8bit):6.352097747179528
                                                  Encrypted:false
                                                  SSDEEP:3:yionv//thPl9vt3llWebPfgXS7VJuQXb1FvE7rcm3Qr/qb7FH8VW5GY+kg1p:6v/lhPbb3gXSRJBXpScm3QGNH8VgGbbp
                                                  MD5:A30DF9F34DC7814120BA50F5DD0CE35A
                                                  SHA1:97B36BCC8CA676C45E125D6041E1C7179EFC2E0E
                                                  SHA-256:297B35A7D181F05BA6DD330DD4E39F4FEA7AD6F01A22213CE14E3CDECB164CD3
                                                  SHA-512:BB495C7962BDD98FA13F5CD5041F32768B4229ECD42E896A2130318B26DEE39CAC68E417291FAE057E968C4AF679D5F573833CF4D96F9D007D333E5BE52F4F0D
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a...zIDATx.b.|.+p!..20........6-.$..BQ.j_Q..;.><....,0...OY+z.r..`.#0.....]..,/.8E.T .L.5p..\..fe.......q2.N...|P....O 22.d...=s....=.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\cyril\theme.xml

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:XML 1.0 document, ASCII text
                                                  Category:dropped
                                                  Size (bytes):203
                                                  Entropy (8bit):5.001291483492264
                                                  Encrypted:false
                                                  SSDEEP:6:TMVBd6OjzwgKZTaQmM7LDTrktoHUTUZBQIKe:TMHdtAgwmMXDkyHKABQIh
                                                  MD5:071CFB68143BB24DE6C59139839E99C1
                                                  SHA1:D9BA644DF50DD3AC5FB456329A3E0E267901972D
                                                  SHA-256:D7556C00AEA0E6CA37274EDDEE3DE2A51A0628E5CD6EDFF10AA6065053ED8AD7
                                                  SHA-512:44A2C8ED0FC0B8D7394125ABA09958567E9BDF5E342F1616A16FA35366230F4E1C25778838FF5DF5EB8743346A425CBFD0021C6F7FDD10235207C9B4B757469A
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>.<FileZilla3><Theme><Name>Cyril</Name><Author>Cyril Burnet</Author><Mail>cyril@techeo.com</Mail><size primary="1">16x16</size></Theme></FileZilla3>.

                                                  C:\Program Files\FileZilla FTP Client\resources\default\480x480\ascii.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 480 x 480, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):9233
                                                  Entropy (8bit):7.881461091129402
                                                  Encrypted:false
                                                  SSDEEP:192:DjfNACMnpxmSOuyBPQNr6uFF2kp8w4ESSB91C82yg6h:DpACMnPtOFParJFD8wXSePP2m
                                                  MD5:F0AE57C083B3ADA598C3ABB1074D9877
                                                  SHA1:2BB4664A2421A7CB5B623870A7B57EA1F8E332C2
                                                  SHA-256:DD8D6DCE5B232BE9C8AFD5474D67A41C01A8C9C8A24EAD135AA582B04AA3157C
                                                  SHA-512:7DB4156CF7514138E497F9FD50E3D4B14D680259A58FE08493F324C8BF14C7178A70F099E058B76E456173888E87DD006967F91F34DBA22622A6566AFE6D1E96
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............J.N.....PLTEGpLbbbeeehhhiiiggghhhggggggiiihhhggggggfffggghhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhggghhhgggjjjdddggghhhhhhhhhhhhhhhhhhhhhhhhhhhiiihhhjjjppphhhhhhfffgggbbb...hhhhhhhhhhhhhhhhhhhhhhhhhhhhhhggghhhhhhiiihhhggghhhgggiii...iiihhhjjjhhhiiihhh...hhhhhhiiihhhggggggqqqffffffiiiiiigggggghhhhhhhhhhhhhhhhhhgggUUUhhhhhhggghhhhhhgggfffiiihhhhhhfffiiiBBB........................hhh...........................'''^^^GGG.........777[[[ddd.........DDDhhh......;;;___aaaeee...---aaahhheee^^^...@@@eeeZZZJJJiiihhh...\\\ggg;;;...[[[...eee777bbb777fffTTTQQQhhhcccgggWWW```eeeiiiIIIYYYbbbfffPPP^^^cccfffUUU___dddaaahhhNNNfffcccfffjjj111^^^dddXXXeeeTTT)))bbbbbbgggddd[[[RRR[[[WWWcccffffff___TTT555YYYLLLfff\\\^^^eeeaaaccceee```JJJQ.......tRNS..%C[n....^N7..4Q..........h..X....|KFy.k..U....1......2..t.(...-.f.a.0....*d...=...v@.r:i.........H....,.".<..................'.B... o...$?...7....*...o!9.qI.....5.y..2.0.\V../f..NEv..S...b...O...$...m.d.....|Yvi..._+sL......p)...... .IDA

                                                  C:\Program Files\FileZilla FTP Client\resources\default\480x480\auto.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 480 x 480, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):9389
                                                  Entropy (8bit):7.933343802830352
                                                  Encrypted:false
                                                  SSDEEP:192:Bz+KXMnvd4CxFkzS9OhgtJxqDFCYsKAwQWsVcTgi7rSL3b:Bz+emvOsKB+iDHsb8gXv
                                                  MD5:77269A36DB7A4BFA680F7B013D848A75
                                                  SHA1:CF44D541845FBE939160B4BFB52C08C4C893B27B
                                                  SHA-256:B8485E4E544DA9CFBFE8D3D3960840BFC0A2933905652628C26C5FAB1C1EC2B1
                                                  SHA-512:8328C0016D0F06D75DD752F4F8B2BC0645D4FF8EE1BED71D1C32224D25B630B4AAB8FDA49A5AAB39AADA24502055A4628F67128CB903D2C2F29B2390488638E6
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............J.N.....PLTEGpLggg___MMMeeehhhJJJhhhLLLZZZgggIIIhhhLLLhhhIIIhhhKKK...hhhLLLhhhWWWgggLLLeeehhhKKKhhheeehhhMMMhhh___&&&hhhJJJ---gggLLLhhhhhhKKKgggIIIbbbLLLhhhggghhhKKKgggiiihhhDDDhhhJJJhhhLLLhhhIIIfff]]]\\\......hhh...hhh...hhh000...hhhCCC...HHH...ggg%%%...===...EEEhhhIII.........666...HHHKKK,,,>>>FFFhhh...===......333eeeBBB999LLLHHH...JJJJJJQQQ***FFFGGGbbbaaaCCCYYYXXXLLLLLL....................vvv............ccc...PPPppp.........|||.............___sss......YYY.........[[[...............;.;,.,R.R%.%...j.j9.9.........l.lQ.Q+.+...P.P.....i.iM.M(.(....I.I...3.3..c.c.....d.d|.|V.V..A.AH.Hr.r......4.4...q.q_._..|.|].]........B.B.....x.x.....?.?..o.oD.D...w.wW.W...hhhLLL......MMM...............}}}..........................iii...lllUUUyyy.........\.7...ytRNS......8..oA... ..Z+.f....B.~S......*.i.{...T...=w....%.`6.........L<..p...2,.].......J...6d..&X..C.wP!.!I.^1.....tm.f.... .IDATx^..ms.U...b..$..M&Y..Y..X..b...B1.....M-Q...}..

                                                  C:\Program Files\FileZilla FTP Client\resources\default\480x480\binary.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 480 x 480, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):17611
                                                  Entropy (8bit):7.936027216507175
                                                  Encrypted:false
                                                  SSDEEP:384:9jaNkb3JEsrxVmciLr1RczKgLHt8KQhz7cNE2DvjAROGj:xaGb3JJxVmciLxOzKcN8bwNE2DL2
                                                  MD5:576283CB669678FD8B462745115D8ACF
                                                  SHA1:41A6EB678B25DCFB49401B85C62CE5FFB378BC31
                                                  SHA-256:40C0C7CF55787A53920D4D615AFB93FA6EF9C33EDADF02D14F6483779572B77F
                                                  SHA-512:694330D415B183219E77FE5D2632F0A0AF4F9713A5079ADBB7EB584B6EDD23837E4DFBC7239AD0E36BB5ACF0CAC8F5675A0DD3A8E66A1840BD69720A7031C548
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............J.N.....PLTEGpLeeeiiihhhiiiggghhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhgggiiieeeiiihhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhiiihhhggghhhhhhggghhhggghhhhhhiiigggggghhhgggggghhhiiiggghhhhhhhhhhhhgggfffiiihhhhhhhhhgggggg...gggiiigggggghhhhhhgggiiimmmjjjhhhhhhhhhfffhhh...ggghhhhhhggghhhhhhhhhiiiggghhh\\\hhhhhhgggjjjhhhhhhhhhhhhhhhiiifffgggfffggglllhhhfffiiihhhmmmddd......///...fff>>>......^^^...^^^...HHH...fff......VVV...eee......fff```...YYY......333DDD...WWWggg......FFFgggbbb^^^......fff......gggMMM.........___...777eee;;;111fffeee\\\[[[dddYYYddd[[[[[[cccggg^^^MMMggg```AAAgggQQQKKKTTTYYY...RRR\\\,,,aaaddd...ccc...___gggUUUaaaKKKeee]]]UUUbbbMMM___HHHbbbZZZXXX___SSSbbbNNNccc@@@999hhh$$$aaaYYYhhhBBBgggQQQgggeeefffbbbcccfffddddddddd888<<<```NNNbbbVVVTTTaaaSSSVVV\\\]]]]]]ddd@@@&&&```?.......tRNS..Af...........lI..4Z........vU(?c....oW..C...{0.R...i.\..}...=.s$.........2_.9@.!F......7.:+.y...y.....aM....(..9..c...F....h......s../?.k..!B.....o...O.....3.4,..x.o.v|

                                                  C:\Program Files\FileZilla FTP Client\resources\default\480x480\bookmark.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 480 x 480, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):6177
                                                  Entropy (8bit):7.856036382675507
                                                  Encrypted:false
                                                  SSDEEP:96:ye/4ihfUP7mqvKRocYrUkA4YbINqeYF8+8fGRIFMkuHpZWvUAjVMj/zCWaUFfQ0q:ye/Hfxx4rqnEweXfQkM/DiMC29QbL
                                                  MD5:869CCAD7537A629A0E507D45E23C4C2F
                                                  SHA1:6E57C27539852ED695228A7EAFFC075C226070FD
                                                  SHA-256:60C7FF5130DC558BFFAC45C9041E161F1EBA7DF449F3A0D083D977CD694309D5
                                                  SHA-512:3F5C42DF0A0DD3F211C00D0751A648AD217367431CFCDCF73998D788F0CEC1C07E0A0567AD06DFE77908D1BAD31306BA5326B05E340C1B2D2D5D63C6753B3C20
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............J.N.....PLTEGpL.............................................................................................................................................................................................................................................C3..................UA............J4................1#.............................................................................................................................................x...............t....p................i.......d........xZ........lO.....bH...................._..........rT....................................................|...................b.i....tRNS..8D4..o.....`.U..@..........hL.1....t'.....*......$.........".......{......z...!......%....#..{.v..r..pm.j...wg.d..a.m]...YdV.S..R.[P.X.J.S.PD.KB.H.<....;9.7...3.3..0.-.-...)..'....Gf]/..M+......^F.:..n_=.C?..fY..[a....lIDATx...a...D.5.{f13s..).S~_oz..n..............E1.....v....x.......

                                                  C:\Program Files\FileZilla FTP Client\resources\default\480x480\bookmarks.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 480 x 480, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):4325
                                                  Entropy (8bit):7.701829753187855
                                                  Encrypted:false
                                                  SSDEEP:96:r6QXy1Uq60LlFFlIBJjj5ppJSPNSGb80s5BA03Jr4F:WIy1UkqBJ9p+Fjs5BJJg
                                                  MD5:AE88AA83EC926781DF9EC47CB8EA8AA0
                                                  SHA1:F94247D50771002911698C594130CC8401DE2566
                                                  SHA-256:F41C7079C17E20FB6C47E5A4B0C5F0884C85322EE338E2C5041BE3ED550BDF88
                                                  SHA-512:FED9206744BEBB9D9BCC90D1D67B4ACC8C937031B386722891B76C3260F0735EB106DAA54E00F65D85D0432286605426AA33C26E730AF0A975A9063EC5C539B6
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............J.N....4PLTEGpL..............................................#........................................._.......~....qT...E4...................................................................@..n..F........C..k.....g..\.....Y..#........%....I....................=....:....5....7....3../..-....).....+............. .................................~..z..............w..v..s.....c..a.....V...........N........^.....R..M.........................................................................."..jQ.........\G......tRNS..Fw............m..&9....X.M......#./..W#..N.,z"V...................................................................................................................yG.mz...8NL_....)...\.......IDATx.....,Q......23c..>._.D>-X.........................I..E./).J.VO.....v..Q..W.....|...^..._4.w..k.....=...3../.%...R.....jj....G`......Q.F...;aYSC6.~...%...0+..Dn..\.O.FH..!

                                                  C:\Program Files\FileZilla FTP Client\resources\default\480x480\cancel.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 480 x 480, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):7569
                                                  Entropy (8bit):7.902362167336274
                                                  Encrypted:false
                                                  SSDEEP:192:pUN4iI5AyLVl1RoaYWlmGSAGe2YgEiGsSVIqaiLZJZri7hEQ7lZ:WN4ttPfXSe2YtiLSMiLZJZrSEQX
                                                  MD5:4C2C126F11CE45B698336B49B24F8AFE
                                                  SHA1:7CD96F7E9A6FD3CA36336764ECDFE8A317590D1D
                                                  SHA-256:314D5EC0DBEA36C3B37D48438E7BDD50178811B7BA04E46F438873DE3A5C1FE0
                                                  SHA-512:5AB9E12DBA7ECA3D9BF63C7DEF45427040DC39938606555F8D3D47A06750CF8E3808099581C99C3A059F6874028A646E18B3F56DC179533FC7C3F6ED0557AEAD
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............J.N.....PLTEGpL..!."%.!'..'. %. %. &. %..&..&..&. &. &. &. &. &..&. &. &. %. &. %..%..).,,.!&..&. %. &. &. &..&. &. &..%.....&. &..&. &. &. &..&. &. &..&.!&..&. &. &. &.!%,....%..&..&. %..'. &. $8...&&..&. &. &. %.!&. &. &. &. &..(. &z.... ...`........S........u.....m.....'.............................z.....n.....L.................p..\.....0..}..k..D...........g..w........V..................................................d...(..bf.......9?.........FK....\a.......-3.........4:.AF......$*.ps.tx.........39............|.....KP...69...........;=u...........-0.W\....... ...uv.#&;........mq........qs...........jl.14......df...........+....-/y..........v....s..............~.....|~.y{...fg._a....LP.EG...PR...............),.Z\.........\....$k..k<.@....tRNS....AXi}............{T?+..%Gf.....a.2^......(.Do..wM....!....[..7<....;..B..7..0.'.".........u.W.2....[>.%.R....Kk..:................G...................................{....

                                                  C:\Program Files\FileZilla FTP Client\resources\default\480x480\close.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 480 x 480, 8-bit gray+alpha, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):4748
                                                  Entropy (8bit):7.604863604758853
                                                  Encrypted:false
                                                  SSDEEP:96:8z3MZ2L0h4gMbBwYEwQNoOiiN/IgEpYbJRH4x5rbroocK3L9:MMZ2WkwYauil/bJRUKc
                                                  MD5:96803292CBF69CB363327370B4646C95
                                                  SHA1:55A3B18772C69D7256F015972711EBF9442A442E
                                                  SHA-256:45C5391E3C1A2156846C742EE2DBC7779B3D3F498E7BAB7DE4F1D82086462F93
                                                  SHA-512:03720A293732106F0AEF36672AA3A1F25BE59D2D179FC6587716AFD6C5691FC60FCE58E44804A60AF1419072D371292B3E68CFE63B63D93C118EE2D1A7E7B057
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...............v....SIDATx...1.....@...D ..D".%...........................................................NlvumN...]x.$....e.YR../.z4..r....lk.03..3,3333333333I}[..mg.:+2......E...K.F.......9;...)i%.d:~A6.......'........z...uL..G......?.P.....-I!i%Qq.>R...>}_..MfR...Uz..Cg.....3._q....w.sY.jw.+>..q...zQg....r7..k}t.O...1W^..j..o>b.T).e...G.]...WmiM.Lj.v..}..i...).y.....j...5........../............w9...`...[rA..q..4.......m.j}.v......6.......R.+..Q.:..'.;.>.ul..l...L....Haj._..6.4.f$.d&....5A..i../...0|!l./...a.|!._....a.B.>_..\\Q....M.0|!l./...a.|!._....a.B.0_...W..[....0|!._...a..&._...0a.B.........S..._..^../...a.n....c.XH.X./....Wm\a./..k.!._...0a.B...H........0|!._...0a.B........5L........X....0|!._...0a.B........5L.....a...0|.../..;...........0|!._...a....b...I......WD..k.m.3[V'.7...1.6.0..;kKk....NO.Y.B..f{.J.D..M......-;9Q.../.^...[...DG.$...S.../g.m{f..8..}......o.?$..I.(...2.6.0..k...Y....p...d..,P.6.>(a...$.0..o..x._

                                                  C:\Program Files\FileZilla FTP Client\resources\default\480x480\compare.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 480 x 480, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):8222
                                                  Entropy (8bit):7.87361971360084
                                                  Encrypted:false
                                                  SSDEEP:192:N5fnCOK9xpodseO7rMQaN0EtFM27XaQkSdg24GDkY:tKvpcsj7AQaNrw27XDVDDkY
                                                  MD5:0B07B1EA2BDE56E41DCBD50E79BD65E3
                                                  SHA1:95CDA38E1F49D3B0E7E2A9A307B325A46E63F030
                                                  SHA-256:7788BEBBA4F6FA835D285950DA618E348642E7479A662C961D9447AAFF1464A9
                                                  SHA-512:89DE464B969E12720C1FE51738EF183EBA81DFD10992A79755CEDB58593834886EDE09E7AD4A815BD42B56B0E654C65A9C84367D16E0345C5A8227927B482E10
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............J.N.....PLTEGpL................................................................SW.39.%+. &...............................4:....<A....!'...qu.............iiiiiiggghhhhhhhhhhhhhhhgggeeehhhhhhgggggghhhhhhhhh......iiihhhhhhfffhhhhhhhhhiiiqqq.....................jjj|||............ggg.........iiiggg.............hhhkkk............iii...............gggyyy...dddggg...{s\..4...........#..C..{...iii.xW.$......~P....+..kje..E...gggolc..e....@..Esss......................K.................vvv.-.......9...nnnggg...............V}V%.%(.(9.9V.V.....5.5.....\u\?.?..<.<u.u..A.A`q`'.'/./N.N*.*+.+...eleG.G...NNNSSSXXX\\\___aaadddddd]]]AAA(((UUU...HHH...^^^(((ZZZ.....SSSKKK\\\LLLcccMMMNNNJJJ###@@@EEEKKKXXXKKKB.BBBBKKKCCCIIIBBBKKK...FFFHHHKKK...444.......?@=....tRNS......xI..n..;....k...............................*<Mbs........._...5S.......................g............D...................._................................................................

                                                  C:\Program Files\FileZilla FTP Client\resources\default\480x480\disconnect.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 480 x 480, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):4421
                                                  Entropy (8bit):7.652384910388458
                                                  Encrypted:false
                                                  SSDEEP:96:DFhqPKQqMp33g8q2AhyLWA5yyDfjDZaWYVlab2u:DDqrzfq2Ahgp5yyrJzYVlaiu
                                                  MD5:E7A7E89F12DD8D49F9AFB73EB52E0466
                                                  SHA1:C4B57E0F2B6D286309E4A962C504ABD1A602D971
                                                  SHA-256:BF0F361801F7DD78C748D611DAEB2180D50DBD9E3A284758BC4A5E6F773758D5
                                                  SHA-512:139DF2A8FC3E6331EC5E8A0B3DAEC852A484FF5E59C54A6F72EB0A257432146E56D73AC86C4BC222B5DAF16270A0A910FD3E9B9796485394282151AE93C62EB4
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............J.N.....PLTEGpL......................................................v...... &.....................a......................3................3."&..%..%........%.!&. %. &.")..". &..&.......!&. &.!'S....+..%e...... ......x...............%.........~................1..F........S.... .........N..X.....f.......%@.....|...........V........|................&.tw.9=...............BG..........................................jjjhhhLLL...........{{{aaa.........]]]nnnQQQ...mmm....KN...LO...DI. &.)/...%+...|}...{}..... ...=?...58....|..f./..)r.....}..i.N..F..6...g........w.....!........u................G..............]a.HL.5:^.. .../4.t..@E.SW...j...tw..-s....{........ttRNS..M.......L.u.sS..Qw.....P.<:.............D......q%..e..y.1+..1..{.d.2.Q..:......$0..7....4.BI..,.{...;..........;v......IDATx^..Gn.Q....I..!D.r...D.x....Sp.N..{B...(.o2.....~W...x...{..uv.v...b.S>~.d.#.J}.)......}.O........yk.....u....:.}:...:.};...`.p....[..8KC.@

                                                  C:\Program Files\FileZilla FTP Client\resources\default\480x480\download.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 480 x 480, 4-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1172
                                                  Entropy (8bit):5.966572392789165
                                                  Encrypted:false
                                                  SSDEEP:12:6v/70Di0Z1Z1E0+h8tKsssss9U8fYLXL444GXXXXXXXXXXXXXXXXXXXL1xd8xIxd:75u0+oKsssss9U8A58xO6h9q
                                                  MD5:E08B0F6B99714332A5ED3817AF06F694
                                                  SHA1:6DCFCB4253398169E14FA6B6222203371652946C
                                                  SHA-256:4C7A9A59FFDBA87A0C8F25B7032D6B62E078AE31B7BADEB851585FC67998872E
                                                  SHA-512:B30AA63EB040289C9A664401FCAD2853B5168AF4691F1AF252E93BCC52AE6D86E9778FDB1F998853EA45AEA016727882E483880EF0947FF76F7C081F237EA7BC
                                                  Malicious:false
                                                  Preview:.PNG........IHDR....................0PLTEGpL.|..|..f..d..;m.......|..f..v..].....v..\.......R....tRNS.!..!8..w.}........u....IDATx...1.@@....."|..B...l..w................... ,,,,,,,,,,,,,,,,,,\v...................................................................................................................................................................................................................................C<K~.6./<RG.D..@.._S.>(...h.........HJ..-1......[`@l.........[`@l.........[`@l.........[`@l.........[`@l.........[`@l............13..v..K%..j.v.b...-0 .....[b.l...%.....[b.l...%.....[b.l...%.....[b...-0 ......b...-0 ......b...-0 ......b...-0 ......b.....%.....[b.l...%.....[b.l...%.....[b.l...%.....[b.l...%.....[b.l...%.....[b.l...%.....[b.l...%.....[b.l...%.....[b.l...%.....[b.l...%.....[b.l...%.....[b.l...%.....[b.l...%.....[b.l...%.....[b.l...%.....[b.l...%.....[b.l...%.....[b.l...%.....[b.l...%.....[b.l...%....tG.D..@...$.................-.S...X.N1..b<..xp......-.

                                                  C:\Program Files\FileZilla FTP Client\resources\default\480x480\downloadadd.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 480 x 480, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):3371
                                                  Entropy (8bit):7.6085134491908475
                                                  Encrypted:false
                                                  SSDEEP:96:efy3gwNRWWWWWWWWWWWWWWWWWWWWWWWWWW0IVdhbhlCHF1q12V+12mO:841e8iFw912P
                                                  MD5:4446C16BA6D4E7F0DA53623691E4D714
                                                  SHA1:CEC1FA54C27358A438CBCB31E655303D2E50EB7E
                                                  SHA-256:496DA69784B29607A4B6510D8D7CAE7B1615D80EA4472B681F411FBD11CAC444
                                                  SHA-512:2DFD8BA2EACEC82A77D93AB1531A78595A28085AE576B58BB1559EDA112A068FAA7403E1C05023EBA44DFE02073C9EABD3CEAD2758A4F78B445F25483B600DD2
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............J.N....zPLTEGpL.|..|..f..d..;m.......|..f..v..].......&.&(.(*.*+.+,.,,.,,.,%.%$.$$.$%.%%.%'.'%.%$.$!.!(.(+.+$.$&.&%.%.\..@.'.'%.%$.$(.(,.,$.$&.&0.0$.$).)$.$ . (.("."$.$%.%,.,%.%$.$%.%,.,$.$.q.(.(...+.+$.$<.<...).)".".q....%.%&.&"."...........................*.*...,.,.........-.-,.,$.$!.!$.$.v.+.+*.*(.(,.,$.$#.#+.+!.!,.,...+.++.+#.#,.,...+.+,.,"."...,.,...,.,,.,,.,#.#,.,+.+"."!.!.i.+.+$.$...k...~tRNS.!..!8..w.}..;p...........`%Q...=.%..w.....a..G1U.I..Y..?4 ....C.S8Z|k................w....N....._n#..=Rv|.d.FE...l.z5.../.5....IDATx...Eu...D.2...k.a...B.....O:.IgG.F.4..F.>..F.>..F.>..F.,..F.,..F.,..F.,..F....F.....o.t'....#....#....#....#....#....#....#....#....#....#....#....#....#....#....#....#....#....#....#....#....#....#....#....#....#....#....#....#....#.........k...5..5..5..5..5..5..5..5..5..5..5.7>.7>.7>.7>.7>.7>.7>.7>.7>.7>.7>.7>.7>.7>.7>.7>.7>..........3........................................................................................

                                                  C:\Program Files\FileZilla FTP Client\resources\default\480x480\dropdown.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 480 x 480, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):996
                                                  Entropy (8bit):6.015697154048635
                                                  Encrypted:false
                                                  SSDEEP:24:fO+NEIzCp9zVIwT9SVMB0zT8DYMKn/Z0wUHUd3/VOOUGUsXQ:2+upp7T0Vw0zwDPK/1PVOkXQ
                                                  MD5:77997FF57AF571672F8EFC7EE809142E
                                                  SHA1:C44DD1461D0798FBD721EA58ED53927BE576CD81
                                                  SHA-256:CA23648B2998ADA62394878E0A25D5272B5F45B04D17B670617E9958E37AEC33
                                                  SHA-512:1A9BDCA1F1F9CCB0425E775A2D9EECDBB3EE20ED347DB77DE87F65729FCA53890E20636B1C1B6F6581778A757EE8175B2762264AA80CE5C28A13F4D510B6B1DF
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............J.N....]PLTE...GGGKKKIIIMMMMMMMMMUUUUUU@@@MMMMMM'''......KKKJJJ............KKKKKKJJJJJJKKKJJJ...KKK.............tRNS..3.............. ..............,.>....IDATx...q.1..@..f...L...F.}ov[..................................................................0....%e.m..zC....k......k.o.._.~..5...t.a......5.._.~k....k.a...~..5.~.a.....k...G..7Lprz6.y.ou.......7....a.....k..._.~..-..k.a......5....;....k.a......5.._.~K....k.a...~..5.._.......k.a.}.~..5.._.~.....k.a.....k.o.._.~..5..._...~..v..5.._.~.....k.a.....k.o._.~..5.._.~;....k.a......k.a.....[0.._.~..-..k.a......5.._.~.....k.a...~..5...a.....k.o._......k.o.....g...~.....k8.._.~...a....>._.~.....k8.._........5.....\~..5..k.._.......5..k.._..........N.5..k8..p....._........N.5..k8..p...._.....}.k8.._........a...~..5..k8.._..........N.5..k8..p...._........N.5..k8..p...._...........................................................J.XN...~......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\default\480x480\file.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 480 x 480, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):2279
                                                  Entropy (8bit):7.303696157864078
                                                  Encrypted:false
                                                  SSDEEP:48:P3D87OE9aBziTInibcE6662666666McFSmeQ924juiZ+xF:b8aD7s/MuuiZk
                                                  MD5:33774E40279BE08B64BEE8C287258678
                                                  SHA1:0F6349785CE1F4AB0C8E43646DD04E522A720974
                                                  SHA-256:9EC4D7DFDCFD51CB756104BDFF72A974825BD274069CD6DA52C78BE89753B377
                                                  SHA-512:6E31A977C028E472F382C1DEB1E0AF39337FB65E4C7CCBA52BEC2FDA3D5E2E4164375CF59636AD1D1EAC105D2E254B819BB4DAD3482C97D5C43569198124F7EF
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............J.N.....PLTEGpL......................................................................................................................................................................................................................................<<<.........hhh....................................."""...GGG...]]]......BBB...............jjj......lll.........eee........................................................H..2....tRNS..Ex........m..9.;.....L...........J.7..y................................U...".y.,.O..:L...a......$.)..#...Y]$..-.M.+z.V.......................rIDATx....C....p2a.c&...u.QD.wZxZ....t{..pD.....d:.c-...m.^.....vG.....x.O...".C\.......'.e../...._/....d..=.e....5..w.ExI2_....).".I2_...s.p.u..B]..Q..=..i.....%..G..0W.kX\........................................................................................................................,.b Z...#.V..Jn~.y(...........`|.H...."...4.C..`v...p.K.H...-"....6.....}....m.@

                                                  C:\Program Files\FileZilla FTP Client\resources\default\480x480\filter.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 480 x 480, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):2731
                                                  Entropy (8bit):7.50303789132687
                                                  Encrypted:false
                                                  SSDEEP:48:ZG1jgqfsNrhWVQRxLvY1SxZZvJVyJQw/fTpHO+4zKdf70VKZG:Z1TNrPxg0TJkNxfQVKE
                                                  MD5:8BA37BA851FAD91B76C7C9B5DDAC18BF
                                                  SHA1:77E44925B19B19247EBCBE16CE0B65BEF533D67B
                                                  SHA-256:5E67131EFFDE188B8C27D92982ECBFE9AAA313D0641243E69DE7EB982A97A782
                                                  SHA-512:A58C01BFE9A4F0B7DB826D739D69A5CDDC57D8FBB890995D659D4A2F740F2C26BF33C8DE84FF1D3B7BC0CC0FABDCAB9BA0F586CCBB0941C7F68A1254264475DE
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............J.N.....PLTEGpL...hhhhhhhhhhhhhhhhhhhhh...iiiggghhhggghhhgggjjjhhhhhhhhhhhhhhh.........................................................LLL...............ttt.................................0..8....o....8..:.........RW.39.#*. &.....<A....qu................V.V8.8*.*%.%......:.:..@.@..u.u.........x..C.."............+..e..........D...................iiihhhjjjttt.........................}..P..0..!...|............'9*`...;tRNS..Gx.......l.9.7:.................x.HV.#..lz.,.8M<a....^:.{mU...rIDATx^...........n..".................................0......2...U.%Uw..%..;............+RM.....`... ...~/..?IF..e!JG.}.[.l]..1}.$e.A.F.K.9;.....(...0........i.B..L.....0.....B..>.!...)..S.,.Y....(..@0K..w....I."A>..R..R.`.b.....ap...<...=.D.,.\k.^.*J.......k[..H.....b.{i.R...v.s.`+....`7A.7......j.c7.O......b,.._W..$.e,...R.......O....n....X...g..b.Ae..stD.X6.f=./.+..30.h.......1d...Pb...g.k....E.-.b##0lmW........SW...K......

                                                  C:\Program Files\FileZilla FTP Client\resources\default\480x480\find.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 480 x 480, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):7368
                                                  Entropy (8bit):7.920394518124266
                                                  Encrypted:false
                                                  SSDEEP:192:K33Z5JwtdpEhfl4RqfQS/RDcp6fk1nPX8tRAiCJaiQE:KnZstd6t4QRDsUk98si1E
                                                  MD5:31CB1244F73290719DF3C7538B730AD9
                                                  SHA1:D3AA9CF378BB4FE8B231487EFD0B647BCD3C8A06
                                                  SHA-256:3E1A1E56E1B1B47FD85D83D0071EA146307F49E591A8A2CB8807E7EBAA6C4A18
                                                  SHA-512:9D1FDC85C4AFE39A51C91159C5A518D81B169D1B786FE14128709A6C573391E16DC449F6653D7EF77E7DEDBFAD81EE4C63220189C1296691B58DB87CAAF8D628
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............J.N.....PLTEGpL...MMMJJJKKKKKKKKKLLLLLLLLLLLLLLLLLLKKKNNNLLLKKKKKKMMMLLLLLLLLLJJJKKKLLLLLLKKKJJJKKKKKKNNNcccIII\\\EEEMMMGGGJJJLLLMMMBBB LLL...KKKJJJMMMSSS......%%%...........................---===.........GGG===...OOORRRWWWZZZ]]]___bbbdddfffggghhh:::PPPVVVhhhhhh```ggggggggg```hhhhhheeeXXXggghhhgggggg555fffiiihhhhhhaaaggghhhbbbhhh___hhhggghhhdddhhh^^^fffhhhfffhhhhhhhhhhhhhhhhhhWWW]]]fff\\\cccfffRRR___fffaaa[[[hhhfffhhhWWWiiihhhfffhhhdddhhh^^^fffaaaiih|t\.~P..E..:...'.!...........{s]kkk.................vY..2."......~uZ..B.).........{S..5.......6.......nke..Fuo`..:xq^.1...yr]..9....$kif..=...........J..H..@........7.zU..../........7..]..}...........................S........?........................ ...........*....3...}R..q........PKB.....tRNS..(\.........xT-..0...t5...i......AMH..P=.....b..&.........+`....9!...........5..8../..c..o....0#.........^...y....TWo..e....Y.*.y..@l..K..e..........IDATx......A...sy..YR..-|...........

                                                  C:\Program Files\FileZilla FTP Client\resources\default\480x480\folder.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 480 x 480, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):3163
                                                  Entropy (8bit):7.611068614820174
                                                  Encrypted:false
                                                  SSDEEP:48:e22Jfa6yNgTfWEqrV/J1hmdleeeuQ77ekH3pIrgrO126a6vdN4Ppb9ggxz:eVJffyaDWEY71hKaHB3/O06Td4pbSg
                                                  MD5:DAC7322EB12099122145D2431CAF1EF1
                                                  SHA1:30B3CA4F92B659419F544DEE49075E30E584F72F
                                                  SHA-256:4AF5B556C71DDF23E8102E34566A89DDE088A483CDF4BE6A2816A6DCF950BDE0
                                                  SHA-512:0646DF92E04CDA777A2B62FC03EFCA1FE905658FF450C01B2DCF70516D4265FF0E9CD2E35C1FAC4E4292B359DCF5B74C288A99C5F80CD018B8FCC40FD1E58A21
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............J.N.....PLTEGpL.............................................................................................. ...aG.......~......lO...G3......................................................................................................................................................................................................................................................n....................x....*.......{.........b.................}.......a$Y.....tRNS..Fx............n...h$9.....X.N.t....../....Z&..N..+z#T........................pJ..._....W.u........(........=..Z.D...{..g.6.R.7.Ea.E..^.w6.L.c.~:...k>..r0...c.-..v......^IDATx.....P..P..eff.......iA3..........................Q...%.$_(...,x.J.V..7.-.+.;.fK.m..E.[.,..Z.<T.fTn8..s0.j..gsy...f.4x81...0.....DjCa".......N......w.-QKp.?..Gr3T.jOi#7B..Ee...95...[..F.}.um5.>.\.Q.R._UI../........j[~%....q.Op.......j.DpV

                                                  C:\Program Files\FileZilla FTP Client\resources\default\480x480\folderback.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 480 x 480, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):6038
                                                  Entropy (8bit):7.7896870537265865
                                                  Encrypted:false
                                                  SSDEEP:96:bZo41O32DeteIrw1kOs+6QNxmgzWQ1xJVLHGkbvKB0oljHJIt0G+ulcIx/Qn9dna:bC41E2iteIskOsSA2WQ1VLmUCDp6GuWm
                                                  MD5:4FB33DFFF3371B53CF990BF3EF4577C2
                                                  SHA1:B4C0C53C7FA9826C17304D35B043A9A2524996EE
                                                  SHA-256:DE44AF39AAC7131AD05258246552DFC89E1C1634BAABD2989F4CBADA8D67598C
                                                  SHA-512:7272515CDCC85C9F9795C7DC5D74C939735A52599E9B06F9508ABE9E3A4B1A769394195B6788414EEBC6C27DA9CED7D000B11A2F1BF082399ED41BDCFE93FA03
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............J.N.....PLTEGpL.............................................................................odE.....bH.C2..........kM..................................................................................."..?..U..g..y................................... .....4..\............F..u...............=.....O....,..n........~..........1....^..............:...........J..c..`......Q.Q..,.,............,,,............mmm.........NNN..................yyy................@@@.............................................P.P...............J.Jr.r......888....................................K.K%.%.....K.K......>.>_._.................\\\.............................................................................~.......tRNS..Ex..........w..m..%:....V.K.....\/O7...'"..a+..M.V.........................................................................................n.;....S.*.W.$..G..-.D.ew.!|..jU.?..........Z.9

                                                  C:\Program Files\FileZilla FTP Client\resources\default\480x480\folderclosed.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 480 x 480, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):2198
                                                  Entropy (8bit):7.49847240377598
                                                  Encrypted:false
                                                  SSDEEP:48:vYW0f9lBTP1tLezNtahytX6666666666io0xHHHY/Q2sO2iSQbp:veHlTatO0/L2iFp
                                                  MD5:F41DA3306071CEF65632B5591CB57504
                                                  SHA1:FD7F206EE5B191F5BB327BB37FE586D90C1FDFA9
                                                  SHA-256:BF67DEC586E7BADB5C358AC4734CB80C550CF03438EC70C5444068319BCC3753
                                                  SHA-512:2214CF7CFC145504125B2179686F19E861438F94F7EB7D937D943FC682FE7DE0C594F29228E8B988F955507C755B445578D3124B7849CDF7EF7A65782EAFFEBF
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............J.N.... PLTEGpL..............................................#.................................._.......~......pT...E4.........................................................................................................................".........uq.B...`tRNS..Fw............m..%9....X.M...../...W#..N..+."V..........................yE..mz..8L.J_.......e8....IDATx.....l1..P_L.ef...|............................I..E.~Ip.j....y=4[...^....+....[.Ao(x.^[.Qe..<....Q.=...3u...l&x.d...9.?..i.\k"xD..8..z@Rh4j...&5....Oc.q).r.L.Ff9....4>......h.M....PY.-..H-S..=....U...hz..O.2.4j.\.......x.\5..j..r.2..T.B..s.9....sP..c9.N.I[.U..e...]Y.Y.....n5m......F.g;0B...nj;0.`b;0j....4m..ff;0.......p...w......E.T1........VH.....(F.).wS..K.....e`v......^.....^Na...La.....)L`...)L`...)L`..};..l.w2..l.....6.s...6.C...x.E.&....]...wW~Sx.3.CL9g.T%..B......0...el.....M..=N...w..W..|...+b..a.......ca.....W..

                                                  C:\Program Files\FileZilla FTP Client\resources\default\480x480\folderup.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 480 x 480, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):5994
                                                  Entropy (8bit):7.816077503911296
                                                  Encrypted:false
                                                  SSDEEP:96:sBuXU5t3zsDnMTuCtn2AT7EL/++EtvK0dnajrw9HS0b7mYsocn8b/6DLg:sUXU5dYnMTFR2o7wGXda6b7m+cnQ6DLg
                                                  MD5:E562C94006CB02A351754462D36459D3
                                                  SHA1:EE7A05212042A7800AA9D8B20421416D347B2C00
                                                  SHA-256:7F0899F331F7C33A0781BA909F80144BF6A58771C3AD8E2C13185FF372CF780F
                                                  SHA-512:B8E2812FE8DF47E751A6462DF714243C9320BF033A7D04B869456121741A0009B164B836BD1731A47F6BB59782C47AC6F9E4984414E161CA589B655C7C490837
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............J.N.....PLTEGpL..............................................1........................w.........mO.......~......lO...@1.............................................................................C..R..f..y..~..............o..]..M..:..%.....X...........................H..)..................................t.....b..6..................2.......... ......c.......j.}.B..B...|..f..}......222............ccc.........RRR..........C..................................mmm......xxx......................................................BBB.........................................:..,...g.6z...#n.....................................|........................................................I..E..N...................w..V....tRNS..Fx............l..#9...VM.q.../....`*..N..+z"V.............................................................................................9....R.'.Z.$.M.....4..P.n..*..-..~k......r

                                                  C:\Program Files\FileZilla FTP Client\resources\default\480x480\help.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 480 x 480, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):6442
                                                  Entropy (8bit):7.873449497068477
                                                  Encrypted:false
                                                  SSDEEP:96:SkU/zn/0QetYFlGKIvUIme9QW5fLmS/jvaN5ie6oL+4HlJ3fMeYkJEeZyR8lQ3f:mz/btIvU1e9QvS7va316oBFJ36JaCr3f
                                                  MD5:BF8B87517AEF468F43AF11CEDF739078
                                                  SHA1:EE57D75C608A3D214443DB8E9FFC74E7829FC260
                                                  SHA-256:AE4050393D3D0AA4901550538EC3B0D2148F1F5BE462E1FB9BE235A7EF456AF3
                                                  SHA-512:3DBD3AC5FD519D459A425D57177B267E05329CDB749372EC11FEDE66B6E2761063FE08AD9168CEBE8A721BAE2BF3FE799BA8D107330823937544FF660495C1E4
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............J.N.....PLTEGpLhhhgggiiigggggghhhgggfffhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhggggggkkkiiiaaaeeehhhhhhggghhhhhhiiihhhfffhhhhhhggghhhhhhhhhhhhhhhhhhgggiiihhhhhhhhhhhhkkkiiiggghhhhhhhhhhhhfffhhh...hhhhhhhhhdddeee...hhhbbbggg^^^iiihhhfffdddaaa^^^[[[[[[XXXUUUQQQPPPLLLNNNLLLLLLLLLLLLSSS```eeedddLLLOOOfffLLLbbb```LLLUUU___NNNhhhLLLQQQYYYXXXgggIIILLLMMMHHHKKKJJJMMMKKKHHHfffFFFNNNgggLLLKKKKKKKKKUUUNNNKKKeeeKKKJJJccc]]]LLLhhhMMMhhhHHHffffffNNNNNNKKK999...@@@...KKK###......PPP.........777...JJJ...AAA...ccc......---......000HHHhhh333IIIFFF...KKK......ZZZBBBKKK...<<<.........AAAJJJ'''BBBJJJ...ggg'''^^^FFFGGGJJJDDD===...>>>555DDDIII...JJJFFFHHH333@@@KKKeee...999(((...UUU>>>LLLIIIKKKDDD<<<CCCTTT^^^...iiiYYYQQQ^^^cccRRR___PPPUUUYYYbbbXXX___ZZZbbbeeebbbNNNQQQPPP\\\[[[bbb(.......tRNS..&9N`ny.................s;+...Y....P/.4]....f?.K.........#..U.}.....c.).w.............................G....!..R../.w...,...C.Xq..~............f..+......L...u....8..<..C....$.

                                                  C:\Program Files\FileZilla FTP Client\resources\default\480x480\leds.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 479 x 480, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):71300
                                                  Entropy (8bit):7.969395094249343
                                                  Encrypted:false
                                                  SSDEEP:1536:+ugX0gq4ztRfYQc/IRPwaujGXyNyUj4cB7QvivVW6UgXccjyRlw:bgX06zXY+IucGviwoXcjw
                                                  MD5:87363ED4937B5B1633E6C756268A46A6
                                                  SHA1:C4BF71F9307A897FC9B44ED740DBF2797750E90A
                                                  SHA-256:1D6C546397E8EBF71503279D0D8DA8A9343908FEC4B9B1D97926EC5532EFB365
                                                  SHA-512:3BF66CACA161D6AC8ED60236DDB6618B910A485E4DD69797CED2F057792B2757F634606E94C7DFFF28EA26C261E23B3CAD9EA063EB056E648AB9B2CB83C173F9
                                                  Malicious:false
                                                  Preview:.PNG........IHDR..............,g ...KIDATx...s.H.F.......$..l...~....e..u..IZ....8n.C...._.N....rO..L.=.W... ..f+<.....#..B..\.P..|>........|....K...>..]...brZ..5.d.>.z....8..~.}.#.n.....@p..;8..&........G.....x....yop.]....Ba.x..."..@?!...-........b.x.....R..6.{.V....@...... ...8...aE5,......C.C... .........K...B...#......!...\....$y.S..S.n.:p....%4.w.(.w..g.....L...l........<\.n...\D..~.M......A...j.j4h,~.....o....T....9..@......_Q....?..7_..N*........q`.~w<..'..U.F...:.,D,....^..`o#..9.}^.R...W...B.07.T...1....a....g...S._..(.V.!.Klt...pq...hw...-.=b3........\K.}...0T....f.. .........v.-."7A..h..'....].U|Up..<........^.S....y....,..M.......9......n<.o..s;...i..H.h..C|A........`...P..l.m.......w.d......O!]..*...6.!$m..4.=..~....)...]U.<.........'.9.Ia..mk..uf&...`Oe@']f..M....!../...Io...N./...z.....p.B.z ...u..1...+....?.D.?.<.jpB..n.c_...GS..fy...i...L...mBH.-...Y....~0...t.......}.Q.nj5.e5.Q....gT.....}....W..FA...p..W..ND....*.../Mt....Z.

                                                  C:\Program Files\FileZilla FTP Client\resources\default\480x480\localtreeview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 480 x 480, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):3266
                                                  Entropy (8bit):7.328039314567966
                                                  Encrypted:false
                                                  SSDEEP:96:DegD6aa4rCMu38yvE44444N44444444Ya44444l444444444464444444444444w:lLfuePf8T3nX
                                                  MD5:E21443D7CAD7E6927FD6D798A4232BB4
                                                  SHA1:0C4B2F6E709822C59F884F960471009408782D09
                                                  SHA-256:A67AF84C06743847FFC0EDBC79FFC4A3CE93C89FF57C03C0F18C3782B5347988
                                                  SHA-512:052428EDCC9D026EDA6CCB32EA2E7104B68D9D346F016B82AEADE8B7FB191D704E21CEC084721DD35AAEB51BEDB06BABD4097F7F7623E58834805DE2BC3CC47A
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............J.N.....PLTEGpLfffggghhhhhhiiihhhhhhhhhhhhhhhiiiqqqfffggghhhhhhhhhggghhhhhhggghhhjjjccchhhhhhhhhhhhhhhhhhhhhhhh...hhhgggggghhhiiihhhhhhiiihhh]]]fffhhhggggggmmmiiihhhfffiiixxx......yyynnn|||...rrr~~~wwwkkkjjjttt...iiikkk................sss.....................................................iiihhh....ppp.........mmmlll{{{......hhhooo...gggggg........qqqiiihhh........gggzzz........hhh..............hhh......................................................................................................}}},.,.....................................................<<<..................hhh..........................................................""".........GGG......]]]......BBB.................lll........................eee...............................tRNS..Ex.......D..m..l9.;..:......L...............JO...7...........................................k...............Cy....w.................................................................wU..

                                                  C:\Program Files\FileZilla FTP Client\resources\default\480x480\lock.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 480 x 480, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):5407
                                                  Entropy (8bit):7.81091631819485
                                                  Encrypted:false
                                                  SSDEEP:96:v6YS0SkXlJsggePtQOC8UokUWrXLoaUIf4Th2KO3vY4444444444044444436Ak:bS0SkXnsutQMUofWr/UIf61xAk
                                                  MD5:D4A4969B85930B19AE2790ED9BB70168
                                                  SHA1:B7AE0D6A15CFD5A091F5D12939AE66105325AD35
                                                  SHA-256:69A41DCFA17370F4DD0E6FA74943FA674DA8D860AEB35F3208AF21849AD314A7
                                                  SHA-512:6D8B27A9030E9EAC7CFD288B3CC6535113B269A79B91038C9598646918ED16191AB5A1AEAF895F6FA9EC15DB3BB96BFB93754A0C9858C2BA8F2E6F7B2DD3DE3C
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............J.N.....PLTEGpLfffhhhiiiiiiggghhhhhhhhhhhhhhhhhhhhhhhhhhhhhhggg...mmmggghhhhhhhhhhhhhhhgggggghhhhhhggghhhkkk...hhhhhhgggfffggghhhhhhggghhhhhhhhhfffhhhiiihhh"""gggggghhhhhhhhhhhhhhhfffiiigggfffhhhggghhhhhhhhhfffgggdddaaa^^^[[[YYYTTTKKK>>>;;;+++ddd___WWW111...^^^QQQddd[[[HHH...fff```RRR...fffOOOFFFWWW[[[CCC...)))...hhh............YYY...]]]...bbb555...eee...bbbddd...eee...cccggg.........UUUaaafff...................................................................................................................................."..*.v5se=j_AbZDXTHPNJUQH`XDf\Aoa=.n4.}+.."...........&.r5WSHLLLSPI.z-........[UEMML.......~+......,.t0...x.. ..~l;xf;...}1...m:\VF.~*.......................@0.....fK....}..................k^....tRNS..3Tv........fC"..;....M...^.+. ....c...p..?...-'./...E..Y..Ii.H....n]I84*..k-..W.|F..Z .RBex=.'......r....0.......$.7...`.|.Dw...........wC.m....k:..9....L.L......JO7y..........................

                                                  C:\Program Files\FileZilla FTP Client\resources\default\480x480\logview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 480 x 480, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):4550
                                                  Entropy (8bit):7.7815610387333285
                                                  Encrypted:false
                                                  SSDEEP:96:lfOgGHniynLAQ8t/jUV3RHH7CO9J0iP1kYK2Cd5:lfoPnOjURRHHFqIGYKhd5
                                                  MD5:A5C2E72F7C61158A6E17AEA666DE99FD
                                                  SHA1:83F0E6816C8735AC340335209D6C02916F4C019C
                                                  SHA-256:9BF88F5A0F4DEB7035CFD2930225596B4E0767010D34F01C3EE093C17164033F
                                                  SHA-512:712A0E1A5D098BE686F2A897A12F8A41D8B2254D30F2539094A6FC8E334238AAEBA16562E2BC8DAB81CBB31FC8858B936E134D5EF6479170FD2ECF10AF75F61C
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............J.N.....PLTEGpL..............................................................................................................................................................................<<<.........hhh......................................"""...GGG...]]]......BBB...............jjj......lll.......eee...............................................................2..3.....@.@A.A.......}.z.........-.-.....a..l.l}..}........1.....?.?.............=.=........u..x..~.~..K..W.W-..;.; ~.!..0.01.1y........4..B.B....|..~.....J..V.V...sssjjjhhh.............vvv.......iii.....................uuu..........ttt......................rrr...kkk...........www.......................v..H......~..|........T.T<.</./,.,............K......wtRNS..Ex.......m..9.;.....L...........J.7..y...............U...".y.,.O..:L...a......$.)..#...Y]$..-.M.+z.V................@=.}....IDATx^..JC..D...M.D.4..TDal.vA........Znkau.._8..

                                                  C:\Program Files\FileZilla FTP Client\resources\default\480x480\processqueue.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 480 x 480, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):7566
                                                  Entropy (8bit):7.752987987439076
                                                  Encrypted:false
                                                  SSDEEP:192:3m3p04ei2gMITCePAnPEjklUWUunlLAV/tnT6:W3nuITCjnMoDnlL2tn2
                                                  MD5:DC267D9678AFF17E9A8A557F0C9E690F
                                                  SHA1:A6AEE93AB4C750B297B1B3995924B383B9BE7875
                                                  SHA-256:930281B5E99BCF3C891B48A2830F5BCFD19D2AB03F9A2CFFC2594016233CCD14
                                                  SHA-512:B918863336196EB55584655D44AC328CFBCB08BD8C8E3B8896567A91791F746329B7832CDAC81A996EEBFC81C35208D408CB126D518C766D15AAAAC1384AF503
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............J.N.....PLTEGpL,.,+.+'.'.|..|..|.,.,,.,,.,,.,+.+$.$.r..........hhhKKKDDDlllhhh[[[LLLKKK*.*...kkkhhhhhhLLLLLLLLLhhhLLLLLLhhh+.+-.--.-+.+#.#......+.++.+...hhhiiihhhAAA,,,***KKK---JJJKKK.y.fffggggggKKKJJJDDD....v.gggggg___hhhgggJJJFFFiiiggghhhKKKCCC###hhhgggIII555hhh>>>...).)eeehhhhhh...%.%999...hhhIII;;;aaaLLLELTLLLKKK.........hhhgggZZZDDDIIILLLLLLiiiKKK...hhhIII...eeebbb^^^[[[XXXQQQ???AAABBBFFFSSSddd\\\???GGGKKKhhh222...LLL..#...777ccchhhhhh...KKK...(.(+.+ . hhh???%.%'.'%.%iii...JJJ%.%aaahhhOOOdddaaa>>>LLL@@@'''ccc@@@>>>```.........RRRKKKMMM...!.!ccc#.#KKK...555iiiJJJ&.&+.+$.$#.#...LLLKKKhhhWWW[[[ZZZhhhhhhggg...___.`..a..f..u..f..I..e..f..u..|..r..f..d.hhhJJJ.e..;mhhhKKK.H..K..f..b.KKKKKKhhh.s..y..s.iiifff000hhh@@@hhh;;;LLL.a..|..|..l..~.ggg.r..}..u..n..|.....|..w........tRNS.F......................f....\..M....<D..W.._..Y..v'4.7.H.8....:..P....3...-n.D.^.d....oO..V..+.#......>..6f......vm[fp{.D.i../!.$.J.(z(....w.9...a...n.S..c.g*.na....`p..u.e..+

                                                  C:\Program Files\FileZilla FTP Client\resources\default\480x480\queueview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 480 x 480, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):2303
                                                  Entropy (8bit):7.2593892345533515
                                                  Encrypted:false
                                                  SSDEEP:48:Tar4QgSavDfX6EAl8c2TfYgC9BN88J86qb37oX6C/WhmOAhO7ZS:TlQIvTzA+H7W9zFqT7oKC/POAhQS
                                                  MD5:247CC463EC1C836C2388317B8C5FD91B
                                                  SHA1:28E00529F0A265CE1EE9CF0D346BDE59A8AC695C
                                                  SHA-256:444B408A816C39E965A7C960C44C8976ED99B1EF3263088B41B6A170F3747D9C
                                                  SHA-512:8BB9472A75B0F9671CEE6DE747F346A7F56D497C9CB42CCD60F61724BB8FFC8BA733E395A79E0AF2984291A9E2F92FBD3BD23A49E6DB4130220DD90EFAF2CFCA
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............J.N.....PLTEGpL%.%...+.+-.-$.$&.&,.,,.,%.%,.,%.%...+.+(.(%.%+.+-.-(.((.((.(*.*,.,,.,-.-+.+...+.+"."......,.,,.,"."............,.,).)).)).)).)).)+.+!.!#.#$.$...*.*..."."..."."...#.#+.+%.%...,.,$.$$.$,.,...%.%,., . 0.0.}..f..|..|.....f..f..|..f.....z..c..|..v..v..\..a..b..l..X...........YtRNS.v.v............U...b......L....R...........N..R.SSSS....M.M@@.....77..........w}...}@@........JIDATx....,.....O...{.Eqn.=g\. .,nX..wwG7......'.C...`..'.F.g.E..gg.r.......)..0`.=...&..0`.....&..p.`...&..pC`...&...0`...&...0`..7.&..0`........:._...J=..(.\...J=.R..z.`......L8..0`.....&..pg`...&...0`..w.&..0`....&..pk`...&...0`...O.._..........".S'.O....k..P.y.....W.&..pg`......L.p.0`....... ...I...L.p.0`....... ..0..a........L.p.0`......&.8@.0a.........*.8@.0a........N... |....z.}..`.Mm.0.@.1.0.D.).8.w.......z....s|..vS.p......;..g.Na...S.p......;..g.Na...S.p......;..g.Na...S.p......;..g.Na...S.p......;..G.Na...S......1..>.`....m..'.

                                                  C:\Program Files\FileZilla FTP Client\resources\default\480x480\reconnect.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 480 x 480, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):3766
                                                  Entropy (8bit):7.668064468145603
                                                  Encrypted:false
                                                  SSDEEP:96:yABVE4ZAOL7HOxM++++++++AfcNIHSX1KWRhBIPpQ:yAfE4ZAK7HOzSX/hB
                                                  MD5:C19505C35182FBC2D2C81ED60E62926B
                                                  SHA1:D415F48879875F94CBE9DD7FDB7A7DADE6603EB1
                                                  SHA-256:981892D7FD00D58C2ED41E33BFE1CC35FDA8F66D3EA1A533063CBA3058331683
                                                  SHA-512:8125BC3C108BF846BE6AA38FBAC89E0683FD784A239858FA23E71E533944521410EF925525CC3FE32BFFC28D2DE47353555FD727D69E7408EB7CE10D65A664D1
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............J.N....CPLTEGpL...........................................................................................................................N../.. ...|.G...f..h.)q.D..u...................6..-t.......g.w..j..^....{..*r....F...i.......0....%.%&.&).)$.$'.'&.&$.$%.%%.%$.$$.$%.%#.#%.%$.$%.%%.%$.$%.%......!.!$.$%.%...!.!.3...."."#.#$.$.......~........p.pf.fR.RZ.Z.......<.<,.,y.y...7.7...}.}...E.E.....u...................................jjjhhhLLLNNN........{{{aaa.........xxx]]]7.7...mmmRRROOO8.8.................a.a..h.hQ.Qg.g|||SSS...9.9I.I...`.`@.@j.jm.m7L7S.Se.ey.y.G.X....tRNS..Q.........L..vs..P.......<:.................................................$...z...._H...ToM......#j...!.C.....................?......................................................%..i.y.....aIDATx...S.4W...}.m>.~.{..[l'.F.VWE.O.@..F.K|.|+.a(g...X.o.([M.H..53.m........B.,w..f'B.?....95_.....l.-'.<...........S..........'...[1..hr.^^.....3.g1..O.....M.

                                                  C:\Program Files\FileZilla FTP Client\resources\default\480x480\refresh.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 480 x 480, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):9002
                                                  Entropy (8bit):7.90499917866584
                                                  Encrypted:false
                                                  SSDEEP:192:85bym70BSUT65YNWN4LgwR8QOl6xjOyJ0Bpz0Q34IvCZSS0OlApz:85bH7yT65IiCclKOBR0QIK/SnlO
                                                  MD5:F95D73543381834FD6AAD987DF30F157
                                                  SHA1:29B81A5613C3A7B73260F2579B23B1CDAFFE4FC9
                                                  SHA-256:E72E2057AFE1C9C449C2F43A83129DC24D4349E34F40CE957B56F7F87ABA927A
                                                  SHA-512:095924C202A73FF4D91668AD9FF6EFEC9D5F12D410487669AC2518D7CAEB12651284D051BA8AFD692BF0E0CB059C70BBC590D265B38FA1243242385E50262B0D
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............J.N.....PLTEGpL.t..u..w..|..|..|..|..{..|..}..|..|..|..|..{..|..{..|..|..|..{..z..{.....|..|..|..|..{..y..}..z..|..r..|..|..|..|..s..|..|..|..}..y..}..|..U..f..f..i..f..h..f..f..c..f.....f..m..h..e..f..f..e..f..d.....l.....c..f..c..k..z..y..x..y..v..s..f..p..n..l..i..f..j..r..c..b..a..]..X..P..M..>m..0._..*K.......Cu.Z..s.....E|.x..V..v..T..l..s..M..^..4^.u...........................................,.,-.-...%.%%.%%.%*.*&.&*.*'.'%.%+.+&.&).)'.'+.++.+%.%,.,+.+'.'+.+$.$,.,+.+%.%%.%,.,%.%).)%.%'.'&.&,.,'.',.,,.,#.#%.%%.%'.'+.+%.%,.,,.,-.-%.%,.,%.%+.+,.,).)%.%'.''.'%.%%.%+.+*.*%.%,.,...%.%(.("."....K.$.$,.,*.*$.$&.&...*.*%.%$.$&.&%.%+.+.j.%.%).)&.&&.&.!.+.++.+).)&.&....y.*.*...#.#.Z.&.& . *.*.4..t.%.%,.,$.$).) . *.*).),.,%.%+.+*.*,.,%.% . ......"."..."." . ...x....tRNS..&7F^m...........xaN .......,.2V.=s......g.....o...........D.O........Xz...........f......sYH3!.'..8...?.N.ev.D......................... ..&.-.....5.I..T..e.t..........vi..X..G@l.........W?'

                                                  C:\Program Files\FileZilla FTP Client\resources\default\480x480\remotetreeview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 480 x 480, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):2426
                                                  Entropy (8bit):7.173475038176575
                                                  Encrypted:false
                                                  SSDEEP:48:Vb6fcRyyUTT1nf3UeGj5nMoMwW/ZVUHBYIYo2hBo:CGuT1nlY5nMfhuHxVK6
                                                  MD5:3DAED236D7DF410FF02684080378572D
                                                  SHA1:B7427A30E75C4AAD0A8B031BBEEB16E57BA7B8B4
                                                  SHA-256:75A915C0CAF149C46DF534577F1FB089FAC8CF0EFDA8FBE6115B5118942391E5
                                                  SHA-512:2A4C7659795B6C497AE657CF287DC8580769E3D7A91C130F0E559F45C1E55E60324E80C4C2B0C2722E7BD0158D8779151B0A80177EEEA5BABFE277FE9870B55D
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............J.N....&PLTEGpL)))ggghhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhggg+++ggggggiiiyyy......lll|||qqq~~~ttt.................................................................................|.............................................9<@.............Y`f..............................."........}.....btRNS..Dx.......l.9..L....................................................x.GU."..ly.+...8O.L._........'(....IDATx.....0.D.%.&..k...I.............................n..F....wmSW.H...(.8OI.-.h.j\....F..E..(^...>.....8N#...mU6..nJ..H.tK5..t....`..N#.S..F@..J...tMk.....j.....L`...k..q.@....+.Y^.23..b......l}G. .7..s=?xD..v..B.....q...~....%...8AC.#..f..'.v..:.V......`...... GM...F.....h....l.P.....!2....w..bM.dH..z...5..z=.....Yg..C.t.Q8lS^;D^$)....@.......dP_...T4BN..!r..a*.:....bLF.]T.T.........;_S..&*.M.62bI.92.%.Nw]y.....@.y....c..2......F....*nI.%R.....JRu......AAB.y...q.H..3.fHPt...@.q>*n@..RR..............P...n..

                                                  C:\Program Files\FileZilla FTP Client\resources\default\480x480\server.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 480 x 480, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):2466
                                                  Entropy (8bit):7.092284993226423
                                                  Encrypted:false
                                                  SSDEEP:24:5RzIW1ACCU3KfoR7hLRBw47hHLHvZAU8fLoa+C0VEULkq1J95e4+zY2ZFBVDOofS:RUyRrHxAU8fcHVTF9izlZEogy70Eu6Cj
                                                  MD5:7560335F2F31BF8300AFC5A0BDBFC3CE
                                                  SHA1:B80FBF9440699B2B22F27C0368DAE86F9D6A770A
                                                  SHA-256:B4C90CB537691557A35824C335B4A41E1B877A81C748CD0F9E9180A25A8BE94F
                                                  SHA-512:43AA887B9CF2AB4C5B6C4BA5F2940C6048037EDCC279BD70EACB582401F9E386AF8365712267EF3E0757A07D185C881C135419244862BE3CB66E37D6D5B2318B
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............J.N....}PLTEGpLggghhhhhhhhhhhhLLL<s.fffKKKMMMhhhIIIaaahhhLLLPPPhhh???hhhLLL666LLLFFFhhhJJJ...hhhLLL.p.........................DDD...HHH111ggghhhggg___```dddRRRGGG....|.EEELLL<q.dddKKK.s.hhhLLL......%.%VVV...........ppp|||...,.,KNKgjg......F[F,.,`w`...........%.%kkk...............R.R>s>CeCY.YK.K5.5...OOO...:~:'.'...Br.3.3).);.;&.&......A.AN.N___?n?vvv<y<7.7,.,6.6.|.E.Ecpc:.:ITIF.FH.HF.F).).@.....:tRNS.$y......w"..L..S_V@9..ll..............!.>...............[.S....IDATx^..gw.U...$...\. .J.{l8.....$...Q.....z....0.;w...|..........6.Ei..Q...~...y7G.......u[."p.....:.4..lGA..m......1..8~..{......]....6....!Ea..9.V...:p.Wp..^.{B...p.....0`.......0`.......0`.......0`......Uie.=.. 5......p...e...B........+`Y..?......p...+..?.........p....0...^.2.X..5..k.......cU...k.}4a`....g7U.Z7.$.....f...;.$0...m"......^.n6.....?.n>...._n......||.....&...\k.?I.....~..0.K..|=l`..............<{...o.$..8z.......?.|.......~j>..89`..w..|m&A`...4...q......

                                                  C:\Program Files\FileZilla FTP Client\resources\default\480x480\showhidden.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 480 x 480, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):7759
                                                  Entropy (8bit):7.88490309976475
                                                  Encrypted:false
                                                  SSDEEP:192:zeiOHPJ8NiNzLyGCY4WQfIKbQZc3m4rLhaW:10xZ4WYIAV3trLh9
                                                  MD5:BA100276E608AFDADD0DFC761506145E
                                                  SHA1:251396BB432C8FDBF28715F059BB83B1580ECD3B
                                                  SHA-256:151ADA50A20E640A599481D440A048C769E0EE10F6FCA3851B143E0027C0ED76
                                                  SHA-512:400E2EB545EC1FFB813C233E4404D36847152D1A14FD0BD6485478519FFF787536FB6AF2993380F377F4F82C04819189D7A7AB361ECB345F1119E00EEC96C367
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............J.N.....PLTEGpL.................................................................................................................................................................................................................................................u.uh.hb.b[.[`.`n.n..................J.J1.1,.,%.%(.(C.Cg.g...........-.-......O.O..=.=:.:A.A....Z.ZV.V.....2.2z.zw.w...............7.7...n.n7.7.....-.-/./2.24.4*.*'.'&.&B.BJ.JS.SZ.Z`v`dodhhhLLLKOKHWHCdC=r=9~94.4-.-=.=fjf0.07.7X.X:.:?p?,.,E^EM.MKLKbrb......G.G...sssE.E\{\WWW.....mmm.........A.A.....................pppm.m...999).).........AiA..................{{{...???............1.1...<w<..._w_.................'''........................TTTjjj........................................}....tRNS...5I]v.........."Bg.....)T..............o.N../d=...................9...z.X............................................................................................................

                                                  C:\Program Files\FileZilla FTP Client\resources\default\480x480\sitemanager.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 480 x 480, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):3100
                                                  Entropy (8bit):7.3519707048561695
                                                  Encrypted:false
                                                  SSDEEP:96:PRgWuLcX8CGm0eNxv/PLVj9EyEmDffJ07:PLu2zd0eNFfEyEcx07
                                                  MD5:810967A850E0F96F44874651F649A952
                                                  SHA1:DD51AF31B2883DD27F3BA2EA4B8E572E1340261B
                                                  SHA-256:66D6C15DD8E819E7B62D277AA237FF77C8C595F65582A368CBBC15427F82BFD2
                                                  SHA-512:48595FB92E30AD7FFEE8237A37CB6C2F6A1603DE8EAE73DA8529D828888759DA3F74B0CC56D8E6A787F25749E5AF74EA07DE698E6178A6175B25B530D9F5D0F3
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............J.N....1PLTEGpL.............................................ddd..................'..7...........!!!............$$$...... ....................................................III......U.......................(..b``&.& +++...hhh...'''+.+......### $$$dddaaa...aaa$$$....,.,......hhhLLL.........lll.f.....|.........,s....a.....I..A........H..2..)q....?.....M..................MMM................nnn.........zzz.........`......~.kkk...............mmm.h.+r./.....uuuU....@...._..V.....1.......!...i.-s....X....iiipppTTT...0...........3..W............yyy....%O....XtRNS..Z.....Y".."..!.X......k.....9.........Yhj.....7.!.88..d...i.....................!8...%...BIDATx^..w.Tu.......*.v.YX..Q.F..h.o..wf;.w...{.:7.<.d..m.p..'.....Ov'SNnc*.9'....)..?.[..._...gB..[N9U.2PW...Z..yw.P..5/W.....0.t5'...N.......g.hF..,E..4.t.../....\.......`....`....`.......0....0....0....0....0....0....0.....yab.986.....'..,k.<g..O....\.dV.....l.. .<.Tm.'..Q.

                                                  C:\Program Files\FileZilla FTP Client\resources\default\480x480\sort_down_dark.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 480 x 480, 4-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1325
                                                  Entropy (8bit):6.797313860142275
                                                  Encrypted:false
                                                  SSDEEP:12:6v/70tKsGjoBOgO0L9hXhXISdkokGDJYU3TxVKnF0Z4rGsB3933pQKDe0Fye8/X2:hKwBpZuckirvKFAvsJQv0FyeYX2
                                                  MD5:BE55E6AFDA1D005973DBB0AA2709D20B
                                                  SHA1:13BE53066DFA5B044A8305BF9BD5B26F5C8EF18B
                                                  SHA-256:89D40A49886980D7F405B10C27BFAD5FB5980C3FD71C471CC40F391889E6E381
                                                  SHA-512:C68D169EE1A53F5CBF690E1386B15AD470CB87401A99FEB6647A64C3146A91B39A74BC86834374B9ED69F693A3042CA17C92509D0AB6F8804C06A3359FCCCE73
                                                  Malicious:false
                                                  Preview:.PNG........IHDR....................'PLTE...NNNMMMMMMJJJGGG......JJJ...GGGIIIEEEX.]^....tRNS...........~.(T.>....IDATx......... ..6.T1............................%...*.stP.@.E10hX'|.._..:..9h...e/V....b.s.0...t.[UQ2..(..VU..s.*J.9Y.%.\...`NVE.0......UQ...(..dU..s.*J.9Y.%.\...`NVE.0......UQ...(..dU..s.*J.9Y.%.tU...75.*Ey...\.......d.[UQ:..(..VU..s.*..*..*..*..*..*..*J..T1J..WE...*F....(.bX.(.b_.._...._..a...uU...}.s~..|..hg.. .`..2..tP.P.@Qt..q.....k................."v.9S..<g..c..."v.......8F..Eb.n..p.......$F..1....F..1b...;p..c..."v.......8@..J.p...........x>.z.&....8...5`'..;q..c.N\.v......8...5`'..;q..c.N\.v......8...5`'..;q..c.N\.v......8...5`'..;q..c.N\.v......8...5`'..;q..c.N\.v......8...5`'..;q..c.N\.v...........5`'..;q..c.N\.v......8...-`'..;q..c.N..v.......8...-`'..;q..[.N|.......>-.!.w\?...)......E..1b.n.;p..[...#v.......E..1b.n.;p..[...#v.......E..1b...;p...... v...}b.....[...#v.......E..1b.n.;p..[...#v.......E..1b.n.;p..[.

                                                  C:\Program Files\FileZilla FTP Client\resources\default\480x480\sort_down_light.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 480 x 480, 4-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1325
                                                  Entropy (8bit):6.845783965852488
                                                  Encrypted:false
                                                  SSDEEP:24:3RFBPyggt/pmBe3oH8UU/vlUiYo15YewBN:3FygS/pmA4cUUlUiYo15MBN
                                                  MD5:06AEA9DB718477BDD66BCDA4302CE28A
                                                  SHA1:1CE1ECB4320C235E2B6216C1C7C1A03B8B3D9EEB
                                                  SHA-256:9F5F8BCE887033CBBA6E8E94EBE06452FE25610835CF47D04BE2FCD32BF88936
                                                  SHA-512:097DCE54EEBECC1ACC0DC69B0A8BB5D34B3408CD47D1DC9CC0549ECFE0472F2B80CCBA906886E6EC26B10E3989E014C76DD4443C48653ECD800B15DA437A577B
                                                  Malicious:false
                                                  Preview:.PNG........IHDR....................$PLTE..................................../..C....tRNS...........~Y......IDATx......... ..6.T1............................%...*.........A..P.........B@o.L.l...s.0}U..c...S:L_.(.......WEJ..2...U..`..NI0}U.....S.L_.(.&....bP.).&....bP.).&....bP.).&....bP.).&....bP.).&....bP.).....w...."....|.R.LY.(...S.L^.(..j).&....b_...b^.(..j)...P..}.R..y.......d..*@./.UK...U.._..].....W-%..W.J~..ZJw1....b_....M"..(.~.`h). 6b.W.`l.va.6h..a........:.......w$v..."1..]$.....$..(1.7..8J..Mb....p......\$&. 1....8G..5b...;p..[...#v.......E..-b...O'>.x.._{p......I|.....8...5`'..;q..c.N\.v......8...5`'..;q..c.N\.v......8...5`'..;q..c.N\.v......8...5`'..;q..c.N\.v......8...5`'..;q..c.N\.v......8....` n..q.....@....&0.G......Q` n..q.....@....&0.G......Q` n..q.....@....&0.G......Q` n..q.....@.....s.g~..{=.x.qA.` ...q.....@....&0.G......Q` n..q.....@....&0.G......Q` n..q.....@....>0.........|.....@...........M` ...q.....@....(0.7..8...M` ...q.....@....(0.

                                                  C:\Program Files\FileZilla FTP Client\resources\default\480x480\sort_up_dark.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 480 x 480, 4-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1418
                                                  Entropy (8bit):6.977739851393717
                                                  Encrypted:false
                                                  SSDEEP:24:HGNmkPU/il6Rl7MUBuNEEZxNBqorhrWSkx/iLZt44Eb9FaaaatqnB8T:mUoUTAx7RrhqPwvqJqnB8T
                                                  MD5:083ED0AC0DB9F49D3EA62444670AF4CA
                                                  SHA1:CBC2E2AEC0534A27F8A5D9ED3D2E9C6B4CE9586B
                                                  SHA-256:E0B212D8EEA521F1B08F8192A21D2DC00EE192BEDE1404859820B40532BDDED9
                                                  SHA-512:90BE43119CC4EB45429A672642EA75A07C1BF92A0CCD21F130149C2C95200675864D96849E34C3F672D38D98417D39829C32D30655BFF5A1A62D8D412399A0FF
                                                  Malicious:false
                                                  Preview:.PNG........IHDR....................-PLTE...NNNMMMMMMJJJEEEFFF......IIIGGG...MMMGGGJJJ.).z....tRNS.........~..w...p.S....IDATx......... ..6D............................@G...0.E1..C..C~..O..BtGa...,..s...Y0.`M1..b.5..K........#.`.$....$..%.'.F,.8I0b..I..K0N..X.q.`...I.QK0&.F-..$...c.`...I.QK0&.F-..$...c.`...I.QK0&.F-..?......1.....1U.R.x...a.pSb!_p(.{1....`.8.c.=.,..xq...C._........^...b,..k......Zp/.{.....^....=..s......Zp/.{.....^...b,..k......Zp/.{.....^...b,..k......Zp/.{.....^...b,..k......Zp/.{.....`.8....8..O.8.obq.....l..`.8...!.-..fq.F.C.Y.....,..`.8.{.1.+..Zq...Zp/.{.....^...b,..k......Z..K.._n..6. .....r...;c.. ..P..../1.((.B...q...*....+M.....8M.....8M........=q....=q....=q....=q.....)q....=q....=q....=q....=q....=q....=q....=q....=q....=q....=q....=q....=q....=q....=q....=q...{.>....}`O\.....M.=q.....=....{`O....u`O.......=q...{."....}`O......H.[..8F.c......?6.4.>@...1.>@..~+b.|....F..x...+b.<...1.>@<....?#.`@.....0 .............

                                                  C:\Program Files\FileZilla FTP Client\resources\default\480x480\sort_up_light.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 480 x 480, 4-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1408
                                                  Entropy (8bit):6.9584684581679435
                                                  Encrypted:false
                                                  SSDEEP:24:ZU/5cTjcKhnT9lKZ5KjWO3o5kiz735kOnP65POPzWi5U77////chqEqXo:ZUKTJRTY1O3WkQpkOP65POP6SVqXo
                                                  MD5:10AD50B05A6AB28861B99529A9863DA9
                                                  SHA1:C8B86B8B3BE4721128CC35299BFDD60E75C2058A
                                                  SHA-256:6322EF3887B166933AD21A5B69C54F4F1C02D822C047DE51A2AA7FF89F73A5ED
                                                  SHA-512:0D2C96F3BF149E2B8C47A2C006BBAE6A0443E8958C433045F444B254B16E49951717E3CCC8ADE580C0E4176C1A496C1147B0BA0879DC22F5FB5DADE09C3AC55F
                                                  Malicious:false
                                                  Preview:.PNG........IHDR....................*PLTE.............................................7....tRNS.........~..w.D..q....IDATx......... ..6D............................@G...0.E1..C.....O..BtGa.q.V..^\..U.l)&.bI0.`.%..[.)v.#.`...H.QK0".F-..$...#.`...H.QK0".F-..$...c.`.%....,..$.g..$.8K0&..Y.1I0...I.q.`L....c.`.%...`A.::.....(F.K.9t..9..Ma'X........~._........^...b-..c..X.6.C0Z........`.8...).,..@q...C0P.....L..`.8...!.,..dq.6.C0Y.....L..`.8...!.,..dq...C._........`....b?8....X...Xp/.{1....^...b-..c..X...Xp/6.C1........C....!x..C.F..`.8...!.,..hq.6.C0Z.....L..`.8...1.+..\q..sp/.{1....^...b-..c..X...Xp/.....1..Q.E.I[.#.Yb.tb....-='.`.H...;.=......... ...^....c.....S.=b..c.....c.....c.....c.........8......8......8......8......8......8......8......8......8...............c.....c.....c.....c.....c.....c......=.'..{.*.'..mb........=p...{.>.'..{b..$.............=.'..{.>.'..Eb.."..1b..#...^ .z...............................b..@<..../..0 .............b..@<..../..0 .......

                                                  C:\Program Files\FileZilla FTP Client\resources\default\480x480\speedlimits.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 480 x 480, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):12683
                                                  Entropy (8bit):7.948673837999981
                                                  Encrypted:false
                                                  SSDEEP:384:NoiX5CPW14wKRwtl3u4sYOvWPTH3JUECe:NBpCu1VVXAWPTH3iZe
                                                  MD5:B5AA21C3F5D77D5D55982FED0F46E12E
                                                  SHA1:D0540523E377726B1A936980A2EE968D8FD63DE2
                                                  SHA-256:D42AAD945404D1A5F66A168F6AF3A89D34BE856FCA13911EE0A5D3DA8AB7B084
                                                  SHA-512:39641960860C6628B0CBE68FB66C1A2294F66F19D019D37B3385BD95190D1A636E39848FD0B1394A671CB04F5CED1A1D4F16F76A0DD0E40CC8948D521E7170C7
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............J.N.....PLTEGpLggghhhggggggggggggggghhhggggggfffhhhhhhggghhhhhhhhhhhhhhhgggfffggghhhggggggjjjhhhhhhhhhhhhhhhhhhiiiiiihhh###!!!ooo{{{....................................mmm................................................ttt............qrq......lll....................www.........................i.iU.UG.G7.7,.,..N.N...w.w......B.Bo.o.........2.2d.d..............<.<...bbb.......\.\TTT@@@...---......ccc...[[[......___......]]]^^^PPP___...TTTLLL...XXX...MMM......LLL.._. &.jn.tw..QQQ.....\\\......KKK....\\\....$*..,2....6;....EJ...._d...z.c.15/./.HK.>C...eeeF.Fs^_. &.W[5.5[~[...9.9TTT.y|ataO.O...>.>..!....KP..$.......WWW.....#...k.k....14wGIfff......no.14777DDD.HKIII:::.JMEEEJJJLLL???FFFLLLLLL...IIIKKKHHH===BBBHHH.IIIHHHHHHKKK.........b....tRNS...2?Uf.............o\M(.F......y"...............................................................................................^:./....t.&.....S.....................................

                                                  C:\Program Files\FileZilla FTP Client\resources\default\480x480\symlink.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 480 x 480, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):2681
                                                  Entropy (8bit):7.553016497296657
                                                  Encrypted:false
                                                  SSDEEP:48:f+pztxMclZZjWA44e2Oa28uocUvJeQ2BAD2HCt8uHyqLROw44caJnwYlNOvS/44D:f6blZZjv443Oz8bnRByTecKL72S/444a
                                                  MD5:8EF619E2FD6613D80CD761C5FAB62092
                                                  SHA1:6C3CA15E4D9026643E4A9958BDE6173EDEF3E69D
                                                  SHA-256:18E3E7D585191AAAAD145740530D6941C07A8F9ECFE2177C6782969E3532BFCC
                                                  SHA-512:66149A4FB6A06B237A41FF53FE85CB2A20F5AC3E39A16173B3986F8170DCFEB65EEAE7146BF5B876661F89BEE863E0E0DFCD002AE90C6302E1AAFD51AFAB70BC
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............J.N.....PLTEGpL............hhhLLL...............mmm...jjj...iii|||~~~...zzzMMMnnnggg...}}}vvvkkkPPPRRR...{{{ttt...pppxxx...........VVV........oooZZZ...qqq...\\\yyyrrr...eee...............QQQ.............lll...sss......www.........[[[...........................uuuSSS.........ccc..................]]]....................fff...___........................NNN...YYY.......................TTT................UUU........OOO..........WWW............................XXX..f....tRNS..eT.J3...PIDATx^..1..... .....X..................................................................................................p......`.$......Z........,X.`.....,8@p........,X.`.....,8@p........,X.`.....,8@p....%X.`.....,X.`.../ 8@p..}.....,X.`.....,X.`.....,X.`.....,X.`...?.......bX.\LE.....Ca...}]..\.a&..|m...._.f^p..0......\.?.......~....a.....3/.`..y.........f^p..0......\.?....a....?.-...........f^p..0......\.?....a.....3/.`..y.........f^p..0......\.?....a~.

                                                  C:\Program Files\FileZilla FTP Client\resources\default\480x480\synchronize.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 480 x 480, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):6803
                                                  Entropy (8bit):7.81150566445154
                                                  Encrypted:false
                                                  SSDEEP:96:tpuNoMaJduiX/6x2XQBitWxcy91QIKk+04DCAdsSRheyDaqYauWfliqAVAxmrdAW:mqJdNciQYI/4DCAdshWYctiRA6AeKU
                                                  MD5:3CE9C623FF201DA78CE5462EDCEEEB57
                                                  SHA1:2DB3F189CF2CEF4538E44FEB3E26B5F8F5B16CE6
                                                  SHA-256:0FFFCF51EC568BEF40C6EB3A471CC9E63899BB4CFB42B70F40207F819AA826F5
                                                  SHA-512:D775CF8C77A77D2F74338E74C86BDAF336BFF50BB7750925102806987A2C8D59986DD0E74CC23E104E77D62B29D91478756FBB4FF1C882E36B3ED480D88F9748
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............J.N.....PLTEGpL...........................................................................................%.'p'.......!.............,.,,.,,.,+.+,.,+.++.++.++.++.+,.,).)+.+,.,,.,+.+,.,+.+,.,+.+,.,+.++.+,.,,.,,.,,.,+.+........\.\.....N.N...+.+..1.1o.oA.A...,.,v.v...8.8..,.,.......>.>..+.+e.e,.,......V.V{.{%.%<.<^.^-.-I.I.....*.*(.('.'%.%%.%%.%%.%%.%&.&&.&#.#$.$#.#"."$.$%.%!.!.......=..g. . '.').).......s.(.(...!.!. .%.%'.').).P.......#.#.p."."..........oT...........................................................|.....^.A0....p.................................j.................U>......................>..D..............-.....N..b........o...........O..........U..8..!............Q.....~..j...........cW....tRNS......xD..m..;O........................%:Pay....M......lD......V..........1..............................................._C$0x..Q.9.cY.f..)<I.4n,...+v.L..V...h..`.....Q.....?.1!.:.h......

                                                  C:\Program Files\FileZilla FTP Client\resources\default\480x480\synctransfer.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 480 x 480, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):7499
                                                  Entropy (8bit):7.834547447829501
                                                  Encrypted:false
                                                  SSDEEP:192:56ZwYBqK1ujUJxZr577ySvSRSINaGOxWTZheEny/x:o9+wX7EkGOxWTZkEnU
                                                  MD5:58B47F061260769A0A6B2CBECD8F1AC0
                                                  SHA1:CDECDA2416B100517F36E7AF65FA36C40C574D22
                                                  SHA-256:19B2D2BE74DB5FA58DAA88DA1ECD8A5F97C3353B53362A9E1AF1B5D2AC043D4E
                                                  SHA-512:A4BCC18F1DAC0D42DAF549F40B69C52FCA4463FD4554F19677491E6FBBDED6F71D9CE3C1CF17CFD8B5BD63D35A223C3172F1F5163399C3937220783346371E21
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............J.N.....PLTEGpL.$$. &. &. &. &..%..&. &. %. &. &..&. %..&. &. &..%..&. &..%. &..&. &..(. %. &.+*..%. &..%5... $. &. &.% ."#.2...%. &.....".....!...............}.............%............}....... ......................#....MM.7N}c."r."........$..!..........&..<!.J%.D&.<'.(&..$.6'.1.z<...%mV!X{$I.'E.(8.*2.+,.,hk$.,&M.&..!..$.j)Zh!*.(...&.&(.(..#...T..:.... ...\....%..$..%........... &.&+.+... . ,.,+.+).)'.',.,,.,,.,+.+-.-&.&.k..|..n..|..|.).).k..u..}..}..s..Y..|..r.......................................................................................................................................^..s.............R=......k......mP...............~....s............................|$~.....I`.. }.h....c1....r.&.1T....<...1@..Gb.m....tRNS..,J_q...............W@.h"..z..5.........m...C..3.....P..x..........!<Id......................................-#z_8.......yq.H2..p..lf`zr.{.g^so3..H............................./..L..d

                                                  C:\Program Files\FileZilla FTP Client\resources\default\480x480\treeitem_collapsed_dark.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 480 x 480, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1307
                                                  Entropy (8bit):6.476637761224862
                                                  Encrypted:false
                                                  SSDEEP:12:6v/70oYQmU4SqRW5QvWGP6CtRNJzJJfI1idS4spS1a3H4I1Mj3x4V3P3S1iJLbu3:0N/qR3WGPhzkU+s1a5Da1iFyqaKiZz
                                                  MD5:E273DC1B158F4468373F96E8F7F9E5AF
                                                  SHA1:40056FD1200C2CA282740111D76F0C40C58C6A57
                                                  SHA-256:A0B7B5F58352ED7E017365E5A22921CEF46F70833CCCC2CE200AA424BA0CFB2C
                                                  SHA-512:06D1902ECF859937F68786B7A1F528B1F424F118529D86FD31EEBE937E0D85F77FFB699DAE68FD17240BA964F5799087E93FB2C3A60EA6C5C8E40965350EBBEF
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............J.N....oPLTE...NNNNNNMMMMMMLLLMMMHHHGGGLLLMMMHHHQQQMMMMMMJJJLLLLLLKKK>>>IIIMMMMMMDDD.....................MMMLLLIIIJJJDDD.........%tRNS.RH..M.RSJ.N......"%...|.......Yu{.{....X...6IDATx.....P......!.y.5^:8..ma..=)I.$I.$I.$I.$I.$I.$I.$I.d:T....#...-.-.-.-.-././././.p.p.p.p.p.p.p.p.p..0_.M_.._.|..|..%\....F7..f..././a...........K8.K./././a...........K8.K././a.......YX....m......^...EX.EX...&L.0a.",.",..a..a..a...&L........x....q......&L.0a..a.&L.0a.........&L.0a.EX.E.0a...&,.",."L.0a....a..a...&L.........",.",...&L.0a......0a...&LX.EX.E.0a...&,.",...&L.0a..a..a...&L.......&L.0a.EX.EX...&L.0a.",.",...&L.0a..a.&L.0a.........&L.0a.EX....a}..Dx.m.#}.q...~.....v.........................n......K8.K./.....}._..+.g._.._.|..../_..+.|..../_.|.W|..../_.|......./_.|..._.|.W|..../_.|......./_.|..._.../_.|...+.../_.|....W|..._.../_.|...+.../_.|....W|./_.|......./_.|..../_.U.W|./_.|

                                                  C:\Program Files\FileZilla FTP Client\resources\default\480x480\treeitem_collapsed_light.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 480 x 480, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1282
                                                  Entropy (8bit):6.579143329764119
                                                  Encrypted:false
                                                  SSDEEP:24:lmIhXPlkXgCAT8SVx1vK5mYWWWWWWWWWWWWWx7+FiKgncNApgvG:j3kXrAISVx1isuuL
                                                  MD5:D1EFC64C8D183D6304489AEACA6BFC23
                                                  SHA1:98DE48219D8E6BFBEA7DAA1E7E19EAAEBC105B79
                                                  SHA-256:8E6AF6C59A9C1FF2F7D0CB805C48570EA891E69E2A64092B187ABADA9023A3ED
                                                  SHA-512:48134C48DFEE5824DA2378A72DC59F7486D8B19AFA5287C3A8DC59327BC9D931AE805EA86B682115B3AA46EA7DB3279F7CF07B183C7DC7AEA1DDA85DDBFF21C0
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............J.N....fPLTE............................................................:::..................666.........CCC.......m....."tRNS.d......F........z..#....I.!........Q....)IDATx...mk......2.L./Yq....y....$I.$I.$I.$I.$I.$I.$I.....j...w.....m..m..m..m..m.................%\.%\.%\.%\.%\.%\.%..%..%.p.p..0_.._.|.W}..&..%..%.p..0_.._.|..|..|.....%.7 .0.0.0_.|..|..%...|..%..........G...w.z.......0a...&LX.EX.E..#,.",."L.0a....a..a.qa.G...&L.0a.",."L.0a....a..a..6.",."L.0a....a..a.&L.0a......0a...&LX.EX.E.0a...&,.",...&L.0a..a..a...&L.......0a...&LX.EX...&L.0a.",.",...&L.0a..a.&L.0a.........&L.0a.EX.E..a.&L.0a......0a...&LX.EX.E.0a...&,.",.:>.F.t1J:.....r...nG..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K8.K8.K./././a...............W|.._.._.|..../_..+.|..../_.|.W|..../_.|......./_.|..._...W|..../_.|......./_.|..._.../_.|...+.../_.|....W|.._.../_.|...+.../_.|....W|./_.|......./_.|..../_...^|./_.|......./_.|..../_.._.|....

                                                  C:\Program Files\FileZilla FTP Client\resources\default\480x480\treeitem_expanded_dark.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 480 x 480, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1404
                                                  Entropy (8bit):6.50184507502826
                                                  Encrypted:false
                                                  SSDEEP:12:6v/70GPPgk7gB3ywx+FH9WvnPmV4qBJyI6BJyICc1NCavvvYOkl5qIZwDD3PgiBk:QgbU2RnPm64PWxgiBe+nsWglKyyO
                                                  MD5:084F031857785E083227F56E67616415
                                                  SHA1:F934F48D038C8BC7CBA8EF3EAA9883A4A720C1F0
                                                  SHA-256:3C1EFCAA6B3776634606940D6D4B68F1F52C75D72B66260946BC559961282535
                                                  SHA-512:7B71EAABE99DD595E7D21D6283DF5B817F8A57D0C311A6A54FD1347E26C82829A4B38875995DF208E5B105892F01E36B37A6E2C7CBB0BD83193FC40658E02230
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............J.N....cPLTE...NNN@@@JJJNNNMMMNNNIIIMMMNNNNNNMMMKKKHHHJJJMMMMMMIIINNNMMMDDD...fffNNNDDD......LLL...MMMCCC........vS...!tRNS.'..R.}...$..'....q...|.....X.........IDATx...1..... .....`1.....................................................}.4..P.$......z..^..Ro./..........g|....z]..o..{...o......w/,....^X|.v...&.{a.M.}......7a....o......w/,....^X|.v...&.{a.M.}......7a....o......w/,....^X|.v...&.[a.MX}....0.........k_.w........K........b.x...`.I.p.@...D_P...E_^..-E_^..-E_^..-E_^..-E_V..-E_V..-E_V..-E_V..-E_V..-E_P...E_^...E_^...E_^...E_^...E_^...E_^...E_^...E_^...E_^...E_^...E.w...%m~.w..W.....w<.K.....|a.N....(.....U.........F8.{........f.................N................................K.o@./a..............K.oE./a...|..%.w@./a......%.w@./a......%.0..a......%.0..a.....; .0..a.....; .0_.|.....%.0_..........K.o@./.)_.|.....%.7 ../a...}..%..K./a.ma.ma.ma.ma.ma.ma.ma.ma.ma.ma.ma.ma.ma.ma.ma.e././.g.0_.|..= .0_.|..%..

                                                  C:\Program Files\FileZilla FTP Client\resources\default\480x480\treeitem_expanded_light.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 480 x 480, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1430
                                                  Entropy (8bit):6.612363843936813
                                                  Encrypted:false
                                                  SSDEEP:24:XMv/276qbrYFe4XDXx1yVr6vZcV+nxUtuyvCuKSm3NQ9jdM3SWWWWWWWWWWWWQT:Xs276Tv1y16ZUkx2+T
                                                  MD5:511A92EF28D25E6EE856F9326D7A9549
                                                  SHA1:56D2EF8535BFD94023ED5554AE73184C21C2DD0E
                                                  SHA-256:E45294341BE154EC935A1F317FA7363535BA594E9EDC02DCF7B7EEB649596D40
                                                  SHA-512:4B33CFD369B77DA7F195E761C236179E64D1947B4EC1F23E1C0636D4FC507DC11FCD94DDE34727DC33AF89A35E8A0B9EE387BB4A084BD9FF54B382820753AD57
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............J.N....fPLTE.........................................................===......:::.....................666.........n......"tRNS.G.J.d................#.......!w.....Y....IDATx...1.....0....-....................................................u..M.P....a.|....&z...o4......Cz}{...>.....s.v........7a....o......w/,....^X|.v...&.{a.M.}......7a....o......w/,....^X|.v...&.{a.M.}......7a....o......w/,....Z.|.v...&...a.M.|....}..z........~.'.&..>.`D..a.M..............3W@X.2...a.;.++.}'.|.0........@..N...+_ <_&.}'|.../../..............._ya.;a.........0....w.W^..N...a.;.+/l}'.|.0........@..NX........3.~...._...O...o...I.a..Ac..|....&....T'........}oma.ma.ma.ma.qa.}a.}a.}a.....................%.p..0_...~....GT8.{.|".wX./a......%.wJ./a......%.0..a......%.0..a.....; .0..a.....; .0_.|..... .0_.|.....Kx..0_.|....Kx..0_.._.|..|..%<.K././a.......^.%.p..p.0_.._.a_.u_.u_.u_.u_.u_.u_.u_.}_.}_.}_.}_.|..|..|..|..|.$.u...g.<

                                                  C:\Program Files\FileZilla FTP Client\resources\default\480x480\upload.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 480 x 480, 4-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1276
                                                  Entropy (8bit):5.565308274512407
                                                  Encrypted:false
                                                  SSDEEP:24:18fPDxm0oUc555555mgq2q2q2q2q2q2q2q2q2q2q2q2q2q2q2q2q2q2q2qe0D2qt:181m0c5555550TTTTTTTTTTTTTTTTTTf
                                                  MD5:5DBB4A4639578D421340976E766F2C32
                                                  SHA1:EA3782BC213CE0C43F3C65F07C735D21E48B36E8
                                                  SHA-256:EDD8D0E29F8D928A035C9301D78F2D13915164F761444DDF14A5F5C245EA20EC
                                                  SHA-512:B7AD4ED496F3A16B0F69CACC9390679FA354A9C68E82E1E7FE97257124059C50F4F21247FB5CD9DE959EF80271CCD2EF3BCA39E1577F96EC8EB2121C75E5CDFE
                                                  Malicious:false
                                                  Preview:.PNG........IHDR....................'PLTEGpL. &.... &............m..R.......'.....O.....tRNS........88.!...<...wIDATx...7Y.A.F../.%.. ., ..8.....(.H...lx...g.f.|.....v.O..[.|<.r......8...S..8...c..8..3..8...#..8.,....8.L....8.L....8.L....8.L....8.L....8.L....8.L....8.L.[..1:...x.;....x./..0%..S..0%..S..0%..S..0%..S..0%..S..0%..S..0%..S..0%..S..0%..S..0%..S..0%..S..0%..S..0%..S..0%..S..0%..S..0%..S..0%..S..0%..S..0%..S..0%..S..0%..S.(0 ....(0 n....}..0%....(0 ....(0 ....(0 ..S..0%..S..0%..S..0%..S..0%..S..0%..S..0%..S..0%..S..0%..S..0%..S..0%..S..0%....(0 ....(0 ....(0 ....(0 ....(0 ....(0 ....(0 ....(0 ....(0 ....(0 ....(0 ....(0 ....(0 ....(0 ....(0 ....(0 ....(0 ....(0 ....(0 ....(0 ....(0 ....(0 ....(0 n...F.....`J.....`J....Q`@....Q`@.....`J.....`J.....`J.....`J....Q`@....Q`@....Q`@....Q`@.......zg.g..W...;..N.......w.....?\...w....8......8......8......8......8......8......8......8......8......8......8......8......8.......g..."...$..h.z.N.A..=:(.... ..P.W;.t......;............

                                                  C:\Program Files\FileZilla FTP Client\resources\default\480x480\uploadadd.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 480 x 480, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):3558
                                                  Entropy (8bit):7.602783324688387
                                                  Encrypted:false
                                                  SSDEEP:96:Tdwmfyctyj0pRyE9e6Epdx7lvsh6X/b0UUUUUUU:T2mGQppYtpNJ/bv
                                                  MD5:7CBF8BA09C12B4EA8341BAECBD27FB2B
                                                  SHA1:AF9211B1C4FD3405E51DC97492C2C569E42BB86C
                                                  SHA-256:7CC649C7DAD1289A984A80BB144A56C8493A61114625DFBDB5B04C4EE2D30600
                                                  SHA-512:7C847CA4B813CD5AB762D10FE28D3CA09B0C346CB0DE780D8F680FE9DB52C3A3F111C6F2C9CAD78FEB406B7ABDB808BD35056AE1418B2190D01E76F776D18610
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............J.N....DPLTEGpL).),.,,.,,.,,.,$.$,.,$.$,.,%.%$.$%.%%.%.V.,.,,.,+.+$.$(.(%.%(.(-.-,.,$.$0.0,.,,.,%.%,.,,.,&.&*.*,.,$.$$.$,.,%.%,.,$.$,.,$.$-.-*.*8.8,.,$.$...+.+,.,%.%*.*+.+$.$#.#...+.+,.,&.&,.,(.(....................................$.$!.!!.!&.&&.&,.,!.!....j.#.#....=."."-.-.......... &.......r..~.,.,+.+".""."...*.*m..R....',.,%.%. &...5@y....htRNS.$_........._.<...=.w.w....N..1D.K...U@A. ............Glk|..............{..Q.n7.R%.P[Ff...;C.....88!.6.w....IDATx^..[SZI.......0.x6QD...N.I5F.E33...g...n...s1}cI..m.../..aW...3J$.....Z.y.....L.!...Q{..+76.E.(?1i.q......M...6\...i...Gm[..\.!..Kk...{.G0ha.v.....Z....v.%...E.K`..A.h~.v.:y....9pa.1Gofm.]..X..}L`...8.-...n.1F..c..../....v.[4b...#\|......].E`..x..h...X..P4...#Z.]...5....<.8.....E.Q..U..>.J6......w..^C.P2......D..=.>D.x..C3...5..G...b..U.7!..{.z..1.....U......,$c`sx....B...^....f`s....R.d.l.YH........ ..7 ...M..........1..Dc..$``..Y.\.h..h.l ... ...B4..B4...........i001010101p........

                                                  C:\Program Files\FileZilla FTP Client\resources\default\theme.xml

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:XML 1.0 document, ASCII text
                                                  Category:dropped
                                                  Size (bytes):212
                                                  Entropy (8bit):5.070806606480616
                                                  Encrypted:false
                                                  SSDEEP:6:TMVBd6OjzwgKy8/I+aQmOT+SVKLDj2K/oHVQIKe:TMHdtAg7gIcmOPoDjlgHVQIh
                                                  MD5:75A54B0F2673D762239BC479579AF93D
                                                  SHA1:13BB8FEA1C2E296AD1516DF1D565E2CEAF2D9484
                                                  SHA-256:209F8ABD4D06BA609D1D92943CCD2B7EF8918E88CA3F159AB8D1D6FA82EBCDA1
                                                  SHA-512:8F4AD697B0073307A9DD5559C702F30BB52AADF48F875707691A2480A9BAED48EEC34089ED1BE784358FF7EA213B68C62B972CC24278E6C32B0FFD397C2A0E0A
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>.<FileZilla3><Theme><Name>Default</Name><Author>Martins Svarcs</Author><Mail>wtastudio@gmail.com</Mail><size primary="1">480x480</size></Theme></FileZilla3>.

                                                  C:\Program Files\FileZilla FTP Client\resources\defaultfilters.xml

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:XML 1.0 document, ASCII text, with very long lines (2451)
                                                  Category:dropped
                                                  Size (bytes):2617
                                                  Entropy (8bit):4.747682783202365
                                                  Encrypted:false
                                                  SSDEEP:48:cWb3FaIsL8PmXbE50m2bRkgbpEbz4XfZe3e3e3e3eiM:pb3UIAbZbFb6bgM
                                                  MD5:9994A10E6EE72A5AFD26CBB582E946E8
                                                  SHA1:C4B507E64A476A260974C17F2E13E6C41EF19CB9
                                                  SHA-256:27B4C87E3F1A75CE58CCE51086D8445E3C33590111A258BE8344B842F74C05D0
                                                  SHA-512:776EF79C8E72695D3A142438F441A85BB5043D584F6DD5216D4D8E7357DFE19871F775059212D3C7DD2D8679463056222224A27EE7D544BEADB1A2A921A27EC5
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>. . These filters are used by default if filter.xml doesn't exist in the user's. settings directory..-->.<FileZilla3><Filters><Filter><Name>Source control directories</Name><ApplyToFiles>0</ApplyToFiles><ApplyToDirs>1</ApplyToDirs><MatchType>Any</MatchType><MatchCase>1</MatchCase><Conditions><Condition><Type>0</Type><Condition>1</Condition><Value>CVS</Value></Condition><Condition><Type>0</Type><Condition>1</Condition><Value>.svn</Value></Condition><Condition><Type>0</Type><Condition>1</Condition><Value>.git</Value></Condition><Condition><Type>0</Type><Condition>1</Condition><Value>.hg</Value></Condition><Condition><Type>0</Type><Condition>1</Condition><Value>.bzr</Value></Condition></Conditions></Filter><Filter><Name>Useless Explorer files</Name><ApplyToFiles>1</ApplyToFiles><ApplyToDirs>0</ApplyToDirs><MatchType>Any</MatchType><MatchCase>1</MatchCase><Conditions><Condition><Type>0</Type><Condition>1</Condition><Value>Thumbs.d

                                                  C:\Program Files\FileZilla FTP Client\resources\finished.wav

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, mono 44100 Hz
                                                  Category:dropped
                                                  Size (bytes):81088
                                                  Entropy (8bit):6.4967751447299955
                                                  Encrypted:false
                                                  SSDEEP:1536:G7qQLiPKin38KlwXXUDlbAiuVdUqXk1XWL/MAtfCG6gxw7vQWiVlb+a0S8bjzK/:GkKi/7NAR7nWEEAdj27I576BJ4
                                                  MD5:B495C090044C169829C4DBAC2FB97130
                                                  SHA1:DDA3270B95DE7B77A9FB753C74CC0498CF02FA3E
                                                  SHA-256:E98EBD6282CDBBD74B316F075971D61032FE8DED0A7EBA7F4F826877E16C9D43
                                                  SHA-512:BBFD48F4E36AFCBC82C254AD291B6AC850CD176710D7637774DCE508DDA161A0474C809A25CDC551A5B5AAFC4822D68385A0A70B48C85F9F3074175315696B57
                                                  Malicious:false
                                                  Preview:RIFF.<..WAVEfmt ........D....X......data.<............{.q.q.x.......,.^...........|.a.F.K.N.5.......}.p.......+.G.o.q.P.&...........E.....1...$.Z...".y...........\.P.T.W.m.w.".z...~.x.....!.......7.u...u.....[.........................l.P.x.....;.......N.m.9...*.......z.....s.............w._.......9.l.........N.p.....`.....x...].................M.....8...\.n._.......=...).F...).8...'.........a........... .......-.........i...Z...........*.a...w...1.........t.....$.......b.........B...0.o.u.o...[.....J.p.............e...7.w.>.........s...P.....K.....`.c.a.E.o.{.......5...........}.....{.........~.R.........;.....o.....q.7.>.#.8...-.................../...T.<...;.".......-...;.....@.....#.......$...v...m.<.`.H.U.k...,.L.........3.......o.....:...A.k.^.....".......e.g.....5...G.....9.....9...../.I...w.{._.....O...H...G.............................+.Z...P.......o.O.....Y...4.:...f.......L.....E...O.......z...j.t...:...................s.......A...".m.......................d.....".a.....[.....

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\ascii.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):638
                                                  Entropy (8bit):7.534076223217043
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7ZhG4E+LC4i6ECSoGRc4bIpwQlr7carB2S8j2zqGFj779eA/29l0Uv:wg4Ho2Soc/spll3cQsSLqGRlel5
                                                  MD5:1DAFC9FCAA6D1BFB1E3BA6AA8FB6E865
                                                  SHA1:C2F83807BF1749CC2398E867A706B6F7846545CF
                                                  SHA-256:DE18C305A576CF63065F0BE9422EDCCB20977EEE208FB3E79BED72F7EE7A357A
                                                  SHA-512:B90F8B22767C0A63A42A61228294BE4D962D5F8F2E1DC6C7A23A5BC7250C0FD280DB7113DA0D8F1DAA7206A754F07C84EF09D94E893F41930FBB4749EED08EF9
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a...EIDATx.bHLLd.}{.[.._.t.+..-[.,........d..v.....E..#.Oa..f.....T.........5....2.*T......E.IU....o..4....U..;..|>_.\..Z..R.....~K.R..N.N....~v:...GP.N.KS..c......4..+A@...d2.v..~..n.cM..`.|>.b..x<.P*.....p. .....r9.).J.........F...X..8...`.j.B..D.V..Td2..\.........BE...u.7B.Nd2.......y.J.X,F.......t..p........X,..` .l.n.....v..)J&.|..N..j...BP...f..l6.H.....F....z=.@$.A..C".0.4;.. .=....U..F..f..h4. .<....d....O.....!.....a.ZY.(.....D"..D"....t&............O:|..D.O.........K...>..4.b.@:............@0P.*.Z.....F.r..$S....I.......`...}.O..~..!...#.......'H/.&...^V.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\auto.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):684
                                                  Entropy (8bit):7.534440401683116
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7E8fD+yDBNGImIAT7KQQhJLRNnRqOUnbdgf/uXc4aM1nk:L8fNNGImPHs9RUbdCuRTk
                                                  MD5:B12CDE4CEC51BA2F84E09D9E045D257C
                                                  SHA1:A4700E59C04A2F0FC1B20C3D3879B593490210C2
                                                  SHA-256:1C6F71323BB543922D8623281A390D772EF92BAF1D79083309C2E9D464CBB0CF
                                                  SHA-512:EC65586322046558714880D98CA57372123E544A4F5926B5994A47D082E3F3D373C0C332356F87F45A2F3835B28ADFECE056358C7D9390EE7506CBC77C9D6EC9
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a...sIDATx.b..'''....>......?."77.........E..Q+`........+.ka.......N...3So.6n.<.......?.. 0==.....{...x...\AA..<`.u....tUU.<. 8.....B!...y....F.Y..E...d2..N.I....gGEE....\.z.j......I..u..u.r..h.O..9.................sy...b..B&..dy....dI...P.Q..GG.x.bE~.d...(w..f-L7....K..s...="..F9s.LQ~...a...7k2...i..R....cF.p.........;2S.A.@..kR7..e3@....:uji....m?...8uC.^..x....#x(....v..=h..r.6......4...<..N=....'.v..U?. .&...Z...<..CW...v$E*.......w...a..=-EeE.I.J@.......dp...2..Eq.......m...........Y..,..0.]..d...^'.H.H2._]....3pK.....8o..'(.\.x.....`......_.x..{O.I...c.7b#c..93..Kk........ac)H/....m...a....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\binary.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):634
                                                  Entropy (8bit):7.518749902993462
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7Tljd0CgH+eDJ5eZpiCaZOLZhwPZpBR6NmZonLfZDZDr00s6gyQ/ZoP08c:8jGD+eDCpiCCH3gt00s6xcoPVc
                                                  MD5:6B5831512E5C666A6957FD141EA81E01
                                                  SHA1:84FE38932A439EFFBB5C14682031F6FBC1DCCC28
                                                  SHA-256:57BA9197221718B2CFA1655980F9DA18C63D9ADB841CCEDE61FCA577A28588FA
                                                  SHA-512:45CEB43D6B361D9C72F3077E0A868B2D9655777F8DA30B1C45C94E93FD5D5B17DB241C64A8CF78CE73DCC0688778D9939D36FCC89A7FA8DF6177270180F2CE78
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a...AIDATx..S3.\......m..b...:.q...>.m.m...}....EFF*......Xwvvb2.T*\.ti........8q.[xx..B.@OO.FC,............J.;w.1.r.\u....iii...D"...b............k.F.X..pX.....B}}=.......HFWhkk.........8p@o....[ZZ..'Dimm...w.Z..3.`.R.......................J...?.`.y!.H......|N.Fk.@.Q=z...W...g.l.2.../^`.........0.a......}.6^.z./_.....`/2..|GOO..% +.,//...%.Y.....+WB..8..Dc....`y....#....Q[[.>'F..b.F...HHH..[..m.6...;HDR...a...j..r].uSc.._.JJJ...K.....=<<0o.<P....Jc......C....... '.m...2.........$J....v,...M...v.....o,......?......ou.z.D.(''........,.:..M.....8t.P.....{..........IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\bookmark.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):318
                                                  Entropy (8bit):7.039739482097343
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPWAlllJ8c6EIQ+mYk7NiKZQy49a4+pAaB8dQ2fD6c/g8QVf5Jgp:6v/7xB0jQ7JNZQwp5ipfg8Q7Y
                                                  MD5:0598026856986DA9BC8D68C9D54DCE55
                                                  SHA1:210BE5498F1155C80F4D127A87E381F7E4923B03
                                                  SHA-256:142D8DF4B61AA8DE96B58AFAFFD6B9EE89ABBC882061A533777B08E023C87566
                                                  SHA-512:FD3446A787AB59271A5C9E8B261474F2AC4EE8550F3166D5E94A8ED7286B1534275658F85131D475176E10D50494CF6057530E0324B2C2C14D3FFE216D101A06
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx.b.|.../<....4.......f.!7..-......4........Y...Z..`...I..&(o.>....{.j.5..- .... .......OH..._`.?.k..X.V2.'.K.+....x}O..4...E....].(.x. k..A5A..;......./....&.@.8./@..h..s._.K..&.`..}s...{.......?...O...'.o3rM...).M......._.......o.{.....~..(6....?.`f2.]....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\cancel.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):548
                                                  Entropy (8bit):7.484554583702818
                                                  Encrypted:false
                                                  SSDEEP:12:6v/75k0NDOJDrLK2AmQ0g+dWEv6EyWCr7LA2It7:8k0NC9rRAmQH+dWfWCr7L49
                                                  MD5:989EAF92A59E8AF310365695629AF61C
                                                  SHA1:3DF816E0943C1F493B1017F2529EB46C2029E981
                                                  SHA-256:BA3354576FD955B00FA485D54C9979E563C4D6231D9EBE253F320A7B26DED29E
                                                  SHA-512:FF854E1C34D08A981A30AE1EC0893290D0129A724C3FB266612A7974AA4FF6CB3C4B9F302BF3FD8A50235D351B190FE9FD90A27A2632A62718831AC72BEDDCCB
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx.b....n...Uj..#....m.VT.6....m..m{..f^.........wv^.@H`..g...s..Q?ZPH.....alM8T...'....B.4])d..?u"....|..A.....dL.2........M..Pw..n.>k.U.......d..5...S......:..\.........5.lH.....A....P..q.kfn.C...[.{.I.M..}x+2..o..q!.......3.@.Nt..0.....V.R.LT.Y.W..s......Q.............y"'..A3.i.@$.1...]...kV.....A....G"..#....."..*.Y..3{...!..J.X....Y=...Hn...IN...p.l%...q...#+.G..iN....5....b../..e....8M7A..%f.+.3.!... ..2HYW?.q.QD.m..P1...@._...zwxg...K.g........Y.Jz...Zn.X&.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\compare.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):560
                                                  Entropy (8bit):7.541145966641534
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7F425cDXSMWVW++2EZ88qQ+t6VQTUEHPn2+OIUNx:A4j4VW+EZ88qrTLPj2
                                                  MD5:F5D5C63156F9F79D0C881F3E28DEB9D2
                                                  SHA1:9180CB55A9DBE3D36F8806467BE4613BDA55B4AE
                                                  SHA-256:C2FF72BD759633AD8B4EE6D70C377220BA237C58AE67EBA0C129693C4FF6D183
                                                  SHA-512:484CE1E1B9B8101D48BA25103592CF04CD18538947202577F2A3848E7859C8F46FD46549CC7206DA33C878405AFC3AD0B87F51A1BF44A8D1062D180873156E60
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx.b......_>~..J..r...m.|....m5......m.}&.6.r.g...4.Lx....;.n...G.B.l....e...E..y.Z..iK)d2......49..>.k.s+.....sJ1.n.0.f......3.a0..._M.9...c...`.*...u.m.o...d.}..e.tH..;l.hZ.k....2.:.*.......|.&.vq(...;!.A..)...... Z.:$.N....b|...De..[.a..Z...5..J...J.o@X.%.F!9.....Z.@.-../^.^.x;. 2..?.%!...B.L..{.B.SB.!PD.a.A.6!....,........5_.1....z.4..b6......=gS...m......25..J........\.N..I.........S..8........:..A...0.......-.............c.$.Bg#..p. .d7.l..O..|!..@6...p......"sb....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\disconnect.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):623
                                                  Entropy (8bit):7.605757834324087
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7IC4tq8eZ37gn9zRtCbeYb13M2V89VtJgxLC/4SwT9:1C4lCKhNYR8+8btJcLeVwT9
                                                  MD5:702E99741F314CBFD4109657B06A9AC9
                                                  SHA1:E63418919F39F516200DF34D6B393585E8083C42
                                                  SHA-256:73B86CBB4073D7C2642FFC6A7EBD590134D11B3FAE21CC22E85378F5A2658D32
                                                  SHA-512:A8B27D32BEDC956A76E81AAA006A66DC45C3A3844D0405F93E245CDCF560605229102013F8ECA4252A14AB94521942EEFF9EB7303C362DE5E065508ABD2ADFB3
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a...6IDATx..S....CS.m..m.mck.m...5...c.|@...?hdJ^IZrn.......g...{xT..X.~.a.&........i.s...'..S^C..tK...x...).5.9.....rL.Q..{<..b....."U..O.x....g.?..mf..b.z.H...^.].!:..$.J...!R...~...j....S.t.."....d=E^.....Wz........,.9........5...sg4.7.\.......b...3.\..{..$.{W..-...).E..N._.h...t...)...N.....f...L...4.d....u..&.~...............3"3..'v...........B.__0.&(,)a..Y.d..K..I..M..<...G.....E.l..4.....].R....-.......<....V.0..+WLe.i..r...ow.$.<...d&Q..j.e]......i....h.o.8p`....z'7.u>F:.6....-...@s.[@...rr.....KmAk c. |.'....Nae[..6.....T...I0].LZ.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\download.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):414
                                                  Entropy (8bit):7.137993945394194
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7/dOiE78uhfGksUHVFoxQnmxRJSWkcMZ+r0C42L:qZuciFoxQmjJAceC42L
                                                  MD5:8DB82EF833AAF9D239AE3862100EF484
                                                  SHA1:A868997A684E2A323656A22ED387590E684574C6
                                                  SHA-256:B71CB2106CAC049EC3BB7663278EFA31C8ADCA7E898280E2A73ABA2E3EAD652F
                                                  SHA-512:AEED8EADDC4E2BF334CA783F1156ABB204F0B61B83F4DE69E92C3830E9C7B0DE1DD3FDAE4FDB3A32C6AA3748750F991025C894EC7AB212C5134F618751A62B56
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a...eIDATx.c`..8....Y.<..~..?.M[.s.n........W....-&G.~Nn...e.^5....ODV.h.....^)...,.K.<._.....o..6%=gk..yD...7........U....zR......[...._...+VN....0.....Oi..........6Ap....:.$......7.R'..i.jn...l.IR .'.Tv....m..f^Y...;+'.. ....'..?...WX...n.].l.<...B.`9......a.p..O..o^V,..._.......b@\......Db.p........7nB...@..U.r...g..O.0....s..?..(~<......0}........Y....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\downloadadd.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):571
                                                  Entropy (8bit):7.357843398812955
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7jDrfSjDlYUeuXi4iB2sh3FbMc2dobnTnrv47ZiN:Ir8lYUe2e2sh1IVS3vTN
                                                  MD5:F639FC64785033EEB01CF56D647C001D
                                                  SHA1:C2FC2BF6822397F7A66538B30BB29B97AFE897F0
                                                  SHA-256:C33E12F993DA6C91FAC78BA3B259FF81C13C73938075E81556A823964CE66A23
                                                  SHA-512:48B60B84F42F29EB797606082EC4B29398312C49C2F9557DB120DD7B876449435C1418D10564C79FF01B02A802490CF167E4221F832E19B71F10403A9E1FF0AA
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx.c@.....%...#........Y.%../j..#......Q.a.3_..._.7...-. .,....R...B.......X..qp./z..y..?B.*R 1v)+.ny..1..^....5.....OI.spp.+..kT7.rwO.n`bfe)...E...?..T$<S&.;t.....Y........|e .?..A.]./(W...g.....s...{..a../Im.......v.....@.5......W...0..Q....;D6.w....c...M..x........u|.....3f.. lV\.....[k...k\G].........q....m.+2a....Izm@..mg.RS...... ..;..../NE..V..P.|A!..y6A5U.... .7?wP...^....8y88y...x.!.OD.._L.[@L.......uS_..5._......+..yY....~Q.....5...8.E`..b....t~.F ..b#....'=..4.......`.Q.x.....K{<a...5*.V..)....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\file.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit gray+alpha, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):270
                                                  Entropy (8bit):7.015272532597241
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPO6xAwQAF1EJSKZOTbhFm8ch7yOeGGmG3bp:6v/7P2AkHZOJFuyOeG0F
                                                  MD5:04C9BF0E976D58746509191EB544DD5C
                                                  SHA1:8D66AE72F3AA5779D2DEDABB05836B125BE934CF
                                                  SHA-256:1AD78DC10FE08FD8BAC26AFD9D6DE513B3D63D141B0F8E51CB487251E9963A21
                                                  SHA-512:EBA144833097C513BA1321A8626DA7319B100F6B8182C6B8F36C284A5FA99E52421EDD51E0660F3B931BAC94CA43AD28CE7C6E5C84E8DD23B32E9E66AA959053
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...............7.....IDAT(S..Mj.@..a..-<.[.....]..z*.M1.,J........`+.wf.J..&Fp^..<|L...9.f.I...H....7IPo.."...Q|.a..0..G...C........B". p..y.xl8#Q.X0..bj.c./hB~.......?.Xg...(......>'4...#._...ln.......*..k..]Y.N*..n.......W."1]...C....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\filter.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit gray+alpha, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):182
                                                  Entropy (8bit):6.373621698738607
                                                  Encrypted:false
                                                  SSDEEP:3:yionv//thPl9vtJK6PtYDCXgiukAYZNL/OY97gppJNgagHRPLfckknVe8B6kF+VQ:6v/lhPO6WfwZx/Om7mJNhgHCVjBPkF3w
                                                  MD5:8C4257477AD350959B683DFCF193C8ED
                                                  SHA1:E34A8264249F3D056FD4889365FAFB48EC01F884
                                                  SHA-256:8E20DCA41C350BD2081603DDF55DD42310F15BCA2F13FECD1E0BAEB76431A277
                                                  SHA-512:537AAEE647341B89E8A34AEE5CC108837C0114B3081B3BEC143A4D61513E348BA3FAE5C24A6F94ECD3372D9E26F2AE1095C2B3FA6AC92160DA40C1097504313B
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...............7....}IDAT(.c`..x...z/..>....M.........0.....h....~..o....}.~a.%T.,....V....b..2......t..v...]x............?.....Y.... {..0.....5DS..J....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\find.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):503
                                                  Entropy (8bit):7.476611124995403
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7kQCavFP4Q9s49rORSFQd/mHDpUGOX78Vx0q7WnuK9:mCqh4Qd9rORwlULYDgT9
                                                  MD5:AB8EF66EDE19BEBB12708C2366B53149
                                                  SHA1:E6B1AE94F256DEDCC2A2159485A3F560F799B562
                                                  SHA-256:6AD756F2BA1526759F04C778BC706F8E8FCCA1D911EDBCE572CB3981A322AB85
                                                  SHA-512:54B697D8C5AB290A6AF7336C4F249EA961E97572FDC7B4BEAB6D5B5DF0B6EAEF57F4A04E4051AD9B7E0DB3347A89AB21A0A174D77AED437120FB6E261A9ABCCF
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx.b......8.Z..Q..l.r...g.m.m...g.]...N.f...8.......u.....H....HMM=...?...........H$.D"....a.m....X$....k.......NI... .y...As.[...B....rt...^j..e..lhh...)n/...Rg6.4...........}...Y....#..tw.-89E./....5xR@1..f..y.W..1.=..+.......0.....xY....../tN.o.x....(..p\iL.H....nG.@...(.-.7k"...y..'..........^.h.*).T..c;...aHN.?...}*)...........ee.zDK.d.;.eO..=iX..7.K.......$7....H.P"...{.*+...z.......[jkk..h5.U.....m.......j1..x.7....4......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\folder.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):411
                                                  Entropy (8bit):7.295120788949264
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7NEwP4aX4PHBzUOyawWTOZlnmcWi8aRB7:C2aoPXya1SZlnmcW3aRp
                                                  MD5:7C3F5DFB8E30E246F247003254BE0AA4
                                                  SHA1:E0FFC337E1FC46A8FF757517B47D1BD97BC041B1
                                                  SHA-256:0BB90CC2902C9A9B9386137864267E40B44507C745D7A2347579A671E8B9FADC
                                                  SHA-512:437B0592FB3CF2352DF02538422D6A897AB48EC6A718579575719DC57A4FAB37E542A48FE33ED77AB855B16B517D94B1FF768A86DC91F384A810CC0E399177F3
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a...bIDATx.b.f..........o._q..y......l.......F.._.{=,..HP...@..B..6.. .0..M.C.m...>..5{....l.m.}......>..\N..>...eV_TZ....L.....Y..;p.N'3....c..7.@'........%9..l......NG`.$.J.(s3B.328..a.g0.Qx?H.E?`.......;..!i0.}=........$..&H2C..5n.*...o".\D..w....f....K2.Bik.G.?......}\M|.J..%Ev.c.f{....$.H,....d...\a..jd.6.Z..m.V|.6.[..A..<-..|,;.I{.....8).V=....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\folderclosed.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):340
                                                  Entropy (8bit):7.072327278622731
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPWRQS0J11YRjMxali5xZ7QaQhKLkF+pdocfv7sAVqahX7dAThPjp:6v/760J31aliDQKL5o27nXaT
                                                  MD5:594D5849BCEE210458D71A7E73972F04
                                                  SHA1:C941D9F869B31FDC224BBB804E56022F9342A17E
                                                  SHA-256:BEBCCE52E3E8F61DAED6BB5D9C807BED44A148B5E18E41D28CA917D70C59AD1D
                                                  SHA-512:85C636F10D4702B75C368B7DCED974D1598FD2C6651E97A88189A968B4F3AC927D99E091DB3F69B1C6F591D51E0AFE8787073C236E64B64B83D79DE4461C95A0
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx..5..Q.@_.....C.. $........M.....w..{...K9..a...W..5....K..C..../K..G|.{..W.<._6.^o=|..l...5..............7.....w..@.2..._.....t..x.....l..........`..L8E.....qbF...<..v.~GI.....C...FU....+.. Z..fa0.U.. ....U...@.....\..N.X !F...o..... .........U.<.1.........%?....G.]$ou.........IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\help.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):313
                                                  Entropy (8bit):7.058623871364096
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPWdmieP6HD/CG3UxPX3uUk/Ni7WUJcQrGnk4O/7qvmbNCzmvtKW2fm3nUVp:6v/7yFH+uWPnuUkViqOHrGnMnNamvQ/l
                                                  MD5:26F157F55B230ACF358C0AB56B33B310
                                                  SHA1:00D94E8A67400143F01CF93656A306B88379D1B6
                                                  SHA-256:731AEF09E1554C428EF3DBB1D3ECF7889DB5B4EE680130F432DF95125E329BAF
                                                  SHA-512:C974225D52F3617C4EF3CD303D0EDBA6739B0746C37B9C76CB9FE74349D15424E57F7825B3D836474A7C95853F5EA375EF13D400C8B71984A152A5810FC4F220
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx.c..`c.D...K*.....(.&Zcpp0k&...S.....$......D..>.-.<K...|.G..C....].I..@;a.Q.<...(K..].1}..V..w..+......5.9J...JL..`..,..G..~..+<Ar@Fs.f..J.q.;....[.I.5YDt....?$...Y%.d..9.......g.I'+..2........XD.&.x,.fW. ......8...g..A...qz..&-.....0.....P...E....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\leds.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):848
                                                  Entropy (8bit):7.7433247823163835
                                                  Encrypted:false
                                                  SSDEEP:24:rwhXol60fjy1p3SjCsgCUZfrPzyOSnFG/b:U+60ry1p3SjCsYZfrPO4
                                                  MD5:A34C5EE7AD964372622803F63F0B60A2
                                                  SHA1:4AB2942BA820C81ACAD7E314F7F9CBEE2EDB766A
                                                  SHA-256:F1029BE550D5258055138D707017054C7F3B2D648D6A222BD6C9F5E8BDB51197
                                                  SHA-512:3C51B08A18E4AFF42F741894CB7B023450BCAE7AE9A5DA46E3C2C1671219BF6828E827017DCC0AE93C70170E8D6D2020D9178D61AB6F50C3D6A45B2B28520AE0
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx.l....L...).Y.m.~.y.m.m.m.....t.T.|/)".ma../P;.*&.....W..=.04....(.....C.........{3..L..02.>....m\.<....1..)>..J..H"9...j.%Y...'..#pFQ.e[X...........z.....=..,...h.y....nnpT..d.r.....>@.%..).p\..zP@5....f....|.......v.D...R.....L..1.\........(..-.e...8q...B..!.......m......j.>n.Fx.K;..f.b.::^<..Z..>7..y...tw....T.'..S....%....8e........h...jS.6E.!R....&q....m...!B\$...).R.qA.a..J.g.W.s.j"h..."l..,.\;.\..`y..._..EWZ}[~.-,......8.&..5....fv...2`.....'..../50a.Qzsa..S%0.Bs.....;..V.i..7T\..Y....G....3..oK.~[S....P.Y..zmHz.w[2...s.5...[...F.p.v.6..6.....^k.k...gS.'4pg...gK....s...#+n...l..]3O.>Q........F..P.E.w..E......K...w.V..3p.".W..q.....s.,....8.\,~... X..=.....`;...n.*}5.....)[n.j...C7.p..Mk1..Y.g...V....G.Z;3+#+<;.019D+...x\...[...K:vba 9....F..J.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\localtreeview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):530
                                                  Entropy (8bit):7.456602635417933
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7SzjK3rEZcjrnPFQ9LqaODth/yZko7tVC0xgxWLD5dp++Ye6Zk:bjKEZcjrmXgI+QzC0xVDvD6e
                                                  MD5:91393DDC9493DD4F714DA035E76AE8DF
                                                  SHA1:503309EDD6B63AF6D82C43E9DF6536C452802E20
                                                  SHA-256:E6A7CC290CD9A878AFC7412C50A713934DBFD28DFE0ADEEA462C9E3932BBCAEE
                                                  SHA-512:C3123B093C1D62ABB26207BA90A0E9E6D748BD55AFD3A8D0A450A38A5445B6613EA52B8E7D5F57E6CEB0BFB2BB92A80C8D5F9F0845ADCC798199704D0D1983DB
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx.b..0....sWPP..2..={v:''g.......TKHH....J...(z.....A7.f.G7\;.q+X.)...........\.I....~...?O[.V.......0...`..{.}{...K)...3...[.....:0M3x..C.Z-KD......D..a..."....UQ.23-Y..y>.?6D.n.....`T..q.M.F.....d..@.>...^.*.......@..a..,X.U6.34...P.....6....Hf....z.V.... ........Ac<..@.....N..._.....k.'.z-.{..1k..I.@...-.*.....H.M#...m..x.f.O0.DC...0...p#>.]..mamt2.V.. .......?u.x*.....>}..H(...M@..mE.....}.....U.L........j.e..%.....j..&....Jzh..3.aJ.R.........l.?....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\lock.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit gray+alpha, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):282
                                                  Entropy (8bit):6.90095293813037
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPO6NAlE89ZPDjbQKETOD8qnra5eOaUyPRt16Gagd9m7uLl0LmSup:6v/7PO9ZbgSD5jOZyPLqSm7Sl0Lw
                                                  MD5:625804B0DA8E79E3E31B5A664E413EEB
                                                  SHA1:FECE6EF2D0343157064F5BD23725F9754E209641
                                                  SHA-256:1446ADC561C5531B89543351BFCB0F925BF2023507C365340F702EE2EF0506E0
                                                  SHA-512:E1C087957FFA6078B3DE38A01D02C8DBC4991B2748FA02A10BB20D43BF5F2998B5710A5CBCC6884F13D6710960774DD16C87FC17482F26BBB679D500C825EDF8
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...............7.....IDAT(.c`.:...G..`G...5.X....NJ.1p..n``.@..{.....].C:.t...g..qf..%.\..Gu.W.y.w..............%..?.............m......(.~p7?*._......[.....PP......]..?.(.....hB.k.3...*8|.E....[Y.s.../......u...G....%{.@p.._-.B......w1..L.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\logview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit gray+alpha, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):391
                                                  Entropy (8bit):7.276924159510342
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7PkNIVlUt6nOvr6TULRzGIBmV/bZzIQtp7:7GWDj6EzGdzZHtp7
                                                  MD5:8E9484762E3CA06C612752B395EBCF3A
                                                  SHA1:05188934B2F9E7E5FE72BDBDDD0551725135AECF
                                                  SHA-256:B742D6EAA8271CD2BB0FA3B20C35188C840EC72D11DC750CE9683FB0702778E8
                                                  SHA-512:A4A62EF29A29B903C361639E44E7A85F5E851C1F764C784B63E617406C1550E451F665134CE726B25B9824009D4B2E0ED3237F1BCBD9D82E04CCF7C735B72283
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...............7....NIDATx....o.a......Mi.^.....AB.0...g.Z.1.#$..."..f1......A..@..Dh..r....^f......\i.>.mb}..#......#...|O.."{}.4.....d......Z'...Y.n~8.H...l....\........I......A..8.l..-.....]=.k.a...9,Hh*..TTze.X.,...%(..2P.x....s?.DO.*.wr..6.i....3$..5.\K.U.,.fnw6......\M..M...e.$1!..k.qI..%.@L ..#.;.'%....h......W].....+..%S./....7..u_j.......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\processqueue.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):343
                                                  Entropy (8bit):7.115977369006804
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPWbyf4zMVm5VwISwhao8iF+OlvW/QGWEwR0MLXQOiEIfmE5p:6v/7akPm7X7htTlvCQ5mMLXQ8Ij
                                                  MD5:8173CF7E3B074B6EC28CC6DD45CA94F0
                                                  SHA1:1D189C28347A54F11DC8C869B67254B3408A3AFA
                                                  SHA-256:04CF8D2BA9BA6361AA2B2CC8D1ED74DF1D1000339194D71AF568BBA3967A2E0E
                                                  SHA-512:2A434831F503721D5656314A9111BC272D22818B7AA5D149BA5000BF2C9F71D48AB97CCAA6BBD20FE4158D0A20C27C36C7FA26F75BD5C83C6F590870AD75EBD3
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx.c.&..?,.o.>{.......U.s...;v.`"h..O..kkk.{zz......>{{{...%.4z..........; `.......((h5..aj...7....v.#..3....P.......nl...'.O..ms.m..$.`.......?..u}.kl....GF......o.......d...C..9......%...&.kl.#...[.dc....."....]]]7.....=<<...QYs...t..h......'R6m......?~...`...3...7...._^g3.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\queueview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):505
                                                  Entropy (8bit):7.475329434666842
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7yaIFwXkKoTCDM6aTrbRYVK/Dg5U7KHxF2q:KUwXt0Vg5U7U2q
                                                  MD5:4ED1E006F06AD3729510D7378A212ECA
                                                  SHA1:9593C8D1FA14C63996231E3D2AFAC990066BB72B
                                                  SHA-256:D2CCB02C79AE185B559C8E67F1B8C0548D8E4EC5CA3108E5A5E55E1B3A8A56EC
                                                  SHA-512:669F8E733D3DDD22DD1EB57543C15ED93D6B809D8D8BCFCCC031470201C8A69CA2BED0856F6F6E65F55220408BC503CD088337DED1E5C821EE3C45B6069E81EF
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx.b...8q...k[.[..d..........su\\..... ...Y.P...n66....Srrr.111..x7.m..cgg......mmm.........M.0.AAA.....Wyyy.........../...?.~)...f.!.o ..].....#..jnj...6.Z1_Tk..g>.q<_.$..l..th5;T..7o...M.A.^..g.......0..=~.X.m......q..$dJ..u.Q...Q.c.L?V.%.a..<....Bl7$...$FU.?.x.......Zv..8Z]...2....x......[`Y.A.q.......my.x...!\.....+...L........CXu.l...../.%.q.~&F......J...(......p8,.h...5MS1t..T+4.A.V..z..:...yOvp...k..r...x...`0X1.!.[..`Rs].....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\reconnect.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):643
                                                  Entropy (8bit):7.573316073556545
                                                  Encrypted:false
                                                  SSDEEP:12:6v/79iX9NnMnsG7gq/yhCsdhdYq2J0cO4nffMV575gNgx8pKW8:g6MshPdhdTcO4HW575gax878
                                                  MD5:CFEE3117C2DE2066E27F57CC9FD96817
                                                  SHA1:B0F2F46E69CCB08F637C2B6FAF458F770D4A3173
                                                  SHA-256:C2D357A18177CA549BEF2F6620593F4D3B314281123A4A1D0E9E4D23548DF75E
                                                  SHA-512:D6C6E714FAF7170E8C491EFB922F9814301F59B4647D7700D5108C67015F401992D3E156C579EE79ADB24309EE5F7169DB6850B5CBFEE8437F620C7981FF4727
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a...JIDATx.b.p.....-...=.K..`......m..*.mk.l....m.4..........I.T<.uz..LBU...J......N.(..n...;.s.y^qe....c.B..LN.!.O.-..k....D.k..!.E../_...H.Z.@..u.|y.:.i...//...%LZ.B.F.@0..5E.zK.j.....q.FN...k.uZ...u..r.B..k.\a....`%*....~..\A.a.$TY@....#./}.!....m.?..x...n.D...]...J.i.@..A.<..Q _...:(...4....c(B..A..."~4...Tv....N..n....(%.0P...M%Q.I.~%F."1.A...g..R..+.....m.......t...nI...q.......n......k6....0.]R...2.B...T..a."Ah......n^|m.T..].aC!....e%.j.j6..zv.....T<..x:.Y.......m...E:._....+$..!tM8..q'..kp._@'..!....b....*...9P.Q..7..1..*...f.?CR....q."......X...F.1..fo.pz....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\refresh.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):451
                                                  Entropy (8bit):7.376232864388554
                                                  Encrypted:false
                                                  SSDEEP:12:6v/72ARUCiAqlz5bCfnSmE52RGmLSt3l1RLXFK42ec:Ah0unHE528mLK3l1tXFxE
                                                  MD5:CD9BAD2367655ECBF4F0C18F4F95F4EC
                                                  SHA1:2BF6A4709A63BB9BF88E18CA7B8F0C50F6D34B0E
                                                  SHA-256:F4D6DF9DF678C238D9CB471E79A8C1176B913574B4993ECEE83EA53F974E6885
                                                  SHA-512:1DAC7C01AB13F2F9743BE993002F4C92B48C942F95BDED0A4548D2C7762AFED85AB72A885182943FEC9237209533AFBDDE633194C6EEECC8302853A0AA7FEAE2
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx.c.|`...l....$..>qV...........y..Z.}...b..*..Q....znxV......5....F%..../....+I...f..ME..U..b....+..D.arV>j!..f......y....Y.._4..H.eAT........!y......_....j.2@V].`...~...|..]....X9x.q. *.<.l....)a...k5..D..p.`...4.L....ra...}L...^.._0.Y..[......! .<...g,.i;.w....-.......$f.P.Z......{...99Y..F..e._.W....x..vxO....w.._...oV.aa.....2.Cp~dH.V.........k.....N..g.I.........r*....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\remotetreeview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):518
                                                  Entropy (8bit):7.417467319549082
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7mKafKSkCiS5/m6MDCWWeaGWoStWi/cvI8SVi4rF:GafKdC/M2WWeHWrtWvpSVbF
                                                  MD5:F2D685B4359744ADBF97BF035D78F23B
                                                  SHA1:CCBB897C1C5A648CE5E18572B7EC9DB172763B21
                                                  SHA-256:13FFB9AF847DB4E83B1D323405429919893FD6180FE0ADCE77A1B390273C1E5C
                                                  SHA-512:2E5CD42B910A1138B88C563F7551E40FACEF918AC0A8C4C5F418E5D93396FFA58CD792A40A1BD1AA65F47B21F01A5D471D68B56D90E3C85DB59D751BA1821DFC
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx.b.....s_.n]..wN.2%...,.......k....&&&...WXYYM..q.e@||..........qqq....-..q.....:~......._ZZ.h~,....0..v.....p.......W...pwwww..........hy..K.n..?...Y.f}.7o^...._.....}6l...$I...[...=..O...C.Y.O...'u..M=x. .t.....3..9...K........._.?.".?.......Vx.D. "..H....DHFk,.1...~YK..2l..l.u,...[.r.......N:0 ..>.-_HU..Lwn.Z....i...pz.'c.w..+.$.......&G.fG..NG@..9.=....g....!=.=!...YvN.2.g..o7...\K./_+...........c.hCI.._+.Th.....o.E.~.T.2H.....t.~.&...5".{....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\server.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):453
                                                  Entropy (8bit):7.424482970442153
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7+MiblsIxWP1e9HQczNnon9IM42KpnHKfQXy8Ryg/2c:W4lsx6imd275892c
                                                  MD5:B7D268F710075D632C748655173A1E1A
                                                  SHA1:536139C0B6F6365209C1EACBF74FC156A06C7A58
                                                  SHA-256:2F3E82E18D29078F0D04233DDF0E05AE840AF25E0983666B34DF09EDE4A72302
                                                  SHA-512:2858E090916869768073A3D2C884A793C12493C34AD8EF6033B3E8BECAB79E10A77CA5353C553E988558516948F14C72496A52D379741BE8411EB4B1EB9E0A68
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx.b..0..\.q....W....4....|~.....Y......'...1WNI...?.u.LL......^............6...|.cff.Y.....a..t...a....*........r\..h............."..y....@#.m}.z..d|U..?A.pMre...&....S.@......7.........,.(..........I.3....../_.$)"...W.?%|......6..0...g<|..,.o.i.>q..+..R.O..DQ.f.........E..Z.....=.....N&,.s.h(...8.....W|L.Md-.K2lQ.........v.F...}.....=...,.(.s.:_.~..s>.........`0.#"..V........s+.6|U).....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\sitemanager.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):595
                                                  Entropy (8bit):7.5078827190688235
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7QSNr/5eTiRhU/PQD8lfqrk/QiQKzEBIbf8+blD8nRoVPO9:eBvuIkfaiH8Iz8+xDwiVa
                                                  MD5:856047460F44A3D0582F396D76367179
                                                  SHA1:7CC18E999B5C1DC155E6FF547DB2AA20EFADD450
                                                  SHA-256:AC97A63EBA30A43CE50D13779CFBD237564F282CF76D9ECAB9E0616E765181FC
                                                  SHA-512:661086660BE0A8059C3C3577114BAA40B61901A4E8AB04C968B077DF96D1485F4B47B94A156334ABE82F59EC499925EC83C188B356E1078C7605F7F1B60DB9F6
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx....Q..s^_......5.V....<{.Z..l..k....Oyq.\.........f.X.iX.TF..J(....o...p.|...{.r.h5.~..,.....B...O.>=.....d.ZeF..?...8~."........F[G........{...v.......[_[...4.....B.....9x..&.... #.L....p...c...&..vX.z.|.@...V.}.E.I$a....h......B...'.)...H..H.W.....SF4...G.. .......4.z....r.5X...E.....5....q.\.......y......~A..[[L'.-Ox.RL........k.'.%.1...(....W.w...%.....G..Y.J)^.0..<.....H.3..:............$.@....4."08....5.....7......l6.|.@.-.r...{.....tDy......../.N...`.A,.(...N.../F..lZ.2.o........'%.).8)z."=.~...b....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\speedlimits.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):438
                                                  Entropy (8bit):7.336777520323256
                                                  Encrypted:false
                                                  SSDEEP:12:6v/73deMJXe6o7ZpQkmPNVRrLBz/SvM3hHLs67:SxZefd2RLRp/WyhP7
                                                  MD5:D4D712A881146D80DFBD85AAB111072B
                                                  SHA1:D9422C016EE632EA7DD7FE66E495CC129B8FDECF
                                                  SHA-256:14FC705B5CD6261A722C2228332695463B98A2F7FBAE97E457CF096886D07651
                                                  SHA-512:864B0C623480C2C661D0447DE44584FF720F9C17F6DBAFD425510B0E28A9F2971C8065C5BA8DCF5135CB384CBF49A0E7135CBF6BF9563745189894477FFC17EA
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a...}IDATx.c..FAZf..zv.pbr*.._TT.^[[k._......iU\......~.Mj...n..fzx..e`cU.W...r.{..........^....g.o...Y$&..U3...f...;v.......o..7...Y.qI..................`!....vt..j...\.`....0H....#15.|....g.&..X...g..3..F..y.M.e.....qx.L.WP..'0.....lp .H.................N.........Z6.!`AF&.CG._...y...AB.@..6....@....Cp.v.y.Y8....Y..:*..ddd9.}.7z..]PTV...]bm9.......i..J...|a......(..h......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\synchronize.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):436
                                                  Entropy (8bit):7.401420692537156
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7ukuCtTNzrnskOOaV2Z1JRH6tCIF3gJi:hyhf/OOacRu3mi
                                                  MD5:100FC761A41F80BE64C52A74F64CDC93
                                                  SHA1:5CB3ADFFDB0B4F3FE4F4FC7521A74B88A5431EA3
                                                  SHA-256:C063BDAEB8F6230E543D05E61A1A46865159A2EC4FFF230265D6D0D75FDC103C
                                                  SHA-512:DEE91D2F8B88C2E24C7BC33E00EB2FC96F0306E3295ED1E0C7B9283271DD794C4F19AB008EBE3FB5109BE4C990EA358E9622AAC7A0923653AEDDE17B80C61EAD
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a...{IDATx.c.*....'Y.g......f.9G.NX8..d.....jVz>...2..3n.z$...>..\y.7.t..y..7...X.#YuaM...3..`.2..imN3A|.F....._....D.+x..&.....C.a......6....aH"...i^..m1gNL...5V....L.{C......D....../n.P.a.5m..:R9...7..,..w7!)v.)3M^>y..=.%/?.........e....0s..5-{....)..u...a-[.}U5.q&......w..M=2.K..~z..=Q.......}.tl.6x../y.....f$..._|...-....l..Q....3.H.............g...r0.j..L-.2.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\upload.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):377
                                                  Entropy (8bit):7.27263470317427
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPWZrdubw4OMYzd0JxH1cOsWXrsp6CdcKP0Jd4a5+7zUrTp:6v/7mrdZ8dX3CeKPpUr9
                                                  MD5:E1A965661F46E68691390D35E366EF7A
                                                  SHA1:2D969BC64AC8D796935ECCE48C81BBC00A302E94
                                                  SHA-256:80F945E32B6BDDBB23B5BF234DA17A8828C246D6331611A3CD0B51E4B1873174
                                                  SHA-512:8E09B9974ED7E515D167518926EBC53644156505BD3F9EC261BB38E1D9B88A94EEEFBAD71047033560FC4F79D69943D5CE06E99BB0B9C62287CB39D5AC0FBA08
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a...@IDATx.c.)........,.jv.Ye.....JL$Y...lf.n.......w...G..=..5....nu..z...W6.......t.....j....-..+.9|...y..K.r'^.D.9......jN.,.^.~...T..z.p...MNoT.}..BP.S.D..i..:..?..p.T\......Y3....^..dE.E.\IR..6...&....R.8yY.9yY..aAQ^....0a...x..E&.......Z.,_.|...........x....-.8q.f..u.D...si....^Z=.p....q.9G..,8Q..."0}..5..w.^+....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\uploadadd.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):511
                                                  Entropy (8bit):7.348600466901681
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7hI3cFJiHh6cX9XPfl2vqC8rI/argn/aq4B:WI4kRX9XPflC8rSargyH
                                                  MD5:37AD622CB38008845D98CBE0BA8D4D68
                                                  SHA1:48531100C28E537318ED291D9A1B1EDA76BFD675
                                                  SHA-256:DBA3101B9841B204B7DD32A8120DBAD439367ABA633AEBB3672B917EF6005FC3
                                                  SHA-512:A2426F2B3C7CA1F42B320E7F9EEB3A678E65649512B2B7DABE15F6BB9ADB545A0FF5F1DB33B4F8A48673EE8FD85E64EFD8C2C7F54CB320151854F54FC0FFFEF2
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx.c...o..M...pp..?uF<........0...b...{!.j.\6...4..tZ...i...[...$&*.P...F.n..-....u..c.dF5..=.[-.S.ub.V.......Z..I.;..........f..5[....p...f...........^...P..._..Q........MZ>./..e......`..6:.....4...r...KW.p.4......%....=.,..rE...{.Ari.....V./8....N/...........y....._......#....1..+..@.m.._...P..5......ev...3.xU..Trn.Q.q.K.......EKl/.w..f.`.f.....Q"...D.......p..Y...c..1.`.e...l..q......8q.a....j.1.P..l..z.go.....#Q....;`..=..l........IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\ascii.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):974
                                                  Entropy (8bit):7.737825415231118
                                                  Encrypted:false
                                                  SSDEEP:24:b130h9bovyRkp8KOR/Nuu2p+TLpEbA+mLtyN7:ah9bfkvQP2p+TLaA+mL0d
                                                  MD5:FC4B7AAA20E1C0016CB37DA7A87B4187
                                                  SHA1:6863AB21E568B3A1C8805C6FA5C35AE142713D01
                                                  SHA-256:48FFEA8EBF7AA5471B40E10EC19540550F155DB687F5BCFA12CAD1FA52A79196
                                                  SHA-512:A1D8076A9AFCFBEEC25CA82F477F32B0DCEF825506F34CECC6FBC74E2401272A0587EE6154BAC8BED97772395B88E6665CE6E4CAE38DA72B6A72B6E491BC037D
                                                  Malicious:false
                                                  Preview:.PNG........IHDR..............w=.....IDATx......I..s.}W8.m..m..`..m.6....~U/...t..L.Z......S......\....... ....1..f.......xacl.Y...........nuvv...M.......KUUUJHH@ j...&2.AA.V...~..)."]..8...~~>....S,.S(.Z....C.fR.zW$088(......FW#..YV`hhH...W.pX.HdA.z...*11QIII|#F.__V..4.r..Bs...))).....z...m..@OO.(....~........TCC.ZZZ........8...3K...g.iMM.222..7.6\R.&OLL(;;[O<.***D......^y..}..........N=.T.m.x.SY...{.....=...6}..K.pL....V...._...>Y.........1B...D..SO=%..y.....q..~1.>..s.../.........s..Yg..r.!.;.6.tS.....T..?..@aa.....D..yyyS.b..>.`...V.....T._x.Y.N.s.@ev.VV....+p.-...O>Y..t.I..@Aa.A.....h .1Q__/J..>...m..X.BM..F...A.3.g..-....#.=.{W.+......o...~.iV..u....q...f....)...f....A_m{.N......[v}x/........T...b.L8....y.$.qO ...K....N?....x.P...>:..Ce...=e.......B..p.9..N..pdddj.4U5..?~...g..._`..6....%..*.(&2"bd......h.,..).../.}.wou..O.~.....,....|>..].......\Y."'5{.$.....e5.._s:VM.Or%.X.Q..~.....$...X....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\auto.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1140
                                                  Entropy (8bit):7.790902022199737
                                                  Encrypted:false
                                                  SSDEEP:24:oEyeBRdfOZSpUfpRwtrFu0snbOkcb6trMMJ57wACfE8InqSce36bP:oEpbfOZSpUurFHMbbqoMIZCf/Iqleqb
                                                  MD5:BC3780FC5B18962FEB8B65DCC502947F
                                                  SHA1:92A488AA58EEC52BE93BB2CBD922366552F5DBA1
                                                  SHA-256:B323AC62524DE6E0762AFA36232C3358979E991BCD1A94148F49CABAA6A6E9A2
                                                  SHA-512:1AC34F9BCCC48A37E83BD523F0851AABF9A0EC802DC1431C7CF08C90051E6A21D4CB650D3683CBD3EE6B43CC98D6ACB1CAF2EF79F601933CC54649998809779D
                                                  Malicious:false
                                                  Preview:.PNG........IHDR..............w=....;IDATx.....,......S..2.BT.m.m....Z\.ksv./...1U.q..}.-;....}....mKK......g.2.Q.........2..dCR.-.....vohh(Z,...,.\..0H..kU>...pP__..t.F..V...1G ....v..A..f#...J.0M.r.L.TZ..%y'W...RWW.2.,:h..d2I0.T...*.jE..u......D".".Z..Y"...r..L...............&u...!...:..D.D<...(P.T.*DRe...F=..T....b.........:;;.D.....]...c..1J)...........&|.....p..,8..t?v...IE..g.....>cp...so.|...H.L....W...2.....*5=...Y$..s..`...cQ.G...=...L..`......e....kM.........c~...a@|...@>@*...E.......2...=.7}./....%./@.....y..."..`(....^..t..u .B..e...J.b......~$.7..G.....+...U.........C.(+..T..LNNRSS.&...m%....0.T...\.9|,f.N...V.>..v...3..R....0>>......^.*...N.[..;...1.xq.....x.Q0..;.....`.TY.....H...._.U.;..b6..|JV.S.&. ..1...?a. ..@!...k......k....g..i.....a-.lve"]......aB..9..;.@.$.......Q....t.tUD.bi.>q..{.O.......T...].ER&..`.dW.......{U.%.UQ........<.SZw.{.....?.|...s.3..W...........1:F..z^.M..jR.........w&.=x...<&7.........'T..n.z.2%u.lZ.r.LZ=/........

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\binary.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):937
                                                  Entropy (8bit):7.6980039972192005
                                                  Encrypted:false
                                                  SSDEEP:24:1JFTCWrfR6ZwuHHP6SS9n/UWizCaSLXSFRQz:jFTfR6ZbnPnyn/S/O
                                                  MD5:EE92146BF93ECB0A94122CD3C955E30D
                                                  SHA1:D099EDB6DE7A773E7A1824B53337381E2A9A9009
                                                  SHA-256:0BE651BA53E93E0D445E1B04823546140865498D506B90CAF039B2DCF9EDE48D
                                                  SHA-512:E226E07183CFFFAB750FEBDE3632AA11D91E3C313905D305C7FC9DC5BE75A6889C4B2B49D288BD7F1F0F0209A22CA4D37CE42C7E6AEBA9FA04F1EB741BEADF8D
                                                  Malicious:false
                                                  Preview:.PNG........IHDR..............w=....pIDATx...S.dM....m...m.....=..m..'.F...9s..uWU..2...I>i0.N.t..z.......|+.B.,..Z...%..o...G...D.J...4477....555...u0.566.n.C.P.R".I...*>>.7n. ....P..HMMEee%..................\.....G.W@@qq1.........#.......(++C[[...`.Zq..%h4.Hc./ .=.JJJ..j.*.u........QQQ.X,...`pvW.G.ST^^...&.r..WEUUU....<..67..."SqqqHNN..[X@...!}C...-.A8.>}.@zEc...Xt..G...7.d`N....dr..l.u..10....3f.=..A.w........ep....lPO<...}.YP\.....v..G.y...s.B....E...{xDp`..]@UTT..o...]).o..#))........V...Y...q .....]...{...Y.j..w....s...b.<.8.....]+`JD*..k.:..4jG.-.6A.T........Kq.S../v...........^.7.. ....`.5K.+......M...HHH..... ..,.+....;3..x.=...t..;..&M............{...g.}.#.......K.....OW}y.5..=....?4.Q.Q.p'..@....^\....?..D(wt.f....%...._..5.B...0t..X.-....Nf...0....f`PN@...I.yr.._....==...w....`ALL.w&k.&..b.....V|..._...u?. ......x.+.J.T*..qR.0M..].....?"m.#z.....f.y.o.?..1'......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\bookmark.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):336
                                                  Entropy (8bit):7.060004696530624
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPZ1dknD9coShCc9YUNj+6V8hSqmSjsTrepz1Zf8XZ0QHD71Wj7dp:6v/7vm2oY39YUNjR8JoTKtzf8XSQHD7K
                                                  MD5:448C9566157A6545B55BBC65EC035274
                                                  SHA1:D43734EC0495586C77236D0CFB119BDE15717E92
                                                  SHA-256:D337EA13034EA808D6C1F42BE4E5EA548F297F4C24F617A52CEBEBD71422F2A5
                                                  SHA-512:7C040FC59597D7BC2DF66DF43E4494BC7469EE7E1136A4F74279F20F747736C248D1D16A5B8A32EB65FE4678ED2D5144A9AB23250D032FB2BF86B4F580038688
                                                  Malicious:false
                                                  Preview:.PNG........IHDR..............w=.....IDATx..%P.A.@.w.]#.c} ....wwww.....qm;..g...[...?.V.k.b({.N.l.....'..N&...u.\..".....'.&.+....n...?..&.#..}H....?....M(Z..\./P....Bd..g+.z. ..lS!PC..9. .....@..6U.{..@.....OW...@..8f(.j._....<.A.W. ..:.yL|{...N...$.6.-^...W.a"8......*...x.'."..}.X......'.....e@.<..5.........tv....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\cancel.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):615
                                                  Entropy (8bit):7.528080158719681
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7MSsCEqt65tCs7Y4ZsIV+/nLy4vJ5yejaSsdbGQwiTg80i0v3liN:hSsdq8y8/S8+/Ly4HVjuu80iE3kN
                                                  MD5:FFC4084C925A44B9A427CFACB60B0D0D
                                                  SHA1:CB8A06176436D64E14D3EA1D160AF2188CB99B8B
                                                  SHA-256:8541E3327C66A84F2992EFCA3D3816ACF83D0595257725C65830324EFBE6B55F
                                                  SHA-512:3A9F20806CABFCE664DD264516F836D7D39BD5D38152631218EF1290E2A1AB18A238D7B247B2E8A3614B6CD6237F4191FA651F123C3B69FE2FC5C083CF90D095
                                                  Malicious:false
                                                  Preview:.PNG........IHDR..............w=.....IDATx.....@.._m..A..m.ET.AmDeP.8.....$..6&..f.|k...i)k..?..?.~\..._....;........a..S.m+pV..)....[.ow7`;\u.../B...o.,zST.:k bw...........m..WE8+jM[.2.c..j.;.k...0.........e.)...=+-...U.m.r>..d.....vENV........~.2..^.....g..>....D.E.^..IQ..V..8..P.7..M.....kc....0..;H..H{t....<....G)...Mg.o.pT<-/D..l....:./.9.V..`!.............,......Jx....`.?..X..K .....<........F.K..U5......1...... b.P.ex.)...%._G.....\5,@...........F.S.....nA8..........wBv\4"WM.#...1D>%B....&...g.....x....:.......{...[.y...9.y...o.0<..,.>!...N.'.q.%.Z!.w.q;:...2.k.............IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\compare.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):726
                                                  Entropy (8bit):7.594404615240779
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7lRMudVR9J8CRW0Ro6eTmE/gKhnnRzMjJNH/GfET3hgJ+EOkOc:sJ8T0RovTH/g4RzMjbuuCDND
                                                  MD5:E94D9F352059F9FC26545563E046FED4
                                                  SHA1:7EBE17DA2B2261342405AFA3610A31C663E0DD8B
                                                  SHA-256:228CC19E705FCA59A99232DE6845C001AB5FC5A04815CF842A281C610B56077A
                                                  SHA-512:5724CE476F98932B01EAD02D2C454E8C3411ECE0B3393958FDCEAB17B55E441ECDEFE6656036CAC63A6F6A152776939BC2982015B03B7242DB17FC29001BDC79
                                                  Malicious:false
                                                  Preview:.PNG........IHDR..............w=.....IDATx.b.:`..X.....08k.m.yk.m...y.m]b...6:.7.u......O.f.3...HZ.........d..DB.....(.R...:........=.I..i.t.......".....$......l..c.....Fj.@.....$?.4'E...Xj.}G.?/.....M..x4.4...L..'.O.......?.J.!..pQ.J..&...9>.....y.*R...,.vDZ(...U.'.....R.j~........+...J. ..G. .\.0k.6...J.$..G.P@pBh.2.(....U7....x/9.....:.c.+..K......tg%..W9....q........:T.V...m..T.B.9..B....-.D..1O#-.T.y.....)r..@x/.g/i..-.m.'. !..F..?.Rd.5.7...N.I.?..*../7E... ...h.h...m...j...VG.2.z.3Y>VLgF.l_n. .r..km...3...."...mTx.W..Hnc~.4...H.q..m..;.....S ...{..........I...\.m... ......ZI..v..1Q.......w.........B......-.p>. ..p}..|t...(..?i.{.*..@(........3`..`.....L..i.N....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\disconnect.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):913
                                                  Entropy (8bit):7.7371366739927545
                                                  Encrypted:false
                                                  SSDEEP:24:DVlj3ZV/IQi2k01lsFZf+RaCGYiukvFCvqKjSmI:/rAukrZGRaCGYiJKjSmI
                                                  MD5:0151B253AA9748F37487150909477D10
                                                  SHA1:A48EEDBC8DCCF233EAABF8F7D045AE65DA6BF3B9
                                                  SHA-256:C5DE1A69F932CBB7EC2F25E5D22092CA37033C1D1DCFA366E080DB9B271A6A71
                                                  SHA-512:E730CA426B21141FC453ED09ECF4582FBBA7AB3C2624CCF924F1D3DF6AF61865CBF44742D3D4AAACD76578A860F162B25439CA91FBC923638C57F1C5EAE2D833
                                                  Malicious:false
                                                  Preview:.PNG........IHDR..............w=....XIDATx.b ...37?@...dG....m[c[k..<.q..mO.=.Al.\k.m..;6.9U.....e..X.|.....r.......r.........=.z#4..F.z.f.r.....F..V..N..j-f.T..@X.b...a..X.e!..c.&p..H^0.#..3.`....i)..c.......].E..Y.y..F.);/Xz}..?...!.....S..p.N!...3T.....f...P6..^..Z......T_.fN..?...e..i.y.0o...."......$...^.!..6.....v..._..$. ..Gpf>LS......v.?...p..h\.OB.0..8./.^?f.6..Q]...<.....x.'&C.Y...8a..."......3..2q...ft.......f..5..Y...V,ot.5...C.j..7G~gc'.....^.G...O.......D..(bE}...+........,.;......w....@Q.@uu5dYF}..]*.....x>...]......W@b.s.^.P.z......8j.%......0Q.0\[.u..Q.e.....=..q3.n....}N.v...G..`...i.Pg.#. ..=..W..y......5..:7.."....E.....r.:S..y.p..{.a..W.qF5.Y#~..F..h....%.Wc}..K.O.E..8hE8...%.`Q..=.t.?...{..79......@..X...Cl|..a.#.....F..!VV`Ar.D......a....]`.3..+UV..l.S...l....[B....."[...m8.e.2..9hI.v......y.....h>...........dH.....-....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\download.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):299
                                                  Entropy (8bit):7.104393007839961
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPZEhyYKUgxleGDjRbPFEvPreShMjVfxXnAMBZlVp:6v/7Cyv/oGDlb+vPreSk1xXAMBZ1
                                                  MD5:6EB5C63C607C3DEADF6CF144B3F82402
                                                  SHA1:9EE2F3A11E1FA83C671BA9556584033580873DD5
                                                  SHA-256:106335897D934523FACB371122C197FE6155CF780DE1B3CB4A5A4058E7B34D74
                                                  SHA-512:5640CEF022F2F2570BFCF76408F1478AD61D43F6B5207451D1673078893A1392C7D6EC1A4901EDE38527753DB74D3904547D93D7BE2FADA04DF7F0BF685B581A
                                                  Malicious:false
                                                  Preview:.PNG........IHDR..............w=.....IDATx.b......i... ^.....:..0.g..%.G..9.5,.m.md.u.q.....?..9>.s.b..Z.$@... U..kQ.".........;.U.p.(L..'....mK8....PB&..z:*....u)........X...w.}.?....p...-c|I.8...ip.....E..=.....l.#O(F4:Q.d..c.z.o...2@.o.-....=..+....".I..h.C....1.$.gJ.q....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\downloadadd.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):406
                                                  Entropy (8bit):7.335297639701669
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7NxMGFpOyAUPHv5/Pn/5VOmMxj2VtS7GPj1T/uF+O:MdFgyAUPHvFn5NMxj2SCPMF+O
                                                  MD5:5F41EAC0D665C8F09FE2029CCE593372
                                                  SHA1:AD847EF603FF3010F43E49DBB5EDAC8F308B05A9
                                                  SHA-256:5C094635BA52273033E7E58FCE6464508E5D7FB671BBE6A0CB9C741D243CFA0C
                                                  SHA-512:E814C67EEC32114EA38F6695EB7D0964049ABB7A632260F0E4B2565D73ABEA8D9CFDE2874D3426EF2CAAAC2314C2132A68AC54C8EB37A38C8A81EC4F0AB331DC
                                                  Malicious:false
                                                  Preview:.PNG........IHDR..............w=....]IDATx.b......i..n .bFlj4+...3.\.....jb.MT....ul...m..=..<7k[........*H@./.~..6-.=..5.....;...nv.#.h....x....u.>b..g.q.[%0A..A G.?A...$.Oy..w..M/.C....DO.p...............T....m.........4L...&.e...S.|...Z.....tq......".<..8c..Co....>.......U.iz.....%j..B....c.M....>.."7zJ.....~g.._...J..]..<'.x....kt./.Q..v.{..f......R.E.).bh....8..,.......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\file.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 24 x 24, 8-bit gray+alpha, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):376
                                                  Entropy (8bit):7.2672979681476715
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPu+qx2wNLHE5UAD6nvgLA8WJCfxCHf4C1Dm6023OhHTwvuF2SmOtM0IiEdr:6v/7mPzTG6vyWJ7/4Km6URTw2FKOq359
                                                  MD5:EE6C02D4B8613DEA4746D8EBB1925488
                                                  SHA1:D219832F847C56E5512FFB2801F5F4FDF4D63229
                                                  SHA-256:244C74E11F248FE30E324BFBDCF1EA36C8FA9C7A185940E83C7EB3F8927CCB32
                                                  SHA-512:7ECF0ED9218C3EAAE14BFC4C7FC11CF82A6DC9BEB8316F1955C167FAC2836623F4B44A2BA272DBC6EF4FAB347E56726D6E02C44D1A6F31156C2C7E5B242B1769
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............J~.s...?IDAT8..AN.@..a.^.Sx4..A.)L(@ii.......D.HL.P......*1..t..._2o.&...1s........[.V..Cl,..Y\s.......:.sF.chl$.b...A....'.N)``4.A...|$..@.~..%.x......>*%t.D....!.....q.%U.I.......t....v.p..gJ.`...iQGM....$2".6U....0Z.../{...?..QV.>....X..K....>pq.. ......p......c^..za.......G:<,t..9.N.D.......0e.lW.............n.k.-.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\filter.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 24 x 24, 8-bit gray+alpha, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):216
                                                  Entropy (8bit):6.680528840864718
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPXiyTs1JJMxR6zpFd/ziHB8toxs95p:6v/7qZJM+zTd/ziHB8toxs93
                                                  MD5:F5A5AC8F87E4E6A8D1DC6B7583D2614A
                                                  SHA1:017B80B5DB7D5A5255BF308D49D22FCB9738D9B8
                                                  SHA-256:6DBDCA9A1B77F3810634D2652C38A6327C49FF78AFD346B0B61B671B70C96AED
                                                  SHA-512:D9381B0794082CA12170F39EE4564E7C4A34CC06B046BB5F7B8BC7FF0AB925EA999CF0EA216F292A880AFF07B1963C6C2DA256FB08B5F7AE22F7C5EB345C684F
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............J~.s....IDATx.c`..4.tA..y(pUi7n..J.c..qj........:.!.1...._......._.)...B..zx=.....f..+.....0.K..^..I.S..K]&2>2.3~......I...................@..HKW...J9H.bX*.0......q...Q.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\find.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):785
                                                  Entropy (8bit):7.654297878181793
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7yylkM/HHJhGe9RumEQc8CudE9ZBfV2NkQWNEL8FvkhmCyJ0pm1qWz3mJc:pyugnJhGe9RZ5cTBBfkCkhmCa0IxqC
                                                  MD5:C17844F31C2C465D9654EB678B8339EB
                                                  SHA1:8C52453717F57735C758EF78B4A07396C9AA24E1
                                                  SHA-256:7D194E1E2F2C08124858BE9AD9DCAAFBE713EDE2243488308B506C2510FD130E
                                                  SHA-512:7BEDE7A65B4F0F913504D45392812904574A4EA1FCB12309260D5BA4BA4F186457AF1ACA7632D7AE78610C6AE0AE73508AEB7446BB7ED83D3BDF8C661939B5A0
                                                  Malicious:false
                                                  Preview:.PNG........IHDR..............w=.....IDATx.b.-.....)9..v.`.......m.6W.m{.c.mb[.~....U-.u.Q..-...,X:..(..R.%8Z....ZI-]{k...6..8...mY.!...X.U....u1.-.w...4ql....;.VU...N...Vt].1....._;...^,..XWY`.Lu.g5a...{....^..ev...6.E.....j....C....}h.B.......]..F.1.C3.g.s]...6@c.........{....w..<s.fZ..........S...np@.....<..v.#.$1L.fq...$.}(...m..<.......-y...Q}.4EBW.2.c...1....p..p.pr....im.....*.).O.-Fap.T%8..{...i8{;j..s..uYJ...x*.$.k..Y....:...#.P..V.%..&..??......c+pX....y..l..B!.....f...(.t....!>< ..."6s.*..^..|..SWH*.....kx.....(;./..)..\p.d.v85.5{l.. .....#kJq.`...%H.[..y.v.......q....i\.$..].....E.....2x.-QM.1.....'.....|.3..N,.....G...W.*....H...Y.(..;.@.gX.4....%...........'u..m..WW..5u......g...a|ZFF......F.....'l.30.(....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\folder.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):493
                                                  Entropy (8bit):7.469694044352245
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7ZoM7fc/kSWRwRPk8tQxAIT7HggQ5rwjmpDMsr9:K7E/kZRwmuQWMHRQ5MjI4c
                                                  MD5:FC529382E4849ECCF70165A5D70E2F2B
                                                  SHA1:1E06AE9A571EA679DD0BD2201C0A1EF0D33FCF58
                                                  SHA-256:589CA772823495E7348CA5EA31E26BC1A0E32696AE6299815F7D1124E7235DC3
                                                  SHA-512:428540D9551A182F6B3CC32427F0AF27E6D0BA89EF885624A23FF6B617995559CFF2E48B720DE080791883F6A1CC12495AD71ECAE94CD9EE5DB5CC30A4B10A7C
                                                  Malicious:false
                                                  Preview:.PNG........IHDR..............w=.....IDATx.b..`..X........i..m.6.r3...ek.].g._n.6.=.w..w..w:...S.jsz.LY*.0..i........K.,.1..9...........`(wd.,......46b..U......O.....X..."b...k_.U......p........ ..Zr.O&.U..s.o..CIK.j..-....m..-!......2p..x..L......M ....#C.../Y....PdC.D(.....i.o`.....;g.{~.rG..O....{..H.X.=.b...$.*M.p...H?Hm..-.....f1.+...@...(....L$-b.V....uk.......|..Q......W...M....}Pd*..U......6@.3ECo$r.d.N.2.......>P...Y....9.bw...frzo&..f.n.M.g........n..F..R....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\folderclosed.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):368
                                                  Entropy (8bit):7.132051056446801
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPZtHNQQ3vhoNsBCVv0BMKtPtFmum/Ppqwg3vMS0dNqbF7suJ8Vp:6v/7fHGQ3vhoNsBCN0BMKJtHm/Pp/4Mr
                                                  MD5:6A85ED30E0EFC752E16305A95EF4E849
                                                  SHA1:CB7983F571A5153DC24F7C6937E6E44A30CFB124
                                                  SHA-256:38195DD0C38D027F9B72A5ED03D589BC34B7D7CD005A106EB830770C06DDF527
                                                  SHA-512:5A8BDA4EF2C49AEF6F9114EC2E871627A7B3E57F049CFAA8F3862C9EF32902A93A159A35FADAD9AA6558754B46974D4D4DD415B3B25943E42111A1753B465C6F
                                                  Malicious:false
                                                  Preview:.PNG........IHDR..............w=....7IDATx...%T....q*=.pww...i.@.......[...x.......[..I..Z..T.0..]...9...^BR....~8...;.G.!-.D....*..*..X.~.0L. .8..y.6.......t.\P.E.....E.......8.`F.A..q.. ...|y....@...C...(...0g..4m.d.....fD.....z...F......#a$`.g..K^n..@.<#.<'.bB.......q.o.x...l.Q....y..r.,R..#<..S.l...R..j..r.al...-(.!+..w*..8.....<T~......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\help.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):255
                                                  Entropy (8bit):6.786152246961665
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPZ4ybSuLQ6q/SPmBpgQSqXxaop/jIsup:6v/7HSuL2AmBpLnvc
                                                  MD5:6BB536F8851BB9B09DC40C25E2CE937A
                                                  SHA1:DFCEFC70714787DD67FE4A2928CABEE5B742A687
                                                  SHA-256:324D6C797069BA43B0833CE66BF917CA7F91B8092EFB4A4E7CBDEF5BEBDE493A
                                                  SHA-512:5FFDB940A3F939E868F066E06C28C96D7F902F6DE56325690EFA37BD34AAA2D6987FA07485E71BCC7CEC23E4DB0A220337D535F395F3E605336E8C846B1B0209
                                                  Malicious:false
                                                  Preview:.PNG........IHDR..............w=.....IDATx.c....G..x.8..K....Y.i.......H.(.KR.p...x.6%.s..K$..q ..F.;...Z..dP'..Z$..r-..d...\$.\...h....s`.kE....I....@lHM.o...xj.>....@.M...5..-...$.7...1 ..bg ...%.eh.m...9h......Y N._...V ........ ..........IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\leds.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1004
                                                  Entropy (8bit):7.731346539563078
                                                  Encrypted:false
                                                  SSDEEP:24:BhAfp113zmjSU1gX0+FzqKIHmhjCxNTpbvSs1GngqFW:BeDqjAkymZHmQxNRSs1Gn9W
                                                  MD5:F447322C7F61EFD1034741AEB8608D51
                                                  SHA1:26B89C717EAA0C44A608746A350E912713B75D05
                                                  SHA-256:9B5D502A15760B6E6E18853C422CD88D4B0A76B977FA5E34CC6F747BF247E357
                                                  SHA-512:A94174533ABE7D93E1F61565C970EF6FFB2A018082846A7914E4473241A2BFFFA835E471295DA2042BFFDE2A24B819403515A91D1DFD2A010E8EFCC588AEB078
                                                  Malicious:false
                                                  Preview:.PNG........IHDR..............w=.....IDATx.....\Y.....c...N.k...k..l...k..~.....EiO..<.......n...wk.$...r..E.?s*$......]C..4d....y.O[B...x....(|.e0.f.....H.....)....dpPyIt$].o!@...r..&....W...5.)#4.N.#\.8..4.k. .*..0.%.{t......d.;.-..l..X` .......kb....j....^.1....`_......T..A...:.@$ H..1.D...=...."...t.Hg.@j..$... ......!!J...s.);.....c...(.G!...J@n..'..&....T.n....-.9,...I.....a...L`..A.....DEQ.....a...>....m0|%...V..u.Z..:\..x.y.k....9......5[..}x.....oh..z.....9...............V.).....e%.V,+.......O(...?3.."|..Y::;.p...|.m..l.-.......s{]]......Z...gFll.|...4vw...K..........{.SzA..F.z.I...PH30.Rgp..FnnH..5.;.......j..Gz2B.....>..m20(....d ...q...1vW.........y.n...V...A..z.Xv...$..4;.I..$+.....|x.h..4zg#...F..........Mx.Z...s...c.1.MFl...7i...1pY...h.V..vu.q................. !{.#..HG...Mf..H)y}.I/Z...v!.$.._........2.e..D......}PJ~..200..6.xG.I...>_:..0.4Bw.!..4...........&xw...a. .W9..U...l=.>V...!x`2*CgP..4.-.....?.........IEND

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\localtreeview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):800
                                                  Entropy (8bit):7.655347637725677
                                                  Encrypted:false
                                                  SSDEEP:24:MxRQ2LvlfQpouveUt7tWeGobpNvsILWwNOte8Ui:Mx22JIouv6obHzNOfUi
                                                  MD5:F93B941291F95BBECAB8C1E53F5725CA
                                                  SHA1:89A801FC43BE0C01ACAFCF2F82C17C2A63A3FE43
                                                  SHA-256:3953CCC93FA55F963A8CF997B3A4DA46590EDC7BC740D5075BD5E0D18681F7C5
                                                  SHA-512:EEC02BF8019D122EA784827EB763487A0A3715C30A941DEA1A3753B86493043B6035D71EC935C41C0F68E2DB83B92BC853919B32E9B3E45954D2AB61ACFDCD96
                                                  Malicious:false
                                                  Preview:.PNG........IHDR..............w=.....IDATx...lG.G.6.,.. ..m;..nl[..=.m....b.g.W.>}.=.m....._)U..jTJ5*...c....L.... $m*< .S.0t.i..B...v...Yppp...........S!!!.K.aaa.r.)....^^^.....9099.;))),55.(..6..lxxx.........<..k......................#11....H ..v.]C||<.!.....>@w...w.y..;v.....>OII._V .S......R]].......V:::.........6.....~......HHH...f.M....l\..iY...jhh.`aa.o...........v.W...0...< ?.[:9........s|.,.....N..x.(hl.`i...;.O...g....X'..]....~|.....~.!z...(h......L(9.j.......g....x.}..s..1..y..<..A...=........Z.$..|......w..&.UB.-d.x..?..m....$.E=@.{O320.@ff.z..z(<.J......_L..v"...=V.{-...~.};.326..YO.........`..t}.=.0.Aq.g...b...(....(L&.?...^....Q^^.z.....X..K...4.....'........S..rssW..$==]7U....[Hee........ltH.{Y.lT?.~d....n..'....*?....H.n.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\lock.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 24 x 24, 8-bit gray+alpha, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):344
                                                  Entropy (8bit):7.2060897285546845
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhP9FXrH1fld51FPLBBz5v4bnEO+FlGaFnlBOaY3p:6v/7DdP3FPndvKnEO+FblB1i
                                                  MD5:469F9922AB8B118250B9353291D3C6ED
                                                  SHA1:831C64A6CBA3D7C5EF8DEA6BC9236022F0CF0217
                                                  SHA-256:A6D3CA324CCD9A7CDE09F2F1FE652B4BCA2A7BB3572F746A83E03253B99FD6CA
                                                  SHA-512:134F14B5FEF2CB4CF2F125D450F3983DCD4CCF87F5373EE785785DDF70C455D652A062658A68A8F2D5F71A11097B009B961E5C46376EF0F72488E49B6CE59FB7
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............J~.s....IDATx...?K.1...Tp.t.K././.. .....7N...I...'.pPD.[.w..Pp....I.....<.J8..e..,y.....{h.........4!|$....pc~z.9.\F.R .S..F....q:.......m.lp.(......S8N.DA...;B...R...L.VP{Y.)z..3...Q.eC&.o_..5...3&.. h.!.2&...&.......$..c.......4....U....v.......!.v.b.).. ;2o...&.&./.;.j/Zb....sK...$+9....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\logview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 24 x 24, 8-bit gray+alpha, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):555
                                                  Entropy (8bit):7.41303447238569
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7mzTbl/n7xHvl1+csiwPR4Ck1WDnaQz3Xe8Qh29DQAd:tzT5hG4f1W7nz3XXqa
                                                  MD5:37191ACBD970B504DB017FF511DC33EB
                                                  SHA1:5D92208822B4F876FF70EBB2C4EBFAD0CA9C7489
                                                  SHA-256:16CF7F6C392A2FB7927B1EBC01E7A3AF458BDF6C3DC849604A4EC805C4D4A582
                                                  SHA-512:926A92E50E1F6C4948094DED4492B13585DC3F49F2274B871FD61E21AD4456F27AA0BCA72ED4D1D3D67DD307AA60FD137F63F41C99BCA873BB95E8280E8BD8D1
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............J~.s....IDATx...=..i......wfgg.[.#.....K..\.Q($BD!Q)..Q.....N..(..h% [..... .H..1..7;..R2.........c....m...q.AwM.l.W.m........KP...Caw.}.../... ...Vjt}]...n.....'C..Q...B.98......q...).-...Y....l~6.../{.|.o+.jE........C.....0/..pj......@XH..\O.PR..P..7dH..a0/..t..D%.P.Q.%./..h.u.T@.*..`.L.....7.U.E...g..3..h.Q....6..!...V.)..Y/.u.......:.W@..d....3...[.../A\......SVQU.....z..Z ..0lT._.....o.c.E7TA..z.IM}.%]..c~.\.D.\.7....!7+8..."@O.AS....f.LO...@>..X$.>z$.A.G.Q.D..0>..!.AI...R.....A..z...."3E....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\processqueue.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):268
                                                  Entropy (8bit):6.71744573347677
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPZ6+coh6aOXh8BdbxSf5ByR+gFeLrwqpopdTTp:6v/7Q+fh6BR8bbO5IRKLbpIdT9
                                                  MD5:BA74EF478B761BD4B154DEFFDF9265C6
                                                  SHA1:61BCFE964028E73BE90FF3A8C8581E21672CA6F9
                                                  SHA-256:CDF55174EE7CB1AC6AB4F005B5FFCAB5F7A02CAAF1B12DBB1F6480FC70380644
                                                  SHA-512:2EEE1FA9663970F24E4C461EAF62B0BA64E85292498D61633C151F45856426FD16BAAF7EDAE296317E27727988F9CFD9D241945FE158C736F626E0E5481FC588
                                                  Malicious:false
                                                  Preview:.PNG........IHDR..............w=.....IDATx.c.A`....Z.q......TL../+-M...w..!..@....A..@.....0u.N..........A-h..%A-x.f.. ^...Z.....,..Y........-@.R.Y..sig..?....X.....>...*...1#....4.j.k .'%.MC**fA......._.b.R... ...I@...3..Q@.........Q0...A8vA]h.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\queueview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):731
                                                  Entropy (8bit):7.638960413963767
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7ohMCUkTXgl6l6iGS96bXKvIDUNqPB2/F3TKsG3wMQXhqt84+DXBIA/0R1:Ny17le6bXYIDUuw9TKsDMQxE+DOw0R1
                                                  MD5:41CCDFDA66425EF91E665ECF9612D032
                                                  SHA1:FA2E2B75C9DA1EDEE08F64FDDC040568ADFDCCF8
                                                  SHA-256:C42D3E5C5D35BE83C587D86F81826A75D8A3CEAC1A874917A710F0A2331EC739
                                                  SHA-512:C928446AA740CEC622C675EF92C78087511C189AB0CF2D5BE914BF7E668D5C5203B845E927EDDF7E3AD2D055DABBCB1EA98301F16F5EBC32FD140BEF58DEEDA8
                                                  Malicious:false
                                                  Preview:.PNG........IHDR..............w=.....IDATx.b.....4..N9.w.Q.x...+TQ....m....m.q.u&k3.$...=.g.H(..X.w...../.{.g......8.q..Q..T8&....9.kNj..m.w..S.m..;z...!R...7.........wDEE....?...}4<<..;w..n.._..<y.E..l......aaa[.V....<*../i................o9}.4.zE.y...fN}LLL.......tJKK)...........M...(,*.o...R__OII...]QC"""^/i...7.?....J{.XM$''....|I........&.qs.w.;9......h........C.m..4IJJ"88......x....I?."./.F.CJ.'..C#.#..........W..p&.+....-. .....J.?.f....6...J...#...P..O.4....j)h..o..C^..;a00l...h2d...Q.w..w.(...?D.....^w..R....0n..^&.i.O..7.....Kbp%.~...b.....4L.@.....[.Q.......[.......%..0..89.`Y.N...;zU...Ocf.5..Y.$....i.f&.......me.=K......K.....O..9.h./i ...<z..X.".J4~.h-.....L.........IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\reconnect.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):949
                                                  Entropy (8bit):7.7428764520223545
                                                  Encrypted:false
                                                  SSDEEP:24:1OaBirN8h2jqPlz6YoqFxmBXl5G1icmLKXlgfUcQc:1oeF6YzFxmBXlk1KLMCfDQc
                                                  MD5:FBE889615E9FFE0AC59730EB58C4E71E
                                                  SHA1:ED2526C2F5BD2586DABE647DB0FC4F2AA42F04A7
                                                  SHA-256:5CCA96991B2255836750A64F4C0011EB5891C2188E9B3D031B03F2ED5567E4B9
                                                  SHA-512:2096DC78A5A71B78D77D3F4C7A0006688FE516B285B272724E6D8D8D8C2E1497D8D21730AE759715ECDAD74F5C8425DFE1F894B5F79DD522E05998F6C3CE2FCB
                                                  Malicious:false
                                                  Preview:.PNG........IHDR..............w=....|IDATx.b ...9gRY.8.....K.{.....{..(........=...6O.m.k...g.x3..m..T.....b....}R...T$....@.$.N......../.....%.9.r.p.e8..-6....e....s.....^...o.X....W..o2C.....`a.0R.L..3MCoap.Z.o.H/_..?OAF>._2*....Gf.$&iF.:<.;..sC..A..ab.....Y.t..^...L.o.L.~.Bz...../+..v.....^.\.].>..........J.}....qm`...q.m....H....g.@..qo.rQG.o.w.z=......z'....&..~b`.kq..*.f......jh.v...D..7.....9..hfm..L.........G:..9`2x`.(X....H...*.I..f....Y....SH.p9.......[)(54...4[..*`T............f.H...5pwG1......".8......e....E.D.v...9.>......\.:..............I...!.jF$....A0.l.\$._5....NI.*...f!.....*L<...;...S.! #..x....nI(c....`/...0..3.CX.....!.. ..5.v".,#.Z ....+.}......|..X4.d..d..bG7X.........d.$..VI..v#......._......D[.p......F..E..d...n8...B.z@F. =A..#3@r.H..........t...auy.r....t:...LR.toz.../}..7....w...|/$Q...v. `jj.<..........r..rabh.....'F....i]...8..~.Q....y_.........IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\refresh.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):403
                                                  Entropy (8bit):7.2590588527215765
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPZLqIktIjTEVXON2hIVjHhh1zM339Zm7FVHTPv5XcusTFoL7tYaZk/s+U8u:6v/79qSk82gBh1Ym5VLPs6RZEs++v
                                                  MD5:57127617C13FCC955B4C204C6C413763
                                                  SHA1:C764CE3F61E62C2F1A619DB1BCCAC1EC869EA711
                                                  SHA-256:F3B5AFA03C7EDC495284DF9E7CDFCE7D0845DAE64B88CBB0578BE9A286C97ADE
                                                  SHA-512:3892E9D3B43169150BFF6E2A9DA54C44A944805586EC36BDFB9433287DE5DF4C601398E1ED1028034F55F7C943795F55F3B62AD5886666AF49111B46388189C5
                                                  Malicious:false
                                                  Preview:.PNG........IHDR..............w=....ZIDATx.b....9gR....3`]a.....T..T.Kmk..u.m.......;.<.7.......s....8..f...`.:7U ..3.._.nd`S..&x...#.2\....G.3;..^!". .T..!x.!...........g.%2.N....y.V5<.+..Y.?.I.}o....J.0.&p..f.......b!.t....M....?.^.....P.00.....w..m.|e.L`.M`)......ss..l.....j...5..G>k.w.t.CY.[...<.....b.........2..gi.....[52.9...'p..q.A........a{..Ub.1...z...r...<..E.[.........IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\remotetreeview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):736
                                                  Entropy (8bit):7.553489674646903
                                                  Encrypted:false
                                                  SSDEEP:12:6v/73eWx2g7/H3y+KSIBFCARZgowcWu01ZAyaLUqLbnOGwSmGvXc:+mg7fxK5CATucWjZAyaL17HwShPc
                                                  MD5:301131E41538586B6B50B63C3F8C2B99
                                                  SHA1:F79F1AA6B45EBDA70674C9BAF3A81AFF873AA3D9
                                                  SHA-256:BDF75435E4642BA4CA958269ED9DD163F4DE4B5F09D04B667B6B090E329FF450
                                                  SHA-512:6C6B9E22A1EF5B69B8FF835C91308FE1ACA0E6B4089F9F2D382E158D810201946BB5D1D9EA63850AE489AB788C1061A23A4BCBA38073EAB3CC6A73657C28BF71
                                                  Malicious:false
                                                  Preview:.PNG........IHDR..............w=.....IDATx.b.....4..J9..r.at..j.5.:.....Am>..m.mstV..}.z'k<...*..?...k....pF.........c......\xS.......y.]..V,.g.+..........{3.:R..jR6n..m..K.LII....7--.QRR.HMM}....m[.la...J....B.Y.~.........u.....LGRR.C2^.*.`.."""..........7. ]......_p..y.{.B.}/..R.^..8]PP@]].555....Fgg.z^[[K{{;......9+222HLL..U...>-a.........]...9.....a..b.q.,K...KLL.b.z...`..@..l..,..l.i.K.4..`.Eb.........0f0.9,.V..9>J..:........{...i(..J.......`...6....&...).Ca.....P..H.....z.....`~...A;2.M....A..!.......V...yh|..a.....1...n.`..O.74GSE.2....(}PA.=P.(0JB="..}h....R]D^."]$.q......}.{?..T.s...b[s(.....yb..=.9K.EM....^0M...s.z.[a....T....srr...^6..!.I^...Q..J-...?'..j...0...h.4........IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\server.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):653
                                                  Entropy (8bit):7.600912591819238
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7mIe1yFFaE76+DbFATu1i7KeYcZNNip+scrpdnSh/wRodc:iYyWG6+iS1i7VYcU+poh/Coc
                                                  MD5:6C56C7AC973D6B891BD3CAAC98ACAA42
                                                  SHA1:B2CD1D5C2A7490E0A62595CA846D9548467FB892
                                                  SHA-256:AF68A95DA06062BB8DAC3C6CCED5E9E1FBF161DD61E19A8B624A6131A6DE0427
                                                  SHA-512:F8248A3FA865293CEF9881F751FF116EA0A3053C577771A1BBC5B1072F00FAAC4E0E9990EF418A8D658BEA3E0493789A128915B67C666211F0D512E2525A2F48
                                                  Malicious:false
                                                  Preview:.PNG........IHDR..............w=....TIDATx.....A...Fm....66.m...x..)^.OP|.3.fP\....53...U.7p...Bt....".9.v..!;UP.L..]!.* Pj}W.jQ..CyS...5..VMsc...W......'y...`.Y.S.`6..U...x.q.c....'.S..8WT.r..r......{YTH}ht......G2.t..r[N^..7q.J!..,.....^..3..h.=@.(.j.]..D.....74:.....;..Pk.5....&.4:-...(...y.`....@..o..s........C .SR.....+R..<..-Bi.......u"....!...xb..X.....l2..I..N.H.,.=....%8.6..'....d.X]]..|).Nctt.z.....G......eYtvv.....6....X,.D"A...h.....F..$}m.X(../....D<.{w.X..wR,.>~...*..."..s.........P..../.*4.`.:Oe.x.1..F1=3...a...Q.#...s....0..Y.^|y...=M.X.+,.D*.....YY.......wU$....Ne....D..H..}..8i.o.._.......3.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\sitemanager.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1038
                                                  Entropy (8bit):7.762181302500522
                                                  Encrypted:false
                                                  SSDEEP:24:AdiO8bYpLAACDndAxbcwKLaQiwg/jN9Cw/br:AUTYpLAASSQwao9/jrRbr
                                                  MD5:9680A5B4290104352D298903725A8325
                                                  SHA1:4D1F67C7AC4399516540003FC1ED4AA5CC666EF4
                                                  SHA-256:68A742F83F04F8481DC6B91C1422E866DC5AFB62B1EC50E299F03E3CECF94C74
                                                  SHA-512:31880D4396AE29321BBC42EF67D411257FA685842A118E646F298C90C189577E6FA2425CEA50FC4A891A74AF75FC658D3E073F24C8732E4BA02B360EA27E02E9
                                                  Malicious:false
                                                  Preview:.PNG........IHDR..............w=.....IDATx..[h.U...sfggfw..v7.6MLw...Z........(P., >...H.../..DP.[.......jkS...BhmR.tw.Mw...\...J.&J.P....y....\.....2..}.3.8...+.Po.t..2.C.e.o..S....@)Z.+.6x....\.t.u.0X...0pQ*B.A... ......VeP..00zy.f.C.$,..>....x.O>%..Hn8...f.#'.b$u,.DJ....|...'I;=......6v.......96J]..O.}u....?....RH*.*...$.vE..DE!^..n...d.R.4L..,.;..........hY.J.*).$m......)b.v....E...G}.A..i4fX.......[..]..L....t.....t0:6.i.,%m.,.\&.......f<.G.....l.LG.."B.e.....eR).z.R.6te..dl.gE...7.L3.a..M.R.%wv...{^..5.g:...`.:YX.'R.0..u.|>O....] .......VR.5@}[..?..kh.73..B..B...IJ[.@.......*b`.f.u.HH.M.]........>FE~...=....x...R.1..QLg...'..>Me.{...x. @..b.......4..&.D...a..i.....pq/.|?.3J.is.<h..a.Tj3(@.2.A>6.s....v.R.F.....Q....>._....mx.....~e....E.>.i$....{..bx.7\..2M..Z.D.q2..d..C.......J...'...aK....&z1....9}...V.T..6.!.....L...,.-..E...RB.....e.S....FR......"...4L.B.![7..:....z..Q..R>544tr....1P.*i..>..c0.........D..I!..j.8..mSo\ko8...q@..R.GV.mt...

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\speedlimits.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):461
                                                  Entropy (8bit):7.3403357557975255
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7/+XeVhrA6NWINuy80CWlOitfzd5sgxVo:++O3cQ9F7rJvo
                                                  MD5:4F7017135A468DEC89C9B0CCFE49A993
                                                  SHA1:F56480F6561D1991CED6085E69F6683B4BA628BC
                                                  SHA-256:3901DC8F16DE446345BF86B850D467FEC9B0DCCEA282ED2C4D45B48201C59E02
                                                  SHA-512:D47D97E76F5B65492698C4F8F00AFE8C2179E84BC5B8B71E5C5E239BE58ADB375CA33CB49B911621C735F28B0A32DA6B3C705BCB2B4D475640C4F63DB2ED6877
                                                  Malicious:false
                                                  Preview:.PNG........IHDR..............w=.....IDATx...l.A.@.....m.]...mP.fT.mM..lmN.~|.yo.9.cfgvX.~.....v...k.<F..V..r.s...c.O>~..#~....@..r.u.m0.3T.b...r1g.a.Z.,...w....7."O.O..w..)..R..A...Pp..d.:.4.@@.r[I'....N1...7/........#. ...N..'.J..-.X..6..8...|c......:.v{".,.+PB.,..>....."<L.IH8.....].. ....&.@..>.......^&..........'..S.P......J.....B.o=.}.o......]..cKQ.D...V:.I.>...7.j"p.#G........[......f*..qDB.....#..O.......z..n..'....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\synchronize.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):525
                                                  Entropy (8bit):7.471136473005463
                                                  Encrypted:false
                                                  SSDEEP:12:6v/74V47VjICo/Wr2tNI8OiDcfk1SdLAPKV/S6Ghfn3zh:B47VECo/WitNOiWk1S9FVq5
                                                  MD5:434F517BA9651744F02E323FB532F756
                                                  SHA1:C655874E19932B781062D05C61CD4E786817D5A8
                                                  SHA-256:82759E6A82FE1E82BDD3722CD74A1F7ACD470061DB2AB53359A18598C0CAC5BE
                                                  SHA-512:9C381CF53018525BCB17763F6D278D8A8FB804FA07F81A69C17B0DAE1FE694A18C68B8C5F6C47E22899E38C0B732790FC37416D950D5CA3981FF829CBA2DE5E0
                                                  Malicious:false
                                                  Preview:.PNG........IHDR..............w=.....IDATx......M.E..Gm.m.m.m.m...[#.|aO.w........F.9+.K...... .. e..h&H.o...s...b`. ..[..4...v.k#N.g..j.].2.2..h..F....u.........c. V.]f..&....{{.S..w.&..5.k.`..uN_...l.~.......1n..FL.]e6....!.......b>&.A..o.M.Sm|....14..3.4....I.8...Z6sM.j..g..|...p4B.kk.Y..{.`,.;zx..1/"..$.q.t..w..N...h...+...HX.?..t*.....V..:x.....:..5.....gB`.X..x.2...`.....Z....>.2...jJ4.d....F..K=....zh..i.G:|. u.n...i94..?.*.2.\.!.....c....?F...N^.2@|..j......i.......~L.>.......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\upload.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):273
                                                  Entropy (8bit):6.663022393752252
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPZc5/9sR1AAU7YrQOctJllIe8s91szQcKoktWu/EEbp:6v/76sYMPc/P0K/v7
                                                  MD5:E4C0B2CC3A3630B0D69125D7C4146D55
                                                  SHA1:D2670AAD72F8678EE070D3C6CF5490A97597ABB2
                                                  SHA-256:6596427F5CD726826E803FF104D4083FBDAB8309CF8A8820536EE3851DF8DCDC
                                                  SHA-512:AE1E82963D117E731A8FA864B40893C89E5B4F2D3875994A7B8ECE4993266CF8F2D0CBA998006EFC03AB237345F97BF89F405436A61426037A338513D9D82B55
                                                  Malicious:false
                                                  Preview:.PNG........IHDR..............w=.....IDATx.c.9.f....O.bfZ....w..?.....,@|.l8./......b..0.,.0<x6%....B.O!..]H.....H./@...&R-HD...9H..@...g...@lL./...(.]..bA ...0.......Z4....L..$..@..,P....@.....x"..1..![.x.q.....;.....@..<......I.,H..= .H..">..L.m..n...A....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\uploadadd.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):438
                                                  Entropy (8bit):7.34162055469022
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7tdmnCrkEVzCO9lEFGWqecq4tnSOptWN9Kq:sonh8zF9S03sOq
                                                  MD5:738A1CC5FB4CA61551C50378F8F300CA
                                                  SHA1:E4F221318D0B45EA17296E70F436B78D847EFAAA
                                                  SHA-256:38B7CDC9E1C5F771708DBD05DC49B83C852432373DDF663C4A4F68493BA7439E
                                                  SHA-512:E43023739BC140B40FF5FCF91821F88B13D74CB7CA58B9AF1079EF53216F5547816ACEC3084E6658DE296ED06E011191172C852EA5F031AA7CCA114E9054AD0C
                                                  Malicious:false
                                                  Preview:.PNG........IHDR..............w=....}IDATx...C.\......el.m.ms..mk.;....m.}.....[..[t.EY.z..c........."..S...B7-..B_S...Bg......@....M.K..6...68.@..;......%f!...|.wxf..k..N]...........<..[....m..b3p$Q..Q(A.j|`60...l.]...W..kU.3.G.......,"............S.g.yQc..Wx..U..B...Oi........e...]~LE...k..j....Vx..:.(3.Y||..1...r......~.....$0.^..zL..|...{zL;...HE.L-......!X`...!..C...Z..a(0.>.e.]...J.%...K.........IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\ascii.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1259
                                                  Entropy (8bit):7.728629961336813
                                                  Encrypted:false
                                                  SSDEEP:24:547IUU7CqNnGa8tW/DCbBWInq/Nv3S8lDNgbIfHU1wIDH+Cg:5kqNGa8tAWg5S8JLHieCg
                                                  MD5:AFCA2ECBF5BADA1EB0233288A1B4E8BD
                                                  SHA1:4486FD1B95626E82A14A44D4AD17374C71908FE9
                                                  SHA-256:4B8BA4D9F9CEA5AE61E705FE45DFE476AB8BB01C842325B7161A02CE29D401D3
                                                  SHA-512:9DD113EDCC28FCD0793AAFF2078384A83002FBCCF5AC31417FE25AEE1CD6102EA1139D3827C7B992DDF4092368F0A60B3B149DB8FC4EA104650B11D4884893CD
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx...C.dI...m.m...m=.1Vc.l.f.j.Z.m..X.nUO|_.+.'.L...h.!....P..".Y..z.O6......%.....@...6.g2.8F...r... ...yyy(//GQQQ.]VV...h(.J...$....V.a..P\\._.......[..ZY....v..YYY(,,D]].jkkQSS....D...?br..d.... ;;.,mCC...t.l.. 33.Y ....................kd..U...e...N.bcc....H...-*n...e......V..PR...........zq..u.*.y....322PRR.a..F.4&&.IIIHNNFzz:...X...J....@4....v...D........p..].t:..DO......d(9Y..B./..o.N..[...O...|..u(...S.5k.xG...{.....J......'N..t.<.=....oC..l6.b..B........<.1(...?..A....?.w-|..MPw........h.6i.$<.....k." ...._.c.........N'......B...'*,,.....(--.......r..d`...@...<..........<......./]........i...{y."|l.....c.a.....Q.F..BP6)..?..A'.D..w..?....O..........=.T+A..).._?p...z........>|..|.....QQQ....3....q7b...\..5.Z..>..cp.q.....*..pR.K..a..Pk.p.].m&^..<...C.}y..[v/x......AN.>...9...{..!CD6Z....1]...V....e!+_.}zB..5.KCV.(............k..........{:22....|f...3 .o....Gp.h...... --...ir.......e

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\auto.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1479
                                                  Entropy (8bit):7.821774226336037
                                                  Encrypted:false
                                                  SSDEEP:24:p2orQtPB43obzrejZQIlD7LJ3O07j9KqbKKOv/wg2/P2ZWaXeIllqQ7AF8hjvZhf:p2wQtXe53O+9grJ2/fPQ8F8nhKxJkn
                                                  MD5:2A8B9ACC913021EDDFBDC2BB8C3B62A0
                                                  SHA1:651DAECC36A6AB7ABD04DFE32C4BD05A5FE3BF93
                                                  SHA-256:DA884EB12ECC8C7A4E1E1DE0896BB2C017E991EB675325AE5EC147D7AA20C975
                                                  SHA-512:4A17EEE392C2096FF93BE3B076C44982FFFDE7491DCB415DF99E7EBE3083ACE7E21BE489BC439515E52C53D28BEDC339461066DC5F06FFDC6D330328550B3108
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx.....+].......V.k.w..m..el.y.q..c....V..j.]....wu.t....%.[.....T..c..W+hll..........7.._]]..W....+.f]]..........az{{....^..g.$p...&''..N.u+H%*.7nZ@......e<..q.l.^..D".\@...FGGI&.d2.-aY........M.HsF"......c.:...>.)..}4.%....\.]!..p7,`*^.).)\Z!...cA..(.,..z..w.+...|mm..%T$..o.....I.R~W.E.h....&..."*../p....a..$.$......\N$.@^...4<..p.=.......LM.316....ccc...J...368.3.L..p\mc..a.(.b.pW.X..pe...iU...'.S!B.....lH.\H.5.9...t.....9..(x6..D..-........px.1I|~X.Ll^..Oc(..:.........@.....r..p.....i...<.{......T.N. ...T:C.4..fr.......g<...M.'..(.W..;.....w..!.Px)..G.}...0.....F4].i.z..y+<.%.....t..upC.G8ik!...=Jb....M...0.$......R...,G'L..@....>.T.-...2.....' SQ.#.D.....I@a.'o..r1R._.r.........y...@pr.M...y..{;...L...O......DGE.2.\G....q_`K.04grC..w..vy..Mf....~x..H.4....{..)OBo....4........o....y....y&fM.....).3...sx..9...........mP...n..]L..Y.O.e....(.uh.%..+..>.{z.8.01#.%...:........w.@m}.).. +...W(.%.8.0t.I3...H

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\binary.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1237
                                                  Entropy (8bit):7.69171762371757
                                                  Encrypted:false
                                                  SSDEEP:24:sEFz6QoBXyMbmF0NPL/hpEt3v/S96qXV6rDHDzrlJVi8goX:t96lBXFmIbhat3v/S9LgPhbiVY
                                                  MD5:96A2AB487D235858753561E2096C8746
                                                  SHA1:A0F311EE3C53B034978B7C300A1823073134CAB9
                                                  SHA-256:7FEA394F048495CF8AF39CB8E4755BDD809B83396E3120914CB528B51A2925D8
                                                  SHA-512:5C4D91A97D112521E4B15FEDBBF5B3B1990085506203343F6A8715302280BD33E67CF126EA0B428157B431BA70EA283611C3EFEBBA93A909F0C0499FBD2ABD9B
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx.b...{....<*`c....c....;.\..?..m.Y.m......9..%.......3h...K....L&..t:R*..R.d..`..4.W.....z...'777rqq.......f..A..B.....g...!.....#GGGD...O....?...........N.eee......].....H............e..:..Z..999...@.......6O6@rr2%%%QQQ.....6D.@JJ......:..A(dt.7..xg...W..,11....."............0.Cvvv...;.......E...g..j..A.0...&.....|DFFRDD......3i4...U...u.b......+Waa!..v...ENNN......h.e.......1.9....7n......|EGG....Ba.........%..._....;...i.Aaaa...*?..5....1.......Z.b...W.^.w..6u.T....E.#G.........R..(&&Ft...KPpp.x... |..._~.E..!0..j.<.._3g-[.d5.a..h.]....A.5....j.*......>}.$.....Y.~.(??.5.l......[.....k.....#d.\.z.9.8p ZL.x#G.d..;..^........;.....'. .......C...........~..W.g.y...p.m%......x..Z...}..f.9H.R...EX.~...A...b.c. %.HKK#...&......s....^.j...baa..a.&Mh....kW...y.p..K......:t...Z.&w;.3U.....[._~.|..`p...|.;.H.&M.L.q...{8/H.f....gO....;.{r"..5M...5...=#...3..A.w.@z..19..$G2|p .*...a....$_K..F7j.>0..8..G...4d...

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\bookmark.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):432
                                                  Entropy (8bit):7.22488705000766
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7ig8yrgCb60gl+QkwHv1N8GVv+5uHIqrHHMAm:Oh600Okv1NvVI0Mp
                                                  MD5:B4AAFD8D37E7829359F93D87A5943790
                                                  SHA1:3B94D7B56A6E8348EE7CA04A5806B58F371D4EFD
                                                  SHA-256:25D72CC3F67CEAE3E4761CF157333B3A856323C3869CCE90F6C19F0C5C65CB19
                                                  SHA-512:D3DB2EC779BD8B552D3CD6EE30BE762C4D83C081DBB0373B2B0ECF64C4DAE7A1F55EF3DD714A35585A2F2EBDB8A432B6C90FE7F88FB89875A3DD12092E1EEDCB
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz....wIDATx.b ...Q. ..T.....?.l+.6....moi..8?......uW..|.c.)..g.._0....k-.>M?....,.<Z..s......N. &..Z..k"D.<@.<X...x7.0i.Fo.z.....o..... ...........]_.6.6.....;(\.._.....:..f.W..M.A...Wi..>@..X..P.....C.l.5j.t...!nP..r..+...U.&..5..K-x7j.......wJ.r.q..S.S......u.....?.._3...4...s$e..*..>........s`."m.....@..v....Q.....v@<...@,.K.]..J9H[q........`'....ck...F.(...l..........IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\cancel.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):858
                                                  Entropy (8bit):7.712683125490113
                                                  Encrypted:false
                                                  SSDEEP:24:eXyfaaVJigfIv1jR9xYqMP5AEDprlpsZHHewJ5:KaVJivjRTMP5/rlqZn75
                                                  MD5:53A60FFF53A63577F011C5BA43C92D5E
                                                  SHA1:F9869D533F81E605DF33F1093BC4FD915F5B4EAB
                                                  SHA-256:91F02970471A42264D0C1BF9854FE48C5A3BF0DD787213F211ECB685ACC091EF
                                                  SHA-512:6EFA863D27B55AB17C46342BE17D42947A8C8577526D32C2929F8268A2779A68E9186DE4456C4876135BF012FBCEE3E553CC75FB9CFAB9ACB38D6D066E35790D
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz....!IDATx....uG...7.m.u.....Q...m.mP....l...kg.N...N..3k..?.1.VI.#...b..'?..h..F...%%...N<.a0E.#.. .fHu8.;..#2Q...&..:.w..3........}..+.....1.....)....qh>...Xm."..9..+......%M.....6.k(\.`S..O.......{.x^...=r..0.....Pp.y.. 9f9.WX?.x9......$$D .c.......,5...h/.b.............\...W....!H....&|h>..?...2.....}>H........4p.....].o...Y.A1..@..N9.S._.s....O...z.W$M......j.}w^<+....!..|.C/>$.....0M.+.6*.\w.$W..x.r..../.......`..H...........?\e9RK..*.G..9G..3Ua..5.Z|.D..TO#..N8......Fq.L.?..4.< .....~.........D...K.(n.f^\b....S.|.>...fx.be........Ju....3..8kB.....Ca..&.v.J..6..C...+t.t]t...1.....8.....}.61..+...[...b-S...6b#.t.....0...5....Em,.`..#^q.x..7.-.S.h.....]..b.V2].!.^2..9J....:....Se...8..P..D.L.F...3.kCb.H..l..F./l..7...4..'o........yi.^'.*.....w..+.K!Z"....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\compare.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):919
                                                  Entropy (8bit):7.7114842030576245
                                                  Encrypted:false
                                                  SSDEEP:24:8DWzUWSGzofDOCHiCLaJRnca2ZYn8EIzNz:xPh+nrLaJRhf6z
                                                  MD5:5974610B7E07C4AD482DCE665C396D33
                                                  SHA1:69B97DE36EA06DAB7C6F7E88AB83E05D8CA20E85
                                                  SHA-256:AFB397DB5228C74E78B2C98882716C666CD4E9C1B5678242DE47B0890ABFCE27
                                                  SHA-512:4164707CD893054C6AE00C85A39F1D284211436EFF070F24DCDBC179AF172956EA0DC03ED86C63179AB114DD5EE82E0FBFCDD22E0A9DC0A05CE2F5CC982B897A
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz....^IDATx.b..`....o..+..E.....l{l.g.m.n...j#....j.L.ws;.w....^.`.....pu...;y.|.(.{..o.G..K.Kg|.K..K.&..<F...O'"..\*d!...92[r9 L.Vy....4.BX.H.g...&.....(.mB..f..*h.,#hr.Ge2......E..Y.w.!..M..|a.sh..bz..;..;o.^M3a...o. ............r..L..v.|....rV.:w..+k.<,.;.Os....9..1.....i!.L$B...ct...l...q.....*g.....m..:.0..e.U.......W(..|<.J=.U.!.....%..M.q..+~5.l....?..]};.3...HN.a(...|?.....o...........K...m.Y. ..v... .i.U..g..a?.....y...-.....k+..A...M<...t...z^.....d.5$z+.......n..8O..9.<.B.}....... .@.....C?. .,.0..3p!.1..!.wU.C)NnMn*...a.S..n..[Z.i..z^.9.k..lx.c_M.#....zC(........Jg..8...`.g....:Tu..+..J....q........{..Z..A....-...A[\Vy.V....q.l.*.T..A..\U.a.....L..b..](<...?q.....{oXT..F.Eb..I..#.!..t>B.+c.@...q.R...0C`.-....:..:.p.wA-....nMr...D.c..R.......:w.k...K...W.......[...........z8@..........c.j`....4L1.........IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\disconnect.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1278
                                                  Entropy (8bit):7.802476767974719
                                                  Encrypted:false
                                                  SSDEEP:24:BaxDSWJhog8pm555MpvcpaTd1FRPzlWFNqfeUpQMKQLi3L2tN9NlitzPSDP:o9SUhoE55MpkajhkN4eUpLLE2X9Nl57
                                                  MD5:4C78D67A172724938B7912CF0243F560
                                                  SHA1:589F829DA203349EA89CB587CCA504DD8FBD766E
                                                  SHA-256:4BAA62D7F150CEEBE6FCFCDC5723AD866FBD14F8F9812A6BD6F4D791627B020D
                                                  SHA-512:3A9F7489FD2EBA90837977823EF89189C007FC1B4F28FB1F372BED49C90E23981F331BA41F73477E72B8EBCFD907C65DEBAFE1EEBA1767562F0C8B6049299AC0
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx......Y........]m#.N..m...Y...Faq..;[.....'..>../s...i.f...\.sF....&<6d........0G.<.......1..O..A......%..&O....I.p.!\..D:'.1|!.....cn..........D.a.0yb4........CXTL...(.ME\D8......._O......k...!33.Y...a....^<..%...'....MsA.a..g.F..M.....d.......0a.7f.b.g.B$.S8.b".!...k.~.(..j3.T*.6`.L..w.:....&.)..0....<...1\.@.>.a.N.. .o.F...Clt0.Ba2a-..a;....&=..P).....M.W....4x{...........p....O3x...`_?..y!S(B.b.a...v....d...%e..J.+P[W..\.Qq.8A.8.&..T.o..}..F'....B........./W.N..l/.{..Y.....r....._x,|.c......<xxy.d.{..m!......y..0....$.B..I.7:....-...:.j.j.Q..^..^..Q....F$..">&..{=..oR.v..N.91.!......?^.....{O..P&.m...hA.A..S).......8.....t.34?.P7Nv.X.0....G+.Z..Ji=B.....d..p.]..c=...2[.0{.l%0.BOCS[Y......&.`..p.&b.d.`.a..x.....G.D./.B$d.....t7..'..h...,Q.P/_.n..5n.q..}8..b..3..T\Ns.N.E......k.3..ns.....t6...a...X.f.......L[.....c...`...hO@*?....1Y(..{2..p.].=Y.d.?.5....x.....T......%./S.|.H.z..TO..Wi(VO..."9...v.x

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\download.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):323
                                                  Entropy (8bit):6.930881261923216
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPKq0yAsdsKrZqmHK7tSDenLiHO1DBtFVEF9ebFAfklLvuJ0aVysV7llVp:6v/7iOaKjHK7t1nt1LM9ehhu2av
                                                  MD5:77350FB05779C6B1AF43FA9836C5ACC0
                                                  SHA1:A76FE4E856F57F6211FDAE8CDC3DEF1740246A02
                                                  SHA-256:54FE6596F5997C99501B0BB83959E25127D2A9AE39CBDD57C9AABC3527915249
                                                  SHA-512:838143D02BBA889D0B5D1346AB11293868177E6581A383A0E92117CA72DA992C33328D53FD443B7533F49F1BEA47DDB7EA778908FE3E5619AA4A7296E58D9FAD
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx.c..`...Q0..6....k.x%...b)z;.?.....9@c....L....8@.I....3....%.....9..*....@..5..*.E..rg...1?./ES.......6.....cH..@...Z+JC..d...Z. ......gH..*;V.a.'...2<....,.b.3...x....9.X..yq`.... N..y.`....8`!....o.0.....7....5k%)....Z*.].8`9...~H9....p......<*..lv..".....\....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\downloadadd.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):517
                                                  Entropy (8bit):7.411552387975486
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7iK0FAIt0qc+nduoYtRTvkm0PJo/vZWUQUvE693b2Hc:DHtG3oYttkm0PJonZ0Uc69L28
                                                  MD5:23C5C91CB1648C404F308D89F5390CA5
                                                  SHA1:D5AFA23A94EC4DF4EDF150AB38D364AD14283AE4
                                                  SHA-256:798D544BF4999058189B7EC2B848ADBCEE3D8A407AC8E1322B3079C995E82773
                                                  SHA-512:9EC93033DE14B11E70710BE2CC71E6C90A35B0D179C797DBE88C55FE93D58252778D435D5A42D1CEBC223ECBF423647A8E687224E94DB5D424A552F4444337B9
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx.b.....`....J@....F..P8.m....EC0.m..-..`......z..|u....1PK4_b....b.71Ck.J"c..ODH.x..).C.Q.R-.." ...pX...-....h/.9 ..Y.a!...2........U......z..6..%.......oo...C.vC.E.@.nqEL.8.....Y..;#..+.V.1m..[........F.i......&. ...S.B..K.......b.f.....fY..,)..7....%!M.?."VC.....1........!...XDF.I.@.....N|C..l..".a<[.............]Y.GZ...%.]..P.?r@..J..c.v.....A.I1|.)&.!.m.....[%/....$Q...^.N.^............Q.f._.P......._.....(..5.....Yo.1..r.S.0....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\file.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit gray+alpha, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):441
                                                  Entropy (8bit):7.279474191847172
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7ts542jG353OlOnjwT8Dqv1juUB+yZJy6/7:KugdZj1ku6byK7
                                                  MD5:068B66A4C4B5A6F590DB1FB04C8B2E85
                                                  SHA1:0F58F1CD251B4673A94C9C54E9B95AF1D1807938
                                                  SHA-256:66975981A4F7015B7242368B4C42E56CE08C2C9F34B2B66C9DB0E6B7D32727F5
                                                  SHA-512:A16399D497CD76C34F5C905A8BD1F567DD6377B8A61B98BD9643A942359BEC734FB55F39A7F2CBA46DAC67537EDA4479EC366EBF7B18952FB9AD63238A4CD91E
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... ......s......IDATH...N.P..q......L.\..7.c........._...T0J.........7. R........r...M}..z.8Pf.......F.....8..9G.b_.l...O......@l:.W...3..2.I............'.YQ.M.|0P..e%P.d.Z..bI.T(Q..a.....3DD.~%P..n~._.@.knH. ..;...4,M.N...<.A...y......d.q.X...L.;..t.....H.u..k.1.....2.......&$Q%0.P.Hk....<.$.t.eB.9..D.cT.'@...5<....z.d.r.<.?c..`..P...I.a...|..A..yR.G.]..%.L..Ab..Y..."...2.{M.../...{U^$.......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\filter.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit gray+alpha, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):261
                                                  Entropy (8bit):6.739556990779287
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPLGsesANvYMC7DtU5BSjnCbDp5U0xp27OAypv8tVp:6v/7u85tlnCbDpXxkCL8t7
                                                  MD5:5D8B8946A30BB2C937574BEEA0099799
                                                  SHA1:3436DDF9664B9317043EE3EFA333800B4A8FF06E
                                                  SHA-256:25069280D25BB2591BEACEEB66479CCE2F36C718313AF8930CFDE0BB64DF8A0D
                                                  SHA-512:285D633CC6567008209BCFC54B382777B8861250F87530E438D323086D0D130064176648B0CAA5543A4CF0131C6373ABEC4467B44B7851019C20C8F307FF58C9
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... ......s......IDATx.c`..X@ia.<.....v......c.n<.\'..=M.......W.0 sW..(.0....h..........&*..e..*...{..JE.,.O.......Ud%1A.....C.`@F.T..._....Kf.....J.'...o...\Q.Z......Fr..74...k.O.......X..h@'%....-..0A.x.j..h9=.h..3...;..s....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\find.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1215
                                                  Entropy (8bit):7.769033660075704
                                                  Encrypted:false
                                                  SSDEEP:24:doZDRE+8OP9PEsCF7VGjwZ807DJIPsABKGepU5VOHj6DQ7i+b7IWLCD2FV4ur3RZ:dmDRqO9/CFhis8QJIxKGe6WHjPi+gzCr
                                                  MD5:571139604559E9727B009FC0F0A35026
                                                  SHA1:274EE59BE11A96107B08552EF9DAD24DCB37339A
                                                  SHA-256:03679E8752ADAA16606C34C3AF796FE55E9629BC2B674635BC9333155CD008A2
                                                  SHA-512:4ECF8B27B2746A935CB9AECEB2EE45A3390D80DA2ED5C509B593E9A7EA26B2995327686D665FC37C81E14B08549DDD6BFA1FD8D454BAF3B3AC9C88EBF2F34F22
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx..Kl.U..K.T.K......A....L.3mg..i.A.-E ....-.P. .&.]..@...$..........+..,..c.&..h...?O.!...,{..nr.....9'..[..X..x.p:..D+D'D.3...N.6...?..c.oE7D......wStM....(...1...3'.9..?...y..mYgMC.w.6......:.m.{........*..nr.4q.=7*..?...@..V...)..4./.Y..........by]...<]..YQ.-.g.K2o}X.Dum=..IB\... ......c..5.4j.\..6K+(Z....L.{8.....bx.6P......n..R....b8..]nV.t..?.t....x{..pr...1..@T...u....b..........N....i..D....QLG.e...."[zC.$...c#...&.p.y.x..{.....D'.C."3.xVr..=R....>.t.a......s..7....x9.L....f...Q..Iv-.u.....s......}d.7.....`......g..Q2...q.........Q.B.^I...lk...p<.M.<.&.\......s..B..o...z...dm...:..@.R....<.D....d.Z.....Q .....V8...L.e2.r.,|...D?W#O@.x.......@...|.-........[%U....9..s...d...^...X7Ke...h...._|..#K.....za_7LFaw...8+..`Y......r].:7.}k...fWb_.v..2<.*o#..;.c\*l..\.j..|.!(J..'.{...<..(.;2.@...L.q..n...an6-./D.h...2C.G.p.....l.Te\....n.7..@.D..&..{.;.qzJ.........r}e...@|.A.,./.'9.......@...^.Z

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\folder.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):598
                                                  Entropy (8bit):7.537757732037882
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7if3qTZx/dtbZqEIgdSBQOxKB61lmJDm64TfI7yQDBcMSsIMtSSpez:FOdtblvsBQ9B6XSmvTqHSKSSq
                                                  MD5:DAB0B46E390CBC837F2A9E782DBB10B3
                                                  SHA1:7AE0A5F2E1E13516942E2745929EFEE42B0AC8AC
                                                  SHA-256:2FE8B33BBEF00E5B80A9BB7605062C27EAC25F252F14883147D5DA9F7E899F34
                                                  SHA-512:CC2D7591989AC021590A7CBB6F6AB91C2E077E01D9B09B1DD4A04286DF43422F0A0EB67428BF7B8A4FF6DC6CEE725D798FE5910FC2D2784A2F51CC8A16EEA45E
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx.b..`...Q.h..`...8.7.c.m...c..M1g.m..l...5..{._^......e.L..!Se.t...N.....6..$....W.x.....5.;.%f.II)..e....k..k./...V">...."....:...p{.s.U....O..`.B6t.....g...[..+.+.....;[..6./.{...6.....Q.Z....N.....YUjH....:.R{.i..]N>e.....T......q,.0......N.wC.P...R-....a..N..p.e."t,..y..W!.j..{M...;......G...SjAR.h"&........./..D.. ..z."..o.....A........?..!.!......l.lw..y.........p........-x}.( ........e%`.i.^.......,.....1...i.\T7.xy...o..E. .k..H......+C.{lx.-EC..S.j"..X.:..^2W..B../$..B.....E2KJ.kWb....d/.9.......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\folderclosed.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):449
                                                  Entropy (8bit):7.277585752281084
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7iCkuQ8/YRFeCRbSOPruSPXImLrhML+dBuZ:wkTZneorVXImfhML+dQZ
                                                  MD5:EA3731B3EFD45B81ABA07F4AAEB59B25
                                                  SHA1:ABF886627761F703AC965FD4C25616DEEE5F748F
                                                  SHA-256:48F5BDB69B41C56EE042ECA1457AD46A004F06CB320FF3179200DB7D931BE551
                                                  SHA-512:91D83967AF974939A1924EEA859911D92CCED0EB26C18EB879F47B175F7F61E29DC0097CBFC6B93D57EEE4E431CCCEDC561A5345A34B3D4EA107545D417802CA
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx.....a.Fa.(..qwKpww.......>..K..\6g..~...`'..o.:`...+....7i..H.L.b.*9.c.~..s...h.\/..t.......H..+J.F.h.LI/$..y(E!g...).....cyg.rlS?.+.{..'.sV+. g7.k..y74.<_+...Q.E.Y....9.D..^..V.M.....:.y.....w!....0...y.r....D.....%h.E....."j;L....)ET.@.:y.....es.&.P..}:J1s.&..:g.....P.F.......j.C5..1T...P..x,...P..A.N(.X+ -.%..+..N.).n.T....)..% n..(!..........E?0.'.?o......Rt<.Q....]..........IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\help.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):331
                                                  Entropy (8bit):7.095565135282059
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPKqcOd9lJ/A8WNqCV7aDVhVybdPOUZO4gGgTTkFSk8nOvUyfW/Vp:6v/7iGnJI8WNV7UVfsdPOZGgsFSk9ch7
                                                  MD5:900DD3CF8073F00DDE69E14566482C23
                                                  SHA1:C1A02D6233708BB438351E6339EF8726A9A2BB47
                                                  SHA-256:83E16FB1C48509C8606C8EDF5D8CCF9606D799CC1FF29E23155D6B6D7D24B187
                                                  SHA-512:89D6D646A308E454134586C464BCD6BFE6FF630722610F30CF598B97480EDC8B39E9BAB71B7A20592E74B4553524F615ADAB057D69E2501BC89947CF3CC65082
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx....D.p...(.#@.0I...h...d... ......%.........B.(.j.>.9-..7j..8....z.i.7s...a.......o..8.h..!.C...y......oA........?d<...f'.(.!..(._.tP......C..b.P;y..f......|.'.6..!J..N.j...z.S....x...c...o..5.<.t.*..S.~.8`..X...".....5q.%D..OC.3..& ..Op..%.....r....s....5R.E.J....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\leds.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1217
                                                  Entropy (8bit):7.740564574812406
                                                  Encrypted:false
                                                  SSDEEP:24:62EMIGKq1DkBwgzatU4vAlmXMUdlhLXArL6zzzQ2:6am1MBvemMUdlhLQf6zzV
                                                  MD5:D1ACDC707E23F7EE928C86E5E5AEFC6F
                                                  SHA1:F91A3440E35C44470B88666B0546B8353A9083CC
                                                  SHA-256:7B840B9BF6F990940C61321345DF3F327CAE05944B02BCAAAC8E3AE815CD3952
                                                  SHA-512:93A2190AAA583ABDE8B29C11FF9D210B55B373A41834EF52CB51A825FA92B912AD4D3DDC70F3A71946C404DC4D5CBF8D28FD8E865D708CDD5930C3334C0367C9
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx...}H]u..........w.i.....4.>..KPA.P1...i.6.xS%Z. .bH..T.s.k.y.].6m^.OK.nP0.e..VA....w......}......9.2...z.j.8..&Q..0..Mbb.jD...ZA.T..f....H.N.0.prr...N...suk....L....H]C.Le.7n..@...........OG6m..'..G...f..f..Z.....i0...v;..#..6a../n...F.@,..7u.?:3.by....o.R_L..-...GTr@.xCB<......".h..^.. ....X`c6[H.!....vK..X.@.0)....z.\..b`.....i^........%..TZ...j.....>.x."6............G...+C .q..F,U.o....'#..q....i$!fRS.' ..#..N.xQ. NB.1..q...S)..@ ...<.E.!.=......Wg.Y...~cv.|..Fd...........C@L.....`.....^...=.0J.I=..Q....(E.. .q.qLk&...&,....5!..I8;...>Jb&gpm...b.>....(.(2...Z.....S.P`..Z.F.bam.Ra.:.^Fk..9..Dz...yC.z...........ajOu..=."Ri..0.)......YA.Q.Z...w...E....B..4....*..*..e.-.uL..'..<.K....6Wd.Q..s..W.. .".k.......d":r.E.......S3o>...^......rcD.+.x:....Q .=OSmx'.])..4.....K../.@R.q..NS.i..7...~..O............ G..|.t9..i..0........Ts.u...q.z.`.s.O...r....}8./U...W.#...y.I4N.U..d..5..N.....UC.....i..tI>....

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\localtreeview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1019
                                                  Entropy (8bit):7.6875539559992125
                                                  Encrypted:false
                                                  SSDEEP:24:TAmVfqplE/m0mW8jaJb21+Z8QBqxTuhzbD1:THVfc6/9mW8jDjV8l
                                                  MD5:B993FFA6DC32E0B71FCC7090848FD8F3
                                                  SHA1:D7794906F8FEDBF30C9D4C12890E8E970ADDD42E
                                                  SHA-256:4BED7D2814E00835D8B5F8474153E0D6A0F3C4A925D2A4246C1B1D08F7A22F41
                                                  SHA-512:BE68D78129FDCF9012B60A14B5C15F51F4C705663D00DCDA2D530A127EC7D82C2837FBF8EC0732FEA1DAF60D6FE69E439308195A8B72A08BB14265219CC145A0
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx.b .......$....R\F.RP..B.gk.6...1k.m...3.....t....|..|..C..a........"..m...w:.Y....5D.!%.....N.q..,..k.j5.D"y^.....K. ..G<.....U..}}.]..R.Ekk.....y...I...q.......^.v.H$..r....o.].....%%%G....GEE.8w..P(...Q.....agg.K......ZPb.......=...G).Q..J...fh1++++AA....J.===.........'''dff..........D..999+........N\\............ppp..+W .J.............1......MD{{;z{{...u...........c||....w.K1..KMM...u.....Z......nvVH@..@FF..XZZb..r......6$$$h.\.& ...Fs./ S..`B.B..Q]].|\C...@."........2.T...(.....%...D..o.H...c..0.|.a|....}.?.....!...@.v..|..y.....!)T........`.u.!C<.t....<.Y.#.#<.$.!..?..w.?..o...@..v?.....m..J....1c...%....|+}.".K........M...............".C.....+U.?...?........n...U..+.@^.q...p....l.4P.....DGE_.hii...[...x..}...7.|...?.,.[........ED!#/7.......R.d....,-....b.F....f`6.....^.q....-`bbJ...}%.b1x<....0::.y..J..m.............o...4iY#.....]SS..`.....................!IJJb.......`......E...Z..o.....Q.._

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\lock.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit gray+alpha, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):438
                                                  Entropy (8bit):7.335543461016686
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7GdfJvCPtzDruIbyI2+wAHNkssFBpY/YrUqM/mTFz5wcfjXR3cVz:fdBC1zDrtbyUOsipYQ4qM/ezS4l3cVz
                                                  MD5:A88423CF7C371E66A49336A0874792AC
                                                  SHA1:5B9F81D13B5E60081ADF5D8C72CBE3EA0BDEE91F
                                                  SHA-256:0153D55F130FE4F8A70CB103875E4D73A7C132E20A573FE759E55A934C5A063E
                                                  SHA-512:FC62896E91348896931CE7E2B212EB78AC2CFD1AEAA88D0E9AC75C068437DFB4819F8B09133E59B90FD2A0B2EF65CCD9BD45A7F8C83AE8386297F620B98266D9
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... ......s.....}IDATx..;K.A...Ql,.D.!....Moa#.*....Q!..4"QEQ0.%A......j.N.. .....gMd......9..\.|..J-..h...N}..G)M....@3.C..9.}.c..=...o....T$.E ...x.X.u.......LOm.}.........1U.4Vf"...#.KD.(..)U.."~|...7.{W.d.@.qh`..Y...U*VS.....90.....?.`.>....6...(...T..!....2\. ....e.....N.. ..k.I.PEp.o..f...........a....KR.... .....oQK.6.<|....p....4...q.-...}.k.P+......b...N[tI.T..\p....&y..RK.......G......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\logview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit gray+alpha, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):697
                                                  Entropy (8bit):7.634649699674497
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7PC9PHJ5iduuI2hKbAn2r42+IwQiG1ciBadepT+3l7MZijYn4By4iCtN:k2HHz3hAn2GIY4odQGle4Y484iCtN
                                                  MD5:88C6CC7ED1BB843E2DF90D02A1E77BCC
                                                  SHA1:D9F4CAFD0337504EFD2345CCEACAF93C11084797
                                                  SHA-256:0C01D885F5631C6728F6D2BF14B25362543F40F8848D6389C4C87E7E2BA17C27
                                                  SHA-512:DE22F6F26B2B11581241078B29869AC73DD4BAA2AB05A29F1A5AD6C5D316DFF499013096C44F47789745E9C987DD6407C5FE7F63CCC7CBC41CA211341FD9010C
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... ......s......IDATH..;LSq.....a.....`.qqq..8H....*(.!hP..1.B.u.Q.....[.....RK[yk..bT..4 P..x..}..d<.r_..{rs5...,.R+.rZv.M|....&..F.5.,.m...Y^...H.. J.R...4...'.i. 6M....6AN.)L....l*Y4.e.....*..M3..b.Js...y#.9rB..J....(:..-4n...1|(./...S@.L..?.T.B.Wc.p.y...V..PM.-............/.....>...K.~:..xA.B...W.5..L...!.Q...3....DA.!....y.nFX..:.1...M.....@-......$. ..yo...c.v...>....2.N...2....+qH^.`.(#..(%...s.Z...$.CW.+..%.7.g.t&..'..1.<.L"...c.)J.....f.s....)...p.f,..Bh..Y....h`..:R..q..X...V.G.+Ts.:`..d_..a.B..\.U.....('...xq$.._.Z....3...7.`.0...Nr3..k.i...,..J`c.P.yJ+/b....ug..6...C....K.)f...O3...$................z....j....O...{.4......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\processqueue.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):307
                                                  Entropy (8bit):6.827955876112397
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPKMxKuS/hdGVwqCWynnNleQlnom84frQPRY++oD7YP924/NWrkVWwbhe/jp:6v/7iMLS/hdGVwUynNl/nQPRYPoDGrYf
                                                  MD5:EDCF58CB4674A1C184C9475EAD416077
                                                  SHA1:34C6B3A5E2E0A0BFCD0B9AFEA0F4498F5E789B17
                                                  SHA-256:BD2C5844A0CDB51E1F47664AF9DA534427196082C6FB6705F60174AE010A8F50
                                                  SHA-512:38ED2628C3D838B8D1E7E89E122C06B3E2298DFDFF3F47370C730936EC58CD63000F5C093B60A0AC57C72E135B07FD8F13DE0FB4788D0578B1DDEA60578074E8
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx.c.T`...QPZZj...@\...@,.$.... .r........?.........;..S.xMU%\.....#Tq...........pqS7.h.....m ....D....A.....A..`..@,F..`b..;..O...0.c 6...0q.@9.=...T...b.J.e...?...@.D{..e.J.JJ+.........*...l.....x.....@l.$.....*+..&...@.u..*...`....e..........IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\queueview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1034
                                                  Entropy (8bit):7.736557125883991
                                                  Encrypted:false
                                                  SSDEEP:24:fqIHsWgIrrmGsCGXO7SKZtY5/XrjvwH8lQD6:SIHN1C+7SKZtwPe8iD6
                                                  MD5:47CA58185EFB86A3E8C52C6F0ECF08EB
                                                  SHA1:F753DD371F6F0082F95581237F48E6574253AFC5
                                                  SHA-256:3D3253E71481BF0D32B8DDE24C2EFF441CD443D6B5D124A251F1AA9D222EBA5B
                                                  SHA-512:C892DCA41C1BE06E086AD0CE4A6716F449AEAC5A72C5CE25430FEE1A77D93D2E2AF909EFA50D2A4E97E806574B7F0F0A652DC3620E73CA48A6F199F6329197EA
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx...%Y.....O..m...=....m.m.......F..:#.b........8p....+.....)\....-.......-~J..Y..j.mM@p=_.^..Ic.U...8f/ x.T..?.....H.`C.R..N..c.z.."cn...w.}7{..}...RB{..i.kW...{.....r.*....M.eee=&<+...QVV.Fii...{evHqD.[;;.c......b.c.}H.............TdI-.......`......Qk'''>.....H.....988....jrrr.._.i@D.%.......~#66...TU8,,..'N..w.)..?Nhh.2....r.8.....].@FF.$...FOO.........{...\fpp.........c.*./........ .q_..@..u...F.\>.......1pvM........".&..%.i....k(...@.............x......A..q*x...w..{...@...M0.n....,,,`.Q.... .U..U...eo.c.]T...&,hV3.[.X]6a.L.......9W.:.@......t.K|.s;....w.G.:e.V.d..+K+h...no..dv..!.?^.4.....D.U......j.......L[......a.4..L+........H..B.OQ....AM.2@F..U......&..T...>..|.5]..3...D.k|...=V....T:X.60`\GZF..*...._N.x4...e.|./.H.O...aO0..B..a.ld@.4&..(....'...v@cp..n.<..v....y..r[4.$....2.0Bi.q..../.e.#.Ho0.2.l#....T'>...Z%......C.....d...|..g@.......477...&.Bw{#-...s.......u^..Ibb.j...l.........8).

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\reconnect.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1409
                                                  Entropy (8bit):7.812039674614879
                                                  Encrypted:false
                                                  SSDEEP:24:NyBSSazbW1TjJyfhQ846KWVIaY/8AgOjYjWysITWfhVBPBV5WlurV+f8a:CSTbW1T9yJrcWVINgMYjWysITcVBPb0x
                                                  MD5:E9E71E1953732D927B5EDC3122B72452
                                                  SHA1:DC6EB44AAFFA6A96BD5B5FC702F8A02918F11332
                                                  SHA-256:3D1B47A135C990799040B66D9CFB1305A0C93ED5361B24DD0B9DCEB2AE7B2FD4
                                                  SHA-512:7CFBAC3F807338B55E3EA01DCBF06FDC104516A60B651FCE81522F785DCA5393EC31AD3815B1C4171709753A46131BF871218AF29A2DAD96200AF136A974808A
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz....HIDATx...iL.w...f..H....i..d^.\t..<. ...R(.R.....T..;..J.G[J/,.K\.t.6uF.e....8u.1J..b...o..a.ZtO.$.........7.....b.J^..x's..{.6.....\R....@R...:.v...e...._]...-. .$..FrZ...`......M..."B.W.P..}.>.Y..w....,lH....]...d....MBtb8....(...Z....=Q.cW..%rH....4P..Qi4.(.*Hje.W.+...3.O...%...J..s....iy.......[..;b..Q*..DP.*.....e.....C...99Y....b...^4.....K.....3...W.;x.-....HARJ6,...../..:O!..M..;.*).....~t..w.A`....j..r..za..a...A...;..[.7...K.&r.G.EO.n........L-.......m..p..n.q....B..f.V$n@...... 9...._#.H..`..`.F...`.D./..L$...j.P..!..&.q.N..."/.W*DAI....b..L...H...B..<...F.p...I.Hh...X...g.'G....M.u.P.,(.......[".]*T..P..#.+...H!..F.rH.Z...v.=..Z6....y.*.TH...#.......].[...S...[<_Q...../..nwB.....................:.....M&.u&.M....q.G<....)...0....k...."8/..7h.V..j.*....h.v.Ww...!.~(F.y.tz.3.........q+.?.....:54.......}.n....9...s.>kA..c.d2.t....I.J..p1..0..t...6.....{>.C.p9.O..+.s!..Gt..\..`......^..^.....9.....=

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\refresh.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):515
                                                  Entropy (8bit):7.403882283673057
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7irjkUgv/BDhYdd7eOD+pi1Nen013fbruh2fpy4Jlz:NjkTBqteekifK013+8fpyE
                                                  MD5:7B0B19962119DE23988AA5CBE21540B4
                                                  SHA1:2333706E66A0AA09590205754794CBD8B1A1D4A0
                                                  SHA-256:EA1C9D26F6EE41713A53B2B96D5B4B6A12ECB70B966C96001BFBD014F61D8668
                                                  SHA-512:08E8551515225069DDC5EBFB0B94E85E91BEC0563D9032B03A68AC6B4763A5281500FB6C333F0C06C2475AA35711456890731DF53B0D3054F12AB382386F91B7
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx.....Wq.G.m.c..m...e.5d.]S.........o........?..4.......bA8j.sX.@.A..C......I..9F B......GW..[..G..2OQ2..&#>..4.......a .S...I..{...Wr\.L...t[....iX.......9.Y..+..s&..C8.5.f.ER......-..J^.6A....g.......@..............".......&....>..4...&...3>..Bf...r.."...........x.......f ...p..M...v.P..-..JyY..B..W>........._pl</F...>...p..Y=.z.n?KI_G.,..O@B<.L..|&,V@..4G...c.... s.#Q..Q..p.2...a....q.7<.p..z,$.zb..Cx..h....;?r,&.b".{........?....LD.........IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\remotetreeview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):951
                                                  Entropy (8bit):7.708867626048922
                                                  Encrypted:false
                                                  SSDEEP:24:hHqJpESIPRed57dh0TVmrVIiiwyb7hhMwdzNMJi5LfGto15:hHoESyRQ572VFO8dOJij7
                                                  MD5:56724AEAD4EF4DC66C207F27D1E18F6D
                                                  SHA1:30A6DCEC8A26F0A1F1AD339D3B5519B4963031F9
                                                  SHA-256:C16895993B6319A6C38A607CAEA1CB095344AC52F59A054BF6B08186F9C8B422
                                                  SHA-512:AC20B9A044D60FC4D11E67585268F7945BFCB1542608ECE411161FDD2B3DD2AC17FA26C8CA1B5BE7DE4FB2CAD252B1A120C5B531B5909F6ECFAD58AAE906F44E
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz....~IDATx.b .....R.....,..Ea.c....bl.Z.m..m...zw.....|.t.W.{O...Y$.....\._.?..Y.MS7.'.2I.$SfH. [..y.A.0...Z.^..Fm.U..U..={..jt. .....:.n...].v_4j....w.........n..t..9.S.N.].t1....q.....?!..( ...\~....)22.....]....j...o:v.d....G....#.:t.....t......~_.....:?....t..8.vFc...QQf.........w.C...o..G...Gbb"AAA..=..Y.....jC....e...7o.....`4.9s..=.Mc.5h_|||.......F.P.Eg..#.hCrrr(**"??.$%%%TWWc6..L&.eee..V5.........g..#8...r.X.B..rn.|}}...X,..l......e.....V.p....z.f.U...jmx....;.$...x.p<.........`|..................... .5...pV-88.\..V..X...._.....xbH1%.5.d.4$@n+Hy.2>.O!...y.....*......_..O..e....u<.z.........P......@T.'..Mp.......p.._.h.2.T.5e.3S#..^.e..<>.....1..U..i.........\&.&t.v`..G..r...k.aN9....t.l...5........%.5.....p.J+...}+xg..v.:...z.k.p...Y...y..Lk4..j..p.v...x...Vm.......t..@..(....dff.... .Att4............6._. .q......,.ef#.+.-..Q0.....fT......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\server.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):830
                                                  Entropy (8bit):7.6770187407004755
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7iojUwWJVJX/Q0+sZgnqlIbga1UsEw5FErKGTp0o7R9+2/VDgdLShLWaVxgu3:0uJjh/KbgeUTwHuTp0oO2sgZVX9SGMKl
                                                  MD5:3426E7498D09DD130EB4C934C2BDECAE
                                                  SHA1:BD246E54DB9BC6E6A638EFE8C0B1A0CD78A208A8
                                                  SHA-256:13739929B7894139F62D67D807771C4221495AF1217BECAEF269074B2635051E
                                                  SHA-512:761E79BB2AD400B571BA6DCC4FCCC48D4A6F211D2EB4305B1C906347CF8986006501B3171DE1CCBF12542EADD8C2425828D0D6A4B2F23540B15FDD402980F18F
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx.....5g....l.Xe..6.wpl.k..qm#nl.q."....Y&.....W.....8...........(.>...........~%........w......~!.J.....2...6...j.$.J5j.>)) .N3.....q.a...r.....n1..i..............K.x?.f.z....p.y>n.,..'/.C.......b.x\..`...vK......i.....W....|\{^..w._B.w.}?.7.j...P._..X..GF@.......f..D._H1.\y....UxP..G/p.T.[...d.......Ualb.......C$...`..j..js.h.C.f.o..f......'-....q..?.@.......!T74..S.Ui.(5..m.Q..K...gX.Y..4hP.Q..c.5.3X._Y...Z.V7....*.^:%.^....|......nE...M.^.....3D .,......:....c/......X,.P(......y..st"VVV...,~..d...K.....5....l6.j..G...q?....Ka..#`.D"...N.....XXX.7.z...p8,^....N...%....-,..m.P....b.....+.z.T..p.O..P\.nPT..Q....*..T#.....l.XZZ...$....78.E.. .&......V....0o..h.c4.kt.l'F2..:::...Bn..........:...l....."k.....+..AQ..t<.....kPw.F...s..sZ:.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\sitemanager.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1505
                                                  Entropy (8bit):7.854236575747375
                                                  Encrypted:false
                                                  SSDEEP:24:sk2ANQPUm58rQVXFyddUaGsGGX9BwQYrHMdCJHvnmAX/Q3kmhb8qTMgz9BS6/HnR:sFAG58CXFCUMmQmr/mAXMkmhDTnBLHSi
                                                  MD5:20D9AADC64F196C4A6F5F59940477FAD
                                                  SHA1:5E5E4B53174C5D154EB73D70686ECC9E811C3DFF
                                                  SHA-256:0A6342A748F6F0F8ABE80961E23A53C6509E5F5FE89C6B84EE73F30F5AB5C5D5
                                                  SHA-512:C39AD122D27A2F81A8DFE0451D8CB9B2433966109B7AE3FFF7A2CC2E52C0A4135B974C574303B586473FEF3270A534112A8D9A45A26348B1007EEA2057345324
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx..[l[g......s.......i...... jG.Q.Pmh.@....x.xA........H........eEj.v...^..]..kB.7..eM.....\h..Z!.4.....X>..?...S.....:....UR.....x.....o.xt.+.R.KJj.<,.'n....>..../.^...U.s.JJ..!...Q...>}.w/.(.{Cr...v%nOL..:b.OM..q....V]&.5H...:}.>.@.4..g...8Ng,.f..<.....HR....{.K3.........\.J8h.Yir.G2.U........w^?u...8JW(....r>...#..`~.]..........M.....G.~...m.........;.. ..P,...j...>B*..<..@*.r9......L...D...<.M...6..N.y.g.`q9.....F.R../0}....#.........O.vX.U......^.%m.7.#.Hn;......?.B......d1{...4./G+..|...(%i...ny.x..(.,6+.Py.@;.p0....n...1.0H..d2......`.:....X...$...a..p....@$J[..M.R.PO.k....`...^.......B!?.-..e.:c.....%..:.t(.....^.j.Q....)..Y...q.......0.z.J.B .x@.m"........f .........->*..Y..w..iz...2.<.E.O%..x...\..h....[.....Q.]#......../"../.Y..['.1su...f......\..2..+h.$..(..q..oJ...*Q.T.K....(.+~..+..f.#{.0.w.b...=|........$......yq.W<....mz... .{.....z..,./.....u]........l...N....e.@.......'....;....eh....

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\speedlimits.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):572
                                                  Entropy (8bit):7.4861268211214345
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7iktlApFqfuEuYQ+9uCiZjyvKZuHjUQjCENvm3IPYZbbVp2jVc:QlAIu9L+piZKNlEP4Vc
                                                  MD5:21723D62752E3F327181698FE3B6B33C
                                                  SHA1:A3981258EBD12F99324B0A602C0F4DC0F023920A
                                                  SHA-256:9D0690CB60E94BB6ECA6334356B68B1267384CB1B6A88248AA7B46A54B34C733
                                                  SHA-512:BDA931988329776CC9BEE36D2481C6D9402E30CF3C9B2E37591A0F205A7350993C3BFAEF00D816D3E005960A9F4E84D380E8CE49616EA860CF3F92332D36E61B
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx..C.A.E;.2..m..x~cl.m.m.6_*Vw.|....I...&M.>:*.^.oI..M..=I...xf .a$......8G.$&.m|.....14B............;....pw.;.p..!.C.K./..].@.)...7#[...#_..../..{.&J..m[.^..8W....-....z._.........ATd0.z\.........F..3.YD$Q.7...K..=..h.>RDk0.m[.*V..........~B..=...g....*}..)U.6U.....|....\...Y...&.1.u.}t$d..F.h..^...^....S...V&X+.<q....`@..lf.v.`..........|...kg,P..B.j.l&S..mg..d=..ix.../..H.z.).f.*u..|.d/U...6...$...y........,..%W.j..g$...h...I.CkN@B....*A.NN..^@......R1........F..D..(.I.&.........}.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\synchronize.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):734
                                                  Entropy (8bit):7.605469382079802
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7id7abfyGXcatPuZyiwjh4yLNTjo3pxD/xse7pwt42qRjrofXKg6LqqLi4:/a7X9tPucjuaNHQpxtseOmIXKxi4
                                                  MD5:1BA91C1D13A2D292CED42FD957A5D1A5
                                                  SHA1:A40AB6A6981637ACC29913C8259B8AF9AA82E824
                                                  SHA-256:140B9AA9E5729BBBB9E85ECA5494F0A0A31D72DB184B41E140883111B3D3304D
                                                  SHA-512:C518CB268FED63FA43063330E2EB409EB6F16F832EA71348046E2A13D9AC41608BDB4302621592D3339E6E0B64C4FFB88E9C3D271310B21D39E915BC42954553
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx.b..F.(.s&5...=.V..A...m...g.m.m.f....mcv....=]N.k..9.l....4......Fc.<..B..V.t.T..A .a..R^B7...&..&/.....CU.. P.h.h.X...`..]Z.....?......|R.!0n!<.V....\.,..d....w..V...92MO.QL ..J6...We"~..u.....t3..g....}...4./.\../,....xV......k.-.....M.P....T..?...8..GP..|.ao.......-..../..i..J....c[......^..}s'..?.T.. G.<..| .)........6..8.1?.#..CC...../....X:._...R....v.=z....P.S.d....&h..Y....!....#...c..^...Y.....s=....s....N\R[.y..r...d.-..t...=yGP<....'.k..0...*.....?.V..@...a.n.D_.&...;6.C.....]."<....@....d.2...0k.....!P....9\......j.~.Z.........U..h.;.,..........t.......F..S.3............k..B [aT.x.:..O/.}.F.f.GT...6..Y2..G)...t...[..s.<N5........IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\upload.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):314
                                                  Entropy (8bit):7.034055541396177
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPKqkksBY2FytRnDKE/rAfkX31mp0SPJZo2CRs6dGrTu1edpkv1bp:6v/7ilksBY3L7/Mf3BJSs6aT3Pkd1
                                                  MD5:52AB93798B119CA20478CBE97A6B85C3
                                                  SHA1:F2189C258383B0479D798448F220E6859F556FBC
                                                  SHA-256:4A266A0EAEF8540016907B4728084CB0877B93D593BA5DEA6F514680760E7108
                                                  SHA-512:63AC98211859CFD58A63B7BD158BBF371030914BB386E35738C189313A77E554BF12EDDAFF15A25318DB38D878175FC6FAA4FED23C18108F4F3AAC371CF1F2E5
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx...%PD...a.;N...gp'a.w....[..*.H7........O.;....|...:.F....Wx..`Y..<.....K Nl..^.qcM..r..6../.xi_.....f..O.8p.7..c<Al..[b.ba........)B.X......':(Pkx...s.+.!. ..8.A.z..#1@.qZ.f..._.I..Q.E/z0.....M......O.LAp...\c.......cR..o....>0.i.j.bY![XD.../.O..Q.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\uploadadd.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):523
                                                  Entropy (8bit):7.428916394720977
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7ijMAGf1CPZ1C7VWgFOadILMckmt+xc:1MAGtCrCZ5Sdkmz
                                                  MD5:F9D1082584D7C2538D40183FE051D34F
                                                  SHA1:588A9B0C1C3C42725EECA039BD07B5FE5058D58B
                                                  SHA-256:6D862EA747EC843AF0CFCAC450A98A503D1A9546CA2579A39A7A6C371A934601
                                                  SHA-512:A893A6F1935EC5409DD12D859E0C263FD189C6F86B6B3E03AC832136E131CAE5C81D4C91218BF624362EBF3024B19E34680E843711BDEE577B393E99A77B1FF2
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx......a...mx.j.m..k.m.m....{.,..<.E7..-.2....ZOT..5y..-.a..a..S....$..5.....~...H...+!C./.!.."I...`(..+......)....4xWU...H.5.`...nC.......;Y..i:g...sz.....a....t..37i......Q.....4. .O..R.y.4.L...).A;k...?...|.....mC5 sO...S.x$...($.h....Wj....w.E.Q.. 'WQ#T..k@..He......5.`~.].{....[..Q..z....z...L.`..'..?e'M.7}..N...j.r.2.h....XG...$.......=...'.5\.Q;....D...jx....du..}......X.....'..:=.X....q................b.|Q}.Rc..p........}.&..@....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\ascii.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1686
                                                  Entropy (8bit):7.796427098281232
                                                  Encrypted:false
                                                  SSDEEP:48:zFqJ7KXCUe2+K35h1I+CTmWrRgrKkDJ6w2+nxyqbPsZL:A7oV9371IpTmWtgrKo64wsPGL
                                                  MD5:3FC4CB62A7CE4620823A958251A247FB
                                                  SHA1:1C9D9CD7536AC99BE10A330B01B26F92AFC142C9
                                                  SHA-256:641E3AA18B787F745646A8DCC5D127F1CEAC25B3EDD10175FF195E56F4B01B30
                                                  SHA-512:0FF920CE75AFDF4AC2B6A6ED91DC620A4AC2C73BF0DA3C33255C53CF678E674DC20741582457E97E7E956294904162E62CA674F2E1415815A771BE9A12F5B60C
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W......]IDATx..S.$I...m......m.e.;.m.m..........V.!..?....UFdFVM..........)......h..........5.h........777$....+u..............DFFJBB.....&.......#ag(....p.n.-.../....i8m6....S.\."yyyRZZ*.....TRR".........}j(....%--M222............-.....dff.G.$''G...l.p_S.C..<y"..?...|F...(.P..O.....e+..`Mu..@.Rjj.Jh+...C......|...:e(...H....a....(.......p.6@RR....S.X.I.......I..X )%"""$<<.L.0!!!...:..........:IM[F...r..5.u....(...d....TRgeeU9.p....&b4...%j0.>B...$....,==]H../.m.p...)((....Z.0^......._.z...8O...Y:.=W.:I.aw...g..mF..y..I...E...`...Hj.......:t..j.JF..Mb.... .1.:..............@.m.....]....s..#.}........#.M+W...p.....+w.A....".........:.c.0b..5.0R..V..Y3......a.Btt.x{{..@.b...R..l.......j...\...Me.@.B.....pe.)S...7m.$.oW._}.U.~'.X..z.-....d.}...?..(#.........s.+.&f..:u..8W..C.......s..T......_.u..."...S./[.L0..,..#..0F.....8.CL..S.a......$8..W.R.jK..>|....R......^z......!..*.t.......*i...q....6.`Qb..M... 6%*

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\auto.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):2048
                                                  Entropy (8bit):7.814508932156123
                                                  Encrypted:false
                                                  SSDEEP:48:IM7x4pDbx8i9pQpjFcWQ7ZtlX5Rv6hJ03is3:IMCppNgxcWQ7ZXb6e
                                                  MD5:F96F2A63ECBBE7B9D8809F491FFEB21C
                                                  SHA1:EC7A7B871EEB1A6BCB7D7D232FB13806EAE121CD
                                                  SHA-256:6CDBE398FFF7D2F8F10AF52E949018CB778447872F8C0617D4688D9CD6EA3A55
                                                  SHA-512:2422DE3CB1603259A92251B86F16257758FA9C30528E53984D5667757ACE7BCB51891D9FEA563000FCEC3E1F64F43D266C4205C4911F58D68029FAAFEABE6D23
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx...p....Sfff^..2.@...effff..0333g_.e..$...f....'e.........+e..Z[[...K...l'......Z'.........!N..`]...6477....n.w..s!.b7..499.`0.......UU.Y~..###.....0E..........p.ovv.........l.........0M..Lf...SSS...*.......!..3|R....p..j.. ..@Q..A6......Pw..@..n7...8.u...V%J$.%A.:%^.).u...,..tz......2.../z.]..........Of.`..K.M.,..Zz.....m....>......@..x.g<...&.b.....6H../e....a.@~R.:..D..\^...>.q.....P^^N.J........F..(.@>.qbbb.333...ZZZ.....rA..'.U..y..+.W...pJ&....(.l....X]].gs..m.bum.kkk....m..!...H.=HE....T&.R..r....p.Mabn....X]Y....:.c+@Z..Z...G.....t........].........R.....0P?$a.g....}#..c.I..n.h.8...n4.H@..n..E.!..(..Ng...M..wt.'<...^.gL..J(.-:..{....])....q...C..-.......`.I.SF>....A..T..8......G>.....M+XZ.#.#..UC<.)..[...:..A.#..3.......T.........7..h..K...?..G..i.....*........J.i^H...q<.s.M..A..b.EU&zg..T...^....guD$...2q.|./...7......).X....Y...@...) .....8..4....?...S..........M..o..z.4.....g........vv. ...@......r.;.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\binary.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1602
                                                  Entropy (8bit):7.626727499458733
                                                  Encrypted:false
                                                  SSDEEP:48:yDZKtASONmMv9Kredav6s4KPf7bUCe6yZ:yMGdNrl+ecvzLfRpyZ
                                                  MD5:3D417650A2A0D686240CCB6EBE148985
                                                  SHA1:8056F3481FCC03FD1509ECB327E4EA047EE79D94
                                                  SHA-256:50956043E94D8A0320B7D4838149F10C9ECC920AC7998C645E0CCB25B6726546
                                                  SHA-512:8C5F3B44F4E8DA99E0842E195D7245C5705390A36D4A8F3DC2838AC002A5D4F50B061D57152BBA81319C7703FAC9B45260A76466E6B975B6C3276899DE773610
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....`.......PLTE................}2.}2.}2..................................................................1~5.u .q....z.|.j.,|0/}3.}2.}2......0~4%y).p....s.u.l.0~4.}2.}2....................}2.....................................................................................}2...................................................ttt.........%%%'''...444...@@@SSSVVV...uuu...XXX.......000......$$$gggIIILLL""".........p.rNNN.s.......,}0.t ...333[[[ddd...RRR...###777...............fff...---.q.aaa~~~JJJ...v.xvvv!!!DDD...-}1...222.........EEE....p./}3......***))).................ccc......r.t.p...... zzz...............+|/>>>...........AAA.....hhh...............v#...-`....<tRNS..........8`S6..O.zqpt...k[b].Z```b...........k....[e.1.p....IDATx^....Z...m_.6.....[k..k.m./{N*5..9y...>.NW.#....l.$....x!..@L.!.E`.).;D=V"d...~=TT..ZW...D ..D%.........kN. ....'.q%...."....+..Q"@.j...L...i....".............T....[=...|..I.@..m..s..|0\...F7....F^].

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\bookmark.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):557
                                                  Entropy (8bit):7.419592753045054
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7lPD4KOsf+opWFR3EON0U+nv22+7kzg0r632lo76P:4D4KP+opWMOipnu2bzgScwP
                                                  MD5:A97E3E127BDFEABBB86A5958BC9E1943
                                                  SHA1:87D2C1844CEA49487CEA26EE1F4409A4CA3EF859
                                                  SHA-256:11C08E4C4B75EAEE879EC71C1234564B4D3EDA0AC0CA22F5014A8B6F8123A133
                                                  SHA-512:735DDEBD90F8A48785D4A3AAA5CCB6B8ACC599C22E9896D57BE5368F69BE373AA7C9109C0D57EBD3FDE33188E918D65B10591F0602ACB1DB61D20098CEBC253C
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx.....A.F..k.m..m.m;..m,.[.....lM.W..s..f..LXLLLL.j..,B{|.m..i.oE....i.,..D......Z.K.,.....a.(.......$.....C...(.h...a.(.o5$..I#...o.a....!..U....I;.EL....E6Z....q*...:..7.S).t.u.....D...W............N@..Zy.-..Q .^...V:h&..jt!..[k*.....`......`..je..:.3.jn...:.^f.|+M.B.....:+.....Z.h.,..O@P.|?.5..Q ...a..."i'.P...{|E.^7.NW....j...Z.}.S.4-....4{.;.r.G.....!.S+."pY}...<...0.j....vt..&..U....B F..?...}._^.N.v$...M..X.NX...}G......t[..O..=..UC...Tw..5Q.3..!O.=D..2..!B.6.1........Q...........IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\cancel.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1187
                                                  Entropy (8bit):7.797347205231396
                                                  Encrypted:false
                                                  SSDEEP:24:3CNMTy2pprk7SsTEArGj5+XOPHQLQ4EBlXQeT1PfnZ9LY6ax:3CUy2ppwbTK4AHQLQ4qpnzwx
                                                  MD5:112F068BE3CEE29C386D56D797DE1CCD
                                                  SHA1:C5311863FB8ADCFD5A30B0A4664FD638DD64A3AB
                                                  SHA-256:CADF696C9DE036928DA790FB32910562D7B20AA0AB5E09604566A8AC9270C0B8
                                                  SHA-512:62A23116AF2A0AA8B99E2A7C59D6E0D6945EB1F09AB73A9150CF8EE6F6184232726F6CB1ECC11B530EFFE212F2E02D9A486E381DC508FC739F7D57F838617A2C
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W......jIDATx.b...`...3.h..0.gm.m.m.m.m.z..&.{.?9.).2.s..L.}...R.....h.y..?,.)..........A.rj..O1.p....Y.U.)...A.sV...d.P..4.{...e....AH..\./.>.nu.5Kh......o..C..!....].Y..M........?.>5:/;......Hx..f...B....f..R.I.Q..../.7.\..F...V....D...[-O.....f.DK=..s.U.h.X. .......@..b!......3.DO.`..W.Ddj..akdT....]v.L.%`..i......t...-T.J...,m..T.o...I]..LB7....Cd..YP...?=.8....j.I.......W..B....X...)...}.. ..4a....!..Xgb.U....g...v.....}......*.....}.E6..l..O_...ug.1..>.4.>ee......J....sU.=-.........>...bG8;.*...#!....-AX.......I4l.."S..n......'fH.J./.7.P...L.n.a.....h?.p.C.0.T...^..D./.o......U.....6.....}L...!k...#.........&'....Z..x.P..{TLCG.){..]I$..`O.....7.q...5`."...R.N...9.....L....................$..h?...XA$......r}3...Y...t^v2..dZeIt\x.-Q.|..U..!6.../^s.L.N.....j.7...%.;..XY.k}/.......Bu.p..9.....i..........._.He.F...........t^u.L.ee.......M....O........<.9....;..{....~9.......t.W.6m...t....R.-.cy....Ss.z.)...H.6

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\compare.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1320
                                                  Entropy (8bit):7.8184779179574955
                                                  Encrypted:false
                                                  SSDEEP:24:3LEMXmU8zUdydtYKlEFTwK8Ues6lZ7nTox4lWWIdNQRTI5ZM/sJG/zu6/Pv0LBqe:3I018zUd7KlEF8K7eLZLcj5d+RTEjKwT
                                                  MD5:8A31C63B80B52FC5985042D08BECFDC3
                                                  SHA1:9EF26ED80A9CA92CD55F81B9C8BEE3A6512B91AF
                                                  SHA-256:4EBD5826CA37368C3BF9C78D9C9FF58E07B7698CEEC2FC75081B396AC0448246
                                                  SHA-512:F74E1C73440A1547AA5C5D5CE3F0AAF24CB8E2C3969D193235EED66A02E9B474BC0994C36E5F3FA803769A5911EFE730946DEA8AA075C60BF20DAC02A3B599BC
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx..YlTU..o.U@h.. e. ..mi.L.i......R,....1..}1...<.5....Q.....%!iT\..kb.>L..JB......]..Br..v.....s.|w..n...X`....6....Ax...<z.$.$.......G@.)P.. ..S......5..S.U..j...e..;!.1V+..ZU....L"....[..o[8.n..:..S.....m._....ZZ8Y....`.....,.e..ki..F...C+.....\<U..+.....7.C ..NU1~..gYj.....k.J...xh...4..'.:..1.h..;.6.;..Q..9.............R;..D.*.ni..^..8..sI..-...,=.|..~.3G......q<Z..T.G...p.%Pt.p.+..s..Tlgc....JU.....*..Z8,..4.mw...-.+.#|...s........+/.7....X.@...j.gQ....Whl.N.:....x...Y.......8.?...3.G..Y>n......b'>s....`......<.9....3.-.k.~xp.....b%.z.U>..p.da..&..O..Y5....5...NZ.#{....l.v.L...z.<..@..6..._\v....u...h...O.Z.[..&......S ..B.$N..^s.z.....A...:@0.h..._].X.2.q.....$}a..O5.F..v.?...C...V8......./. ?..~.....I ...$....8.G@..7.. ..c.I.,.I..N....."?.|h?.Q.q.7.......I[k..V....+.{Ap..a....#.g@....t.....hq.|ck..2}......../....H`.. fh...Z.~.(-r)i.o.2.........L.9v..lj.l...L.M.....8.r.SnfQb.Y.._b&@[.......

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\disconnect.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1974
                                                  Entropy (8bit):7.868475812113634
                                                  Encrypted:false
                                                  SSDEEP:48:UtYJOWU1b2plI7+/kiDnd+rJCwaMnvjL1GzfOvEuhFjwHo:UtYJOWsbqlIUkkwvaUvjIysuvp
                                                  MD5:B3777D3E667C0936EF16516DFBEA708D
                                                  SHA1:5F08EF04D7D644EE9A715E2F73ED7FC0D67305CB
                                                  SHA-256:1300799C239A6AABD16B9F91D48E94FD243C0521E504C3408CBA3502825D3DB6
                                                  SHA-512:7231F0602DE9AA8B4EC5E0D31D7CCB106BCD2E8C401155434A5561E60E137E0A21590560967D41E2A56DBAC06BE741F8323E7612742E2DB0D05454FBA7B30B0C
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W......}IDATx..{PT.....v.i.c..@P.!,h.%."L.."./(..MaY.X..,..EV$.,6J1..\.......F.;a..:..4*..[.V..&i..9..,..E....g...{...n.9..5.y.+8*...8....JD>....H0{....{.s.Q.._`..gs)yyeR...c.b....l...-.96Wjooo05..]....5.U.3R]U....j.....Yu...*U(.+uwu.{z,.o8..8...b....b.DR.....()C.T.Qn6.%bHe.........S*.(%..s./.!.=.....M.....I.5.A.q."..E`d<~.......@.....5<..7o.Y..N.7........L......."x.....9...~cSS3.Eo...(.F.Z....L.aaL.rC..'.V2..`.I.... 1...k.P..)...B..@"............9....6.l._.f..'9.../.B.............._-e8.)D.y .~....(.....nM.$?...R...a~.7.h.......4|..6`..p..........s..z3|D.|.....gxk.R.D.......l...p.B.!.+Q......pE..Z.w4DWg...d.Z...J.T..*..PRZ.]...!*.+.A..A.}8.S..|..pz..),E...).....\..I.@......c..P1{.f6.......p..........wN....jL...,g...[......pi.....AQW.W.k..Ps...s..X..\..c..]f....cbf..w.!>5.#............0....7....X5..G..E...i......D...}g.......f....If.j.^3.eJd.K.S$..WX.Q..rU.b.J.>O...>..U....JX.x.<.E">9./.d....H.......|.ig.Q'

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\download.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):417
                                                  Entropy (8bit):7.219700562616368
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7XNEzyqG0SvHl1Y0c9lbj2SB3V9nMYZTdvlz:f9SvHlk3nJdV
                                                  MD5:332D58CE0DBDFEDE64274D121764B14F
                                                  SHA1:4B39C02015FEFCFF2AA28DD07C373717CF0BB153
                                                  SHA-256:90B3F995625461A74DA4015252F0217062646F50A79C62E1E90AD0982246E3D1
                                                  SHA-512:0D9B6CACB33C6C36437346C4825AB2B76C27730AA1AF2BF7E27A25968184D94260CDD5AB58F0851E8E68EC0AAC768988F5664AA146F54D53F7E63C8C523E29FB
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W......hIDATx...1,....a..u..k....m..f./.V[.6M.V...h...c.,.......c:..r.K.K.8Ns.wwF.&&&&&&&&&&f.\.Q.!..@.&e.......<N.......V..I<C2................*6... 8.....D.x-..."@..C.....N...w.z~....E/...`O...q..K....Vd.>..ghg...O...1_.]......j..mL.V2D..o..>6...#n..;<N...c.........../..b.y..M..<.H0.*._.aJ?_...!.BU..X...Br.F........z.'=.<........7..A...^.a.X..N.yt..vG.s#.`....5......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\downloadadd.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):626
                                                  Entropy (8bit):7.574157688897543
                                                  Encrypted:false
                                                  SSDEEP:12:6v/74u+iZTLCiOLgYA+Ez+ehv6+KlyTlNajbtTDqroCzFVbTFaxp5Q9:xilC1dA+Ezr+yTOjMroCz73FT
                                                  MD5:FE226AE47525667611DC0BF2BC8F84E3
                                                  SHA1:E927B60D9CBFFA64BBCA6220369857FDD3362201
                                                  SHA-256:185102B4FFCDDDF54EF765C99B5C0D8CD6717B953685626263FD7017750E6204
                                                  SHA-512:B3D3CDAD903F64609597633805A5075C3E7FAEEFE1362D95960E83C2459B08A32CD15A20D213B394155D81F451B90070770B0258D27FF09EDA74FDCFE73753FA
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W......9IDATx.....\Q...NP[o_m.v.2...m.m....m}...b..gyO.[...<q.1c..3f.D...B4.&.0......m...R.J.$W.....$x.!.....}.....;m.....4....a.%....D..^..F...^..Fz@X'......v.K.=:..)..i....L...V....Or..............u.B.).....*U{.._.dW....[..q.=...-.c(....wD..@..@>..^.^.F..J..2...a..`..`.~..(.....'..+kD...LW.}L....F?......w..1...U&.<. x..........|H... k..'...C.%.....os...]p..?..Q..7..S..F..H).F&.qs.^$..(!.q..F.....7.....".k...HDh.K..='..F.K.|.z..9.z"......z.x...=.O.T4B-/7..m.t&./. .l..4..T...[`..5i/..{..p...tp....>.4?.2=#..L..HN.d......... .`....G$...=....H2..x..........K....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\file.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):553
                                                  Entropy (8bit):7.469017497439155
                                                  Encrypted:false
                                                  SSDEEP:12:6v/77AYmsxTKWVIRq/KDdH1XLVUkUs8UaagnFh3Y5K2UcSFh0J:qOshiRq/EbLVdUs8UZwh30ZUcSn0J
                                                  MD5:CD61F1D70C3315F0C595624626E30CA1
                                                  SHA1:1C01B45A041E6CD2F12EC421402153129C8AEACD
                                                  SHA-256:3CD8D46168B74069292B4228D030270D3C25556A73BF273F21ED929350A5D100
                                                  SHA-512:06AC117B9C2BCC68F9F1C62E08B71A6BA617F1DC94CCC96BE5C4D270C29E3B85DE8BDB87936E6E55E7E1D50227A837D999A17936BEE16357E50629645449D33E
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.......1.....IDATx...RSA..qh}.;_.7....,|....V.g.LB.n..r&. (.d...a4......{..d'.M.?.I.+N.][..r.<6/..g.......Y.....m...f.!.{.mz\0..3zB..'.@.>..M.$=..Z.2aF.|Ip..t....#~3............(..)7w...$\R9..'..rM..H.>..1..t..Wf....~.7..x.[.#c....J....'l.]..A...r!.Z.....2...=v.... e....i...p.S.}o@Ked.../B..o|.?`..a.A .......g..rR.gT...a..{fYvM..%k)?).E.$.#. @.b.@.................$Hi..Zf=;H..-...H....],@......R...K.h..pI.......H. s.h.~c#.......).87...L..h.........C.m.2]...!...Gf.<.h.<...Z.......zTf.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\filter.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):352
                                                  Entropy (8bit):7.014966266922034
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPWoA9akJPSP8IDOCnShtff9GuUgJO/aJtIfiNpwd0Nnq8IQcpsftVp:6v/7DqHf9Gb3SJ+f+w6hxcpu
                                                  MD5:12E35E1E47BC40C7CB960D30E2937A88
                                                  SHA1:A4A910E79182B532BE4C2E82FF4A498524F1B82B
                                                  SHA-256:26A07FE2A258F8BD9E85CDEDA32CFD0E9BB97861F19975CEBD3D0DBC3437940E
                                                  SHA-512:EC078B410F36B37C7846AF848C89F8273DE4A996B0B209D342FEEE38026417AD5A0CC64F98F78CD0D351816B45DF207F6453DE2BBA72D6963B943AA8A1A79353
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.......1....'IDATx.c`...`(....KJ.......c....D.#..y..........cA.......).s..SK._...P.Z..IUv....P....xT.?..........o..(....?.X.@.BC.....T*........E.b....T..P.t..#._.....r..t.lA.x.?..V.u.)_.@...&.......W....q....H.oP.Y.....&ZX Z..^<o............4..h.L.[..b%.-.Z......xUz.....v..gP.2.....`......@....FK.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\find.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):2043
                                                  Entropy (8bit):7.8740387624639485
                                                  Encrypted:false
                                                  SSDEEP:48:9Q9CigfeUpYag2d3G8u0xOYg2HgwYiHWz0erv5XFku:GAJpzh3G8u0wYgovverv5X3
                                                  MD5:9602D5D19ECE2ED1E978BF83173CFD5E
                                                  SHA1:87BEC90D2D8C4BEA7AEEFD06F63553786B44E742
                                                  SHA-256:6732D8E506F2763B464B7496DE1F63C91355C230751D603A47B0233065056107
                                                  SHA-512:5BBA6405CA1015385A92A119F2EF579F3FC81A33525F31A15C5DA5DC61E6F39ADD793B71EE8A2C9B0B1FC8CF46D92962D5996F3B7F3FBFBC37023A2525F11C24
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx..Wil\g.MQ..."%.gl..f.<o.v......{6...i....b'.Z@......QKDQ "E.... ..(BJ.B%.....@B....?PH|8z..F.k.V.1W:....w.=...~.[...5.iMkZ.v{.d2.K.!fWy~.x.....p.x.x.x..J@.....7<{.x..>.$...........e.<...+....@`.xt.{.6...~..!..t..e6..u...#.m._6).....{W.;og.[.?.0..0....C0.W..l. .a......v.|...+.'..G^^....}[.g0w...{}[+..m0[.......#...T....|.Q......0.BCpf.o}{+....|.E...5..S.$s0{. ..u.#..>Q.69.Mb..x.".sz:d......{......v.=....9.z...vu....0%J..&..............&...d^dP7mV...yh....&P..aq..S....$a.O@/M.+.,3.t(....t.;>.Qx.z(. ?....wE.h.O.!Mb.Z...y..x ..37.6i7.b.XL......n3.oe..a.. J#....p...H..........G'..(v....j.LJ.a.....-...vw.t..XX......n.U....9..s>.,..&.......p.?[...P.7,...].K.O..V......A....z...K.+?.....x....B.. .h.6.~.7...0...o_...,....3....G...K/}...+.E....1...`$.....>M.....,....8..N..#1`..N%.|."n...n={...\.@.2...(.v.:..`%.k...vlgV...8.....9.E..._.......9`......j.-L.....h...5...#l!.#H.T..-@...M.XT...a.CXzb?3...../.s...a.T.qT..

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\folder.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):837
                                                  Entropy (8bit):7.658948352574359
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7i1Z+zxeHbJ3mlgmuOMZynJkaVCWFr92PpiXypSo/UpV/Q8d0ulXj1am4bp0H:RZWYQmaDCWKPpmypSh/d0sjsbXW
                                                  MD5:63EC3726F1ADB26C70DD1788DA40F5C1
                                                  SHA1:0FC02D0396C296EB23443BC9AD69C587C493076A
                                                  SHA-256:C74257338FBB21A560F1803943C47AAB25A923B9C5B6C06FB323B7674DA82091
                                                  SHA-512:30C690E27C3183B1EFDA94C8A1C56AA88A4D466F784659D716943DAB932B26E54D71BB6E304FA0FE36467E990C7CB71D1DA1907FD599D373622A36DCB5840175
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx.....]..g?.>.m.h..\I.b;Y.....Ll.^MzONg.c..Q..T=5S...>...c..;v..r..c...%...7.VN.R%.oD6.B..PH6...1..=kcQ.c8Q..u.S.T..:u_...vf.\.w. ...-.\\#M?.V.52.8...N)9OFY..}i....T.Y..x..ga....L#...u.J.v...'....c....,...Upyu_h.(..Oe.E.F..../....p.....WiU..75....OM..#..4~.#.H.a..$\^...n.....U.oMR#.C.@..,.ps......v.....%.H.X.#]..N/..p..N+.qJ..I.*.H.%..W...VJ(.(..r...d..R.:%*.R...!>.R...U...).........R......v.8e...D:.R.O=JT...NS...G.w...ia._#`.T%&..\X.........[.o!\)..r....h),..]. q8....H..g......#y..I.....4._.....L., .!|.]."%..!..+....".:*p.Xx."..F....Nc......E..b,<g.JX^x.....a.....F.E._.<...w....;;e.....{L/....o..=q[.xu........M..z.%.!.?nU..f..G.....).v?../.a...^x.OZxE...&..d.)"e$d.9.*.x.B\x!^.!..&e..8I.....t&.H....M.l.N.pU'5.9..q...s..;v.........y.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\folderclosed.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):597
                                                  Entropy (8bit):7.525041421795061
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7OIz+oQq0YmTpp4uZgxbulPcrgor4Sy/njhYrNzsK7lJ:bIyoN0YmTpWkPcrghSy/0sYJ
                                                  MD5:D3CB5A8FF55B0CC0D62903282C960BC0
                                                  SHA1:C8AD5CAFA26D262A21DBD34FC13466635859EB5D
                                                  SHA-256:0E03158440D914549E90D9859DAE04CEE8DA2CD7E7C2183438A02DFADAF14107
                                                  SHA-512:73D470A7D6768FECF9E77B0427BA48AB250847C4BDF1931D08CD3E5655304EA08FBDBA8D6C6C23BAEF2637935121C93AABD1827B061736655008F2807E1D9696
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx.....A../n.X.m...lc4......VcWg......h..w...3/...o.v&..........Q(.;..Sx9..b.......O.?.<Ai.g.67...D...Idb3^.......v....o.^..E.I....... 0(..rk)1.....Gd+........]9(..5R%...%.+(1..M ..D[7>.=..^.....g..Dz.$....b8... .7...K........@b.. .7H..Di7%...........6..vJ..;.\[:.).).W[#>...$....tp.&.'(.Yt.m.s.......Jl..z.$.......N......T...E*$'.J.t`...@.pH.yG8$`t..uDT....[..pF......4..%`..V....`M.&..vJ".D.!K...lJhD....:...~..8I...0Gtst....1......:31.<#_I.T.e{.mM.V..].">.......2.;....jr.\".m..;.....,;...,..F.j||||||~...^E......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\help.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):451
                                                  Entropy (8bit):7.3373589268551855
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7Na2NyL0hYg8iGUOd7znLUUuUCG09b:RIhY3fXMUzOb
                                                  MD5:B0B42B523CAFE2271473DC75636BAE39
                                                  SHA1:1484FBA89C816D2FB05528FB9913C776B1BE4657
                                                  SHA-256:0F6F8573DF3EADEA51A370F7E014115D6BF128E6D698C2BF197293B203C6F908
                                                  SHA-512:772E98651626A06B887966502C0456A6D67D35713B7D8BBE6C606924AB5670BCB64B3C3B7D73541975EF573F0F8025A6DA226EDBEAC195DBA0ED697FC7085E9B
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx......P....n.*vm.m..6.m.k....6..<....d...o./.I.Y.0f.q.....#K`..b.6c....^.. ^.EW..C.p.... .2!.6$..c}.]/q?q..!^..U|./Qc.<...@..c....!..^..C...}.4<QB...k.Q.....[.....keoV...8%.........>..Vb!..2...W.....m...(...?..xozx=..@.19~../.kj|_...M./.?>.;...Y.%.4....? ..6|]6.(...c5Z.O@I[.......p....`1:.t@>.~...*.GMT.1~.. ...-.=!....p..A...s.;D..6..w .t...........?R2]C.....%...#..7n..OM.r.D.H....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\leds.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1827
                                                  Entropy (8bit):7.806449503481178
                                                  Encrypted:false
                                                  SSDEEP:48:A9OCGJ12wFUckS9WqTrEK8DbXYTOAG9pwZTH4pEmi0N7:A9OV/pFUckSE2AKwboOAG9IF10N7
                                                  MD5:E77DD22AE02A04794B54AC7F6756A91C
                                                  SHA1:C6DB35E63CFBBFA9635CFAA8627986AB256F9BC8
                                                  SHA-256:B121263C2E0AD79FCA64F878786984952AB6EB764A3F7ED76D943B8E3026327D
                                                  SHA-512:3B455FA6D818F87D2C4AD8EFEEA9A064D35A7ADAAC2A114B71B91603555C7191C15C139B62C5B4A1F5DDFA0A7525612F807C5A9D117433EBC1DBC4A321059016
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx.....#.....xf.V..1L.m.6.k...m........<.J.N........9.*....&\<.>.JX...&.3.....aa.....K`..z..l....7.......(..}L...[..x.P...K...$m....#"Zy0I. .e.......x 3v....u.KUKd$.d.n.v....}Ou..._.O[._F..El.S.._..3....0........Y....u.P..Xi.q]............f.>...q.........c..V..k.......%..J......4....V..V..B..Wb...........Q...N..c.#..D........wT..M..E..l.....17..6.#.HDlL.........Vh....&>.Mr.K..c..4.#f....Ki.G..........;.|..]...P..2.8.[.6....G@.</..0.6 .......n$`.....ET"bFL.G`8D..<....C...(P.SD.......d..DgT$mD..C...T[h)...|l...@#.[9.# ..v,1..".....B ..L...S3".]G,..@..m....J..#..p../...@...J.`.#,.^b~..\8E......d...t..p?..jD....7..8.g....L......p\.u._.e..M.....J(g.v..8..X.I.VAY.du.+7.Qc...N./....npD.Xev;...Rcx.5 ._.q......Z..a.Gx.v..o..x.^.B..5.xUb.VbIo.!.#..........._.p..>..pD5.v.^...8T..0.C..gX......g.~...B._t.z.{...$.x.. ....{..q.....XE......p./.......gz......~..)...Z.r..=|..{....s..+`..*(.....'2.X..h.}@v.`>..C@h.....g`?......!

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\localtreeview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1358
                                                  Entropy (8bit):7.814910844818487
                                                  Encrypted:false
                                                  SSDEEP:24:CbXaOP4L74Pm+VEJ2Hhm2tQBrRzcEieZvIyifDRWzwqf4UQ1qy0fN8:CbXZZPmCfhjKBrRzF8yY101gUESfN8
                                                  MD5:4A3BB96193B345FA8CCFE1FAEBFC0BD5
                                                  SHA1:AA35FF707BB811274745CF0CFA43A57E8FD92580
                                                  SHA-256:99F6E69336F2C6A6AF2B60A95C4392C81D5AA1C338D9F13AC1ACAA75D19E891A
                                                  SHA-512:B769BB196B9F40FC52DC1E8C8B21370ACE8B30BBA2934D62DD7C7B94B71702DE7B73730DE5EF73137077C08DB2D022ECC8BCBECDD457877935FBB1C5889B4885
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx......@....x..m..m.m.m.|.5.I.).4.Sw.....9A.Y.r..,1....[...8`7~....X.D...%.Zx......K..K@aix.......y..~...u..x1~..'....l._qS\...p...Ql..W....D.....|.....)..38....X.pW.f..........>.[.....b#.........$^i@Z.drr..z.jEQ.9..@..mX......@J....~....G..n.{....+V......7.....!eY..z...VhA..j,?..n.....nm@...w?..m...w......ccc3u]?9.|..+...p.....;..cy6..,.....U.V}..68Zk...7......X...s.R....f._...?...MLL..._.A>yddd{L.....l.4.|...Y1....+^.[.Y.X.2..........H_......(D@Z......~....l.]...R..(.Q* .d...v...../(..Y......v.+0..M.G.Y.l...Q...{.nq....6.^H.i.(9...."{...Y....}.~.EO5e.pDM...=,...(%.)q3..:j..d.KHp..q!qaW...D9....=!Z..f.hD.....`zzZ.t..H z.l.A...'...@1.P.$..`../_..Pi2...8b..NqZ...c%.E..G .t.O.4...H#...Qw.yl.`...o.....5.8.C..c....s...Bx..)...$T.qZ.2......{.[+..GB.z.w...`...r.s.3.\.Dn..;.+....J...H.b.........Q....`..X._@.../.&.......<.b9..@...[.....;z.... .B..._........VP....L]S.....~2..x..F....I%j.e.R.....".L

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\lock.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):608
                                                  Entropy (8bit):7.493543787550498
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7g8YqVYA/HgmH5dO+pASZgQOl/wWpC0yvRJlR0aI3HdYLfKec:d/qV7/BemAl/wwCR7S1Hd0fc
                                                  MD5:60D8F0C9D2C780AF9EF8671CEA5B3EF0
                                                  SHA1:6C1EAA0B024C3CF7013F51050766D164018A1E49
                                                  SHA-256:92BC14CCDD53477D0E425845E535265CAA9A17BF520998CA88199EC763EB2FE2
                                                  SHA-512:4BBEB66F3A5BF3188A091465B26189EA5A025731F77B28962001FD944D27B8B5B009A20B5031C08A92388780354E23EEE2D671AB5BE4737303F7A675952D5D59
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.......1....'IDATX...k.a...w)A....Ap.tPppPpU.q....E.5.5.wTT..A-'I*......Vs.1..&...A+N.....A.(..!..r... ..n......N$.p.1.t...q.=......>.3. .}A.G...k....m=.)R8.Q,. ^.......{~.D..A.......l:O. ......q....6...j...V V.6../m.G.nb....no...u...e....st.X.F9s..-..+7..c......f...N...i..{>.<5gX.4].M..3VYa...I.(>9...+..M...`/[Lr.U....E.b..&....*Z.s.u.!.*.0.G...@......M.... .Y.K...Et,P.T..b.5........D.c.-...}:.'h..97$..v....L.9,R....*.2.Cdf.C..Z...;R.._... "ru..g....W..b_..g.....m..4.....5hT.......1.N6.6:.a......p.Xm.).8MM.V.6..;..H.._..;W.R.pI......o.....}gD....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\logview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1033
                                                  Entropy (8bit):7.768863511317586
                                                  Encrypted:false
                                                  SSDEEP:24:zsDWmHvXFwvk8xE772Kcz00ClXWMbI70vfwC+PNf87GbO7aS1Li21:zsK20BoCv5WI7afw3PNfA31
                                                  MD5:CF0BD15B312DBE7E9EB590C03BE039A0
                                                  SHA1:96A4A1A8504740697D503204E2577DB7CD5648CB
                                                  SHA-256:0C40122279993D27EB44FAB871F1CC3B77DB0C835F414374F721A63930F0682D
                                                  SHA-512:B2790732033CA8974204427872D06D60DF45EF264344F769C37BA4DA0020366FD9F902AA6A9347DE7EE4B9AB72D351D0AFDFFAE82319FC46A89819557FF573C1
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.......1.....IDATx......u.....9...{...2RJZo.DEz.)F.U*e,.l..j.......D..PC...&h..Ukm..v_......r<..r..`...x._.....;&..~.].......:`Za.....V.-V9bJ.n,5h-*^...x.....9..%v..K.|."...A........${.......~O:....R......r...../.v..$.....!u2~....^|....=X...oQ.6.....c6h..Leo.....p.gL".7...*=..o.........pN0...M*.6..:O......N...V.U5_4..a.n....7..S...#..=.....|lJ...._k....rI).z...W.wDUDA...~.#Y2..h.me..2...dlv.>..+j.5.%QT.WU3...*.......WA.<......)...2f.h....$...E@.y...Z......4..U4......4n....A..#.f.y^M.N...V0.<.qp.]..h+.~D.r.P...N..4.e5@..*9<2tY..\..c....l.(..%z.d..Ds...3.I.&-...@A.[..:..V&P.k.......(}`...2I ...h..Mk..>..z.6./...N.+{\.L.KZr......G...v..'..|t..5...^yWT...^....._6..OxL.PR..7.a...W..L ...D..{.D.Q@UYKV...94,u..#.......d.;nlv.ol.g........h...T..0.,J}k..!.Z.a...D..\.RSP.ss.Y.a...@7....e..uJ..!s.e=Z.] ..d5..YAb..*...|...1}VMO.h.QV..:.5Kl..@...~2.......e.%......(d&hS....h.K@...D$..t''. .&..S"....%7e H.....(J.).D(.......i...Q

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\processqueue.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):364
                                                  Entropy (8bit):7.053084072875838
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPUUXEXl5FaUv0RjAkxjgXqfB9zu5Ink4Yq7zcnkrSiUZbDWRC+Vp:6v/7VEXluVRjAkOXqp9Cek4Z7zgkGiU+
                                                  MD5:8E29883E144B9CDAB46EA6939A9B561D
                                                  SHA1:359398993D07FD5F89D4707099274BFA713DE18B
                                                  SHA-256:D2CB80E80774006A574502622B7FE087FE835E12B7EAE3CBC2C7756DBD135EE8
                                                  SHA-512:3CE485978F06A6B557E4386AFCC55AAADDA9C1268A2D7821EC294A8D9F26FD492F7B66B5B0CFB354347DE8E817337D15BE8D01B4E6507B7DB4BA6A92F0DDC15E
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W......3IDATx....D.A....D.E...!H. @.R.......')..JH@.. (pG.......$T....`........n.O+.....x.R.......94I.......Z.#..T...k..0.X...9.. ....H..C4`.b.@q........ .V%.......Bn...u.....@.aJn...M...Br.y.%...Ry...O...U.......U}..0..&.Q...V..~.......r.b...r......F...1`."..t.[.cc@0zO..5...*.....&.g...J:G0@.......x<..~...<s_..R.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\queueview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1559
                                                  Entropy (8bit):7.833720117736715
                                                  Encrypted:false
                                                  SSDEEP:24:cDTOZRVH04m+U98esI8HRYhh9nVaaH68QP7FKc0GIrgz0LBVCK4lnMqTNYQ:qCXVH04m+wsYz7at3P7FK1C+qeQ
                                                  MD5:534F1574C5D441E0B5CDBFAA065E0F74
                                                  SHA1:9B6D42683F85D7418624E400F391C3118ECA0384
                                                  SHA-256:56B1CB2C63DE74670DB9D9823E47EBCC99DF8F067BB873D25C615818948CB0F6
                                                  SHA-512:492D49A3AFB365C51CB2E356087C5FD8F6CF4ED318DACD5A4166FDE85534EA6958A42F84E4E671B335ECAAB3C448ED72CC99EBBCB8F99ABE8BBC57DE0BD7B269
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx....dY..;...8.'.`..m.m.5.m...n...6.3..g...ae.{.z.../...s../.y.5Z.5...".H>9..$...9.... ..q...XJ..A...RNf.....-.@."..|H^&..,.:y..(...6.X.3]..D@L....Q.7..@|||.E....c.........J.H._..........G.P..#E....A.7........!...d..[.n3........:........<.-.A......4..w_A"...................G....q.N..../..5.-...r....L..h.Ol....C..c.JNN......{..=]TTtt...........>(v.Y....=..._cZ.6...O.N.2....'8...c...s.\$.H..x.B...(--EMM....0l.01.kW.xa... .g....:.))).LYY......1.....'......%%%b.+.1c.X".0s.L........j..y.1..M..I.222..........,..E~~....Sb..@c.4!.q~.,..@vv..r...x<..}....B.]..>.......g.;R............h ..2...i.......1......07(........]..h....c8r....>F..4)[.-.....b...)9j.QG.5..E...E.X..fU...._...&.MhZ.3 .l...S..[.........._..*/n.....b.P..bP.zL)...(~.^X......%&&qG.O/....9N...0..a0 b......?..N.xa...X\.i7.(..EgWB6....h.....F....O..:....\q...{..8....X.;.-*...n....$...o.nx..Z...i^.pw..#.W.... b...".........c.r\.......i.;L.`...

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\reconnect.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):2265
                                                  Entropy (8bit):7.8574358861512
                                                  Encrypted:false
                                                  SSDEEP:48:AyQ3QCqi+Un2PvXoWATRyCZ5IZ7YUb2PbpFHPj3vKB96t4KNygKU:rfPAHZ5+EPbveBItpMg1
                                                  MD5:42AA2F8AB212AE2F20C77FAB02E894D6
                                                  SHA1:39D9A0FCF2029EE555FC2D94B9D8B83CCD4D555C
                                                  SHA-256:E8D622236EFA0521DC9061901D20E4999C77DD2847581F320C78F5DD3665F6A1
                                                  SHA-512:6DDA8032FCCBDC12175FFAC5E611B78036928124416674D3E0273C17BB044E73369EECE8CF9A5EFB82B912039C2D96D2E80CB06C491ECF34CECFADE8BC607443
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx^..y..e..........c....b)T.R.(GS.".!..bH.I.P.h4(...&..... "GQD.D...RJ[h..[..1;;;;;.....KwfYbH.I...5.........#.8BP....2@.....G.~ss_.............S_z.E..r..x..Q.....*..~..P......7.....a%..".....@...e+&..p...2xQ...iz.F.I.@)....b...c.......X....CtCp....`.....nu.c.3. .iv<....O3N..]jp.U+.U.... ..XqI.%_L.......p...-!H5..M.F.*g./...L.....QBa.q%..).CJr{}.T,].b..A.?S.n....t..S..|.*.{.G.KO.dj.S8. ....r.}....jk.w..e...P...%&.....0S....A2.g...0c..V...Ny...X.F.....F......)d.q...........w.0.F...=.~....6...ig7q...?.bh.O9'.:..?.E.r_.Y.u..@.....#.8....<..x..i.)....S.2+...|..a..|...v...s........`..x.|]eF5#c.i.l{.f.~V......)....W\pM......7.C.K9.sN........<~....A.Oo..;o.<.GS..*.L"...3....:.P*Y6.v.g....%.,.K.](9..D.t@...."{....G.......Z4.P..Y}}..'....H).t...0.......z.b....}....nQ.}.6......=;....7....[.\Fe.....Q..L.@..<yo.=...e..}..:...5.....m..l.0.....)....y..;.}.tAl.b.8|@t..P...&.c5..&......S..*.[v:+.,B..].)W.l....ur.C.m!C.<.N

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\refresh.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):742
                                                  Entropy (8bit):7.51770585961639
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7kztrNsv1CU2aKA4LEVO/ej3R8NuEeyzfpAJEfhoRlJcLK428eKHp7pl0:DzVNICU2ORu9aGuR4HPeKHpQ
                                                  MD5:77F2114CEE5D114FF955F70100E93E83
                                                  SHA1:A058910F4A48342105660E75D3DA3109E6582085
                                                  SHA-256:7DD19E2D377D47C8F9985E43370DA6AD1A7ABBB26900B3269DBA6511DF518ACB
                                                  SHA-512:DF6C50D9AFD14E145A95DA3C504686CDD1B47DE07CE609D6BBD677CF4D3939A842DFB43B7BAE96A721DFF2D57F00C6FC067582B40209AA1FCCAE559217188AF0
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx.....$M......mcm.m.m.m.m.}.T.....A.'y>N%....K.8q.......F.....X..l.*T.... .B...!.*..R...C$.(.Q..?..........@{.r./!A....U`&.'H.... :.G{.F...o.'..;.C.]..._.3.X..@'d..G.....j6jW.D..uX..........Yv......t.."c.f~....m.\Dm.98...+.8..@4..@.\.3........DG.......eOx._.>.......,...H..R..Zu..&\....(.....:DY..&.......2..\F]..*B4.m,P..<A'SW.Q..cc........B..6?....4Q`.DYis.x.....&A..6...Q^....}!.uxm,....DS..*@4qC..EL.....i...MW|a.N...\..|.J....o.Y.1D...;F...U.5.\.O....D.'....W.OF..]Y.Hl..@-..&..pmu..c...*..fS.c..;K.F.,...Bc..*......n,.6..Q..8...\>..\.(.r..U./p...#.AF|......".VB.]R....X....N....|i.!...x.y.G.p......_...P./ Xl....#....z..j!=.W...Q.X....Cx....'N.Dm^....M.4......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\remotetreeview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1450
                                                  Entropy (8bit):7.802879954373579
                                                  Encrypted:false
                                                  SSDEEP:24:DL5MsE733nXSC1a/ShXwd09bA6Hvx43Q5r7H1vD6vHuWTBB8P:DL5Mr733XDAuX60ZxZpN7HJlKB8P
                                                  MD5:5E5864C1CCE24C7960B5D3ADF7AAD51F
                                                  SHA1:60117AA48AFE8312C1A214062B1179D2394BD063
                                                  SHA-256:25590743B8A8C2DA52FFBEAF993D0AC4C31F4B0BF6A5B3A7FB4F9FF8EE098914
                                                  SHA-512:B16B9CB2AE50C9B13AB5B31119BC6F13C605D990F682995A118046621C73EB6C2B71D3BBF0DFEF700BB8F172C3D32BF618B8A6783BBCDCD0C7C795845EF46987
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W......qIDATx.....$[.....m..m{l.m...c.96..].$c.O.<]..VW.Ll.-..v..[.I.K...S.I....1......O.."W.4....sdI..u2AF..X+.j......r..Sf....W..L."......Y*&.\.2)."..#.......M.6?..|1......3.t......V......oi...u...G..m.1.......Q..4i.ULu..R......D...^.U.Vc.5k...\...i..b..X{..i.<..+.T.}...]..z......*R..m...={.\.C..M..=Nu....-[............eO...l...GN.IK...O.....a..k..>}z.+.s.=..yT................M=....+....HKK;.y..=...vL.}){...K.....hR....i......4.\.....^..?..3..V.f.....y.7...0....(;..+JJJB..V.Z...m..t,].F........b.uv\...x...eJ.....f.......P.[h....{L/.....:...p..f..... .........w....)((..m]k?.e....,.^.6......e...r.Q.]n.......u..y...a.../@,@,..up......N.%..z...m.U..)..Q.s\..q\...*I...;...4.|Km.8......;.....`..r'^.A.@..r.........Lx../N/...3....{.i..;@..n]^..P..W.......U!.....v.Bx.....Ah.....y....t./.?.....=Ob^:.:.%7....8...a..T.....d.?%.....S....#e...|d`...r.....+..R..|...;...~........6...<.U...&....$.......R.H...9.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\server.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1161
                                                  Entropy (8bit):7.789946707579446
                                                  Encrypted:false
                                                  SSDEEP:24:3VzK+kc3pDUZOKGjdLrjxPJp8XUggAqaj9NOz:3llzAZGjdLrjxPJmjgLajg
                                                  MD5:83EF20F610313A4652F5AC274C4ABDDD
                                                  SHA1:2E40F7237322A11F4D326C0A45C0A3DD0D803630
                                                  SHA-256:13BCF1EE293257E6574FF7BD93FBB52EDD581609180F7E463C8AA3CFF0F1408B
                                                  SHA-512:EE2D802FE8F5DF3126F5940F73FD1645AD8839C4F67696611000753FBF526CC6B469975AFF0946DC569573675F4348AE92F3C56C4308FA3ABF28F332E937F8D6
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W......PIDATx.b......6.4.....6k]....c..L1Smj..k.q6v.....|.Du{..L....(......;v..t.:.....Q.C...G]....1>..#........z.@.E./..Yjy)>...w..}.z(..Z9....Z..K...{.s..L....~4...F.....0..!..>....y=:.....fGF.`.. Wi.....Fo.\!.\)..`.w2y-.*..&..N'..G..}.-/..Z..<{..G*.[.h.......G.E8X\..q..:^<U.2.u.|....K.s.v_./....s.-s.....{.,....O8XP..R?......>@aU9|......./.)...y...%W....h..8....Z...Pw}...R~..X\.5..x|.q.r."...)...R........s....R..Uc.b./.B.5-^*..".....I.f#.f..T.TM.Uhq..U.oBx.>....[.P!..J......\.....Q&..V..^..?...L*.7....M...H.Xc........e"...~.\.'..W...FFFg..G02B.....?.....ml....To.}.l...D..g.WAA-.@..'w........H#....5F.k{..`..ke..4....m........L......oK,.m-.Y.4......X..X...I$....~...........QLOOcbb..1.L$.7.9.d2...AX,.X.....Id2....A....Am...W.!..V...\..C`e.H..$.F G:.FGG..z=.......'.h4..N.w..P."...s../.\..jM..5..3..Gm.I%.I....d..K..4|....'.}<n7e.o...n.q:..Z..mi..ZD[......(.............w....H%......r.]........^=[...t"s.,..:...Qo_?z....=.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\sitemanager.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):2337
                                                  Entropy (8bit):7.889825043854827
                                                  Encrypted:false
                                                  SSDEEP:48:crWCb3Gxk3lTNkgEx59ThxAkK/e2OpgMMKcn7nc1aVMU2zu:yWG3lTNkHH222fMMsGky
                                                  MD5:3074B911242301D208B68D18AD83327F
                                                  SHA1:A125B6088F25E22B8030B73953B2D5C1FBD54E97
                                                  SHA-256:8E4E993FA5D35F52D91278798D3FF35182B0E284E7DC385A32847A7E62747313
                                                  SHA-512:7935E90F6D407641CB27DE4FB24563FFBC794945F50A6221117D3B9820B2E94235C8C36808FDB52FC6F46CD6C2FB5320D97532EA463B4906E970962188A2516E
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx..yP......t..1..:....(....p....r) .W.e.caw.eY.." "........5.LF.}..6.M'..fjf.'=d.}|..E.e.....g.c_...s....^.5.....^.kMH.<.HX....K.#../.L........?o....O^.....-.o$...{.{.o.b]T..E.X.. . >].~.O..@KK.R..%Z.....D....jP.QC"..|....v..lF.,....&.N.ti.R.HJ..s..;.#qs..gH..PB.T.rg...0.o.+..>....I..7.k....Y.%..`. ..IJ,.. C*.lR.............EA.G...b.!k....5.QH.v.~..M.....V(:...j.....d..N..S......kt.....>.XLx....."..~......!....V:_)H@z...Bx.......E|L|wJ....q......A...a....$.7,...q..$J......j....b..U..F G..F..&.'l#...S..M^n.477..{{04`.`.............%EZ..:.P..Q9M.2..'..:...R....Z..:.V.J.uA..m..z.XSR..7w.d..P6@...V.F.x..l..qz&..K&MjZ...9...I.HH.O.....!...........X.u..T.n.T..... 8f3....x..T.m..2.!.....;9"cAe....7.'...../....<..<...%.......i....L..:;l....J....yn..X...`Rh.|t...N/y..'..5.V..H..l.^....0.1...j.F=...."nn...:>..]....L*..dP9.OIE.-...>.).!..@....8.....T........3,.+.......m0..A.a%...N...B.P(..Q.T..B..M..)v6p.\..

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\speedlimits.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):863
                                                  Entropy (8bit):7.635125877464344
                                                  Encrypted:false
                                                  SSDEEP:24:+Vl7a8uVEYyO0+W/sWs5XTqtF7Yscjl/7:+VVtsXWhEG7JEZ
                                                  MD5:01468117EF38F6C409E52E6AF4980499
                                                  SHA1:410B3D78F479E5B9AB882B2D4978730CC75D6A1C
                                                  SHA-256:ED4C8B569F8CAD2FF40783F0CE8CE9D9095B1A5E124CB87040131C094B7EDD1B
                                                  SHA-512:3B62E70F2CFBB403CAF1992478EDC8E312C53C50A242A7C6235B35FCBC5339DB9D84ED380A066CB09F268A93752A5BDE9AAD60B9B4AE3F6E684AA2443E356306
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W......&IDATx....lt[....l.Q.m...z.m.m..o.?..u..I.l.....#*********&.i'.....z...B....C......P....C ....9..y.2.L../.*]H.-.aS1.Cy.....A.C.....'a...P.........t.a.......n......XM8. ...(.C..f..!z`..f+2.8...k.;...s..\..$..^:.....(.o.+.~Xq.1....?8............n....Wk...9...T.f..X~.E.Y..Y*.K...,.Z...QWm.......T.D,>.5.Q..0...{.*.K?.=..?..:.FeQ"Jj.q}J2.....vCG....?.0..Q..A..1i...m.W^o,.BA]..)...a!......8....t..O..-:EHb(...P..c.....{.b.XD8o\;...h..c:.#.:.(t.d...d6..E[Yi.g.....x....d........o.\7......,......c....J..h#.........ioI6...L...1",.=.A...;.....B...C..Cc*K.+.XW......... ,w*A.....#h..#...}.c..H................q..L2.n....Y.......7.......q.[..b......'.D.l@<A....D..g....8d....P+.`..xD2 .0.5..d.C..=...I.\*......#.p.d.e..W.:.....H&....c@...p.l.6...-.<......u.N..1`K.Y../*********..<.....:.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\synchronize.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1146
                                                  Entropy (8bit):7.778287018228459
                                                  Encrypted:false
                                                  SSDEEP:24:3iTrjIU/RlA2aqElE27BmLMYLLzVRHpvtiP1BMORO0xt:36gUPaq2E2woYL3V3v4PbMeh
                                                  MD5:98ED26C5379EF6C8230CEDB6A67F76F2
                                                  SHA1:543CAFCF47D42586704FF87FBDBF02B5B3AEA417
                                                  SHA-256:A2542D8C3FD64E23FEA0CEF09BD69DAF5959CAB8DF41BB93A2F1CFB1C59019E0
                                                  SHA-512:3E1D379B5448DF5586A8D7D9A94F94B0CA2522A1B653ADEBC83C7E3281A266255682B4CC5A95D4EC6E73343EEA8D85CC5433B85F0B1E796FC972F6CCEFF9F06D
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W......AIDATx..._..u...o..{..0E-..1.d...A.J5S.L...X,..Z..n.rZ..U.m1&$....EFd...S(Z.h.i.y..x..9c...8......~....'.x.q;.|7f.|-..y9(......JhD...\.F.F..8|..P!i.Y.B.....FN......$D.\.....{.Y7X.......cQ.>.DH.u......e.P!Bj,.<(g._.....g..k.Q..4...:.%&..+,J*.=.r..W....._A...Q.B.....m........N...Oi.x>.7.E?O.....B.'..<.G. ]Z._.....T..NT.zr....6!`..B.;.g0P..;..PT.Cq]6?e....55..(92i.)WR.H...K...}vx...{3.....T6'&$C.....\(.K..tI...B....Ak..|......^[.}&z.hx,.z.xV+w.Pb. ,...s3*.g..&..qih"..r....;T....g.A........f......7N...o.O.h.)..g.T...X'.U.&\...^...<d\.n[.x.........*P.^m...L...K->..?d/.m...=,...}%$..f..i....fF.....h.S..f.*...O$.W.....s>'.\.....B.l+My.4K+..B'.'........T.77R.R.|.~.....??a/dT..0t5.m\O5...... ,q..\:..F.a.n...2. ..x.}l.i.)..yeW.....;.Jha.W..&.[x}'.Y...G..N....t2jG=[8i..58.o...a.....#..pvp.H..'...7ej%."J.[.3q..f.s)o3..k.r.=.+P d..bML.eN......:..L.&...j...B..HW.H.m.....M..P...ktAuya...E_O..vbl,.t..B...l.......P,Kd.>..

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\upload.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):412
                                                  Entropy (8bit):7.233612107216541
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7+0T39vD7StAPw7Z321IZyIlB4dcSNw5kl1r:1C9CtiQi4R4dcOll
                                                  MD5:2EAEFBF6063C014EB0D0CB55DF1F41EC
                                                  SHA1:B2C5571D1BF55786D46C66AF9ED75E0571DB141A
                                                  SHA-256:E52164809B22B8F85F61870873805A7227A4CDDB276987AABB0826361F3A1890
                                                  SHA-512:086A3898C9F0C6D64400DEA3CEB9CA40879EBB71FB9563F253BA56845289EF34AD86A73755C5174ED1D483501C8ECEE27AC2820FB73EFD487C924E5C8FDBE2E6
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W......cIDATx.b...v.;.8....^.z.[.f.:N.T...^C.F]P.6...c......I.s.XE%:.k.....Z.?..f,....L..A<.3C......\.+$..F,....2#....A......P.. ...G.......H.djQ..$.r.Y. . >tb..... ~<..../.q.....,...."I...-..v.y....`..-.....;........p.....T.~>..h(.,.oE.^_d{.o..}...=.&..zF..!j.&..z....}.....8..cWEEEEEE%.o.4.b....A?b..P.-.N..b...HR..]<`....(.:.....!!..?Q...h...x...&O.f%}K.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\48x48\uploadadd.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):711
                                                  Entropy (8bit):7.598337758675123
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7jDTLvH0p981VctgopAm4oyRmOSrzESBWKCbFnu73GmS9Fa3/Pt2j7coev:+D3vUU1o1pAmu/Sr7srbJwGEXt6cdv
                                                  MD5:A7B6F04ECA627B530E7FB354C5892900
                                                  SHA1:D81FEF27E29A08260699E7CA7E34E9407E2E1689
                                                  SHA-256:DACB68CF141608836A1941CA7A600CA5A2D9A532FDC2D5BA93288E5B5AF6CE5F
                                                  SHA-512:44CCB872235530F8533372062663C55F28E3770ED8EE2A3EFC113200F65CAC5220A245D1DDB3D304D1B4A0769E389D9E7003CC1C17F6E1F8360600453B2116BC
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx....l]q.....V..m.Q.6.y.f.m..N..t.......}.GI.y.N]..V....._.nR.d.U.B(eR.L.....R.@......%-..........-........-6....K..&.......+hf1.<.^..........\......%.!.n...I.u.^S m..3..=....l.N.e..%....@.*.........^....`..4.8@.........x....=.....P...J.k......x....x.....v.....5.2.nF......|A....._......A....IP.n..........c..w@..&..@....D.L..B*D......x.1......5...m...A.;"jK.d.s{....M...y....8......{TB...K.7..#...T>..w..#.)s.....V.. ...c.....R1.'..zL.e... ...a.=F.g..As3.$..1w.H.QS.2..i...#.~.g*b.w.lM.....x...cI.=.(.."<......%.....0....lhk..<R..'.. `.5.@...........F.H...F..{.!/.../...S.N.:u.oE.fF...hD0'}.j.............eR..dR.$._.T...R=.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\flatzilla\theme.xml

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:XML 1.0 document, ASCII text
                                                  Category:dropped
                                                  Size (bytes):298
                                                  Entropy (8bit):5.003789070423829
                                                  Encrypted:false
                                                  SSDEEP:6:TMVBd6OjzwgKwGx5aQmn1pjgLDR5/oHUTUZBOHrSCOHWXdQUGOH1QIKe:TMHdtAgCmjjoDR5gHKABOH9OHW+LOH1R
                                                  MD5:C9272D5C5355EBEBA772ABE9504EFF43
                                                  SHA1:3F621D3043D405D7BEA746E99E76096836367292
                                                  SHA-256:41DDF7E633A3A56547933E7B58D4745BBBEA280261577358A54758B7A85E7013
                                                  SHA-512:CBF9A9A22D1FABC8D1C1B1A147AB99A167B9E115BCB387B880621A95A32485667F5CE5C437B85A28874CFAB19748EC26CC30ABA18DD489582B3D2F23FC2A5DBA
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>.<FileZilla3><Theme><Name>FlatZilla</Name><Author>Boaz Lederer</Author><Mail>aniboaz@gmail.com</Mail><size primary="1">16x16</size><size primary="1">24x24</size><size primary="1">32x32</size><size primary="1">48x48</size></Theme></FileZilla3>.

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\16x16\ascii.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):687
                                                  Entropy (8bit):7.5885005883581265
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7BfnB5gR7tJwTtKUHxqETo6lONJtneaD83Iv4SRIcW4zCFyYJ3ehYWTCW+uxU:wnB5gVcKUHxqEo6lOLtney84lI3tcYJJ
                                                  MD5:287F785D92FC38D925220CF93943C56F
                                                  SHA1:DD0131291A3C2ACE0FCC430FB0B04110FBE3982D
                                                  SHA-256:9192D0A199BCAE8B1B6DFEF50DB7B42EF7130EE150C7BD14D95F9D7BACA3196D
                                                  SHA-512:54E5B821392ADA43E30F773AE12F1B4F41DACA2BA627A8AFA10F748B316B2A03674404D0AC480A39891D6679A472BE5B1C3EB33FE97463FAD879D6CF7D2FCC2A
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a...vIDATx.b...2eJ.]..d..leA...$/.k.1...:j.u..m.n..u....6n.l.;...$.s.....2RTTD....o.L&#........\.............E....p.i..`.X`6.a2..R.0??.[.n=...!..`...+..FPEv^\\.........P....e....7...={....i........<.....Y.e.....r9D"....f=......~..e..o`...Wm............k........_.........Htl...V//...2..`zz.4.HMMe.....mFx..B.<.\.7.v..K..KlYt....0Uy@.....:......vwww...Cc....7brbV..E.q9...;.......{0).......z............XQ..F.....O.I........3g...g..^...q,...jV........@{{{....7o.u.4.....<.....R....2.b......yj..YU(.......h>...{.y..w....._.........lmm.5.z.B...9.Z............~.._....*.SB..t...?V.......o...+c2.1?......K......+..............IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\16x16\auto.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):672
                                                  Entropy (8bit):7.597373393891944
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7IHjWIWbPKBf8yBOmhAPpzxGgebManVOOUkO3vX86+EmUg/AcjhjzpKhkc:iIWbPKB5/IplGlbMat0/867gbZpK/
                                                  MD5:9821B72CFBC8649456B8D52EC5F2E171
                                                  SHA1:C01842EA147CA851B99E02DEFF6A9FA7C3213400
                                                  SHA-256:4B9B3AA0D63BABCB0F9075194EECAB18FEE5D2D852E62A96720627AA3A5A27A8
                                                  SHA-512:A87B2C4F9AC42D73EC4FA908EA47F2F657230D5A200455EF223E6BBCC5C3C487D2E2BF17E9239C8657B0CE2E2674BBD0567BB06457557A59503586B59B5060EF
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a...gIDATx..R.leA.=..m;..m{..nTE.....o..y....."s=._...........X,f.......u...B.L&....1iii)...].v.M...`..R,..$f..494........@...y.W..&.J...w.D",\..Z....L.b...C..J&..Xpoo/...Q__.w......|.}0.........M.g.U*.>~..Zwrr.L*..V4..1.{.yT.,ww.....9r.....a.t'X.l.... ..a..p..I....S.S....d.J..j...B.yy..^Ox.t:&... Tz.q.t!3rf...w......v.lF#.H.....m...D"AYY.........8.4. .1......o{R...%.QRT.Q..@..}Kr.....IDD.INN&QQQ...$!9....$..3B.-Q.n.u.'.(.hknf>GGGxzz.......f..w...B..QKd.jl..d...e..<&.E...;w.D......B.../...I[[.ioogr,;;;..........I.L.....A.B......-..o.q#...E....}....7.2.2.2.2.2...../....0.D.N.^....M..:.....V.h..h....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\16x16\binary.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):697
                                                  Entropy (8bit):7.658609320999023
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7kC0a3cB8hU7qg6nYhL4jFSAB8Wh0GYvEVyfDXcN34nsdmDDpB0yFYVXtsRlE:3CL3aUWq1nko9BAssCiDIJmlE
                                                  MD5:CF888FDEE136C738F6CE18309F589CD4
                                                  SHA1:A4D804FBDD2F045FDF8DF2314CC01DEAC9C734A5
                                                  SHA-256:13A8E8208D5936FF030683184B85C1BE3EB66DBDE32137CCA44140F7FB9E5730
                                                  SHA-512:957A771BE969BCE3DD129C57FE2A09C29919B605A162368309830AF80700A6296B4C1A172DB44F1203B51F7DE5567B742B7637D912D6D7D2F97D5DBCDBFD08D9
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx..S..\k.=cw.m....U.qR.U.mT.A.6...m.w.._.......x.>.*".3g..1..Q..EQ .2..0$I.5#......7n.....t.._|...A.@.N.c#.=$.......D}}...>2`4...>$''..t........b.....h.Z..A.o.~g.l..H....X.v.....qdd../.n.#.. "...&.WU...b..5.'..K.."+...Q.S..?(|d.....e...y....<......J...........&.t.e..&........a.P......a........c.B.V..g.....[........-...G...Z..3k../....=....o.a.P..q....I.!..T..8]g~n.UET......[RN..[....z..O)0j.Z....|.y..=.....>*.~.2i....../LM...BCC...I.&!33._~.%b~.AnN.GEd.lhP...&...Z....0.)..>X+.G.QY_..0@.W.t...P(....Gu.F..).V*,.s....A||....<R..H.X..6R[..SRR..?.... .s)\.=....h..!......!d..\.a.".!Z.F......q..?.+._<.;..<....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\16x16\bookmark.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):563
                                                  Entropy (8bit):7.553412470683321
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7wnj5wjF7cO4UxVJmmHITBJ+zjR0v08xKrrRFdk/NfbobHRz:8//1NqjxwneboVz
                                                  MD5:90CDE1FE0183BB1D909A41AC064E0DDA
                                                  SHA1:BD9C9FFB645586B94B4186741ED1EBAE2DC79BBC
                                                  SHA-256:F81288BAB5D29831ADCF320E0E14E8B07B4933F0CC9B7BC4D46869B8590E90E5
                                                  SHA-512:9B3ADCEDCB2735CDB9A83050F2F75EF4D4B525EA82827A7062D853095D15885017A629B8C9CDD20F93F88A4D194D99A657C5F45E88FA069A6CA5A6BB3135F102
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx....x.a..g.W.m..~.m.m.....mj.o<.;J....I....:.r.s.7...J..x.....K..?,.S...^.(..}:.*.r...c..K$p....x5..JA...?..\*.9..YU....aH...pq.(.P]..g.Z7.&-j.=OV.|M..:.C..x..{.k..=.mC.x...+%b...@..5..>...y..B....;.I.<T.(#.Ui..w @.V.XT.y...!..I...C.p.....Wn..QO2.[..."...U?Z#.."....$...yP.t..^.......|R.W=.E...x..nT.w...D..+.=ra.....P&.F.s<K......m..a7...Q.....erR!.2~..I.#...a..NV.y...)........nU. /..;.I.-.......bl.9"w..U.j...Lh..;K.P.hb..F@..o.jl{........0.f\y..NC6..hPQ.5..H....W.....2........IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\16x16\cancel.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):764
                                                  Entropy (8bit):7.676013505524438
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7Uq5TRZ6Ri90RHPIA3/e+uTCCc7iHg2jVrBNbzt9XBQ4gdYFKvJgWF/:7QTl90RHPIAP8OqHg2jJBNbZ9K5LvdZ
                                                  MD5:5785882A04AB6AE21D14ECED3DDADD93
                                                  SHA1:1EC433D5DF1DBFB414872601A583C326896D0A05
                                                  SHA-256:1FC3A4B0A09BDB3020765091D18EE7877952527E9912E9879D22D2602E88B665
                                                  SHA-512:BA0D4F3F8617EE5D78B28177AB38D62A32ED26A2F8A98221690B5269AE2DCD4985CFBB7F860EFC30CD201A483A91BEB4EDBD9B63A33112B49FCBA64F5164B353
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx.b....Zlc3m...........,...Lhfb......Iu}H..Mr..#..p..=..m.m.m.m.......o.......=x.!.72`..z....:.X."..T....5...S.bo.`....Z...3f.kW:.,...|cl.......5.0...81....'O2p.&...O...*V...|.i|......(..f[.n>..1l.6..9..t&GG.]..|V...}|(...y.(|.p%..?t.q.a..1p.\.H...T.....p__..)x.]..:...}zz.K..,64T....2l.Vz4nL;...wg\T..H.ge11%..S......AJ9cb.<.(......=?...I.....4.I;:...11..g/Z..'@....XY.-.*.......\.o .W....."#.....@).7 ..:w.......g.....D[-,.=+R./..K..$....&M.>}.'N...........]..<diyk+..D.........=;....={.*{..q(....@;;>.Z.o....ti.Q.........Od.v.......:.v.3Y.7....R........../y......\9.B.:...D.$F...nR..58...X..E..w.|..0.vR...*T._.......K........t......4.\(b.4..(}........2...`...^v.F.LM....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\16x16\compare.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):971
                                                  Entropy (8bit):7.735971365790046
                                                  Encrypted:false
                                                  SSDEEP:24:LPzwe9lSdt2KEYEuNBVpDghxSprm8YTGD1qeZrA1:LpwtxEL4g7SZm8YQRRA1
                                                  MD5:6A719221BFC8F8D1EDB62FB4DE98A36A
                                                  SHA1:BA3A33A7ABD13C73B0B4CA5F129BE9543E56BFD9
                                                  SHA-256:BFA61514A32380296F3C12B861B3A663E1018441A8AA08CF44CEE2E37C296358
                                                  SHA-512:633057EFBBB584E1E8A4184A21763E1270CCD2144EE89D6018B0951AF818A0CE47D536567B4F233C06250D04542B8010F2960C57E1DC533F6F184F233206547C
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx.]S..kG..G...H..Y..m.6.j.=x.m.....7..I.~..O....As...&n.p..$p....:o.>}.}....]....}....n.KKG..=w4/+.a......../R..I.y.....%...0p..N'".2(!F[FF.pE.|..1.....J..q....]........(:~l{.m.o0......1c...b!6....F.(..D.....+..i6.TR.A.E8.. ..T...s.....F.F.. ....b $...f......}..8...(#y..8..._..`...........t.c.I.8/..f../.....iS.\)K.......NYV.D....4.w..Y.SB.5.\r.U.i...n8|..c..6.v.........~.7...w4..;.C....?t..&.....v.m.......%Xy.99t.).....`.:.K...].yl.Q.....Y.z.i. ....`0..:.F[.k.xJ.-..3.B.G.....4..i.;8."VE...2..IS.L..'.........3.#..\p..J...+.O`.X;.:....m.h.[l..T2......7B.~../..\D...{..j...c..............D..t...{.9;...J...\..ka..l..../y..ab..R.....<...].x...S.y......K...-..!.Y".*%;.O=...'.~..MUA..*r......]$D.b.Hq..uN.....`....."'.r.9*z..|>....P(...ua...8..|.....`.........r.......B..H..~....D.or8..W<...ds..d./..e.0...wikk.o...A.BM.(.z{{.....0.86<.xr.qew./[+..B../..P..T5..7d..}m.......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\16x16\disconnect.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):689
                                                  Entropy (8bit):7.568334207703447
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7ikTplybWAN6eSFan0HwpzcjhTUjG9H5g3YEWK9dybojlJlFnR:4pwHL8KcNTU0aYEP8b0lJlX
                                                  MD5:58AD811474F09FE8D2483282A3A54D6F
                                                  SHA1:1CCD1B7C9E888E691690CB83D7A37C02FAF4DE21
                                                  SHA-256:601B524D57E40080119435A031C0E651A83DFD00B8BC649FC42A488EAB7D60EF
                                                  SHA-512:FD6CFF77FDAF1A9FDEA4E95E942F5D291670A0571E96BAD645D9A8A96767611B1C2E5B89369EB8DFDF88532E2001476480C3EEFCC1F98BFCB014CC1DB59FFB33
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a...xIDATx..P.`.g........m.m.m..m.m;...>......j3_$..S........6N.F.-.8 ,...%...W?...V....cb..KrW...%.6...$............t....e.Ln.6.*.}....uA.j ..U.....&%..{. .6M!.ng...._.M.O3...M...0..y....6...P."..<..nw.Wn...W...h...t.Y......S.."...c......;}.N=.<..<l...J..P..93.l.....v.<....d...1..AN._F..=..c....U.U?...a......c.7..M...!E4.;...r..G....V....c....o..e.c..].'..BD7...T.{.CxV...Tr...G...B...w.pI.......o..^B...V..K..]O...A$b......)#.5..-.O..\D..D*......s)..n.D8..6+~..H....H$...\Jy..[<C........H...........h@\b,N>..H..va_.\.|.+...8).7.....2x'.N.. .@....K.<fz#{.....;....go...n.i......... E..;..x.u..^u..I[.$........o....L.j..9....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\16x16\download.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):510
                                                  Entropy (8bit):7.402919652948329
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7CzEPerTr8fdqS42Vu7b838VFQt4R/vSCs8dglr:tdrCkS4MOC+R/vSCs8d0
                                                  MD5:72577AE251F176D9E27E468B116DDF48
                                                  SHA1:5520C0352F6762BEA8019B735C146403EC933B85
                                                  SHA-256:E9206F2621664DC08A288D7675F3E81C66F608A2913FCA7EB6679BF447E624CC
                                                  SHA-512:BFB89786BC2D66C108694DFE223FA213D7ABA0CC9CEE00515A1774E136A3A14AAC1A982A818815DBA987CEEB4CBCF98F685F0C77E8530086BCFAA4CB7EC6DFD4
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx....l]a....^0.q0.f.m.am.{.j......8y.de.{..@p....r.E.........-8...U.Z.^N.3...a`...'n*..Z..q*..=..k....Sg..4v......~w&...?.1..M.C..............4...Z..S..*.....H^Y...IM...8(...$..Z.c?.#{..g...G.\...o.IPf.?...6+...$..+.,..t._.a..9.B...H...`].....$..wy.`).......Da...h2..U../4..I...x.u..r...B.Lx. .......#Y.{2.....W...-..Ug...}v..Ul....nnW*......\G.r.0.....2+g$..IHH..r.*..*..9....U...SXWB\..(....8..DLT<ENE.N\\"..w.b~\z.%.....H<....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\16x16\downloadadd.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):597
                                                  Entropy (8bit):7.482678631873077
                                                  Encrypted:false
                                                  SSDEEP:12:6v/78TALRh5fwKOwyQ9WnMctP2pm3C8IZQYd1gizm/Skv/VnD:DULHJwXlMcJJYdHm/SQD
                                                  MD5:9BB0652E1B733849DA172C448A6F2026
                                                  SHA1:83FFB9A49A01A4D18B6103CEC9BE015DA1A43245
                                                  SHA-256:AEC9DF3A2FB792A06DF6CADA76F1CBF2946C9FC22514E5052428C88DEC5BB252
                                                  SHA-512:AF3A4C1258D62720EF5CBE041876D1AC6B7D1730B318D71D7EB08D88A198BA6C857C8BD9F30FAB7BA345CA177829D76B30349776DB8F5E63475D21FD515DDC99
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx...C.[a...m.k.m.m..I.j..N.S..<......m...vV.S.7.N.-.........d.8.v._2.....!......B.xUeg.%...cz.=I.7n.w.;.`s.m..V^^...,.......l....,.{o.=.?.....Iw:..........!hll....(-...A:..Z`G.<.~t...'V.V.fff.6.6.u.5.Ko.P.......+.%.....w..(..;=.=......Gp..v.J/.~-.l.....vB...L.j..}K....3.7...........MB..g..J.E.r.a.L......=O......+....z.I...?..U9...3..n..AI....8....$.4..Ir.B.3x.Y..K0t....C.ay(....G.-.:.x...S....7..J...c2.W./.._{s.9q...<g@.)5)..Z.e..|.......,_.|.......[u(......q3..J.Kr.e......[...e*i.u..J.JIK....q...@...v.H....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\16x16\file.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit gray+alpha, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):281
                                                  Entropy (8bit):6.6932704028197785
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPO6fcr6si6Ex1jgWBvzf9P1wAt8cVuQoktPxHfwu6JPjdp:6v/7Pc6spNMLfPZvE+Bdl6J7z
                                                  MD5:33D473D11B06D3E2CDBBA0B46D0E1B74
                                                  SHA1:15F7A9C09306310780745947F5DEEC67D5C5B5FF
                                                  SHA-256:9EC8E5EFEF694B544FC8A7E5F5C9937DFECF56F450A80CA6E6D214C8D2BC9603
                                                  SHA-512:6466013314A7BC4A798C57ADAA68F0824E83B187F97070DDC75528FA206BCB878AEE80FF24895A63F0DF2A2E8485856F4772F33542A9CE89CF6D12936DF1C81A
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...............7.....IDAT(...A..a....._.F..i.7`Q.+..{..8...H.X8..B..3............Y.....O.w....]..R..z.?.3(0.z......i......6...(0..... 4....B.. 4..a..(....[E..hA.......+(... ...K+k..............x(3.D"..<....]...l... V..}g..........!.6~l....X....X....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\16x16\filter.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):651
                                                  Entropy (8bit):7.545164075444873
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7lyOFAbk6foxm6ZvnebnnQn6yb5OAI/ED4OrKVXYWU2mtZP9gt6n:4EbzfV6ZvsypD4OrGYWUXz9gtU
                                                  MD5:94BDF8BA8D3EC665025B7F85517E8484
                                                  SHA1:9A10F5A612BFFF81FB257058EA46EADB9FA10BAF
                                                  SHA-256:B461583348EA100C2FFA1FFF1FA6A23961EB313F9CAC1D4D29DCB4B35060CE3E
                                                  SHA-512:8146A0D159334A759BDC29FACEFCF6BA57683C75580F25F56A1B37CC6FEB3C7C21CA1DD3ECB63A266CFAD55C112478CD1EE368CBB1F7F711F939E2DCA3B1208B
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a...RIDATx.b..0.....6.bAR#......4.....'..{^ ~..K..O..........U..7.G._.... ..8V...iR..X.CJ.Z-.C...[.......I.=..C......X.:..).J8.C.E..yLNN>D.N.m.!@....|....<..a.,.>K++(.(..!I...........q...........T0..U*...I...BTE.u.-..X8...P.{.o{..9.tr.Lfs.u]....C..|...d.>..."...HaH....@..|c...`,g..e...~.p+...hD..PH..Q.gd9..8.U9......h~..%..2VH...~.....n.`.=@~.!..z...m\m.h..,...(.Y......'..S....9..B...}..T.|n....g.|.LLN..fg...qk<.b...iv...N....0@..A=...i`eiY.....#.t..X.rh_.|.vd....I...l.8r.T*.a....|.......zP.D.4.........P.I....m.1....Ry..,;.C=......g.0......sssg.X#..8@.`&s...K........28h......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\16x16\folder.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):627
                                                  Entropy (8bit):7.5629652792588455
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7eR5D1hdoV0BBGsX0ESRU42b/qMpYKERl7dZvuivcDbc7AM3zzbeIID/FVK/N:xcV037XGRU7uRxdZDcEcoGIIg
                                                  MD5:0FFFE8F4A29F40CA136728E248DD1C1E
                                                  SHA1:405FFFE66244D695149A18EF9EEE6178EB90E6B4
                                                  SHA-256:9A04046F9DCF003656ECC676AF9CD9C45B56A9FB4CFA11B882ED463C24357A9B
                                                  SHA-512:AAE5C0DD33D47C74624E973467AE41BAF3BF04165EC898A4A20449EDAC8C1C57AC7BBFC938D9BCD3B0344ACB3F5DF6206035B874148BD5CA1A934AF863477184
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a...:IDATx.....eW.....s.X.V\......j7.16..F....:..q.'....c...M....3.{.RF....[........|..m#...!.....)S...Y..X.$.7Z..p..<.Z.4M]...eqt......]......K.*NSX..Z$=..$""...A......'V>2...o.QF.. C9.H...1.F.V.)V.....b|..AY.w..?u.}.......5...Y..%..$.T.B......A.9H)/.....].ZO.....>..h.FB(..w......s1w.u.......E$....!Q....mc.u..H.!4.!"zV..8{....m..V....;#..........e...(....a_..e5.5...ua..)5.).]...6...^ ...hD....c..i....3'...&...b_9x.....p..[.w.FU.G..s...... .Q....!.)....X..$Ai~.7.8q..^.c.-W.y.#w_.Z......LOk.."d...R:@x...3..........IJ.2 .r...>....].....?..vAB"01.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\16x16\folderback.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):718
                                                  Entropy (8bit):7.66568734644426
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7zKBVNfEtWdipZ8o7l/pRVgQ8/GmIzrzOzq8P96OWI0y21EzGDOn:Ocf70f7l/p8D+5rz416Lxy21EzGDo
                                                  MD5:D2822A13B177CFFB6A4AA5E9F5901AB9
                                                  SHA1:D99CA9DC63683108AD6C55FA6F3AD28156E31398
                                                  SHA-256:577ADDA90FBF60A98D41D59E36F93CB1BF31B22475E4A3E47E8F890068BA5461
                                                  SHA-512:7711AF1DCE5B188BD7CED47F223F045A829530CC262C5531FFFEAB63682FC735BBDFD5049C8D21313B13155530D977AB118987AE4A395F89FFDAA209C2825BBD
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx...3.%W........26..Ml4.mWI..mcm>c..]o....p...D.\r.].E...#.."R.X..%...?.....GP.6w....7.|..A.....}...m.\..8vZ.:.v...~.P/|..b..L.m..0..%.Iy.M.U.\D8. d@..^qT...D.\~A+?.l.i.NU.M..Q(9...2>..H..Z..B.P&...b....st......O..-....Q....5`.R.....H...p.4CJ9Rf....v..RI.....*....Us.;...&G...{...).~:.l.Zh..O8.x.(M.E9S..xQ./.4]L;..e..b9.:ijp.........n.......F......,.K...`Z..#.jJ~.V;...h?L...?.OG.8..gP.>'....r...nW0.".Z.j...i.n...q(.WR".|HT..=G.G.......3}..&...C....=..B$.;..z@O.j.^...t...^.,.6.#).T."..H)@X.......{.........v../...i&yZ..!}..}.tK..j...[w..,..gI..y..l#..q}&...KZ..d.6Fo..xZ+.$B..2!e..*EG.r........4...P.z.}..@..........P...>+......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\16x16\folderclosed.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):617
                                                  Entropy (8bit):7.549778571234614
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7gk6w/INTuWgOciQLCPaADSpKFna/XYvFrqaZbrTya5hg9UxHdxbhK9:h/T5tczLCPsoT9TywhgSlbNs
                                                  MD5:44C07EE90F994CE9593EC02E5A0BC74F
                                                  SHA1:76E2F3E6356DEDF0EB0A2550AABF228CD71BAD69
                                                  SHA-256:A3F36BCEF0BE4D07FC6DC90CD3D120045D2B1D5FDC1BE31AC018A8222F7C7435
                                                  SHA-512:5CDBDE92C417344E839ABB8B72F28FBF15894513EB641710F77F56BE1E1415AE9AB13C97D14ACB7D461A820D55226C4168A3A7AD83BDDFCCF388D40FF60F59D5
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a...0IDATx.b...?.%.:.De.X)G...Z.gp[.(....1.m.F.6qR.6m..i.6.b..mW.*..... ....7.f..p.|....}..{........s.......+]_.V]{.u.V..l.}......;.^.....t....3.O.`8T..=.....s..R&..d.{..e........D.a.....l.......{lQ`.#.....}>]?.-....3O}.M........l......!y.$A.!e.X.9Ee.../....1.B.B.*u...8............tZ....0&%.L......jCA.<.[..AX.....:........LH...o..].L...C.[U..ej+...]eb...%;....m.....|i..*.2Q.#.g.......%0....p...s'...;..|...k.."....V6b+,.C....<..<...'..O......z".kCo.5.e...>}...}.b.].7..'...].]|xX..v.U.9.w..u.#I.(".!Zc.l....x...$".......;...TS._n..`.<K.......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\16x16\folderup.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):698
                                                  Entropy (8bit):7.611008810843154
                                                  Encrypted:false
                                                  SSDEEP:12:6v/79dQILaNNH/UwZr58wulaYXYy986qnbT0XXZ+QLJIZAwr3ugu1ZFc:sdQ7NNH/jr5VOHYcJqnbGXZ+WGZp3nue
                                                  MD5:703552F782A5717CE26C9DAA1D515C86
                                                  SHA1:1A306CFB5C147AC96C8353DC17BB95AF0BD9996F
                                                  SHA-256:49FC0B57862ADFEF288D154DCDDC24564B8E588FD8E3AD93549FADCA75851243
                                                  SHA-512:3017CADBB7BFAEB293AA1B2874A59A8981D95077B19A518D486F1C1853FAC319B12813F62AD5709EE4C650BC46D5F89C17DAE3925C746A42BF4B2D31E71D39A1
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx.b...?..{.6.Z.3.M.fb..9...u...Tx.*..Nh.0U..H.."..........G...w./.j......F.1..u.".m.....c.I.o..n.D.w\qb...shX..K..(.(cQ..h.'&'S.4Y+...d.......p.......1....c..l*...J.Q.R.Lf..K.L@N..}.~..._.w..tn?#....TZ.QHc.Z..B.P....Oe...X[^...?.go.....x..<8=.-.s...,.Tb.LB...N......-.....i.H;v.....&.B .D(.Z".\.Y.1E.O....6.[...._..!.......,.%=.{rfB".}Vt..r..u.y...w.".$.D.....G...,m........H.1..&....V...x4....i.1.@.i~r....L....8.:.._)5.E\,H..pY...<.Q....@....L..B......a>>.....g#.....].H....9a..#..9.(M.5....2.OM4.%(."!...5...5s...13.M.7._.~..x...^x..sso......lPf..RJ"d.....DT.+.o...}..X......0.Z...(.P.....8.4.g.eZ.t......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\16x16\help.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):757
                                                  Entropy (8bit):7.658705084365661
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7n/3RERA7sb/hNGyrffpG6srpt8ccrLtVmDs/5utD9H2wH:wCp5NGWpuurBVfhmD9WK
                                                  MD5:21789851844E0697DD25F6FEA7F438F6
                                                  SHA1:0228B2902B622403E7EE82C2C6B4005D84934174
                                                  SHA-256:D099ACEFE7380030BC4B7765AAE122EA35287D787B195DEF45254C52302C2C3B
                                                  SHA-512:864C3B576D8B08A2AA3875FCD748F50FA156C9249EDC0F51CCA8A2662E08C121D89A6EBE0578E59BC7A70BE6FD016689B746899562EAF301DE4ECF746A1CB99B
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx.....$I...7...}.m.m.V.l.msm...K......./...=...........O6..?.@/.......V>.+..r..........HQ.bF.mF.#.g..a...C.....e....k.O.M|.;...A."..dV./\s...o......(y.bz..E.......+.VX.q..l.......Z.z.O....._j%~.p/..A%....^/vt....V..}.N.....1....qM.<..l..n....<.w>W.....m)....z9 ............Y&...W...Wr.Ji.6bH#dh=.Yh..|5.{......#..%0..cX8.-I....XHM.#.7#,..%...._.j.(..p.O..H..$....C...u.9......k.......l..Kp....1.g.....i.z.~77...a..lH.[.[Z7.9.....Y.k..R.az..@.Y....C.n...f<d.x...e.........:.s1.,.0T.<....a.0.....&.z..K^.e.....3.(FA........y>z..W.+......-.l.:.........t..N.?C'.....4uQ1..i..>......X...E.X..M..u.>..gH%:f.t.T.1M..j.iv...z..k.9.......b+..&....{.........@.~.=.^[J.)......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\16x16\localtreeview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):677
                                                  Entropy (8bit):7.563024445755158
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7b/BCmJXLGr8Sp7UI+kPFgBSnMen5/UFFkDfBvAnI8WefLnzWzr:e/Bx8l7UIhNlMehUC1ABUr
                                                  MD5:38F2F93CA65081734AAB66870902580F
                                                  SHA1:51AD2168046A66A4CDB060F6CC9D0E4EB47777B6
                                                  SHA-256:F84C85D94F6A3D778ACF2FAF3480DE4501114E4D0C68A5F38429E70F8CEE5C13
                                                  SHA-512:7234BBB704D3B5F23FE64DC4B864ADFE3E00E13966A1DE40C39320AAB21F210AD172DBCF57D7D7E81F590FF6DB3AAC32FFD186D25ED353B7AA2BF4AAE6B8D6BB
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a...lIDATx....t.`....m.Nm.m.Am.m.~..[m./...&OQk..r.Ja...K..l.f.[.k......oS.qr<2.%*/.7...B.3G...1.G..k.t.*$........u..QY..E..P........R..l9>..l_..O.P...`.........?....R.K!....r.@w....|Y`.mG.{k"...c......@.E.s...c....6..4.l..#A....>._........Xd...%.}X.p..T..s.v.5X..g...7._.....qM....M.:.k....).R....8.wE...w.'O....3...c<D.(V.oC...,..._.......S.:..=j...c.d.[[...~.q....@....... ..9...>|...c....N)r......>.T/.>.....B.O....}p.=.6....Sg..7...TN......g.....|......H..P.......~......>..'..j..L._m!....v..|.k06....4.A..<]u!.......z%...,\.8;.....4.......E...s.."....)..t.[..tz..o...o..{.....[*..PK.73..vu..hv(k....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\16x16\lock.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):693
                                                  Entropy (8bit):7.569315771278341
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7l+0iFvW79kiuORSG8jUzv0GbbT868kaCd5KbM+6GbNwsusuTs8Vbpg70jDql:u+JFvW7VfRSJpGbM68kJT+TxwauTs8Ql
                                                  MD5:D8919F4887B7EF96FE6AB720BFB07916
                                                  SHA1:98E80001E84CA27B5982ACBEFCBB12BBC0F77A37
                                                  SHA-256:468BBFB900BF78DB075230A212B8A9F996A410138CB55D7F0FD1BD89B99AF8EE
                                                  SHA-512:37B6C546FC7CF53FA46799CD6427E50027C0F056817791D36048F8FF9D861081220741CCBE572C0D1E1C649D2290DAF5490C61E78F4C83DD3656B43121F301B8
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a...|IDATx.b...?....Q....RRR.===}...n.D..c....z.\....7o.?{....o._.~..xx.tl.01 ..f......."...;sss[....\.r.eKKK...Y*..@1...=..;........`.:. WL.<.4333+N/...O.u.........^>.N'....b...,,l.8..(......(.fy{...>....:..Ml......=h......3.....(./.&r............X....:.c....rxs...2.=..Mi{.m..n...C;&.~l...3XKO.d.R..(.d.R..)....L.GU...G~8.P.7..j55..3~#.>J..i.. k..C.C.&.,..&%c........{.Z..O.....i. $.A....]..]V..........Z.;....@.)4.3..A..$..(..W.z....T.+Rw@.."......,.......D.% 9|..o.... ....X.%l.|...F.FC{....zH.KiRp.....,.).[..<..c...........>h>...G........(e&(&RT..(.e....)..o.SV...e.0.y.:.bt.c.REK....s...,...IDR..Ge.SB..g.K.:.~.O...V1......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\16x16\logview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):739
                                                  Entropy (8bit):7.658494339318406
                                                  Encrypted:false
                                                  SSDEEP:12:6v/74RmujyOWdQlsUOMYbnKB+rjOhruxQbJ1pV9cFfupqrFXFgKvy61WB8cNZ7gg:5Rm1V1y6Khruxe/pWWgFo6jcNhZl
                                                  MD5:76759F68EA832C7842256D82F8D309CB
                                                  SHA1:C650649D817ACB2E601EC7BFC487984DF8442485
                                                  SHA-256:A37FA03767B9E4B35371A9C9879E5358E2257EBDD2A1C93A28043A8E3E2DE6C7
                                                  SHA-512:70E77741E609B4AA50A7C34E7EAFDBC2FD25F81844728D6B9A3028AFE26359500DF2A35346AEB893164B53AE9CE23A78B8A21FC4271901D93FE0F328F1225654
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx.....cw.F.....c....mW]..EmcU..zl.g..E.vO...y......q....f..,./.[..(...........w.qG..h.iZ.....w...T*...KR..E.~.)D.^....;.K...w..:...{..v..x<~.C|..W..?.0.c.S.d......(.].a...X.p.`...6........QU.4.....Z(.2 x.^...4).q.\H$...@......)j.`..X..~..`..a.{. ..;..n..f.....`.H$.J..:.Sg..........4...).o..T*.@ ...t[e.R.J(.....~[.M..)`Z.[:......F.oIyaI?..L]..Z..g.}fP.j...".L&...)?....._.~..M...K...[..)@...h...N..B...Xj.....&./....d.y..X.d.K.u1y.....s....:........A.q.r..s..d|....+m5.J...c..|...>..w.......G+..\.........g...../X.j.tIw_..9>|.vx.=;[TZM.T....dl...k@X.E..l.C.x..>v..v..0i$....'N.^l........EF.=.o..;......=..../j..wf.Yi.rq..s.DV.i.>z..?...{S.Z......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\16x16\processqueue.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):964
                                                  Entropy (8bit):7.737922853414479
                                                  Encrypted:false
                                                  SSDEEP:24:7xLpWwCE/o7E+TBIR1uJv36uMpA6LaFL7t8kR5XzGk+9:7xLp5j/o7vTBIR1clMpA6LaFLKE5XzG9
                                                  MD5:129B2F5BB4E320E9CF884A69C70D17B6
                                                  SHA1:3C8C349692962EBEA63FFB9A246305B64D835C24
                                                  SHA-256:DD81A69D735DD824339B062300BC18C56F9E4AA3B3074901671AB77DBDE228C7
                                                  SHA-512:DF38A2B29C5EDDCB967530D4465EFC70C199F8DF908C36B72DF8701A9714A8B9569AE63ABC4766C8653AACEF99276D2F02D85708655E8A931DBF60AA1ACEEB67
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx.].S..:...I3....m...m.\.m......m......}.|......[.........29...|.....+G....<:67l.[..G.n.?.h..!.,.....~.b......w.......j.8...{.:*....?n.[..5.Tlh.,.n..DQ...S...Q....`..V..&.m5.OV..s.pTey-...3..|.J...\...R.......a....D......"q..'..|...-........W.V+.p...7}.{.l...n..]6.z....r{qD...N.C...5............G.....1..h...E..a~ok2.vvfz.e...B!.@.`B..u3.,X...w:=D0_.....K..sdY?'=2.....6....?..^o...8,..{....1.@:.%...8..{I....(.....s.}.....`.*4....j..F[S,.....N....tI.$... S.Y.(...+!3.w...E.....9.O...%^.....h.P.I.@Q.......~..V=..?...a.;.9...-..68.y.............^x..g~{..?~.....p8.*...|.'q..+1.r...~Gos;....N...`.....(................p..Cc.....b..;.j..>.....f..?.H.h.........G...^6.....B.......d....(a.%..M.y`....m.....|.R.h.t]/E!h...|.!\q|..Qf.J.k.*....$.?..7.L.9~...p...][..._...!"+...4"3/{.....m......!.u.(.dN..:..3.,.E...;..3-.iy.(...T.j...*.y..n<~.8..G.}.B.9\.&!....../..k<u....Qc*2t....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\16x16\queueview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):860
                                                  Entropy (8bit):7.68841620566773
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7M3aWhIP89TDTtcZ1AGLC8nJmCqD7I5UwTni9R/rcvos/jB32ty/F07uGC:vaeIWT9cXLdJs7IFi9lMLLBPy/C
                                                  MD5:C3B1C6B743EE75D59FDF2B3520A51A99
                                                  SHA1:AFA37020CB99085A97AAC57C072F01BA5077BA47
                                                  SHA-256:6B671369C65F8819629A7A9516BF61B797D14A5523BF13781E6D7BDEA83EA542
                                                  SHA-512:411B2E7CD30981935077CD67ED2B301022F87E360D2621B03F95E043C98689B6141F8ACD5594BBFB68559E2AE89A93901C782C5CD943D4D4F85A3F447F97BB99
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a...#IDATx.b.0g......?......;..o2....Fm.=...m.m....o.....G....\...D..*....d.......{.........L,ZP4....^E....#..HV..?.:$.6.....Z...\J.(....P..Z$.,..i"A.>.P.:`Z...O....L7l.c"._......=.O...n.,.......#....M0C.F..Y.......L*.E..B..7..}....@.O.u.T*@g..q.P(`..kw7..8.w*.@.&.[.'...X.....g.{c..].7n..dY6.~.7....?....\....{.q...3.|Z%-......<........u.;..X..G........|...._z.../..Om2...!.........b.....1.s..M..a..e9....p....P.l..r<..c...J...x..0.,A.;e....2.G...T......0./I.I...H/.w._..e$. ....K.p../<..c?.47.#..D....[....*..3...'..q.L...".c.J..]....w....1.t....<....W.../KE..d*l..%....x.{.A.*9@.....N.rU2..I%..:......6.t....M.H....=.^.^^D....B.UU...^..E.H((...,..........8P.....c..+q. z...o..:...../.H...`.L...u..UW...`...d.m.O./<.........$*...B0..{DO.'...Lv...j.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\16x16\reconnect.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):605
                                                  Entropy (8bit):7.519188989318765
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7kkOeUtWUo/z107uJ0gU9T0oU1Q7ZK8aVQTWnydD3J/UJ/8c:9kmtBoJg6WooUtRSAUJ28c
                                                  MD5:3EFD763DBD5243A9292436382AD8E4A4
                                                  SHA1:7483E7CCBAB28F5FA2139D1385EAB5217A9565F7
                                                  SHA-256:592646A30752C8929AB69DA90539E9DB76394957E15401F759302299FB1CE353
                                                  SHA-512:FC2D2926EB8C2B3331E92898195ACF033C0A7BE31135258864A24CDA2E6F3D1B0EB7AA4704726A6DCB44C953AAAEFDF678F9445E34A4898328805874CE1AF57E
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a...$IDATx....t.@...m.P.m.m.m...msb;9...P..ip....oY..[.:.[....v.X.s..^....?.m..9o........:.......+VK8l2..NG.w.X..-..s..?.".4..}.x............r..oPS..U-[...e.(6..i6.x.x.G.J.5Y.....l....eg+.q..... .P..uZK.3..Q...X..R(=oG.t........t.....O...............X|......~...[-//..z...)Vg.r..-Z.9.x.n>......{u?6d.........M9.44{D;.UJ..#.lo.e..C6.#.-...=.y..ED.....o..@....,.].AL..n.......@a. ..Sg..9.^...$# RO&-.#&.a.Ma.......2.u.~u...N.\sk..T...,6.$...!dB.../....7.....t...wn...~.5.M....c .........x...\......G.e-..)..[..(.3.{.".."y..........IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\16x16\refresh.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):718
                                                  Entropy (8bit):7.665646335332114
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7JrwwBAvtdR3+NEj5FBPcEZJO+dXmotmZuym24/6esjbbWJqFnIiF:0YvTlFVcEGuX7WuyI6BfbccVF
                                                  MD5:9C7E5A33EA3351DF96CA6F802EA8DA1B
                                                  SHA1:403CF3C1A1D50CB9152A15C5636D05C4EFBE52FC
                                                  SHA-256:FEF8794F7FE34204F21CB25F0CFC78FBD2201D6A05A4E592150581A0D98DA57C
                                                  SHA-512:82DF23B71CBAD87751002ACB5B071E9DAEA02B295D8DA9E9C28621A14F113CFAA0731287FC9461F0C6F18D0A16F21B0E87B5BF61C379DB53CD84E98B13B89484
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx...C` .....m.m.Fm.m.m.m.....->x......c.'..R.......{+....;.zk...L`.C....:?t*RE..Fd.~.M.v....s.R..JX.n...4.!..._B...hR(..un.a!{,..SH.J.J....W.~.H+..-...a!...7.Q.p..A.B.4..D..whQ,...d....d.|.....E.sw*.D.<.~.jc%.*...2Y...~....Y_...t..;...F.{..H.+.....u-`.q...]..<L.Z..Q*....R#:.=.8.9....+.1..A."..0.@~y\....dG...I.........\....u.IB...t9~.......o.k.A..U....v%.S.u.....,...9.\B..E.A....U.0f....Ag.c..C...kMa%L....}.=Z.Q.....q).!.`.....8b. s.....y...s..`..3X..j...^{s.2I1.......`.............s......=....H.y..^..?..n.n5...Ka6K...J;")c.!w...K..B.OP...m+.Q...3...0.e.p.....x....g..4.....g.2.......|vvvP~P.b&|..C.....P..(..X....5....2..b......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\16x16\remotetreeview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):629
                                                  Entropy (8bit):7.522590761505521
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7Mk8t1XHqSPL8TgDc1TBuFRlVIJa81GnLOoMQ4ViDm8Vxg2JPNBfZN:1k81XHpzuTmVIJTGn6oMjifVO2nBhN
                                                  MD5:86282037191DAADD1950E2E349C9DB03
                                                  SHA1:E7AA516070B0775C97FBFE7752DA8168550784D5
                                                  SHA-256:DC206A42720B949333CCFA444CB79BA21AC897687927BD52643B4F1A7FDA49D6
                                                  SHA-512:4283E113631282177EEF2888648233E9538F3FB8DE290C513BDD8BEBFB6658A0A836CB4A12C59EB6CFA3907AE21379E72B1D9E8C236B5C535C6F40E65E8C4D24
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a...<IDATx....`.....m.g..m.m+..m.m..V.7B.`kGz.+..</.A..W(.w..}j..a......tA7...cA..$..........."..../..Y J......M..;...$..H=T#e3.......x.:..r..W2.p<..t.)..A...vt....#p.....g..+.i....n...S..h."A....T.]W.=.pje......Y2...?..K.<{.......@.c..7...!6.......>...~.xz.1.y...E......b..i.......y(...........k.S.{.1.U..`......:*e..7 .P...k.h.w..1.....g|..{...hf....psq.=..|..Y..}...=;5,.....-.?89k.8.Xk...p<..<t.>.W."..3...1.....h@.;..{...6.+.i...$F.Z.,....BL..XVz........E......r.&.WH....:j./V2.s...)...).c..'..c.hf..JApsu......G.....M[..G;u.?.e?.....|.?<.../O#....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\16x16\server.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):491
                                                  Entropy (8bit):7.421784230916349
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7oO1chcpSuh/a5J40CT2dPFZvl2PvI:o2hiSIa/40FPHAXI
                                                  MD5:1657F37324D96E8DDAFE17C0470E4FA1
                                                  SHA1:AF4F0A7AF9EEBFAC3F21305C081AA1B81D425974
                                                  SHA-256:2B13795B80F9092F3FFAE6E8ED409E05036670463F1062F220F352BFB2DAA2F7
                                                  SHA-512:106C30FB8695A068F39A3B9F5BC98E6F977EADF677157D848CB0E63F5F35082AAF7DD8F3052CAD8264C17EE1EF02F30F1B5C5C2BCEF5390E7A6D538A80437D77
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx...%.TQ...?.-.pM8.d.&:4$....w.....e...f.w.....F.2".....L..7.!I.P..k..?..|..B..p...q.m..3f.Z*.v.../_N.<y...~/.d2....m.Z.5Mk.......c..*..;A...l.B^.b..JE.,.H.......`.4.H..G........0.O$I....8@.(......q.....b... ."Ng.:...<.Q.Fu....,..1.F......7..j...\.7..........I<*"..?OP...P.4..;..y~..z.D.e.....{...*..n..S.m.(../..9f2..c.D. .b...G\.t..0.wM.22.k...4k...s.u.*...~..KAooo-.......x..2...+$=}}.^..I..w..O...Kp.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\16x16\showhidden.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):733
                                                  Entropy (8bit):7.668342390507137
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7gw2OYXAhDoi2YTPoZUJQm4qZmJYo/OkjHysnlisPucfIRG67avW:jOfh05YTPoZUr4qZ2YKn3EcwRiW
                                                  MD5:A48C634409DE41185AC61958E307FFBC
                                                  SHA1:9E3C1448731809DEDDCB4DC6D91D1265077618D2
                                                  SHA-256:B28F9A3FFEB034D901FCB49FCB045F2E5C11ED45D6E871287924DDD6B18A08BB
                                                  SHA-512:802CA7355A24879446E883AD06AE4FA359041C7E0F63FB66E42C528D83622BED6CC387C7D372186A1AA1C826E07EE85B3FC20722662FAFF4C4AAA94840958B7E
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx.b...?.%..D033...[.K.....s...........' .......NPP..D......`nhh`.~.^...s#.]]......~.fcm.*""Zjkk. ""R....@.A.O.<...N.0.$Q..^..:.m.sVx...m.m....p.M./=+.J~8f.'.{..i.c.w.9.]...G.& ..!.@7.|.yH+T...4v..EU...u.K......V.}....4 .8.y".l.+..w....m9..mS.....?........4...[w..q8...U...9...W.........Q...bV.S...j8..Yg..+..".+..V.7.cx...?...J".....AKIR.R.......q......c.vf.u..Ft.i..D...,.e..>...)....yg..k..aGW......~...@".E......[.B.T..].pm.b...A.[.=.'n.06........X.t..ob.:.k.@...k.{..ods.e........|...95.qZr?.7.c.q\}..$.'.K.e....%.H......H.M.U......Q.nh.;.._`.J.J......>L.^r..<r...0......f..iJ..A\.\...be......r..X@.H.....g.'.. .DA..1........+.J....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\16x16\sitemanager.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):896
                                                  Entropy (8bit):7.686595369616501
                                                  Encrypted:false
                                                  SSDEEP:24:7YdZZoxMuHbBvCV36WCelfoTCMuLQaDFU3CcS/2pC/vUJpOKDJ:oopCUjQfo2MuLQ6S3O/2pTTj
                                                  MD5:E2AC4B4B68D1C9F8FE2B02AB77B9DBB1
                                                  SHA1:5CE35ED2BDBA01A4B2ED07034D397FC12ECC2E41
                                                  SHA-256:B248A3D708596ADCEE5D6AFCDAB1205034A8F04E51682E5CE08C02301A5DCB06
                                                  SHA-512:01D6DB5BC612627274ED92C95A53B325F7935A508F06823FFEA08C3361D1B23ACBFEA3C3939D6A6565B6554F4CA0F54CEE6CEF1ED50FF6CEE16F46F797DE08AF
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a...GIDATx.ER...X.>.I..=|,.m.Qw.l.m.~.wT.m.6?>cT..=.....G...9....I.y.s.N.x........@yy...v.....8s..e.......K&...>.D.g^..r.....1".E....'.........1+....|...-.%55...?..^.P<.V..6666...G....>6.."...@........r...zB......g.}Fp.X..655.D",M.....r........4.M...+Fl..r.6.5S.U,....B..8.q0.........PUU.......EL....x. ...@..d.p..E.G..(.P,a.x. F.......:..T*...I...b.0.u..mMEE%}..].y..s../......(.f....W.N.D..P.....QXX.E..z..9s..~_...........h..H..y.......WP@F....c.......9.H....]\F...?........s........2li.).oX6....CG..>.......=.....n88w.._...?...>0.h.R<.6.2r..)..../=8nu..=*'+....2....E.E.<:.Sl..m...Rq..SK;........L..N..i.%`..~..p.C....B,.....b........:......3J3....+......3."^b..~5]1u.A.....j.....`.\...2...R..w.....`/y.|.1=....b.0}.3}.f0$..g..8....vA.r....+.OH".j..kN.......8.....t.u.j.#T..m..lO^cM.n0.4L"........!v.\.`.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\16x16\speedlimits.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):821
                                                  Entropy (8bit):7.709017521968257
                                                  Encrypted:false
                                                  SSDEEP:24:7sVNsS8EpQ8OAvRFunlcLbf1dIqKOMKNT:7MsS8AQ8OURsmLHWOMW
                                                  MD5:E9F84FBE853DD86D21EC410C10BB00F9
                                                  SHA1:547095B373672D69E7141F5C51FB36C881A6ADED
                                                  SHA-256:5F79E3B68AD372C7891743A6A9F4C5F260462034181ECA9DA74C7B7BCD2F2A48
                                                  SHA-512:AA87B63AEEF97E8D86E1BB766B00A4070214FA85469BFE04EFCFF6C11B4026209E7C5CDD34AD3EB4EA5ECC4F1093958A18D9F119B1584945BA3708ECEC904447
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx.t...$g..kfm.m.m.m.....g...3..7...6...6.n.20.?.{SH.fXh.h...l1...\...2e...ry2.f...6.).h...G.V.zb}..WX..*...a.U.o/.0...#......O...:..6eJ..7.4lx....l.:y:k.<.2Dnu.*.j7..%2>d....i..x....&;.;\.tG<...r..{........b..y.v....Y..S.....8.&....U..._9......K.J..J4....$k-.......i....w.Cf..@..I.:u.;.}...v......?z..8....J.....d68H...0......................;.8p.....M...m.zv.....4...M&...../^...U.X$B..%)T...w.f.QT(_.#...].=..t.H...B."bJ:..pB.Y.7g.....3g.....|8..^i....@..Eo6."qO..x....`......0k.X.V..I..-......>..........8...\....$|.9r."..>$_.|..7.A......+u43..ZE.H..=.....y.....z."/_..D...?.....r.....P~k.a}a..0f..o_..#.....~.n.._|A.....C. ... -......m2...:UE.-*......[`z<\....& .P3;,..77A...1.] ..r..+..(.8.........cN.......&.....dO.o.!.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\16x16\synchronize.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):749
                                                  Entropy (8bit):7.703109879983936
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7Uk7w+QBeMN3lyaovwWxiOAmaEa/FMgAEkU5AgAwGcdgDzYKUdm3yKUH9Yz:NksBeglcAPEcFMukUykg3DUdvpH9Yz
                                                  MD5:B09F75F68B10E5E6847E1DF05571370F
                                                  SHA1:74B72630E93C2CD334C065D7CF74D3CD4812550D
                                                  SHA-256:F01C4325DE446566586A036A2EC1E4DA839582E81BE0985B40D51F036D90D2BD
                                                  SHA-512:34BC9CDA2BAF3F54729F7BB9BDC7612DCDD4F23D67C1A69805C025E2801B41869E4D72C4CD8F9F34E3012E00F11F61A4A587080867AFD0D9BFF2A01E7131DE1E
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx...C..G...wf...k.m.6N.q.m.m.v.l2.......Z....v..e.%.....r......T..0.T.a....6^u.........w...*..*n.D.X.u]>.t*.5.......1........m...0....7"...p..&_u....x.....+..b...V.@. .}.}_.'.L.$X ........Q...9....._.B.=?H.U....O.UF...L....@.._$.L....d.V|.1M...w..x...B..fL.L.@..&.8G.@.d..z.c&<.........n\z....3.X.:.l.w^..'.'.......?.\......%..&}.zt..[..;.PK...|..-...q....~....u.K{{......m}:...[....x.`..&..j...C.X...L...]p.<...zm...D<z....{.=..W>{...r...F'V.."\.....{.3.|~8b.j..xq.#...^........4S..h.. 2%.q........e./....+.C...Q.d....3..8.d.6 ....}...\..`fb....$....R......1I.....*...q.d._...\.....!....wW..y.B..jps.q.t...z.....]wZ.fWv.E>...qlKJ#...*.R|.._\....5La?..a-.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\16x16\upload.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):449
                                                  Entropy (8bit):7.292578625144907
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7pidLbviJsiq0v4ObeHojs2gDDQHG/1:Jd/rF0wObmojsZPcG9
                                                  MD5:B261F25FF67480005CE97D63FA894E94
                                                  SHA1:95C2337552CBA0A0DC7D9D706E9C85D39A335A80
                                                  SHA-256:0B85A6417D6455687C2812381CB8F0B611C2C0ABDBF053D37AEDF8BF41F83CD4
                                                  SHA-512:7FA215DB6892446A94F4EACD142F3537EEBB1717454D600AA1BD7EFB23F1C955EBAA7F9B19048A90C63FCF1CE3A75604BE9B5E83051D8B94198C88F9B506FB06
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx.c.......wp.f .<.....r..'11.d..c..O..Z...MII..4?/)1.v...UU../^...EDk~QT..i..].w...,+..C....[Z~_...'.w3fD..z......w..._....KM..}'.C...X.j~;}..={..C..%..0.........k..yx...bE.=......f.53..GW...l.I .u....H3...r....0W4..lF..x...q...WXX@.l 9.\.....{vv W....@.!.BC.@..233(,.l..f............2..t.00p.....!*..cQ..w.....6......15].AR..>V....6...D*JH..m.......t...d...D.......$?H....F...#....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\16x16\uploadadd.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):500
                                                  Entropy (8bit):7.468573641875107
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7pRtyK6b1QgxG6NTrpp+/O+Tf7GC457v6dOklUg6bQy7:MYbbG0nHY/TTgSxrmt7
                                                  MD5:91FB39D65148161EA84FA5B6D807EF95
                                                  SHA1:90BE3D473CC4CA73C3F9096AF4EE43A1BDB185E9
                                                  SHA-256:0080E41B8DB8F6B9B8DAF50B22B0B915F52B065650D9BA648E1E95E824A07DC2
                                                  SHA-512:68211D6AE049E32A5AB0DCFA2D3064CFC28F0BB87206E51CB289087C3A2553C47C92B225678153F7372D3ACD236BB57079DE161EEB3F051CF429AEF3565E7F11
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx..........Y....m7.mF.m.v{.m.m[s..8..~....:...ttL{.....m...Y.........wB.....h..%..g...}..pss....Xm`` ......AA......q.A.._...w...+W".........}.|kk...7.i..[6...g,:y.36o..O...._.r.~.t/>4.._...1.gOL.:.S.u.U*?}..\\..v..H..p....)&~.......t.LCc].U.a.....OK.?G..."I.(....@..E...-|..#.....2..9[fd.Q.%.0..b..._aeU..b..8.`.(........1.@.7PJ\....u.s.G..Rq4...oe{.4e......I.cA.k.f-..p....4y.t.'I.]..o.x...r..1b<..G.g....... p......).~........IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\32x32\ascii.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1552
                                                  Entropy (8bit):7.857841047604233
                                                  Encrypted:false
                                                  SSDEEP:24:aYUEg+D6Rpm300GWLfp8uSmsbew0PHjps3LyFee00ibyIM:aTE3I6tGWLRCmfK3LyFm1WZ
                                                  MD5:7267294D33CA396D1E1138EF8FBA0733
                                                  SHA1:76378823A14867D35964FA6EE29779A6E27B4215
                                                  SHA-256:E0D881951B2729F54E7793C0442D34EA8BA696C45E3F37B2E7AB6A5052CA87FF
                                                  SHA-512:B6421C13A0007C7B031B419B3CC0AABC2ECCE1E739717179B3849C3672A6C45388A4E34CCB6384488C018E1A6BE596286A88913802D3DBC3D61ADBC4019BD967
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx^.W.HUg.~..{.^...J]..N.hDk.."2,.0`...d....0...-....3F..F.Z.).dA.5*. k..nZ...z.?{.....=....^..s8........s.7..l.M..7..8[ ...!....y*..N....=<......w.......F1..L.....%K......~.S.....s..;mbbB{..........H......".)"..@.......1.{......".0.....%.....].....4B.u8.....a..0.;.f..f:[.4..gLp,'D....ABB.,....t...:.RJ...h.5}'.Q....S2..$gz............5}w.\....&.p8..Rf..YS.3g.`..(++.;.7.S.X.tT...@..)8..q......Dbb"..~..............=..........h*.).QQQ...GEE....T.....w....026...p.;.z.t._...8.K.V.Wr....1..t.~..-(...e....kh........_../lwF$..|....jh@.......fSEfR..RWW...4...@......-.Q.(t...<.|;|.[|.wM...1..[.&'.....-3'..I.i.\p......x<.{77...U?..?...O...*X.:o..c..J,@).t..M...+....fe9.E....2.I.J........C...&..).4.o.mJgxF<8~.8.-_.....0.?...LA..P..c......$.]..H......I.....o.v.......CLm...A(.B..A .&.k...t.i...G0..8.j|..........G.rr..99o..q..T..6q..).9....k...;.....1.:G...0......|.~..mh.%.A.T....r.M_..XYV...{....M.?{.....

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\32x32\auto.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1587
                                                  Entropy (8bit):7.846513980152697
                                                  Encrypted:false
                                                  SSDEEP:48:17XKUidox2OWDGv/ss2jiquMyQAq2HlYm40HORo:1bKNmcOjvks2uquSXiE0Eo
                                                  MD5:585E951EED607EFB6E3140F600540DDD
                                                  SHA1:1C5D514E480E03D45AF2EAA352463B7BFAA43A3C
                                                  SHA-256:7289AF75F945E34C4469ED24AB2D8D2F64D835128CC67F91B366313F6EC63E6D
                                                  SHA-512:37C98461A50B4E06C8F6BA65E77EEA9753FE03A788DBEC94ADEEE355D39939E3BF0AF74C0260F3A503B4BEBA45C60AA19477485CD7D48DA3735F10A964BB9A94
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx..W..$M.}..X.Bgcm._.....p..m.....Y..1.a..7.*..+_eee........+..h..W.......j.H.`.=IrM....M.....RRR.{...|x...h.Y.A..}.E....sR...PsLM!(++........X....v..S'.j..^..X....UUU.........jj.......v%[O.C..jz.6....E9.~II.x.a.Z...[...Tm&@...=W..".......A.~.PZZ....}........5.t:..^.w....<yR..nY..5%.".#.........A.j.k..-[.._.RB..d.....#88.\.....L..q...jryNV.p8.|FG.t.|y.L..OO.[.8.p...\......s..!.T.....iw*..!....Y..'+LJ...TqB.p,..FEE..G.z...LuZ....}...n........[..f..( (..T..s-.G...W....0..TGD.}.}.1c..........qj.P........#p1............|...e.^..7o`.#i12]B*.}...&M. ??_E`...j.$.:.........5.).Fo../....)`+...q.Q......w.|....{_...?...-...7O..9r$.z.5Y.........C...._.............N[.o.n.._..n.t.y.y.{w.(+#.v...v.k.z^a...e+.:.~....L.....7+.?.M,.b.....i...}........CO0@....fiuRj[ ..' .* ./.......'K...mE.....X..6..8...;...i.B..TZ\LG..#.8.%...=..K....e?}.T.n.R....(<,..S...oZ.=.N....j...-,....v.....y.v.....H.6T..C[.m#.c..9q....

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\32x32\binary.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1791
                                                  Entropy (8bit):7.847449342886944
                                                  Encrypted:false
                                                  SSDEEP:48:eMRtrezczKOBmgsP5My5dD9WvvUQ0kLo8ehAnX:eqKoGghWBw8ZkDIAX
                                                  MD5:D14C43C45AAEE8A0555B0C101BD2069D
                                                  SHA1:EB9438007C8E585A81D35E460D46D1936286C203
                                                  SHA-256:FAFDBE163DAE7AE400D875A3B6C92AE108DDD864A94B368B8E0D1AADB58404C1
                                                  SHA-512:CB83623F871889051A54F5591B11308654BC988B35C7FE0D2A97C9DEE07A95C8BE3970F60F12B3EBFC3662C845D9E70BAE0FE78C44AB76F0AC378220837BE18E
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx..V..d..]eW..ol...c......F0.m.m[m......T*....v.s...{..q/..E...6lX......E.p8....MP....Q..}9.<.........'O.....!...Q....(@.n.....r..x.........-...<.@...c}......./B'.:Q*...t:.P(...t...<.}....`..$.j...A...4b2...2........0..^.....k4.p..0.{EV........J...>.{......[.@..6l`...{x..........2e.V.^...B2A......___xe@..FI1Y@..5.];..III4..{......_~..o.!Pt.../_...X."......R...SRR...G...7.Y*^.~M`..tHOO.3...x. .........h..<C......>0Dd...S'.l..P.fM....,D.....E.T..>p.....K.......ig.._..JV..#....3.K..........^|MJL.......0..Z..9..x.h....P.C..7.eF......d..%...r...Bd.e ./.e...W....S.w....m.w...L&.t.......!..3\..o.U.(...=...w...g../O4..`.....78e....x....o.....S.b..t..;v`....vV.~..7dee.......:.. ..i......W..t...~..7Qo..*..50pd..]~.df......T".g.E...q..m\.t.Y....\.|....BXX...]......]L>(.dE.#>.[.n.c.b[..8...X.<.*.....r_.....XQ.,.w.....pH.e....N@1..LD...O.....}......n...A#...0.7C.(........#.sg........8q....cM............?

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\32x32\bookmark.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1427
                                                  Entropy (8bit):7.8157164183499335
                                                  Encrypted:false
                                                  SSDEEP:24:xl862wKE1UmdNjeIEX/zLaQSFQCXVp72uETa2cP060HTEYgO/dUgQbZTiKj6:xP2wdbdN6IEXLeUClp72uR2cP06hSobU
                                                  MD5:396C9DB62CA43EEE5234620E1F927C02
                                                  SHA1:1F15CD28886B5CF8A1CD27D5E2B45CD8F514D8E3
                                                  SHA-256:F1A0E941CBB0D8F24B301AF2CC04B8B3AF013F5DA3B29AB5650814940DD49B25
                                                  SHA-512:F23F23D3B0CF51A619C9E8F3E16076BD785636FF10C3BB8C1A2E65E00B67584F840055E1DA595BCA158B18AD1D0C2FFFA72EEC632C01B040E8EDFCD68FF08AC9
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz....ZIDATx.......F....m.m..o.m..~.{.I.-n.Rk~U...\WcY.Y.R3SS.gh...^..N".n7....zr.9q....m........13.,....|D.i...{...S..gT..B].d.B...J`..^.Uq....j.;.Y..Dr!RH.^.ftm.Q..TN.)..,Bw...`..&.Yk.v.qF.....y.N...Yt.......}F..*...~i..Xz.#........$ZM.]c.i...+.Q..........r.e`fC....V67+....(.WC..t%.sC..u+.ux.....n.E.]=.~t=.....@.k....w....]]...+..+'.8.G..E..FU.....&.]..m....V.6.....(noU.........p.B. ..^~.+.........D.x...X.m.(.veg....Z...............(.*...{...zZ,.F.....RI...`.....D....M !1..[.pU.j. .>...x..s.]y..."..>...u...o....?..h..K ..J... .5....h.E..3%q.....g......?..a..?.SQ8l..s.x...r0..U..{!..$" ...!.y.v^H. ).......9.-.i[y.!;.....FL}p^._..J..(|..../. s....B......##......4.......>;/..._.m..%...:.=.....i+w..}g..G4d.....)...E/]..Y.....A..M.........3W~..,?.....o.W^........6..u" ...[..._|G..8g.8|.39.<..(.(.....ik{........ *.;... .Q.h.y..:..}...Aj.D.$..@._..X...0l....:5....c.*^PD...QW...rC..&.C..!....<.........`:

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\32x32\cancel.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):2073
                                                  Entropy (8bit):7.9025915400711595
                                                  Encrypted:false
                                                  SSDEEP:48:OWbhcRbGLZDRtxPlaN3ED15ZT+zgM9JbFTX9Xgh+FNE97:OuhcRE9fx0dED15Zmh9JhZ8pt
                                                  MD5:38A9D4C17DCED01B3D09A2D3ACDC6C6C
                                                  SHA1:4F2707734750C6F4B665A31E634CE4877512FFC4
                                                  SHA-256:847BF6503E2D0D2AC35CE6B81410899C94021C494CA075EB74620CA5968FEF31
                                                  SHA-512:A9D40B219F9B8AC3DEFAD67D2FFF2DEC06272C96969BF08D0CC325EB2E36312F7F04D060E3758D31B950081A49BBB1CCBFF8A40A5F01F13A0B3B6DA5376A6927
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx...pl....=....s.m.Ux.m..w.c3.'...fWWjr...U..........?,^.x7,).FWX..t+.j".-.l.7..v{.s..o._S..h2...j..k..]..~..D"A..u.GF...3...ki.=....c..=...."...V.x..K/=v..$..H..7>._@6.o.x.+....78..{G.Z[.\....>.~....V4.z..nz....._...e(0....&g...O{cZk..........o../..'jj.|...x....$.'.d..b.A....;2.....f2x..!....z.p....K"..t.......Y.v-....!..t...q..p...'w..Nssh<......:.].:.N...S4.0u...9..>....#.|.k..Q2I....!.m....z....@...._q..H.R$f<,...NXs.....bF...8..>...8.74.z...b..k..........~.`..b.O.}..5......C........12W...].......W]t..].o.ve.W...x.....h|...\...H.....|.....@..g...?&_U.c..9B..}?.x...B.a.K......%.j....Pw..O..!..g..~...z.(..u...@...x.9,....D..F..%.....I.a..u...q.O.}.......G .P.N.....9..['.c.....m..#..W.....s6..!(-]_?kVR.....|.9..n..b....,..C.....#9A...5..7.....d.=....X.L.I.)....*+....z&.....|....H..?<v.e..*.....:...D..5|....[....Rc.a..%i)......O!.O$...ak.%........i...K.A.5.^Fq.q!..V.....H...6Yf<7.H.F<..Y.r..

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\32x32\compare.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):2612
                                                  Entropy (8bit):7.906926285698179
                                                  Encrypted:false
                                                  SSDEEP:48:a9Ajbg2WGjfhxvcKFbY4xIQHoVcOcEqeXxnzWnMpVLvOgCpWzvsbuw8LZBIrCzZH:rnvb7fXjmjXxKm5AWz0aw8Lti4p8x4
                                                  MD5:6199A6543608CD62F1057EA313C73B2B
                                                  SHA1:7D6E574BF769AD70D47AB3D969926E46B2477583
                                                  SHA-256:0F6082A88FBA5E8B9F31FDB35173AE83CA24CEBA4C5F8DC0740FCA5DD87ECA85
                                                  SHA-512:015F37F53DE111C2D16EE66EC006F31FE9D8493F2B12EC2A3004251C78B72BBE1D16304DB0D805B10D627D90DA440E9D3B6034F55E18834BDDDF307847FBF0F6
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx..W.........vw.t..1.6...|.?.m..m#..j..Uu.9+.Fk>w..zW..."P.%...b.\.......U..Y.|.c../.C.....{)......={6b.N...S..+1.......[^Rb.........).Uo&.}.@.g....Q@......N.....c..5.+1q...L&E"...8.@.../.....7o..Mw...{.S(.....].....@k..{}j.2N.~.0.....I+G.:.&tYE.E..^#.H..OY...R.....4. ..h.N......,.D.i.AZ.L@)..p..H2.X..B..J..........R$b1.-.V..{.l6.C.....~..` ..L@.H...\..m...;..t&O.....~.Ahll,.......x...KY.}.......4@..]0...E..."...Be.[.P..cG...g[o.......p6....{....D...8q"...q..R.....H..H..... .>md....&..0*.e.PU...`....7U...p.....)BC..=.F$..7*2......P..........%.(lh2E...V.M...7..Q....Cw...A...i.......;.s......@.5;g.y.. ...?O.tI....8.?:.2Ymi#....j.$.UI..k..G.0p.P....Q.9.........]{5g6..q.....8....&.............~..P{Y.3I@nE$Z....ox..o.}{.,.[.d....A....:.v..}....c.ISB:g._H......._...:.rb.J.P.Dp?..sY6w.1.w8.-+~.....]Ar`@x....6,A...$O.......g.L."i...+.d.Wl./..z.%.vE.^Vg......"8.X...........@^.i.......T..3f.8..k

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\32x32\disconnect.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1845
                                                  Entropy (8bit):7.853334987785862
                                                  Encrypted:false
                                                  SSDEEP:24:M/RZzToQGhPU9eDUJ+QujoBxT0ItoujFA5fwjH8SNvEgY1arEFwsH/LtDtyrtDSf:MLz0hPv8rFA5fevtcaO5/LhQ7aFrXb
                                                  MD5:1EFEC3BD1BD15BF4069801D03C8F187A
                                                  SHA1:9559987867A7EEC95B8DF8C494295ED54C361F20
                                                  SHA-256:0953845EF159B739C9067D57643D180DC04B9D2ACD692DCADE599B7FE35BD85B
                                                  SHA-512:9C9299D44AEA763A2CF2EAD045681621057A9B6EB3EB3BB96791B2E678AF42B690108CD1D49F1AC617951101D2C9DA2A8E1577BB24EF3C7E923D9D4F6022F28F
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx...t......Q..5Fm....m.m.6..Mz.6.99.]d.ZE.g.o...l.{..?..!`..o....r].eZI(J....X.y.L.eY.....(....u>3>^,6...Bi.......;U....;.i^^.B!...[)..6FF..M.$..8q..,H.....P.....n..m.........P...._......2G...y.~d.....b&.Z........."...w..b.jq.QCQ.>.oD...%.c.7i".^^......b..@K...'.D...+...0..E. .vP........(..Gp.._..'..y....Y.,...H.. .b.iOj....x..K.{..y</.7``7h.....|(...Y.#...`s........xp..}#.,....... .;Y....X..h..h......;t....!92)...L.Fy.....6...q....../....j@.3.|F..H@..;.I....p#g..)..j......+....]Q..A...k6h..Y. ....Eu....Ot.O>'.x......+!..._.5...v...........2..p.l....&....." j...FE...zb...[..t.....1....2...o......=3.E.1.F..N&..I..jv{.I../..........jUK...q......Zs5....b....]..+.R$q5}..TJ.FYE.Y..z.&N.5..F|...H...jx8j.R..`$@QU.....c.5d.w.C0..@............D...H.3........U.%[o..)..Z4..;7.....8%...>}.z;..T..AV.=p.K.......~.|.B.4.x..2...L3..^..0e7`@....S......@C.V...[m...@s...r/z.%.X..-........-...e.5.l..n.......q.zQ2&..j...

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\32x32\download.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1259
                                                  Entropy (8bit):7.810633047574094
                                                  Encrypted:false
                                                  SSDEEP:24:lajY5BiCUZcS8ASxhVr1JllfEYiQw3pEkwQO3u07qvtJvxUJVB53aG0Jcviz:F5Bf24xhJMY38pEkwQO3cvg53aGAz
                                                  MD5:1C3BA4BDB2B0BB052679BDB099D24CE0
                                                  SHA1:3B6A21FD3B3BF57C52A4CF1AE78D8684D669B600
                                                  SHA-256:24FE6BF713952A9AE7D6CFACB067778B7142CAF12E5C8AF615852684F095EAB7
                                                  SHA-512:86C904E372DCE724AF61DB391AB9BECCBB0FE40D1D7B4ADD545D7CACFB7D7ABBF25E6F7CED520E83BF18898BE5A2DA7CDC26512E20F9548CD11C5B6B0F1FE6DC
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx..V.x#k.....dm3...m.qj.m...3.m....n....2=.N.....?........;..7lV_..N.%*..".|....$.....6m.^..#.GC.5..l.=..y...u.1t.S..B.R..V....>e6...3....w>J|.f.W...U..3@........Y....}M.e.:lSZ66.....'#...q7.E.I....|%.DJ3...T.K7.s[.L...3.K....9....B...J.`.5R....4%...9~!...(.4.......(ln....3.&..8z&...".,.N.m.m.a..Xn.#.ik..D...!.rL.>.........:.n...q6r.LM...}.g...*M.a.........[...}...&..H).~8-....z1n.L8.|.&...|.........0.z.....oD..2.Q..l7..U...S.7..7sf8.....!....{...].7p4t.LM<....\4.....Q.....\qy..d>.......}...M.dy&r..f..".t..2. .C.&..M,....G`....#I.;..+...-...t.Pn........*$......J.....................m..4.Sc._Rn....z0_...b.p......q....C./..../h!x.'..}......"/.J,..7.....`o.B:...4`0x0x...[.....0.~f<Z..M...|*.5....K.Tei..HS:".~.+&... .9F.....6....%_.....Y...F.6.../....m.S.u8..)v.bDw.x.rfd\I`e...~f=...,....E....M.yl...M.....z.B.>..KB.M.yx.x...M....L......n_..2b.M..........p....w......dC...Tv..^$.../....Bx.|..E9....A.

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\32x32\downloadadd.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1564
                                                  Entropy (8bit):7.826603017999927
                                                  Encrypted:false
                                                  SSDEEP:24:mBWNW+B4qjmZW1b+MGY8Cdy6nQYm2vAfl1sS4Xb3yDQH1ZyBVOohy6Bn6cGOWuf:mBWrVtBP8My6J+dubkk6eVuVf
                                                  MD5:D8F484059C6DA2B01D1BF36B8A8B5EFF
                                                  SHA1:E2FE8AD90685DEAC21E788B01657144367646FDE
                                                  SHA-256:C306E766C3064055AD4220698BD36AE0939BFE06E045C93B2731AE3681073BD1
                                                  SHA-512:F42581A09FD3A7FC6DE3554B66284B2147F654623ED0E05E6C986F090E4CEDE0E16675BEF02B5E7EA917553E1B74F2B8FF1E50AF681DE8453C49BD81214A0C4D
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx....t.n.......v....3.l2.].F..6f&...mt.~..Qd.;.w.........lmmYlll8....?.>.}...>...sBj....k...0g.....N..2....C..o.............^.x....,.^.7...R..C...d.....A2.}.$...6.......|.............s..?..(.mYmYrO.L=...a.e.3M..T.P...!.D..4.;.L.?a...boo/...;.......m...|....:.jRyR3..!....r..<e/.(..D.i.]+...~.}}}.ww....XPSSk...gC3......`[\.E.O.....l.n .Dq...R..{.......&.V..........4....dr...M.%......<@...#.lKe.e.6\T....}...'.Gquu................`......@....//OHO.\z!Xe(..u'.c..<.\..w.3|...rrrrZEE.c.Add.T...P......0l*..b.. ........w*~.EL..,..=....2...H.K...3.......q`.`7lj.............TRN..&.0....)).y....0../...q41!..|0.-..i...O. ...1.D..3.w f &&&...............).....! P..'Q.....|......u......%.Ro....F.... f....u...V.4...X..-....A&c.Tq.....j.l...j.+...4..>.H`.@".&2.1./..}...?...g......$.........U;. .v....DI.....m.u.^o...O...(.K..%...3.[6.$i..!.V......;..M..1....$.. >L...@.~..h..oV....,.o..hR.xR.F?JR....t..Z.+....

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\32x32\file.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit gray+alpha, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):558
                                                  Entropy (8bit):7.493223074946605
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7us1b3GmtXAS6buSPLhE2Jmti3Dkbit1L2zWE726KyQIw5bz:neGuADbdPitiYs1cj3KtIwtz
                                                  MD5:C6C23F237019311D1E9820F9A840537D
                                                  SHA1:6908DB5AD2A22573350DD96983B7D35C94311B85
                                                  SHA-256:1C956E14E45D41DE7F55FCE1855EF1BF04E33904AC8E4BBCF8C7D900C2731D07
                                                  SHA-512:02F3D001C247D71C0F12D436652528C35616138EADFEA4E2B16B91D1D2EC88852E1FC61B57A2DC4BAE3531C142AE6260EA7F3A05652929032CD1226ED856C432
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... ......s......IDATx....4E.G._U..s.. .....4..p.$..`.5..2^..E.#g\...T......<...._^..A...!...........[.....y..........:.yz..o^.........."...Z...7....&./....F.0.....-7.G25.I.46.Z...[.....H`nl).l....v..h....`.A......F.#8...hj..)fJ7^[.QAP.j|..].....k....N.>..!.....?.`m.Y....k.......l..Z5$.},,...~v.Q..>.._7.?...,.......-f..4...~f..kQO.~.....f....a.M./f...AA..`n.0yW.....@c.m.c.3!."m...FH...zz.+H).....@tC...y...^L.@N..;.=...Q....b.....y...I...y|..GN.!..*..s...;6..".M...{.../~U"..uR..eY.QD},b.C..?~..D..u.......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\32x32\filter.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1531
                                                  Entropy (8bit):7.807712083053081
                                                  Encrypted:false
                                                  SSDEEP:24:mp016kQcyfuYWSawpBsF9yD4O367UNKcnaPtMzERKeA6bXn46llc2yQxVlW6n8CI:x16kAdBsM4VgKruz0KeA6DnJl5V868D9
                                                  MD5:9782CC925B205531FD82F757089560CA
                                                  SHA1:A01A4F2074D348ADDC879CB10EA8EF89419CF094
                                                  SHA-256:FD794F32F1AC72EBC7DB8B53586C6111FAA30BF6EC9E115067B6D9F437E5EA62
                                                  SHA-512:ADE88A9962E51CFDAE5D925692329E8A42F2B9DBF2811CA38CFD74FCFFF481D65F323C6DC060008A19234C24EE6785F69AB0731D8BB6E09CB4F6586E13D8421F
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx....4.......x...a.6..Fm..1..Am..m[.?...;..'7..d.x.Qu.g.;g..........W...w......eY!"..C.TL.._......r..e.w..4,|.3.I.4..........w..$i..X.".e...|.{.u...w/........=.q.X....eY.B.f%H..C.....?.X...k. ........>.b.."...y.....(..}...f3.a..j..p8,Y0.N..v.4..L.P...K<....3.....~..|..t..}. ..t:...%..C.T.....X..x..EH%R...&(..y.P.V.8."....6...E.....P.0...5..6M....@..?.....?.!.c..#.IQ.x..Z.e..N.XW@..........G..C}V......{.|...[[....{{8e.....S...F.....~. .......z.c .\.a.~......<.YYA..1.tr.uG....;T.q%.S..6..at..N`..9?.......<.y...3......U..\...,.......8.........`:....(h...E\|...HT.....-.x@...'@...R...sr.)R...=..(V..`.#.X...{G+..). ...b2.)........8.G..J...m..Ar.K ..........9......k..1]..'t.;.V.?..../...M.!.".Q..2.!.....NB..0C.jJ.L..I..S.[....M..uw..IP..@m. 8@.V.X..'......'.-L6$.#..&......EB......d|..e.....[.|>....7o.4......-..R.{.S..4.Y...b..@......8.R...[.n-.Xt..(Y......0...7....O-.eg.|5-.......}.?d......G.1:..&...E..`mm...%

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\32x32\folder.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1540
                                                  Entropy (8bit):7.831591508875402
                                                  Encrypted:false
                                                  SSDEEP:24:Oxb0TBQLUHYhu1JKV0eiPOyhIRe0PnxQMzqB9V/4OjReUPTrFJ2I7QD6LoPlLEN7:Ox4TBR4hOI5iNWPxti4OjReMoiuPlQ3N
                                                  MD5:EC15FBBBD193EBBE104664EE7CE9B3C7
                                                  SHA1:8C19DB80E8C2BF49AAA8A25CE7208A2F33FF89AA
                                                  SHA-256:9E1858549C0B18A8B1D71A596066CE03A9E2E6F4E64D5E2E563D14299EC0BF8C
                                                  SHA-512:D8C24BD2D4B7A6AF3A043C11F2F3B74FC93EBF9E2741B7C1019968CD4BDC81860C87E914144D35FDEE21AD870E600BE44EBA8A484B9E6F8C54B6814AD3E5E794
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx....m.....s..g....b..+.].S...m........N..{v7F1.[....{......5o~.M......Ip........uo~+..M..Mns_..(..........l..W.........(&..+w.g.......K.4.C.3gwrg o.!...x....Z)......E.].]`".|.;.8t.D;l...t?....J.....oL...kP.|..3CDj......y.f...?...........{...<..?..G...O.P..MtEC..ZsE.....4..x^.......g.}.....t.o...-.cv..#..=.0O.D.F.6....Cl..EKC.n.%...x..b..phP087.,.u..'O.i.....?...e.7O.=.ua2..7..A....._.]...Hp4.p.QT.Z.A@. 6C..F... .....F7..o....G..]'.........p.....D$.J.(.@...%I5b.....bX...p..|L(..s..m.n.EX???".0U..9.d.D...A.hG.... n..jP...u3P.t:e2..2.-..u.lu*+P..6+..Q.Y...'.r.....a.bh..3>.m.n..`}..P.Zq....,8u.P..Y.H..p..?&H4T.....oA..n....E.(.c.f.+u.~g.G.T+.............d.y.{...).vl.B.Q......~..f}..t.e.^....53...K)..........].>O........H.ZJ.....9.@.}.ql...]3.4/..8F.9..(....AS.LR....Tu.U..5.;UJ.sG.n.dXtd.q.G0....9.y6......N..'Fj....r./d3J.\..gMK.&9M..HmhH?F..].`.ay.Jb..R.....h4:."..kW.eA.'P.T...<wR.9....J.Krr.>.2..gk

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\32x32\folderback.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1878
                                                  Entropy (8bit):7.864969384248042
                                                  Encrypted:false
                                                  SSDEEP:48:OfuLhIF/FrE8C/xYZCQhRkiqj/yaWrpWpJ:OWLhITrExZOh5N6
                                                  MD5:67D308289EE1474FDCE90B41C51AEFDC
                                                  SHA1:D68AE9657A7901D2F8BD4FD05B5775205A5F1851
                                                  SHA-256:F2248107E34D7E0AE7CD995ED1D30E97FE11DCDDA7C5A31D0E9F75CCF1D412C1
                                                  SHA-512:B408EEC16D770C182CF7CD9A3C456801667CF7AAD2FAA4C33C753C30DA7006CDEFD121BA0066636E28BD000BDBFDD9BB5F9E5EFA2437E288BED15B89AB908346
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx...p........,4...ffffN.. X.......y.~h.......t&[[.0.&....U....0(^..7.=:.(.H......7._...7.yu..Oe...f...k..^._....`*......h.#bP...t..x..[..K.......m..6.....q.-)..s5.hJI.......k...n.Z....E...Q....c..5......4..[u...v...........LOOS..=.......}y....D._.P_(`.`-.T...-t.lS..c..Y..^...PM..}.......O..."%......7..rS...{.5.S?:..c2..y$.6..)p&..S...<...:...P8..t.:.s...+..[..5?x...g.QVR.Q|..*<.p.ZE...1...c....`...Q....p.............fggw_~..S...'...........B.!...`.4..H....hciL.`.4..$.....RJ..w.].v..aM..#&PcHd.qCT.C."...`..X.].Y...@}.$....*..(.rXUg.*.U.:.&H..?5.KJ..5.`~..X...ULFl....?E,(...b....E1c..P..^.).,.X.B..b..[_.u...m.l.i.m..ipP.q.u.u....G.&.ms).x.CBW....U.J1...1....~...S.uV0#:x.3........4.&a...J....6..L...bE..}?...G0y.g35....~|..K...m".a...._.i1.2.....R..\&..SU.T.P.....0t..s.=...p....Q.......N^V.....k.<..zf.NjS.!.X.Z.Dv.#..L..3..K.........3V.E#=?.._....(vO8~w:p.R.../..2.B.6...q.."D.Q0....Xbf.l.S.

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\32x32\folderclosed.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1382
                                                  Entropy (8bit):7.829437550663059
                                                  Encrypted:false
                                                  SSDEEP:24:ZHWbK54kdBk3VZJPt5FmRgGnwkrZQbtxFMdG+iv/XAMzZ8M8RTXzkEk9Qc:ZHWbwLdoZJP3QRgfWQDMdbiXAMzZoS55
                                                  MD5:38F3EF95D2C88E76DE8A86C2767DEDA0
                                                  SHA1:7CE461A8012F2DBF323F3595B32B30C4CC319FC1
                                                  SHA-256:48CF48584A88AC33B86D201CFFD05DF6DDF3DBBCA672F8F76C572443E08CF24F
                                                  SHA-512:EA0ED87445FD039B8C5A8418D34EF7E241731F9205456B7AEBBEAB9670466517CC61D018F21685BA94C1ECC631B18FC25111A3B950C0000D68CF6B55BE5449B8
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz....-IDATx....<M...YU3....l..:..l...m.6..m..~.......>...~/G/;.........@...?...r.{=..{F-.avnn..}...[.;Wz.^...?..`....].?... .Z&.3.$.?..1..!Z.Ac..j.m_}.g=.Y...<.r).u"X.b%7.w.y...P...'O.Q.;.c....q..{[.7H.DJ.."....YX`~a..h.h4tF.gZ..uX}.B..`8..#..$..k....xS...Fw...|..V.8id0\a8.0..0.&..V}.v bDBBZ5'.7..". !..z.8......\....Vf.U.qx....n....an.1;.......j.H ...q...@..."..].".ub.W;.d2.WI.Vvv'.3.A.......D.....Q.|:@...x:..C@U.z..X.E17jP.Uq_{.:......S.pqb....0......(K....@Sg.>...s_.p.....D'.nc.....S.=..-f.P....\.[.A..\3...L.Qj....1.Z.y<.W.C.s...)J..E1#.......3..P..:......v..8..k1l....TU.......(...........X.ip.}v.QJ.J4.6\.*.. H;...udeanBi2..ucz....Y..kK)B.>i=..........V...+..4y...mbZeccc.^.......@)F....kV....AQ.{.i. .P.h.5P]-+c..(..........0?c.P..y.....n.Q.V.......W.y.2.s...Al..SNM.....K...!.-Fq.T.R....9..c=.+....d.Rny.9vw'.............H.V..;gT...R7.Qz.)...].h........n...~u.s.i..._...)..s.*..K.......=.^.}.1..rn}....

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\32x32\folderup.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1876
                                                  Entropy (8bit):7.864760075337197
                                                  Encrypted:false
                                                  SSDEEP:48:OQVIZdDdSZh9s7+59vvhGeeqgspW1N99F8z:OjvDdsx5vGecwqbAz
                                                  MD5:7BC8ADCB837D715AA95D5C5B726134FB
                                                  SHA1:82514AB5F5C2D6E44C561BDEB6B76396347556B3
                                                  SHA-256:9F793D8265EBDD589ECA4095DA5234424D7191A8B2B77165DBEB0B23FD1E566B
                                                  SHA-512:A9F51315D7548EB3214D95EF250D976BC8D5CFE718835B5F3C49F3AFE94583C37BF7F6EAAE4E4F8C7333FD335B2981B72062117A1B11396B71FDE18678B00A4B
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx...l...F..].._.........b(W..ZAITffff.4.L.8v..v..Wv.(..;#....Y.+....y.......q.;w.....\vA...=2..{.....,k]..f+.x....V.<...o{....4......>p..n~..'............i.my....M......[n.`..._t.e/....?...l...........1.#.....c|.e6.i.K.h;k.U.U.v.Z..........p....].~.4M...`../].}...[h.....Lm..E.....iQ+V....ZkJ.1...Z..}....b.B...,Y..<.o.~gb......r.8..g.9.xs._.....^.3..ir.6.?;0..*.....".,..u...4...t...+....-.%{..Y..?.}...?e.9D.....r...bNo?....$.V>#..T.Q...yK\...e.).J+.09...)...(../..@~...g...~..`._.l.L..........8,.q..!^.hQ...B)I.Y...`....(~...K.e...n.e.]F.....38...v.......t..h.s.H.FS.b.:+}.N.XA.a.s...(+xB...o$.......===..}...............y1.......<...*..V..t.m:@@..I..R...H.Q:K.!.....f...BX....xC\....&....b....&.C.(.J.~.".#J.f1g#......9G.@|..*.......l..'7...B..e4q...x.!..Bd......0&1...Z[.......]..t....w......h...L.Z....r..F.I.....J'.TP....hR.>WkT...<..!..0z.\.....%..S..3hG.!....C._ h.._.....H..!(...p.y....ur..q

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\32x32\help.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):2017
                                                  Entropy (8bit):7.893700966783866
                                                  Encrypted:false
                                                  SSDEEP:48:O7xcahSv3bJbTkCE7QuFrguW5+tzi6fqPKUL83sJ:O7xthSjxTSzdW5+tzaPpJ
                                                  MD5:E58B86105174AAC7DC9F987668A2CC55
                                                  SHA1:A5D7950AAE880DA3A9858EA396E18F17AFDCD1C4
                                                  SHA-256:81EA31CC08E66F9281490C17AE19B3EE2D220B2D86C11F228724193394298CAC
                                                  SHA-512:68ECE2C9F8DC61867AD612B8BF7D001ED12BF10C1AC5DD87FC432AA69ABB49612BBB6005BBAAB321B50A23EE1847E69BD5772B49BB287F5EBA1E39462313C54B
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx.....,I.@.'..{..s..m.g.m.m.....;V.*.......O...y......O............6./..V.P:.3...?..){).m.O.G.8...q..Yd9g3.......p)\.e..ko.E......D....y.}...M..^......"....],.|........&\.o#.v.7...y..7{....p#YJ.b*uRR.n.uR.J.r.B.C[..n....\W.q..!8.. .~..X;....=?..I+'....Q..W..]3O.r.\=l[.....\.wW.%...9.M...[.7~..Qj.+....h.....T.O.j.siw.pP..f..2i.|..W<$....+.....eE.>#mY.....>.....ZE.l...>}7.}..X.q.tR.P7...j...D..Z.}.....HF`1.yy..p..bY.i..9.........(.5.T.........b9..w\s2.&T.1..t....ZU...}..r@.`.[y...q.......m7...^*.....U..Y{.}...E2_...{C..~.9...pM..rt..lm..#73R...L#-....j4...w\.*.../.*.1."...C.z.p..c....t...........u[......{;..`2.cy.`5.NAJv....i...Jn.{..A.Q.....;..f..*...,UY.YJ...#Ru.N;....B.. .W...C5.mdd...0G.7..z.us.s.*.-.r&dR.Y.R+..i...<.A..Q#.....jP.Y..=U)..W.h.*.).J.....7.V...d.XJ...m...&.6......v..x....j.|{.N....H..:1\f.E.U..T...}E..Y.lm..Y.zq.............u....dh.^...p.o..*...KF".2.b._(.....X..E...

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\32x32\localtreeview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1774
                                                  Entropy (8bit):7.832551195098701
                                                  Encrypted:false
                                                  SSDEEP:24:nlGV5NjV6I50Sm1vSwq75c+NkZGmkYl9+bcC3qiJH50gs/Le6pLyvztXvQ8OWS4C:lGV5NJ6HSmALYZGy7IhjH50g3SCR/2D
                                                  MD5:DBA06AB15E6263486CE28315D0FD58DC
                                                  SHA1:DAADC452D8209651429603AE62B3301D6F41DA42
                                                  SHA-256:B86DB4F8C38598A2811BCF94EF666EE7E3F83F430C3397AE64FF526F05087276
                                                  SHA-512:4DFC6DE7BF9743848062BD75DDBA58C0CCDD5D8D3AD2ECB261E65100B443A69433F56AEA8EE3AADACEE4AA4D88FC3BC0C3E8DF955D751943CF983EA56C4BD416
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx...tk[.....1.mz..m.=.0.m.6....6...M.4:9.{v:..}...u..w.....?...|*.r.|2.mu....}.....}l.f.x.'?....t./..U..L.Q..z.??2z.<5.Fm.....M.p...<u....)....T.?6.H........ .".a.....Dyqa.xy.w.S?....9.5.@.N.E...i.D6.@>.D...t\.U...kh#.......[.~.;'..7.s...f...K.......W.`..O..z.....(.L.w...%.4.#" ...B.q.PF..l..t7tu>.R.?U....:.[.....}nbE...~.i.z....J....{.......u..M'.Lc..A.*...Cw].<....@..r7;..j.L....".M...q.....d..X..Fc:N.c..m.H....mk..Xj4.......<.gf5M.U.....Z.R....&:-...M. ....L..a.@....ryR..-.....z/..(.L.L.R...<9yY..#'W. ...C#.{n.9s....L$..3.JZ.iAe.LQ.k;.(.G.......T.V.eMF.# D..x....>50...)....Q??=4t..'.....Z-e.RI.M....dR).w..N3J@ ..T.}....w.......xk]BEZ...)..{....i.x...w....eq..7..d.........hz`.R.C...."Zu.?A.F.X...{.S.*..T..7l./.....+.=W.8..]........f.!.p...J..Kw..W..9..ZG.....M..I....;....gw9.J.tFq\......B.FGz....{...o%..ttt`zz..e..KKW,.....J#H...?......}D...e.$>.h...a......0.O.8.......KbH..%........=..#]]I.2.

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\32x32\lock.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1674
                                                  Entropy (8bit):7.859599419869458
                                                  Encrypted:false
                                                  SSDEEP:48:HKOyH7WElZkqPpVptNskSr44St4aMDFbqsc:HxmLVPQAtFWqN
                                                  MD5:B2367AFA04C223B4E5932EBA393E1403
                                                  SHA1:74C7B2E46ED230FB70E335B08C1BE217C05A1D5A
                                                  SHA-256:D2D67439D802E632F4C4AAF217678678760A387298C833D602157ECAF6221E71
                                                  SHA-512:C5A057696EFC8CBD45B556D51677CAE143296353FCC8066F8CE7FD5935577B0687C46B2324394811120C9F305713FF3FA13EFA6CACD39020747E88394C5AF066
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz....QIDATx....p5K....=s..&..g.m...m..~.m#...Lw.t.[..6..N.N.qU.3$..nl..,..jmm]066.m.y%....f.d2..OQ$..r..w....k.e.(.............~.......3@:::.....-..g.O..].:d.]w.$j..2...0....g....}.....?...cz...|..^.....=..qL__.I&PJ..k....-_..J..._~.....#....0.;..;;;7kF....s...C..E..-.?.~f..$w.........g.}.Z.c.:.v.Z&cpp..7...j.).......}..7.t.....GI..k....<....?.p@%.q.5.t._..:..i2,L.........g......O|.?..O....7....N8.W.|.;...L..]v.'.73....2.O>...u....C...9...Gu%.e&!...~.._...OF..|.+w}.[.........f"6.|.....\....(..L..U...}....I.V..).H...?Z..:..z.>.... ....{.?Y.ti>...:.x...Zl...@Zga.t..M...f=.......X..Y@...1.Fr.(v .%..b..L.L..;<`...Y...C..l..a..Y.r\.Z.....P..(.D.t...|..{v1.]9.l.mKK>..FF.)>..B.E.@..Q...Tl...kUa...e.`eh.Xi...s~....u./.s........]..._...[...Q....k.........3.../.R...cV.1..6..n.....8.K ....B.C.*..R.*....&...:..(O.,..b.g.H....,.M.~.xI..K..."8Q(..YL.. ..mA.!.P3.........Kj\T@..J.........E.z....u.Pq...gci.g.B......7...

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\32x32\logview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1442
                                                  Entropy (8bit):7.745475235760126
                                                  Encrypted:false
                                                  SSDEEP:24:Hz9wGbrh/FmgP5cGrxWLwFVlfSbvR56th3laZED7QYT+U5FVLxPdVqtTTFO:HCCNFlrxHGvSthwZEvQYT9XL0dTc
                                                  MD5:465ACE9813FE91005360A178FF4F6123
                                                  SHA1:5CABE49C8D30E8EF616FDEB8FB64083580B68419
                                                  SHA-256:734E3514D09C78A03CA2231D27CE9087610715193D8DC177AB95F6C5ACFA6EDB
                                                  SHA-512:C0B20B8543E498233E44C02E8642385961B95DB8F0D5F215DFC36D80A57484D915D6C55086CACFA916C330D83A41E81A44DFA663F21CB7B5A8006EFEE96F30E9
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz....iIDATx^..MHcW...K^.c..~.*....`wnZEE`V..........L..nl.F.+.E[...T-(..*(#`.k....w.D.......@..LS..y/.{...s?..,Hss......hXJ)b...`%...B.'''.........e.`~~~......9.......pXLMM....[....R.9tuu..M...@...}OO./..j.j....baaAo...!.HD......:....x<...B..!@__.....L...F ..onn.+++...U...n...Vqzz*.O@.......".f3,.DQQ.0...........}@3. ......|..a....(.=.....@..f.....o..###.i.......#v8<<.....1;.........p8..c.....MX.p....066.QNN.#r....P<...g.@..(.t.h.@.a......@~~>.S......$..!..f. #.....3.g...xv.....y.....g....t.`0(...........sM......../r.z8......(u...QSS#...X.....5VL*.H..N.........(((..8.. ...@S..Qx.......a.o........tb........W.`62...?S...."..10"..d.@......@_#.....7...o......,....T.~R.K..*..e(I.!...S...y766.y\e....9j...*.`zz.......M.....E..A..p.%..5M.....U.d..i...!P..liii...|....72....X..Hz.5ooo.onn~<>>.......r=.".......UWWW.;_@.-.)4kD.A.4.@TM.P.f8%.......I... i..`...........}......FL.;......'.8....!.k`gg.%]8:.fV$...g.`>.9..G?|..l.T"....|~...r(..H.SE

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\32x32\processqueue.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):2618
                                                  Entropy (8bit):7.901131194517795
                                                  Encrypted:false
                                                  SSDEEP:48:B25d68w9BvSJwWcv3bzw1WI+OgsXaOe9A8U86vOLl7EwtKJsh:4n6tcs33w1MX9q2J8yh
                                                  MD5:0F77A3441E8578129A7FF4E49C81389B
                                                  SHA1:9C1623472D0E77BEEBC657155FA092201C898CAD
                                                  SHA-256:2D4C44B6C1016F8ED63EF686AB34BDCA44914C0080AD52A9A660127C340524A2
                                                  SHA-512:AAC4653CDE430786737703E74393FF56B5A21C5E37F076E4296387A48B3992AA1A334525E28B71AA35F1243F99ABF55CA08D9957C11367332111B714841CDB38
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx.....+I...B+I'.dt5....m.m...m.1s..$........9Oc..V}8.....8.T..........*.JZp]n..Bh..bp..X.wbI..~.f0.. .*.|.%6.i...&.)...RS...yfY..B@k.....W..?..A.K^w.0{....7..nu7;.Y8...!.......f.....N........G{...m.+._(....R ..iv.}.+W.....P..?.]..nmv.....{...79.......>h..}[.-.@.d.X.l.....^.}....-...T*......a.v....0.i7......(..G.9....`.8.9...KA...^.K..m_k..^.d.z.A..(...K.1g.I)3.@fd... ......D.0T...>."U. i....{..D<.SF....._"...N.$...d.t........ ..!...\..?A.%....M.+.R!g4.7.d..A..\. ...$..'a..I.#@.C...N.Ld.($.HA..b.'..|/F@...*$...=+?DY.........|#.i..4..c.R.t.-.%.};.......$PH..H.....YY}......@.ZMp0.\.0..).m.....,)..,cWd..%.6........ .p=.....% .o.....~~.H........}...w....c0..Mw....F..:g.....>.....J[.k..O.)....v,i..[.....`.. .IaH..@..{.........?...x........>.m.....9H..p<p..L.....Bg:1<.N......MeAID].[,.k.... .L..(......|......\V1..9.?....].eT.(...B.n...@.7....[..F*...:K..a..*I...).@.E.....Z..p....0.6aI..k.....0.

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\32x32\queueview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):2144
                                                  Entropy (8bit):7.866695703293741
                                                  Encrypted:false
                                                  SSDEEP:48:mmDmaKpeUGJsIIyzE+ivK1fkAonY380CzvzjwpdklqXm:taaKpeUGJvI4E+UFAonwOopdklT
                                                  MD5:844C67E1160408699D307ADEC217F5B2
                                                  SHA1:84F77A21AC5108AE8D6220FF0FD3BA9D12528011
                                                  SHA-256:FCDB3A3A1BBBC138AF7C64A252E8FFCC5FE24AE5E36C4CD7BD4ED8E48AD33B21
                                                  SHA-512:08DF58DCF3CD368C2B20D7F0C6F20ED9445DBD6B3867E2AE5850043926B2DD36EECDF8D5C13336A39D649D1E5C4D44DD6011CBC25923375E8B53F4791BC0A27A
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz....'IDATx....kK..w.a.IN[.=...6.m.m.m.m.vw...V...ng.8.^...9.w..r...p~...Jb...Z/;.UVZ.L......&.G...0...3....j.UR2{q.}5i.....x.q..mNNN....~..t.6k..v6..w.K..R..tE.J..p......9$K=.......).....?S(.h;6R.0K.(&R.%.$.a.o...F<y.|....s.....V.a:6....2.8.......r.>...K....`.M7...]{..|D...G.e.......q].Rc.ei.E...B......G..$q....R.e$.;...=sBP.!.R...n...\p ......S.|..m.....*!D...M.I.....^O!..~..b.D.D...D..T..... e.0.x....Kh..o...5....z.e.;.G...:...c.=z...N..`|,N..0..........}.......T@KK...&.8..q..=.1. .5.N. $....:a...5J..8....4.iVeS.A.._...R...-.3a......UB!?....:..;g)....9s..MMM.R.e(.4z.u..{.^.]..d....m...z.B........0`I....RM....>|......d../..G .i.o..c..900.~......S/-*..f.6-.f..4..4.0[a....O..._..t....D....D1,....H....K-..K4....b.{...c.^~'.].(.a............fL..:.~.s...>33.?+..g.#....j...L6.,..P*.I.|~.......8..W..M7....[.].#..i......UdDz....e._~0.........CE&.!KN...&...~.e..?.P.g(....E.'MN..ZA...y.f.%(.FoB.A[.....bi.j....-......0.1.

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\32x32\reconnect.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1670
                                                  Entropy (8bit):7.8724577847012736
                                                  Encrypted:false
                                                  SSDEEP:48:mwmk7chh8ckurzH5B2lzUzkVUZcHUCC+5dP0cl:mLuburP2lzUzAgkn7
                                                  MD5:6EE1CDA983B082B09340F2F22FB6C767
                                                  SHA1:8D200CA0E4925998A88FF28863127399B9EDD58D
                                                  SHA-256:457B63EE020A89EBECBD8C2BEC4FE53763A2C13B996628F782E60798382DEAF9
                                                  SHA-512:8C24CDF6527D305FB925C6A6EE084C8A9D94BF22D3DA213DDA0AC75F8AB3BF0C5C0F704B39E48726E2206EF125788247ACA2185499DA1596DCAC4941B386A60D
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz....MIDATx....p.X....P...n..q..m.Am.m..X.....K.gl...w.......P`...!7b....Za..C..tg...'..._3...rg].....>M.....\..u...U..r......F...>0h....cl...........Kq1v..b.p:J...S.<.8.25.qa.@?....q..7."'b_.......Q..9.{Ig..G6..$...r.,...UPg...:.w>.....IU/....1I<H.#L..&.a..B...+<L.....p,~..0..35..&.XD....T?...ax...[.x.^.,...a.F..<...w.s...U..C.7..&:..t5q3.g.]."!.......X`.4y+..n..+..*Ss......./$.w.6...]]h...E...<}k...;....~6Z.g..5..............Hpw........s..5.=.].50.D.X.........|.+....R.V...E...[..{..L......c....NR2..k..p1~..J..4...@>............8.9...%9+.....}! R..({.h.S.tv,.......Y..x..qMru7..]Z_.0..%95..C.......e....o......X.#W. .c.#.3.8...y..,...[C.j.....'...Yb[[...3...,plB?6.0.kW-d....:.To....w....:.*..a..oT...n;s.^./N{.!......[....u.>.o......s..1n.b..?R...j!A.R....j$0AJU.V....,.%.......X.H.........c.....l.^..W..h.[.N.j.T.F`..<.U.'_.Q.v.8.p..6.L..;eG5....AR8."..Cq&\.....6u.tr.bE.;DK+..+..{?...{..,"..c/..(c.. ...!..P.....

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\32x32\refresh.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1976
                                                  Entropy (8bit):7.881093197097352
                                                  Encrypted:false
                                                  SSDEEP:48:OD77KfmLVvBE58gXLyjA4V4Wyt1sSjzaEST/1:ODvKeFGvZ4T6XVo1
                                                  MD5:E9ECF626D6ABE0EA06FE28F04184D8F2
                                                  SHA1:96351536B811FE09C04FF9BAA480FB82242B0F90
                                                  SHA-256:9A80D24B7BCC958804B25376E5C39F6A085AA9023463296868DB0B9645E925A4
                                                  SHA-512:94F362062D9E19F18F8C1F2653F350F302279ED78BF33C9A6BCF36428E2A8D5276FBE9D3B10BF8F25CE57040AF6A82457A56378500C060153AB49D7B40749944
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx....x.Y...KzS7.........j.m."......m......w...<opon.......5..$...+e>..h7X7..t9\.,....0V..j.|....PY.00.(.....U.......P.o....=.......%}s.......h...*...i....#.p.....:....`..G...s...w.X.Z.....Xz.}rm.>...E}..W..W>.4}9.z........`......m.7..(.:..S..&i.^...ODo@..E.7T.-.....'.N.G...b.;HO....-x.n...[...3qG....2.w..P.zx5.;....T....pY.L.x0W.}3.........]<.c.O...1.DS@.x...T.c.ER.N..j.g..].b..cqJ...%.Yp.}K..:...A<..=.W....._.:..gS~ b)e...e.N./*..>..kq..h..dx0|..._Bu.....o.2b!..2G..x&.#..<..F.A..h.y..B0..Br{.c.d...;z._.E......)..G......c`...4=E..]h...].-....].nX.?x\.;|.}..WU.K..}e.+...x........8.|^q...mZ.s/<..^....@.........~Qk.p..1.o.I...'l...}...jw.F....0.I.."..rG.(.A..SG..B96.G..T.1..9:f.,..9.n8..w...6...x>..MNK.....3k}Z.....Y{.I.3^.:v'.3L...J..s...b{t.9..z....'ou*_..s...*u....c....g9.q.p{C.QTp..3.....N..@)....x...P.z .-r..........!.H?.....]...'.*so'...n..b....9'..uE.;I....F...Z.bl.7.0.6..n.......n.

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\32x32\remotetreeview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1566
                                                  Entropy (8bit):7.856124360495591
                                                  Encrypted:false
                                                  SSDEEP:48:O36N3S4t6bXJd4enWubIJTUMJwraJr3uwSeo:vS4EbZd4eWujMDrA
                                                  MD5:93656A2188798221023A385E5CEB374F
                                                  SHA1:991C36F45DC931E04AA95B34990DD27EA73CB02B
                                                  SHA-256:748FC0A5B322D1D171E87D71E7DC2563485C72BD8AD0557B99D12477FAA1DDE7
                                                  SHA-512:F3A6F67215BA0C082E80D39DE2DB43117180F92D185AE2B3FC32A29382D13C27E505DC6E85B44A6B44351C76B2DA515A226919FF74A2FAB32E676FAED4FBE508
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx....pe.......A..m{.m.Ux.m...;v46.{..o..2..W./..>.<.a;.#\C...f+..g..m...'..........g.u....\....=..........u..............Qt!....>:.zV......x...?w.5..u...i...|..cq-`!I8ah..S.Y....c...\^...}.#o.hl.Q...^...r...<......u(...f.w.|...7.2.....p.......8...A..."..(L.._.....`.r..EL..=.Z..b2.ZCV@.C.....QZ......n..."E..@...{.Jn ...`!q=...(.|.....w...)XI..@a.( . I@k......F.../.;2.+A.@.U.lb..1.E%.....'..M.18.m#....h5}..H.U..4....E3....I......I{..7....y..D.~D...N`..c.}...0{.......}<....*=............^..80...H8zP....<.fZ*..".H..\.:..G.c...~.~.GEZ......Hp..@s.)gv]q..S.s....n\..K.c...K......3?.........}.mm^.R..R.].47.zO>..Z-........i.V...Yv...;...[........{nS.0...y%..u.}....q.rz~........'.....b.}.Q........^>k....6w'b...M-..w..HW...+..0...iG...rJ.EQp..(.J]]]..Zg...vex..U(.....,.H.[&...sS...Ax..8<<..^m..B.<...-..=.r..............e.J..n@.... .h<..vL$qN.....Bc....1.,6Y.....(.#.....Q.......H.l...9.HL!.......

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\32x32\showhidden.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1945
                                                  Entropy (8bit):7.881352855748773
                                                  Encrypted:false
                                                  SSDEEP:48:OnrJt6G2fPWT5kUvX2vM462j1tdzm0wvOtEa5B2JBnCR+pvSuC:OnNsG2WVJR6jzdzl8OttUJBTvS1
                                                  MD5:217FA1181DDAA3BD23CE7AAA98A36E26
                                                  SHA1:E62F81DFEBE26E0236ED4C3F5A49C584B9B9BE88
                                                  SHA-256:43AE1112F6C1C7A4A3B3DB65925B421BB69D5339CDA4EC15AD31898D33285ED0
                                                  SHA-512:534EF984302CA3100E46EB6C7944DDB75D12F1FB378E36279D5B0D406654AC50FB49E0F41C0B63C1C869F65414847990E112AA4ED75AF75CBA70E8604B61150C
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz....`IDATx.....N...3..b..m.m.m.m..}.k...:.O...*~oWuz.Mw.D..{...0.(DV.ol.x.5._..;......|a.=.....3.m<..SJ`Q0.6v.$.-.....|..Jk.3...Y.^z...n......@SSS..SAGG..dH...........A..6......&N..RY.O...../.&..l*....[..W_}u.|>.%0....g.}v........q.{..p._.>ikk...g..........k.:.....6..Z..._~.b``@z{zd..i...W.....?.{.W.}.].......\..ny.wdttT..~...7.R.$w.q.\~...../h..k....:K...~..c.........*7>..C.R>....c ...f.....1jkk.<.rY.......3$...L....S...c.x....p..'...f..[Z?.y......'....ds9Db.`.ct..M..Q...X...u#...s.b.y._]w.u..).o5o.7>..[?..co...yW#"..X...3.E...|....h)4..tN.0i...o.....i.y.....#.>S.W_{...Z.0.@.#`. hGf.i7.....0..Q....>...W_...)..GK.........p.......Q..U?,0....T.U.......f..5A.....,......?... (T..2.n.e.OX...]y..K..E(...H...=..y..>z...oA..E.0..'Zm.H.X.0.q...c......c...a.....O....~.....h......4..H.(..i.E......*...1.....5Yv.tN.}.~^{.I"<l:...?.?.).VDO.Q,".3v...(.. f.;....+.>dw...2.\5..;z.......U....a.........3...

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\32x32\sitemanager.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):2036
                                                  Entropy (8bit):7.875382760915973
                                                  Encrypted:false
                                                  SSDEEP:48:O8Rx8bYTPPqpFsbb18IC7wUtdLzFfwgbVeDfadZ:Oyx8sTPP04b1O7NLzVwrDe
                                                  MD5:9A4B68DDF573F2F9FE8558E47D332134
                                                  SHA1:B1D20923C6BFC113A0C878F6A8C39798C98FD37A
                                                  SHA-256:1D6668E1298D6D597B25E7A694981C5657B15B82D3D51C51D420413A00B57E3A
                                                  SHA-512:564813F9BE6776BCF854198521F082C8BD6C00523B164EF2138489215DE2D5E299B3E9E7FAE5F53DDAA5AB2F2BA0DAA160BE7309CC94272865FF0797CD4E08A2
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx..T..6G.....g#......._T.A..m...6.m[Q.~...s^.l.m..7..9s..wF.hl.-.y..6n.x...<.~.......M.....dx....;.3h...?z....=..z.g...?..u.y.FGG/..m...CF.y.`2....8..q.}..8p }.....{........s.U..]..y....R.s......NNN.....5.....?./.L....o......S8....o..:.......`0...f...?........?..8..x.#.RJ......x\v.].c...7D"...Xl ..9.s^y....z..C+..j.......l.......S.T*..g.M...F..s.......PJ.....B.# H0n.........!....\...;.$.!Q.Z!..c...q..L..$....L...~........E..Y.g...a.......'....W..L..B........F.^.0(FLMM...q.......,T......G.Lb: ..K......^.`.m...I.s.Z..........=.?2h9'H$'.dhL.L...^a..W(q~..bA...pm1.......`....8-.n...A...I.G..2M.n....F...@...h-.;&.S .V.d...d&.a..S.P..))..n....e....!.....bor1..s..\...q.K..../.i..M....[..pf.|>o...k.&`..A.&..|...+.H..^..}Q.V#.J._.d.@..JOO.'.]..+...sA..:....V.A......x..Hu.....X......_}.u..n=........\L.D.q<..~..X&.y..yby.L.4..... ,.W[=@..a.~...'..;...4.u...m.nl;Y.m.m[....X.....|..t..0/..v........_..

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\32x32\speedlimits.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):2305
                                                  Entropy (8bit):7.884673549108536
                                                  Encrypted:false
                                                  SSDEEP:48:8XAw5ajS8VVYFdnuNesPWEU2L2M7jUjWMOmNzv49Uc:8IjhVV56EUu2M7PuaX
                                                  MD5:F49B3220A64C71CACBD07C4982243B4A
                                                  SHA1:839E5AE0ACA037CF0FA9B8286C1D07397665DC9F
                                                  SHA-256:38F31548EFD96187C765379F6726516AB8A5327A06D88861A5D1E5385B8721BE
                                                  SHA-512:4733B1A2AB893C853554E3D2FE0CC45E588C908CE724D69112AE891A2935D0EC5282598E17170AFE6A262B97A436301F1A5793B86136B7D1ED99D5C6ED681E25
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx....t.....i...mR....]..X..m;.m......4.}}...wr.d.{..;.....~M../....#....m....G%.Q....wu.~..d;p..G.1....t..tG........{]\<ow....[<k0P.8.r..x.wt.....*U...^.{.............8..1.k.2.}.;;..P\uv.C....;..x.S..Qc..~.V....8..L...|.....O>..&.3O...S.0i.o........o.]..A..|..E...f./.#........ph.P~p...Y.K0......v.....1.x.(s`+px..im...o...}...w/.w.d.5|.h.c..a.|..N=.G.~..g?..;.....v.1.EX.b-..l.....;.#...a.6\.....}6p`.....U;;..&.).T....1...e8~.:.Z.....F...c.>l._....b....G..v~...u'<A.J#[.o..AC.zs....^..._j./N7ir.n.&.....r.=..G..m...x...H.1..3z.HF...........S'>h.....A..8......7v.e..b..t..~....p]..t.H.J</.%.8...;./).]...K.0IJ.v........;w..v-.v..@..B.0.)h.a...:.....b..=]3..=1lXJ...7n..ne..U._..)g.0+..9yy.-.fnI.".........d.#|"....^.\.....O.../...k..8.k.>4..I...={...!..}....j...2O.m...If'%1....g.,..V.s.a.5y.....J.j.e..W.d.4\...,&Y"..H..c~~~.EEE.T*...*KZo..%1.'.O ...P....m..h5.].Y.yL.z..b.l6.<.~..z...QQ.JV4EFF....$...

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\32x32\synchronize.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):2105
                                                  Entropy (8bit):7.893806875986684
                                                  Encrypted:false
                                                  SSDEEP:48:nxVn8A3p0M91rqP70z+LCqe4wf40cP+NiBQ4M5jbV5rQ32v2Tt:TP3p0O1g70zGQjcP+NiBQljrQbp
                                                  MD5:BA0F6AD63DF48313FD5338017EAC320B
                                                  SHA1:014D527329A5B35A6559C2F3B0D0669165ADD27A
                                                  SHA-256:891D70D1D77DF9691B3A0EC6E1E4A6E4703B9ECB5340E7F91D92B5033E272573
                                                  SHA-512:DB53AA318CD1307C7E919E2F20044D71152935CABB63E23898ABC2296BA1748E5892FBD19F72475EACC8AF434E0D4BB5F79F9016F9BBBEE26A54D2933C1D3606
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx....|.m......,b~....l.m.m.~mW/j&..n.lV..<.}.w...O....O.<.UoH...~...].>.B..;n..@..x.\..b.i....p1.l6m.Z.@.?...7..k_......*m.({..Lf......c..B.I.x...R.B......R..........[Z3Vz...o.-.x%$iJVn#..d.b..YJ.dQ.......h..;...;....:.}.w..SI{g....r[.4....L.Rk.R.)#A.(v..f..6...-{[....v..)...`?.......D3A8.r$.RH..b@(....$B..".h%I..8......ET9.a1...n..'.........X.s`] .L....@F*.."M.i...Ry.1L6'{."...e......r......h0+."..M.>`l...u.=....q..4..`L...s....[.u..0\.e ./..F.S..L..ZO...c<.y.B.Dx..(...dh.\.k=.a.GD\]....2.Q,.x2M.....K .=.F.E..{..H.p&...+......'.5....M.q....7.|%.G)zX.?F.vN.Yq.q....]...e.x./.,n/b} ..........hQ....Y....".+.'...3..V.95Q]t...>...9N.~...Af.6..E.....(...t..F.zb..q.'O>9A1.K.'.q*.."r.\.W..UzF..1 ..ow.:4c..*.5y.b.f.......y(.f>..S ..r.oY..4'.s...4Q.7._...DQ......q.....,..e..{...........d....>.dh...6JY...+..?..w..[.n.P.9Z.!.].....eFOJ..........>..p..Li.Br..]Y.z._..C..Pg.U.v.y.>........Y*...E.~.+./............z ....

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\32x32\upload.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1056
                                                  Entropy (8bit):7.7664202701837395
                                                  Encrypted:false
                                                  SSDEEP:24:PfJWryoPgZ/eveAzLsX2IPDTo3xgavtMZIbajxV5DPfhXz:PfJWryxg2AHsGcTo3+avtCjjr5Lf9
                                                  MD5:890C208D968EB6C3CE0CB8267F53485C
                                                  SHA1:5CE3CDC4F86610599F006826D12E8BF19935C1DE
                                                  SHA-256:0E6EC88C54BBD99DCBCA7ED090B775E0EAEEC992AB20EEB1850A79A65F7E790C
                                                  SHA-512:895B1A23A7ECA1A8C0D713FAE5DBF8454DEB2221367C379E178CDB4CAF1873224861C7FAF14E33BC77E31081C70D5D79E1A1C48B8220ED761A48C05FFEB2516D
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx.....h....^.I.m.m.m.m....v{.,.V..?.W..f.#.F.6m...4q'_C\..U.zE..4.F....]H:|..N....e..K...+a...-..%.A..g..1....j.S....{.1.5a...!7)..w...tH>v.....w}../..kW|nj*..<....7l./99.k."0..q.b./..RA.O.5q"X...c.V.v.*d<|.....U..9.Q..vGT..Q..X......M!..{....-%...O.&I....f....!v....1.l#F..3.V..K..{..p.8[q....!..;.......6f..[..M.. ..........4.>..8K1.f..n.....^...K...V-P......{...H.6~<hJ.z..{.g(i...8H.|....A.........3%..C..R......vmy;.e'.9............B.@.'....*..MR.\...r%../F1.2ww.I$...........Wa.%S.i...%.o"E0..TE..J...-..<.l..H.......H.3el.m......h...:.C.~...[3...l...u....H.R..ZX...+d9...Q.~....v=..P@.. .(......q.&..-....t5k...A\..@....+.&.?..}.._.,0...7 ...~.........op....j!i.>.^.... ..Z..........S>z.de.R..>}...D&...!...<..S....Rwwa6. ....T.*5'i........ps..../q..PT...k.I.5.SL.Z9f\.Z??P.g.B8|^....Iw...BC.+T3 ....O....\X..#....K.BQ..q._.......g.....Q6.a<.......e.......3$<|1K.....|4...M.F.#s.FF

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\32x32\uploadadd.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1265
                                                  Entropy (8bit):7.792079235784413
                                                  Encrypted:false
                                                  SSDEEP:24:F34GNNUicyzwQ3etm1Ue2FV6P1sDz2pO5Cr11AJvYYau1bNybPK:dVrjPwmHEVMsX2Pr11AJbxybPK
                                                  MD5:3A28A1622D5191AE4B103026D995C8FF
                                                  SHA1:10CC1A0CBD2BFB6B1934A2C64611309BF9381F9F
                                                  SHA-256:E210FD66F470833B09196DEB999F05C4F296EF20BC24236575BC151042F163E3
                                                  SHA-512:B4491487D2B79EC9206DF8AF833CFD20037EA9F2156DCD406A113291E4A0E0318448B02F97B25B3F9E7C56CB7045D46BF4B808FF925B774E34C2B20DA5DEA774
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx....pck...&.bU..m.H...m.=;.k....6m...;..g.......?H.oqrr2~..Y....eO.<..g. ..j>..j..D.8;;w...P..B........E.<k.)..r.)..6.w.^gooo../...n.)....i.o..'$/X.E.......G...>|.'&.z...\.u.np...?XZZf......s.Z.._..M.>}....G....w..$.^...+....`.t...E.....I.}.....$].r.[....'&&.[|..?...!((.^.|...|.7..Ahx8(.J.H.P....................;w..<xP....;..........!...@..RP[X...ZQ..6o.<y...KF..=...x..;3..=.. .....#G v.~.[YA...P..%l...a.SS.{..k.p..K.....rv...+ ....Z....+V....C.d.q]...U.cI|...X...!..!H....-...a..P.Ib...6.oeE.......~.!.@....c..&.i.^ l.......!}..xBf...r.`..g....P.$._....Adl....!..g.7...{A.{....a.r....... 40..e....T......$..._r.^.P.VW.=}...?...$..@D.R..=.?..|.>...H24d..{.4IxS....~..7........bp.....tw.]]!...&&C...(..D'...&.>}.W..B...I....D(M..j...E..5.B!(F..._..C..m#l.....:%....mo...HY.<.R,........E..p.lJ?}.r\N.A... @..m..[d.?..V. ..1f.h\Bt......................XY..R( ..^........zz..UWI...r.o'b%...r.d.:..LJ

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\48x48\ascii.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1935
                                                  Entropy (8bit):7.854020024414465
                                                  Encrypted:false
                                                  SSDEEP:48:0D/LfCJMCRPFFbQPz9XzmjfrN9H0UvKVVenTS7lRlVzcK:UCJMImz8jfrzHPSLenTS77lP
                                                  MD5:5820281B66DE463951694B6B18E6185E
                                                  SHA1:F211F8E494ADB325792BE3C171A2C89D459EA2C8
                                                  SHA-256:2EBA5453C13F3624309326382BB28235781691C262DBF45E4B749308D254E4A6
                                                  SHA-512:3744F5A7DB3B177FA965FF7B2271F5E1866137EA35339F802F85F58DF63F7265E27933489EBDA7CD43B72F26E3DC5DC2E84C61DFA5149BAC25476CA12F08A6B2
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W......VIDATx..Z.p4..==...Y..m.ms...m#N*.mM.......oUWgfzj...S.U...O..I.!...a.%._...8..3g.|.#..D.G"..f.V8....X............_(..^.w......./.|..c....H.cy.t..ZSS.rrrP[[..@r..N'4.K l6..K...z..m....0ZZZ....C.9.iii .. .}...kt...:.....6..Qp.\..8...,.QsQ.B.\Gkk+..k4.@k.......x .............w...[.u..FX.....%n.....z....t..Dj.f& .B.y......W_E.]..x...@B.}n..zc..._~.%.H...2E...`...:r.E...Q]]..G3..>2....Z.B..%....g{.......A..`.X.._.....$/..Y....B..m".z..#.....N.H.(*jM......=......[X.q....}..e.X+.>.[7.o..C..N..+...}.x.(..2. P#j0.q... .Z}.G..(.}3{..1c...op..F.....$..'.`.).uk."...F.......1..A...[..Jz..H....l:..*;.C.C.:..^o\....$...b...P..l...C.......`$.....-......p..Wf+.L.<.(......s....)M99h,-5m..x%y......../..{9x.zB.P..h.6.....u'\.m...{.%..U.(%...Jc.".....:...N.;................2a...1.x...>...a....2.zd......o.};.^..We.e......!..>....sjJ.%.m..:.4.........U.V....eee8HM?"....z.#vF.F..c.k..5/C8.a...-.b+.....Bt~DM._..\vA....

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\48x48\auto.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):2024
                                                  Entropy (8bit):7.882123376988439
                                                  Encrypted:false
                                                  SSDEEP:48:PXZyeIrQwtIg/wwiWbitSmZao+ed+Z1vmLqq2a3hmzHe55:xyDtIgIxWbitScao+eQvmLwaaHW
                                                  MD5:436024743C7DD6DA27DFEF9FB6973BC7
                                                  SHA1:AD5AD8ED21F8339C393BCE7D9C799F83BB1AF6C5
                                                  SHA-256:FDC91F670A4B907C143FF18E1CCBA5868D8D71DECE8731A0694470B7176A305D
                                                  SHA-512:F4C99499A7A69C2103B0B0AABC9BB908BDB9C9352808A838CEF5B4139FF6F930868A7345BD96B184651FEA6222EA6719E4056ED8F7AEED9F101FCCB6186EBDB4
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx..Z.p...}{....1.".."...f.Ya9...0......}}433.b.....n.F.....Uu.N/5...[I.B....L./..r...p......#.<..B.A.......<t(.y...LM.<V.........../~....../..R.j._..\..........~@UU..."s.n..CF...bQ....*...................QQQ "u@..0<. .|w....477.s...p.s.f.uk...;e..u4551.<G......B.@..G..{..#h8)#................z...{8.Qg.rT.V.|.."..pb....x<...u^...k@:`.P...q......\2i .@.Lg.0..c.c....o.....A...$fk...).<.......v.A..41....B|.!U.....I.p.q.a.!....AG:R..t.|.t4.`..W_.^.......b.-.........3._...R.....W.....[\y0~.xI.C..D.....z.....T.Z......aIH.2R...G..)S.t:!..Gu.;..@...e_^...d.xdq....M.{.i..4}......;f...-++..'..g.}..KI...J......y.....6....E.-nt.R.....($....i..u8....~.~.{.e..N..B.....W_.Yg..5k.)Q^^./......;/..G.....>.m..Y.Qv`Y...<.F..t.M..K.v...'.S...w.es~>.u.}....SSq.N.. .y3h.`..C.#z...s.y.y..[....xK....h.mb...J!....&..........u.9/..>_..3......kg".L|s.7.Y.....jwi...\'^.et.v..8......r;....+ ...H.yX.Vh......Q........M..Q:c4|

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\48x48\binary.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):2336
                                                  Entropy (8bit):7.897739327239153
                                                  Encrypted:false
                                                  SSDEEP:48:xvf4swlt27DYljZhdjTprcNQTzTUmo8lx1dtOuZwzb9aM0R9Ri:NTObjZhpv5/dn+zJ4I
                                                  MD5:C1B755C20F9A313B1F5D0851CA2357D0
                                                  SHA1:97C1D420EC0B3D5C9C75F59988B1778ED8B50B8A
                                                  SHA-256:1732B05802AB5567B75A784D616E01673F74C454054D65B3CA980ECCB5A325D8
                                                  SHA-512:351FA32A8AA9BB41C21ECD71DB620E2786FCE25143BC70A9A74B3393B4F5084A073ABEDB6365E07AAF03A3B8E411BFDE5EFAB0CF1AD850870790DBECE259154C
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx..Zst$...=1...m...m..m..z..m....L.1..o&...uW.t.-..(....L..D.....=...3g.([.l.9....sF5%.i..t..!Wa..>>SQ..xl....,500...{....@....;v..( /).\d..[p-11.G..ELLL....ppp.CZ.$..`fe;;;..y.jYvv6......%K....$k....LO.^..x=?YZZ.RSSyNC.....Ob{{{Q<_E333..E.'.....k..!.^..d..6...^aY...n.a...f.y..7.I......Z.`..m....###.J.@.A..8q..CF.n.|.............7.y..3.^.~...=..7q..U.w.!..K.....Z.*..8..b.1h.9.../...&..*W....t3....:v..R........T..A/P.^.z.a.pvv..A.dk.......#**.$*^.D.xzz..+C.1/Js..7....w.m.6...b....%t...;w...kq...t..q....c..X.f............;v.!G..m..V.|.......HE@........>.....h..+V.J.Y..5k..)((.E...Y.z.aV..8N_.r%CKV.}.Xr....&.5.......~.....E.K...%S..D..].....}={RI=(..IIy...s....?u..=.....@..8..n....ccE....Hy..X..h5.....q...)..{`....={...1c........!r..IZ.L..O..U..5..)....>D\\........`.m...^.LU\-.@..V(.g...}..,..,^.iZ2.-......c.9.<y2.P.>}..;t.P0.y....XqR4#PI.[.j.N.:..;........p.h...."..$....B.,W.g...m..x...5..R.p....;v.

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\48x48\bookmark.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):2281
                                                  Entropy (8bit):7.895544189257363
                                                  Encrypted:false
                                                  SSDEEP:48:kPGh5RAE/J6SZTCC9WVIpFkdunM8iiV6xkK7V+8q1pUh+/NK2K:oGPISz91kaMNiV2ha1pUh+4d
                                                  MD5:DB7AC38CBD88E66B6D140C47AF2A0514
                                                  SHA1:30BA0EA85EA3B7C7A3C89EEEBE47E3FA789ACFA2
                                                  SHA-256:7FA7EB5416ADDA7091B6F3D460A36B4ECC0D41DAC4B867AFC4126E635FB6BA16
                                                  SHA-512:282B043FC1D1E69FA403B48E087E38FA86728CF5823FCFA47E2E74FD38FC7B97EDCDD67576875FA1F35EF6015CE79FF3FE97BB803380D634294F8329C1279008
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx....$I....FUwO....Y[g.m.m.mcm{...........cF|.Y~.O....q..C..t^..xa....>{..s..dtR.. .....c.W........\....f...?.G.....$`..Y.R.b!..XG....@@.6`.....82\.....p.XU.w........@p.7...,.....@.{.+..q8`..k@........]{M...$@.(..s`q1.......;..E"R..I..(...^_>..V..w....G.V...X.W.We..G.....oW....."R.).N.....Ht...?.... ...x....w.2A..7..d ..._f@...7m}....R..J...\4............CC(Xc0.XE.}q.m..2+...B.l&......*.s...a....(.>zb.c..l.I...T.B..E...._Z.4...e*O..FV.O....tC~.GY(.6F8h]..v.U[.a...f..g.v........tA....4..`.UM.B..Z.|..I"...+.....S...8@^.6.R.T../....k.....~..a...k..c.....:..U..."..0$.4....l..2?.|.Z....pV..!..2#.cR&.l...0..i......N&..`..D...WV......P.v....X@...U...*+...W@.^......:.b_).=Z.l~.L%...'Mx.......).0..3.-.t....A. ...z.Qe...... ..J.".r....A~..A+.(..-P1|@2.{w.U.\h.m....~....QX...Q.#N..H..4y.3<j@.i'%.Ct..Xj.W.........x....._{h....&S3sZ.W.)...hy..&.B7.h?....'........V..< U.H7...-..x...^.m5..

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\48x48\cancel.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):3196
                                                  Entropy (8bit):7.923256809742866
                                                  Encrypted:false
                                                  SSDEEP:96:Mf88mxxeRaY0LpfaqX1VxwEhGKcObH/Yu:Mz76QqX1VCLOrN
                                                  MD5:6FAEA5A4CAA6BD9064007B90074FE532
                                                  SHA1:51909BF0CF48D1E8BD40ABD53E56A1F6ECBC55D8
                                                  SHA-256:40908F88D2F0C55EA571FAB72A70D9D66C5DAFCD018E37A5942A070123A0E3DB
                                                  SHA-512:82B83BB9A7C65173938AE2D24F460719D06F7171A3264BE4594809F358B122397FA928D45FADBEE7342E3AB95FC0D562D5A5CDC327CA9328B2E5C5428192542F
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W......CIDATx...p......F...0.............a).2.7y.a........w..U..L`..G..W...O...7....#......y..k...IV.0Ye..N`...1V/.....c3..S. .~Z...f..LT[KTSC*.(.....B%C.......,........'xdQ. ./J..|..SfO:.t&.^l.ah.....eQr.E_>.w....::la.....C..Gd..<..6..~a.S...IO..T....+l.4V..+.....s.....7..{.."#...>n.RP_1.......'=.y....DNl"..l...e..b_..wo.h.f_..o.*.e.w._l.9Qu.....g.q..'.$......xF.*.....A.dI..g...d.Gpq.........k.2.(]<...?...J.......Tt....sd..Jek...;.j...=,..8c..W}...\.....I4 .......I.....-..+.....8..e8..?..h..._s.W.2...... A$.F...v.e.%...,....q.}...ZX2..;...I..A...........`.....]=r.7..P|.AF7n$V.X ......6..^..$....@...f.\..>.....t.$Bx../x.....I.=.\...N...P..'S(.A.%....o(.X.D..B'._..}6.m...WSnjb.(...r.4.*...p.`<.c..1....z.w..Po.a\..../..:.Jz.....z...o.....).%..%K.kj.....=......i'...X.q....1...0......g7V..'.a./...3.$."L:M.....wX.J...._tH.5N<@...>.......HLU......?@c....s.E(u..%..V..../.....p\.VU1...8.O....p.@..,.O......&8G&.L...'.8d.4..'.

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\48x48\compare.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):3633
                                                  Entropy (8bit):7.928242183547683
                                                  Encrypted:false
                                                  SSDEEP:96:fG3mvqPsVZ5j3XYXKuSTnOC2gZAlD/ttgOntAOPEJ:uG4K5jHY6uaOC2gZChHU
                                                  MD5:E4394CC2583E17054278BB007E8B4676
                                                  SHA1:4A03370E5CEAD41FC8AB6C49AF2B192F64FE7845
                                                  SHA-256:CE4476801DDB21E930434A5E95DBFB633276BD47A184EEEE7F13715D17C97A4A
                                                  SHA-512:D78FA4042103C67DE9954020C25AED5E23B6FE7DFB3F0D968AF50D81560CA22F1DF26C8D62A6857DD074B76519CDFF3C2B0A9DE09671BDA9530AC022F07E8417
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx...x........W4p..'w8<.........z..~...;1$F<...........~....G.eR...]].D.......t..bcc...U.:u.D..."..w...^\:..+.&vzc..N..X....2..Q..8.......pGR..O<.)((....D.J.$......u]0.eY?.o...TP...z....k...@*..i"...}.p:.p8...`..A....t.......'.>......4...v}.J.[$.......N,hw...mj...i....w....s~..s..F..y...2.5.=R...T.&...\...........|(q......r.-.n....Z.3..v.....,T.2...$Bg....&....d{.QA...=??............{.. ..!..........]7.......I.....u....W....M..TP.U...N*.....D>g...A.\7.....P/..`..AYF@..#.....=....je.{.e..D.._.V..z..,.....4...@...0...9......C.@ X>?b..8..EP...`..<E...a...B.M.C..M...<xp.z.....\3.s`..C.9*............6... .n?.)O....4.-X.;.x..b.y......d.....C|..z&!!.......8../**.?.z!.g.A!..9...8]...[.r.... [....>.@+I......S.......r^Y.B:.QAH5i.....u_.n...`....^<..e .y.[c.C.u.DD.%<5&.......3./_........r\..."w....>...BC...s/H.E.3j. J..3..H...*<<.a^q...V..*...Tp...9.I.{`..KG..>.RP..1....H.Chv".n...f3.A.......N.....j

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\48x48\disconnect.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):3154
                                                  Entropy (8bit):7.924166468402435
                                                  Encrypted:false
                                                  SSDEEP:48:ut3+AlXxBAc6DiQGVR4DJIYr0XjbIIa5RqQHZnLLoiPKmv5k4xDzuQ36EZbfWQZB:utPTmSiIYr0fI3HZnLByWZf6EZ7jZwLK
                                                  MD5:ED4895D987F95765384883E26E97CF52
                                                  SHA1:5E626DD9042BFB6BDDE255256A20414EAC79B2D2
                                                  SHA-256:A97820FB66705BE9F2577EC9B0B91C82E611FB6FF87B58D4E430873DE9E67749
                                                  SHA-512:E3BE633A88C305145CD76BC3BE3C00B1AA177986E23179AAD81BADA73716A9EFFD93A9E2104CC8B4899921421F3696A2806418D042E593E2F83E7916983B08E0
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx.....w....Y.C....._.!..'X<.Gqw*8|......z{.......3.....Ut.r~.V=.k...K.......'..........4@.....m^...y..W....x...[..[/.<.3...........}V....o.....Y0.jvv.[.u+s7,..........d...S'O.._.........~{..v......ju.th.....H7B.c.....*`W.....j...q...b.pW..?e8f.......H....W.^.....q.....[*.....a.m..p..R]...aPcpe...|..;qfe.r.X.1.&.....<...x..[[.~4.d../Z$"....`......n...J.`......~\...El.t....Q8j.X.Zi....Z= .*..L....h....XP....=.^...........6.}....w.y...A.].!L.zR\P.M.rM.j........8.....=p..'.nQ...>++6...58W....T.4Y..,[6v,=]..+....32......6F..g..<...b..=.?.(..7:.k..........C..s`.O.;.......W..x`.D.v!.j....6kBZ..........;N.mq..h.e....(.t..D....S. o7$..v.D.|...}F.^.> c...@..J".3Z"..T.:..v.?..}M^.> .....c`...'q.X.,.Y...C2y..q`...Acy.k/.q@...EK.....,&.....G..>..d..C.g....+..x...4P..Z_.b./.....\..P.`{. a..MC..(.0.p1u..v...t......>B..p.~.FnL..Hv..m=q.......4....2yA$ +.e.#-..q. @hH...@5.9#A.."Z....UX".....>.+Z...H.o.un.p.o.........b.....jc..}

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\48x48\download.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1519
                                                  Entropy (8bit):7.848203204634222
                                                  Encrypted:false
                                                  SSDEEP:24:kHCJOycJJIF3M6Lxvh/4LJ9DEIeDP3NhQ4e2QD0mpbFhjWIgjn:F8ycf6L1h/4jAW4sAg/WIe
                                                  MD5:C65B2DE683E76F0CC41193B3DE27DA25
                                                  SHA1:06EBB9E38DC11A07A39CA398A55DCFB1E85F5EDC
                                                  SHA-256:DE6CE90556D25A59EDE052F54B68E1C36B04E0C6FC34A01CA0895684471EB2EC
                                                  SHA-512:C69AD9F981BF9A5A9FF07889129B49DE861AC01268240F86B6FF2FFCDD01D1A3013C8AB54E8FE16A9D0E0276FC934FCA6B28E1456FEABA98CE8B767C163A7A13
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx...xdY....mo..m..L....m.F..6b.../o...wq..q.E.....X.K.........>.{M.x.7.v.G.4......._....e....N.AR.Z...`..x...xxr...4.~../..`.:X~..n.v..... i#!.....( ..+.....uybzL.G...4E1p...e..k.}8..:.&_j.@..i...bu....n...~B..M......"_...;.....0...q....2../uo.$?..G.u.lK....J. B...cAI.?.Zuiz.....G......O.X.....iM-o..e..z.{.g.<-.#........1.~b..9..&.?h(N..7.$....B.....L)@..=:.4.'..../...~...E.....3.x.(|H5.Z:.8...... .....!B...\..C......'@...P..`.<=..3....e.`......d..}6Q...X..Wh.S8V..p&o.......X=.<t=mw=...m.`.@.Gk&....T.....M./..o.......y........<.d....y...X..4.7....%vr..".6..XY .o^i.y2+.V.wy&.7~.o...[G.@Q\'2.b.R......e..U...ezX.2./3?5.9.k..*.p..2.r*...._.`.:..;...j.c..y....JUp3m._m.......J...Q..~h~F....sAS......q9.k...L...,..c...|...S...t..!6.2Df...PZ.j~ZLK...R.Z.+......m..XO.`(I....:.....e.68jX.k.(.V...H...7...8g)2.d..8...*.....8c^.x.....`....'........y....)XiH...N.p..-yADuf...p&~..]bmTL...=.iPSW..

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\48x48\downloadadd.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1901
                                                  Entropy (8bit):7.881672878420086
                                                  Encrypted:false
                                                  SSDEEP:48:Z5WJyDln+P56SmbIgbbq7iv8Uq5EPgWT2XlCmx3yHqtoM:/Wsn+P5hgbKitMTXlCmx3yHqtoM
                                                  MD5:A19F6B61C0D8D767FCAC997893EC4EFB
                                                  SHA1:8276380E8650768CD644DF3BD77C4DE837EFCA78
                                                  SHA-256:3E63ABEB4CAF4780D1D5B4D7FDC6FA0CBB831BA5401B543B092A1DD98DE12EF5
                                                  SHA-512:B3065D202DCF64FFC79CE6AD1329C648FA74019623BF1E1925BE0CAE0542B523DB17625AF504749DC85CA2B90399915D9896D632294B6C65BDBA2EAE908C3A05
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W......4IDATx...T\...{....G........"8.......Q......S[}..cf}...?.........R..<.]<.y..YZZ.A..133;.}...._.A....:.%.}....r..R..5*.n......>.9s AS..#.G...1999..........S.q..w...^..O..j.?....>[..!......A......k....^}@<.#.O...**<<.D".P#...5.g..M.z@..`.Yf......rW..W.4.N.."..&.}..B.@PP.P..cc..Q.F)5.)0.j..\Qu(.4..2.......D.:}..=...w.}..'...EL|.|...*_(i...w8!..(.Z|u...?I.C......aC.[o....C.Z._.......WxN..FK9q...U..Koa........`.!;v.x...k....r......7n\...s"....~......F.-..k..u.hg4..Q.x<..P(l...........___...........<==.............(...@{@..g..E.H$...........!ha...A.,.N.\.(m.iW.......>22......b.......5..;b.d0ddd4.....j...i...;p.@...i~0Xkk..}C...N...988...'...~.@7'^..2.zl...?.&5T[[{._~9..W_.....4..r.L.wVHrb!.....1.....F.z.xi......O?=.F..N.$...v...g..e6...~..A......Kf..U.L....+...!a..,X.....w..a.X.Cnu.c.v....+^.G..a]D...@aa!...C@..=..R7+2PH.$.}.qC..............u)tP...`...+.....S.%...{..Iq.$h.#l....o.."..].Q.....'l.)....SLd......x..

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\48x48\file.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):685
                                                  Entropy (8bit):7.612898091312105
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7QMdoMAqIF2spEEq24sAKF8R+i7M1En5Eykbtf3N1pL6+DgnL5hkeBSqLuV:GoMAdPpPqaAKU+Q8EnK3bR3NHQVhXBSh
                                                  MD5:FA12DDD61EDC428242293516F84D1459
                                                  SHA1:21DDEA8522835B64C52DF5FBCC2A16763E59C778
                                                  SHA-256:B654E469846083F157053C8CBBCEB94575AD5717A87C28D7B0D876157DBD710B
                                                  SHA-512:A3166B73F8908DC15745AF9278444895DD8E18A93F84DCBAF5FD8CE3FA351B56BDD8A5BC099F4960011886FA7DBA40003700E14949C5E2E6FBFC951388509BD9
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.......1....tIDATx...5..E.G._..gh..^X...... &GBl......t..s*.....m.w..k.I.1......~..[ .).@. . ./..!K../.|..3...n.....B.Y.......^.M.`..@.....}u..p.9z.S...-.+I.3..J.8..LJ.B......=............A..;.. ...\..5.c...z.).....pDB....Z.Q3q<...l.'...F..1.+..ZQ...p..PjQk......Ea...#8....4.I......T.J.....O0..4..pyL.. Q.....>.IBPD=.?`..H.!..A.|....32...bR...C.w.'.V7.p.Z.~..$....K..kYB.V8.{k.#...:.....Mr.....E...|.`0......u2v..#....?{..At.V..m......u..M......w....`.?2.o.9...(.... .;....O....SW..E.+A......7..%.51..F.h.u.M9.?.....6.)..d...N.:q.......j3Sc.$d{;[[kk++....o}.+...AM...9.Qtfnjjbl..,k...6...........HIR.BYD...o.w.)p.6.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\48x48\filter.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1896
                                                  Entropy (8bit):7.865475930800417
                                                  Encrypted:false
                                                  SSDEEP:24:ykexPmVOQmBQ/GGNMJtv9bR30mbhJUng123gSD8rPvHvsq71eZ9gPAHQY0UzhYAb:soaJtF2mbhJj10gHHP7G9aAFhYAL/
                                                  MD5:38C725C54639130D64B107192B0F9D73
                                                  SHA1:4B11E3FC85322C7857E7CCC1E3265053F90AC9D0
                                                  SHA-256:0E05CFD53CD5AD24A9752CFA3E7B62532E107B5892E171264DD5EDE862BF955B
                                                  SHA-512:9BC3878856B4FF1F7063CB8811E6B011905FEF912E81226F3BC858534E9A72585E5584BBEA2C394B56EABB31A70730D777893B454142C96BE956A70461087FE0
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W....../IDATx....#......g.x|afff.....X..?.#....03....d..Ti...8.b...==...z..M....'+b!.....$L./....r...VZ5M.."".r...!....8.....k..^...O|..................G.....h.~.#>......g......N..a|..O.i..mnb8..:q..Y...B.Ng....Nj.>...'.y...w.DQD......o...n8s.....o.......w?....O-.cx.eY...]I.,f.ZH.......#....{..p.v.mn`...x.....VWW...70.Dd.S....]h5a ..E.q.3.|.*.b.S.ZZ.M..L.t.>.y..jZ.......k.#..Fvv..s..]..#....}.[.E_...[o..^..i.66Pgs..8...<.....*Au}@Q@.#.?N......#7o.)d8$H...p..#...h..MS...eHY..5b4"`,...PE .Gi.....dc.*..v..#..&...(.G..3..!$..r...FF.8A...u.....?..._.&..........(..,b[....APAT"i.v..{ 7 ....k.......'?.i.)..3........J...@..3..7.e..J......5.EH...&R....f..op.\.I..D@....... DC;...^.|.....c4.i..*5.-Z.....u.2.8Y.TG?e...a.XCt.a..&.n".....$K[.m.)BI.9.3j...P.4l..cq.. .=.9..ED.(B.. .........._.".0.$.."3z.TFC..c...F.1*...qE.&.Q.=c...Y..(...D.F,..2`m.....d\el.\!...E.qm...-....(...4...9"a&.q.&.7P...Br.....FE.P..Z...y.4.eYz..g ......E..M..

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\48x48\folder.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):2274
                                                  Entropy (8bit):7.878635274584875
                                                  Encrypted:false
                                                  SSDEEP:48:KEJybCXTLt3+dljO/kg/+WDtjFU09XEwrIHt3X:XWgTLt3gjOcghJFSwEB
                                                  MD5:6AABE6412E6F1C85F6D72B5D4D2C3D04
                                                  SHA1:4E98D95F100036330C3C9F30FE64713AF060484E
                                                  SHA-256:64D6AF2EB4732DE739FE438D981A0EC0E09D6BDD89BE0FA6C332A009ED0EF5E7
                                                  SHA-512:CECA624FD26FD9FBD658146D1EFABF00200899E592BC0CC0F75D828267F094325AE3B89A1D205E0E6CACFC71B9F1101A33DD039BECF1BA5AD688BC972536D4D7
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx..Z....l....c.333333333.&.IA......c.[f[....5....0...#.^uk$..u.1.G..?...........k.../z...%/..N.(.....#...w.k.;....a);.6b.G..p.. ..m.{..Yx...W..|.\.b.Q..r....4.G<....Eq1.<..O..79G....@UU..z(.1.1.../C,.Ac.(/."...].vM...:O|........}.}.._=.a.9lQ=d{N...u../|...}......).4..s..!.?l.,.b.D.f.=........Q...\*.|.#/.......N..1..O..n..8..c+....'O.....oa........p....C.........g..'N.....,"....B..Y'd9_2n...+..."F./U83;..!.[..........{...K.....fO..7..7.2uVT.&.zO.D. ..u..%....\......d..I.. ...z1.....K?.6.......R.....m...O.8.cG..*..$.W9T.....T/R;9.%N&..g..a)&...Y...4..g..6..+.kG.p.qk......:.........I....{.x.[...1...{.l7:}.4.l.r]..4.}9r...S..X8.<.<.zk.......B..W.....E.sE...Z.Z...0::za}.X..sKu-.d..f"8.k..*...,.3Cb$..A..=..,[vV&''1<<.....s.........k...5+`,fBD...#...E.r.H..\j.U.........XW7.j..#.L..k...6c..6.&.sY6..........3..g..FNPT;.....K..:..-...e........100.....9....`]...G....Y3)..d.v.l.m6.....o.wYr.u..'..L...k].`

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\48x48\folderback.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):2755
                                                  Entropy (8bit):7.90499974479559
                                                  Encrypted:false
                                                  SSDEEP:48:Cp5Jv2A9UP+0M8Lq//x1ja9e93cVtLJslDFhTmQtJPqWqccGT15imaXbisaKD/:89UOx1meyVl/eYWOOvcXbNag
                                                  MD5:FFBA5ED86AA6CB1FABD91CDF29C7C818
                                                  SHA1:B781BF186534381A0CCF582BCA1ACB033B83BB87
                                                  SHA-256:44B981A2CCBB2D1F53D98B667D103847E5D7C2B91124C01FBFB4B86CA666F633
                                                  SHA-512:3BF8A5DCD8830470E3883974C500769137AEA77F0816382493743478B097C86502C547DD63D7EB57487F9731387FE5453AB03A3338DAA6EC38CBCC39DDC56135
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx...t.:.....p.4...13333333}........{T.&.6.'.....9O..m.gVz....\.H^.).......o.-....G.}t|......k{.'......R{..Q.ym..v.G)5....R.&......RX.1(.c.SZ.G..Z....nF:...C........>...f..k,.........<7.MJ..q...(....#.Cg;d.p......#l.r.Y.6."Y.xq........[WoI.Q.O...........|s.....Z.<.@~...\x.-.|.f.%I2mk..cr..&....F.E1.{.p.9.....T.Pi...k.......8....s6RJ..(.....f....Ks>...L.6.........mz.*.~o.Y....$..nb.SN..d*.&.B...S.1.......#.'@.A....#6.6#B...........7.tSO......._72....h...... r.e.j-...._..Ji..A;;.X;..p...$P.......4Q.\....IE.......v...@G-;wu.c..UD."..."E.r.j.:..A..8......J.W.].8...d..1.....v..j..w....@.............V..l..e...{..r....Gk..4*.JL.2.@.0........u..<......_FP..g*.Z....sb.*^=...p.....c.qs...o.R.8..d..3a..2.].......M. H.(.9...k..c9.........}.{.f..1Y...V..@9....31.b..B^.p....Z.... ..d,I..3F2......5..'....,.....%...Z.t(+....]+b...9...R*d#..".;......`g...8.A.+.}..R^....yo.}.Ljl.}+FX<......2..wF.l.0.....r..<...8

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\48x48\folderclosed.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):2051
                                                  Entropy (8bit):7.871635597132971
                                                  Encrypted:false
                                                  SSDEEP:48:ngWlLIHxtIkGCkX7e9AJH+smGk32e0vzWP4:5lLsxtgp7e9AVkGr24
                                                  MD5:E419AB77F821DDF38E96462F4CE29205
                                                  SHA1:9968A99FABE819EA79A3D99F8CB57E0A2525388B
                                                  SHA-256:C52236A3209DB62DF4BD68CD5B305C5194B0C7B0249BDC082B7327AE86E59B76
                                                  SHA-512:05EB4C7C39609B6072FE8F12CD423D51392FB0DE7C600228068C1623D8673A99AB07B379143D9BE88C96EA78B052232F5A7E8D2C6CF845FCADAC925242023479
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx..ZUt.8.,I..........w......}..233333.>..M.W.n.&..f.W.6u.............\o.z.W.q..SN9.&...3.............q..?./\.....`....n......a..............d.a.2.../....../!....|...U]...s...eYRUU^8.I..+bL......hhh..1....,........9.|...x....8..'...-f...g~.../.}..kX....$*Z.w.C.......].....(Q..s.eU.q.l..D;WH\...........u+......{........../...s..W..(4...&Z..C.)c.x..v.[.".....-..H.....n.........h...L1v.C......P..E.P..e.(+.....\u....D..*.s..m....2.....[....h...2.....O.....bnb...2.bry.V.FD.......gW..u._.@...c....E.1H..Hv,..!M\.HL..:...Fl.......b@.....'F..Z#F..J h5%0i{..*.66....a.00.:......Ly....$.&a.'+.,Z.5..x.............A....=4)...Z.."I..#&.....`n.3ye5...........V@..?.d..m'.k.E..6..jh.K....,....w...u..Dh.@..fNu.f.c.d&t.;.~..o..<.W....lP./}/..oW<g.&...H...mE..Vs.$r..DM.-Am...e.h..#.1.\...U....5,P3..r=.z=....t....~.CYDV..y^m'.......\[=aMV.'.W...(.....1<<|...'....&K...:./..j:1....5....&Z.F.0..i...,....e`.pF/.'E,'.j

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\48x48\folderup.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):2871
                                                  Entropy (8bit):7.90233796795438
                                                  Encrypted:false
                                                  SSDEEP:48:FWLA9A8OSnRojr2uaEARirKRBghPfvGYq55dRqjdcSdD72c+/2DGi8a/2GqH4PRU:FWLA9lfnu2uHAIrKghPfvGHRGD7J++De
                                                  MD5:B258DDE4C540BB7CC02E285BA60AC811
                                                  SHA1:296C63BD4D4E462B99DCDF53A68DB3CF569CFC9E
                                                  SHA-256:44F1AC82B6FD4372880C553814D84579D33DAC6B87A899957EF963B25DC35BBB
                                                  SHA-512:48E9FE25AB5B32EB0AB93EAFCCC7B6FFBEE7157E31DC30E3F01D219A4BAE486E94AAB2F9CED1B3EF4444DF9DEDB642F741077945AB4DAFF9458D531E79DC7432
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx..X.x...%..m7mR.+.q...}.......|.....)e.'.d...+..J.a...G....Frp<......[.S'..G.c........m........5Xc7.zQ...z..2..4.....F....{........Z^`K.~.......1....g4,Dwn...c0{.g..._.}iKC.....}W....W.G;.al...'.-...E<.y.6..s./@U}......./}g.6...X...U..b..Ug.....U?.k....x..N4U.......7@dO...<....,...1W2..9..,A.u.!.8.a...o.v.Y...^>.'w....B.MI...e.>..|.]....12..e.q..b1.M:A...@.E.+.P...R.A.]..;w...w!...`?..O...8......X.6..K.k.....1.q%.t...6..8!P.M=.S....1}.E.p....%.:.0.E..)?k....'`...9.e.A....I..7.;[C?J/.(cLY....D!. ...]......8..y?.7w008..d3.r{1\.R.......Il..;..D.S)...y...!.4..j... .L.....k1u.]gT.~..*..9..'{o...#.#...)..c.k.tUB.......Pm.!Vk.t. ..."G.!.....-8.OWkG........?..cM......s,~.C..Tu...y/..I{.L....^y.l......sb[...R.....P..!..Jm..}].q..V`.......o....../.=..qi.~..zn......9.X......a....`.i...jT(k.....[...U.e....k_.....:..d.........M.0OV..;0ez....j..5.X.c...5.........|Tk#Z.....H$.I.......V3.l3..

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\48x48\help.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):3135
                                                  Entropy (8bit):7.91902628576473
                                                  Encrypted:false
                                                  SSDEEP:48:KKBehCoYIdaWcgw75JFrbHTohEk8S1JIT7OK55E8MUEHpLVFpyOOz/SyM85aRe4F:fUhIISHUyYHITjEAEHpxVOOyMKoF
                                                  MD5:F1A152170ADF3111FACA8DBE8397AB4B
                                                  SHA1:6F00B7BCAB6243E2E3EAB8248DDB5A6C61D2B1E9
                                                  SHA-256:6DD5105CD1B810F2753F990438EB50FC3A59CC93DADD714AFEF9B06AB6DAC970
                                                  SHA-512:296E9EFBC64ABC16B0696C26225C8B6DB45294D71EC39628242A8F6373319354195A078834165DD95A418D432ED7209638B5E2D478E3A515A8502AC9A35C7A58
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx....$Y..s.Um.pm....g.m..5g.6.i...2.=...7*r+k.'....=...*..#..W....r)..X.........6%....=........*......8.#D..h. ...0.....$\...r!......!..C,`.%..%...7..Qmpx.j{..(*..8...f,..&SaM..f.-..+.......O3...S..s..p.%}....(PD.T...(X.T...~{,1....L...)1.F...wVO..0.r..a..=...7.]X.R..5`U.....O3.,s.U.VM.<0....D&._I7.V}:.....^.....f.3..M..0x)i...ZUH.+R3b..Pf...X..c!...L......w1.-.....K.A.V".$......5t.....3F..".m/k..X/{aMH.TT.rJY!.....G.6RT.,K.O.SY.o2P..Cvi.......V.r.....\G7k@.@..%.T-..y.K.9$F.@....gB..4;.X.Z..Ubg..u......{..T ..88......._..:H....p.\U}.._AM..5.od.L.-..v3.lk&.....?.k....b.....]m`.u.A......S.......~.>.BM.8X.rXWY..)>1..g... .4.....s...8..8T..w.J...n...."~7<.K....Pk........s.tN.@.z@G.=Z..../....J....].Z..xx/..I..Z.7...%.Y2..x..:S..JKyK.X...>.b..7...G....U.2.K.KU>...S......tu....3.$Yx7.}{z..8....0.(.AM*<.)|f...(d...Z.)h.....Y5..........t.y.....8...m..0.*K..V.,....5=........h1..%..k...m..

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\48x48\localtreeview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):2547
                                                  Entropy (8bit):7.908095890900794
                                                  Encrypted:false
                                                  SSDEEP:48:fTLVnfuSnUFPcNDhzr/E1M6A7xYJWWZbBYMJdJGTLsNHAfHcDogMrUIPSPIFEUGy:bL1fRnAo/E1M6AipdB7dQcH8UCbGRAt
                                                  MD5:F2B7DA842ABDBE79311B8601C5C3C4AA
                                                  SHA1:3352B3AD0FC6E7A01C9CD88F03689DCF210538D3
                                                  SHA-256:18FD112C1F3EA512EBEA7AA1F8A1AAAAC1F319290565D0AB3167B33421B15783
                                                  SHA-512:552C244077959125A36C3266DCE652A84623B6EC13BF5173A28EE7A3B3BCFC9964BFFD3FD3C25817F1B3F4EC703F4C7CDF042A74975413C00787586BDD9E7B87
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx...T#I...{.......A.........].....~........$...C....!....*...i.:D..?......C.{.=s"%E..(*..1.....wuv....4.S|..:..[jF../.().3ZU5.zD....'..K7o...k.......<......7.\=......UVN.[Y."}E.L9.B..6.........c.........U`.E....wiuY.c......J(......q..R....2.....s.LUAq1H.:_.i....w..\..S.a.8..V....s.j...Q7d.K.E. hXts....x....B...5.v..hn.......<..!.8...UW^~l.0...IT.....k..B.g..".h.......!.(/EI.._,.i..eEs[.kk.o|v..~..t..n..#.S....!xCww.c...s...B26\..m.....i..~..K.s....i...?...:.{C...>....F.g..1Z...8.~m..d.0..S.y....x..%8..;..[\..w..him.X....)4.....B...L...B.He.**lm...p...*...i..i._....*....._..`...$..D......L.0..b..f.eY....U^.pKe.tZ..?.tE.p....Jqze../.n.&....f-......K.......=h=....`{K..k@T..+...B..).....m!......TZ.<Y.VW.....{.wgRicB.2..}.eZ`q..P.v...$..O..-....!c.jO....8....Y...KUa.S...6..a/......ra....D...._.A......&..r";...F.{KJ.&.t..U.#k.'.+-.....[..'N...S...#}....p...G....d.{.3}...x...G..bb.N...y...})..

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\48x48\lock.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):2178
                                                  Entropy (8bit):7.884905660837002
                                                  Encrypted:false
                                                  SSDEEP:48:/G0Hhvsy1lSA+/KYuyoqXpYqNjFS/w9RNtZfEbvcMIj6sLiwX:VrH+loW1tFS/sRpfMvBa
                                                  MD5:E4D56043A101142B29A04667A8EE1707
                                                  SHA1:727A1248A58D11A11638380609E8D370E4FB27B7
                                                  SHA-256:6645FB53F2195FB6B1693AEFCC5EA21EA7765C189D42A2F5D9708A300C58E07F
                                                  SHA-512:2AEA3D40E1FA37D128051A0436DB2105FE6F4431601E50A0B908B0BE6CC74F2043EA1CC11503DFD4B347C73121CA945ABE0130990360F4004DC792DF80FA6AA9
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W......IIDATx..Y.l$;.}.{..a.......,8ff..133333|f...0c.4..&..k.Mv._W.....\Uv.4.Zc).1v..53H...]4. ..%.@..555/+...llll].n..j.|&..zzz....".t.E.....4.y..F..y../..._..7.pCz.....rH....#.C.A...a.....>..........|1Q.U.......7....={.`rr.D..R.4.PJ.!.....E....x.{.3.._..V..sh...\..._.f..^.................\3.kv..+V....................mO.....|.3.y.^...AymH..1..l.s`Rl.M ....~..'..S8..X.Q*\r..^q....{...!........E__..b.....I.G.y...G?......'...:5mmm...~.F..8.a.........~...-......T..t...h7.m.uk.i......#ej.b..x......F.~g...`?..O}..o..-yJ......-.<..k.<......jz.9g.u._....5.m...`.|........A")D$.D....NN.o..,.&..K...p...P.c.....O...W.......t2...|.E...j..wP.......L.KZ:.B..Q.Q.....'m..........J.....m..h.....6*..G..*.....%o.R*.BSS.......5..`..&cr...E......ltyS....f..f..u......s..{....5$..&..x4.....(.B.6s.....6..d.....r.f`...%;)..6....1.......E7;..].$ .....d.........0~...l:..@..d.b.."...D@.}k........-W...1....{.y.6.......rQ!....i.......l

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\48x48\logview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1806
                                                  Entropy (8bit):7.828845708925566
                                                  Encrypted:false
                                                  SSDEEP:24:mQP8CyETU29Vo53vbyBlKdxMBrKv8i2tuVT43vlqbJ3gYRst4xosHcHot4dQHlAn:mITT9Vo53vbhKb4IvRYew3SvSltd8b
                                                  MD5:75FC9278853F1361D2538531CBBDF467
                                                  SHA1:0CA385CCDB33FA883B392C749BE14A9865E2D4FA
                                                  SHA-256:BE84A32CEF2D89E6DB8F055615F7E37B0EEC8250AA503F93B29985D573877D45
                                                  SHA-512:9E7039F5444FC90723972C67C33F656EE1E24A942B1E9422A1926563D570A746CA69469088EDD651FFC28A99ABD3DA1716101F917141926363A64E89995B78DB
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx..Y..+Y....m.U....ui.o.m...l#.=sk:5;......W.T..7....:...d.z....M..:...:._...x..7c....F..AN......U.V.}...........7...-.P.lY%::.........V!.-yjYDvv6...R.2e...T..J.... ..^..p+....B........"....>....@....O.0a.;......8p m.E....^...6lH.D.7..'O......f.U..FC.....(//...;...@.i.sY;r.H....a.~aa!..........0{......0."B...Va<..<......).........0..z.m.Q.M.!.B..3..........!.C4../].v...K...|/....i..F....bl#`.p.O....).|/.~........>}.q....xOj....Z.._|...Y..dp..qj..o)....... L..\F].a...b..b ..Nhy.........@4U...~(...g.R.V..SH...'.0^.Ul.e.x.b)...............r..._...H.8.P......."...g.*......<...+63..+WN..Fff.w.X".* %%EK#.".s..q....%8.U.V.,..{...)...b.}.p..."..`.8.C.w.y.O~.....S..D....s.,H!.PA..-...E_..Y......S.......(....>..{...^A.....0EQB...y..~...X.C.E8..s"1~$&t..j.Z...u'...5fa..F...8@fa'..a+.;. ..#..DF._...._..J(..F..c.~...f..&...U....{.F..0.{...3g.@.E.WQU...O...L..*...'O.`..Q..(....jC............[.*T.....0.....c.

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\48x48\processqueue.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):3527
                                                  Entropy (8bit):7.925284146947221
                                                  Encrypted:false
                                                  SSDEEP:96:E9WEX7k3OxbiSIpGWQxkbQXeaulFyVE6ztPSPeL/XWMM:E9rX7k3OxB9abwwqzmMM
                                                  MD5:23FB03E96EE59D6F8A4757CE5959970F
                                                  SHA1:DC479D457E98E954C7F44AB0E2A31D6122306014
                                                  SHA-256:4AAFE95357E4147AEE94EE32F2B7FE9BC63EE587CDE4589BA775EB1B83D817B3
                                                  SHA-512:4572B19DF98FE6CFEB015212186EAFB7585658B61BEDAD7EE5772FD466EDB75BFA5770DB0E7B987A743002E4C4F73FAFA6097FFC3DE07B64D1C9A1C28DF86C3A
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx..Y...G....a...,..}.f.33....w........ f.v....~.......xY]S...3.2~...1.}.^............S{s...J..D"..u#.B.4C.A.R).<x.w.uW.U..7\...k........W(.G....6...A.g.?.qB.0B.W..8p.kw.yg...m.N.(....L.}.Z."..H...Q.$x...]]]H&....?.>.k :u..SG.P.\..5a...}..m.}..d2.......;....=w{f.....tB2.....'.M$.z..+.`........,-..q.-k..}...d.|..k^.'...g4..f.d".Q.[..:D...,..bbb.FM@.....D..k......H.a:M.V..m......Z...E,.|..*..'.`.p...VAF.v..#....f. )"...(3...8...4.."|...A.....4C..#...B.2.V.Bi.. ..f.B2..:.EK....h6.C.*.Z......O..O.o7k..M.?.C."....yM...4`.........d..C.........JR.b.q..b(R.G......0.B.)...x mSD.5.....A.X.....:.8......DP..;...d.L.."m.,...o..F#`.....5CD>......".UeX-..?..l..f.'..:!brAs.2P.B,..#...4b..p.{.oJ..l.u^.r-..w .EXP..c...y....0.{.Z."..t...T.gV;.~......%.u.....|%....\o...W.4j...%.G..l.u...0[..M....@'..|....dfI.xO.O..e...?M@.)>o|lp........m..T..l,...[R..{..........Op.T.....:..C......p..........h.3.,...\7... 4r....Ed..F.\.....o..9q..

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\48x48\queueview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):2929
                                                  Entropy (8bit):7.910852764112675
                                                  Encrypted:false
                                                  SSDEEP:48:sGcRZ5CKD2CDpCzh2+Eb+40Pw9sgNh8wif1/2bkjfhvENY9iIoJV7:sGg+C2CDpCQ+e+404jNh8//Rjfism7
                                                  MD5:8BD443E6CE5E87FE0785125E4A010205
                                                  SHA1:B35F8456CA74E0D41D12290018E904616DF4AE73
                                                  SHA-256:F34C3F1F1B431F4C957B4352A5869ABBD638196FAC57B18CF8E259D88C11C370
                                                  SHA-512:0CBC3A3C9DB428EF58265993D578ED4B9CB7482BD7AB81FB3B9218C74E41FDE085223024C6972C4B232ABF49C738636C4E6000750DC8664AAF981B6AEF82DCB9
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W......8IDATx..X..#..=U......g.m.m.m.~o...=F.....:.Z..|..uJ....}.....'...w.8..o.....>6..k2.Q...F&.1.t:m..q#...a.n___.w.}....[v7.u..'H..K...i.51y........M.Rf"....^?............:.../.;YBK&...G....,a.4....Q....:..I..z.h7.=.#X..Kh......f.[....[......,S.y...I.T.%.JI<E...i.'Y.Z! ..o~LKGg..7.|...).n.......-hiE.<z{.F4MS:QgGG...6l}.)....nR......T....*.1.>..3f..3.0..S`1..]Kft..e.......Gp...a.n.8N+..(H.=...w..{.....s.v.&.........`.8a.D.# .....,..#.....HM...l..)%...u..g.D)..>-......n....<q=_l....,.`.#.H@"........*.n7._.o..t.!....X..y.......$..H....=.!z.F.....6H.:......'<......7.....*...u..*.&.......4xz_..ucS...1.|.....o|........V.....r...p...m/.C...C.8..`.p...D..{..8.V.$....<_>....s,..:...Mo.L0..B...NB%.J.....!...dU....FO...d8.......+......^.<I...$r..R... ...N9...'K..M.]NP...0..0D..s}.:InR.@M....m...6....]......8......Y.^ %.`..ih.....0...A*J...Y.fI[[.'....j....i..ygGG.Qbp.`l;&....$.....`n.C.....>..%)..9.....z.9..z_..

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\48x48\reconnect.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):2545
                                                  Entropy (8bit):7.901420527012787
                                                  Encrypted:false
                                                  SSDEEP:48:XduFqfnu3axVrJG7QDZCxjYk3WzYq1ev3WkGO6XciFdVqTCj1Inwt8lIL:XduFqfngUVrJG72m3Wsq1eeVYeOTCj1H
                                                  MD5:22FB3B44DED101C8FAD11A7C752DDA8D
                                                  SHA1:48A677C1D97810E0C41809BB4F66E3C1EA462E00
                                                  SHA-256:8BE9B0F22FE85B9679EE83E808CAEE2E2B4C009759D838F5BF4E377343326E2D
                                                  SHA-512:FC8C9ACC691E104E4EB3868CE0C648ECA51C28EA3A182E20D5640DE8A8ED910C7989C86BE36CA08C700F5562E6B157C2903EF0033AFD22A430B2609018029D9F
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx...t.I.....0g..ff...6.333333.a#cH`ff.%Gf.....7.....=..z.3.TW.7..20..........u.2.l.'....7.}p.7.<.85vicW..M...+.mb]a.O.&SlOS.-.I.Z.....%*C....A...X..xi.q/q'..N.\.....wA7I.....+.z..........5....._.........w.+.A..`W..2.6.......O?.+.....l.S.....i...CF...vEn$.......<GL,wML.z.R.v.,?.g..j'...v...co..x).4+.~.e.N....f.....bu........x(...KI....v.m.q...|7.h...vzQg.d........h...Q[."U.6....(+.*..&....?....8.7..............y..e..=...gT...^..N.I..K....@.#..NK.x._.<.O?CB.....7.........9...X.8.R'..e&`..x.Gx=.h..m.n.I..f....S....d_....<..G.K.Ts*}*G+...7...O?...+#..W.....Q.^..X.."..e.....:......L.6....m...a4.s"'.4lS/..>.)5y...s..JoZZ....'lQP8.?......y.......g.-d..pp.......|.4...\...3...b..w....y.}.6.P..I.&Bd....9.U...oTs=.....b.~.h9...v...*.p!~{|*......X;.X`.o[...|.{s4...a..O<N.]..Qk|%..^&..9.Y.-.....m.......s.RXck....H..../..Q.c.r..]AO.X..U.....C.._e....q.2.EN...!x...gb./K(R5.D.A......1.c.x..a%../.XA.pl..QK..1..`.

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\48x48\refresh.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):3285
                                                  Entropy (8bit):7.929718501382609
                                                  Encrypted:false
                                                  SSDEEP:96:VBE8hPRCXYbD3wAuNM9GHez6rUM6q0ElBBcpwH3:bzPRCIbsAJGHCsBBcpm
                                                  MD5:7CB1973BCDE7A5F231FB826668649684
                                                  SHA1:20A2B67270C4A1E5B1D8F3C0519195581C1FD5E1
                                                  SHA-256:39941E1A7D07351E19435F072667A81548B7857F11A45363F516EDEB576C532C
                                                  SHA-512:542F5453C9E24998403400A7AFB3D4358C313AF06FAFB1BCE9AE830B9FC4389B9A2F872A08A16BCF64FCCDD2F5CF390E462DA741CE6FE00CE0981B4ECE17A626
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx..Y.X...~il............1.n....h.n.G...C......0..<..5.h..x...{.>._....z..K.M.J...^.A..`R...Q.4..F.)....0...{....3.zi.....y}.:.....5pS..s......wS..........+.1e.5...tx.:?N.1.K.!....T1....@.m<.(..YaYL....1......+|)I...../...l/.....'g......7.,..Z2.h.O..>.?.=.+..V8?|B.6...!.sAp..*q....W.....pEa..../.E..v..$..:g2.x3\.CoG.m.4pJY...5S.....f..fS..X&...p=u/.NX..............2..Kx.v.[T.0....m.?:,...h......`.?..}:.....9.^a..m.@.2...............f.Xs&.......>.~..>..&R.<.I......uXra.C{.l....................'....W.E...R..L)..f..?..n....3.*N.....m_:.,.}..G..P-....l,......_.C....3.Bt....v..p..g.....mKG.....`Z..........#<.~}?...#]N".......y.J..~."DO...%.]...ZY...p.....uN.)O...(.\.......T8...Z......l..m......q3.......4z..4..uq>..^............j...}...|*..O....$.V....2.s..<.p....o.p..@..........ro..K........R.3H..?..=.W.bZP....................oH...."...d.7.^...gBi.Da.;...::w6i.x}9.~9.."~CV\.+}R.u90..h.....b.W.}9....#I.4+.

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\48x48\remotetreeview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):2283
                                                  Entropy (8bit):7.891705771745528
                                                  Encrypted:false
                                                  SSDEEP:48:wYIdbZuw+9RqJIe5/uKnHVZRkF2YN5pBrzEdTpB6b46WEt:wv3uX9RGIe5/uO3M2YNbBrodT7IYEt
                                                  MD5:25B263DF6EB6B2D3FB2F68FD71738759
                                                  SHA1:6CCACF3F6E5F8457650B256DDFDFB8417D11483D
                                                  SHA-256:D5F1438E45C40F4C064F0A399D418B09B78858F366BFFDCD2EDB906EC4CC74D9
                                                  SHA-512:87F50CB1BD31DD28A4DD2EAE9C74448DD19003526309998CE5F1A74ECDBBF98B2D20113161697F6290F793152DEC2691F32C07F1EE203D95AFD9A02B05CDC8CE
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx...t...F.$...233......}.......2.+/.....-.<Y:>en..w..._k..G.Z..9..#..V2....$4O..r{...|....n../_.m.]J@l`:.....e...iC.{.}...K.9....!D>r0.s.k..eT.M...a!..8.........|.....u....|....p@......T..'p.q..Xa4NX......v..jz.<.|.#bC...>.._..G.................../OU..NR-.wR......s.....m.w}..!.S.5 .....X@....B.....yN...uw.......?.c./...'......V1.......0....h..<....yn....|-7..4..{'T.. X...."......J.......q..x.}Y..?FW..#x.Z....g..O......s........*C..t...c....]fW...-...Z.5.h..X..t..4.HD.$.'.>P.F(.....N.(.5...*..#R %.d.J...v..puy....!q...z.`-.......y.2?...1..S.1$.(. ...$.,.x..<X.........$.k..Q.#.8F.F....L....(..)K.x.C..f....l....Z1~..&l[...v.....Y.....Bx.Q...y...+...Zf..|b..5..4..8%..rE.N>=......Gj[.....9.......T.Cy.)..z.. ......><.... .........=.J.......&.......pF.....L.F.........<..3...L.q......Q..7....A-\.:..]..I.`......[<..@#..f..@.X...u.K..;......z..)2N.r>..W.c....[@6W.....|.gG..' .l...y.)...L:I...T:=.+oZz.q..w3.!.u....

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\48x48\showhidden.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):2702
                                                  Entropy (8bit):7.902295721424778
                                                  Encrypted:false
                                                  SSDEEP:48:GkRJzZBYN2cHvcNkm01Ta8bs0VSR9nGJz1vf3T9pogYhh5/Xgg:GkRJzZBYN/Hv/m01TPbssI9GD0hh5/x
                                                  MD5:3E5B63CCEBBABF0C4C5E370B2F8697A4
                                                  SHA1:18172CE6405F32879D4F2858BC906E9F847B2CC1
                                                  SHA-256:2D9F1C42C7591532F6D182A683A97D9B23AEFB2CE6A46178BC1E5A48634BB375
                                                  SHA-512:7A8C9DDD5F45170887BCC39D038E3AAC9965076FFCA801B26449D819768A7C35EA6695D40BC920C1794FDC09C245590649A8C587D916276D4DF0342611EA21F0
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W......UIDATx.....I.E_5H..3{..;.efffffff.]..2.......8<......Q1.}!....~V.....0...?...P.(`..!6...l..$.$...yS...@..].=n....=..'.....S......4h.p....4....?Y@i.......CF........ .5uuuX...1G...3...(.....=.8..5...D.,.b"`..........4...%@..?.h.~.dm..\h.I...O.W.^..8.L..7.H.P .c.N.JII.[m.....h.....1q...[.....RJ.7/.--..=...s....o.......Y..~.i..O....?..6) k..d..w..S.N..R*um}.`...kjj$f...k...3.R..W.g....E...;...W_.s.=...v1.VR..L.]3.]^z."...P\hq..:....\y.kL1..nP....u#..~....+..X\...\$.......1.,...?O..Q.?.?.5..'.l.......W..:....e.sZL.t1e8.Ga.`..AK....'O...~.%0_=..#..g.]...7._..So.......O<E..Q(....D..!YY.O..K~....<.M.d'...X.t......\q...8.~.W..o..s..g..QJ.........8...D..i]wx.JH.........bO.....5h....f...[o%.kF'R..........b.T.C\.....3]M@nV.V<..d......q.9.@.....>NE..Ks.....n.9....lsSN.....;.x....../......M>9{.._R.oO6.......Zk(D...i...-............>:....*a).Kvb....:...h...P.(=....q....K7Y.r....Y<..%.w...4....t..Z:P..l....+..c.N|

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\48x48\sitemanager.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):2626
                                                  Entropy (8bit):7.905709801224381
                                                  Encrypted:false
                                                  SSDEEP:48:iTXxaM5flG7EDs1HLqrzj2vxVxkJWsCwyLE8FEmHsnv0SaG:iVaMFl+MIH9/kR51tKXpG
                                                  MD5:63F9C7BBA4EB213149B29A86BE75D8D5
                                                  SHA1:91A6570B2CB2987A2D24CDE499EC4F84E29A4A23
                                                  SHA-256:78CD3A0871C8A138863528DF4DB173014BB86EC49691D4BC771D19589FE270FC
                                                  SHA-512:2EF67DBE4C76F4773C8C8A77691A60328430A95911B8704CEC59F2EB451116B5D8EF7738D3FB0E33F551B16B064C9DED5A6FCA7CBEE1B25D78A30BFFF8B75898
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx....t.9..g.fN.b8.efff........k.xef...1...'...........[.M..3I....V+;..{n.Z...(....Z6...=...............W;88.........R]XXx......Z......wrr:.....;.T...J%.&55..}.z.....U...+,CBB....e!.....n.u..s..=...g!..._A.~.#...qLLL8.u.C..>}.t?SSS.r.|'44T-..X.....>....}}}{.c......l..Q33...;'...........\.ti.... ..q.F$.@@" .o...W..r.#i.V....".......w......:.DFFv.:=..Z"@...x.......KJJ.-.....x.'-...H....(7,.#....../....|..'....z.d....4i.;2.......3....LKK.............ooA..1.w.O\..........~...j....^....,.f...A..*PTT..O...`wSj....B...>...I......6..`._..[..,.r.q....R..-/@..........$H...'I[MM.N[.o...~Q=..i.].... Szy....cm..q....;......A..W.([..h,.........+.'F.".......1..e..%$...!~...I*...* k..h..............H.....h..`..i.'..]..A.2.[.$.Lj.......%...[,k....3V....b.Q."..T8....4M"..K')--.Ey-%.@.e..V.K..........b.}}..y.~.5.1X@ee.x..Y.~...D...w..:w.8}b...2....b.........\...+..v...Z..._3....P.,".5..[...2.r..v..0.....6..#......n.J.

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\48x48\speedlimits.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):3435
                                                  Entropy (8bit):7.917337931066047
                                                  Encrypted:false
                                                  SSDEEP:48:Yox/a9GEUOneOPoIqfBe+paDU7Z5yOMeHC8MSJYYUE8+bzQ6nFS3uYLcCJrBRWcT:n6UOekQBeOXyAHCIfUkQOwOUtRWcT
                                                  MD5:C32799EF0D36AD912646A53FF6321C4A
                                                  SHA1:416045E40104628C2D097F62D3BEC6471822F133
                                                  SHA-256:DEAA01CA5C552A0E8C2A8BAB044E2A680B752BF5A7296D755217B9B5AF290047
                                                  SHA-512:D54E073B28438EE3F1E7A1FA860E51EF872FFF35C1FF768F4B12C993110B34DA610F3CE97C311A3BFA94CA27F1B5E223A8093B46A775C4819D902B0EF76DF865
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W......2IDATx...ep.......#V...3.(..23..e..ffff.\F.03'f.%..0.....k...U..{x..........$...?..f>.!..|M......a...b.T.R......!...e."..O....qJ...Phi..."."...b.../.=.....n&..@...........).._.[.|l....>......4..@...@......D....^.0../...>.h...Q..p......'YP..ojj...w..n...2.............5...9.eey........<.....ut.S...X.w.6.=...5.0.s...`.9,....>.+..E.'D..x..~.....V....6.i..7..::.s..$.i..6X.....2q...o.56.EEE..J.....i.U$.J.w......_....[[....x..^i}.m.m<2.....~..o.....ts....z.&.....gW.m.D.M7q..I.B.#...l..../.2.[.rC..._..)...O.QF..G........[.X...~..........?..f...%....<.n:.I.e.......dE!\.....z.........'...G.C.f...7..#.....J.]%N..4..}.HZ.M....y..S..i.4`.-.=.\V.Y.9...|......Z........_../......_......+.$....8d...=.j....p....@..f....U.f..m....n.u........z.=}\.drNb.B.!....r..U.j:_~...{..f.p.\x..P.#G.....iB.'..E:.&.Hp........&.M`J.....:"-.........xp.O..~..].:.x...).P..H.PI..4...\....Ba!...F.*....I.....&.....h...,.$|.....D.(...U...&BN

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\48x48\synchronize.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):3150
                                                  Entropy (8bit):7.901292238314475
                                                  Encrypted:false
                                                  SSDEEP:96:SAYs/XWMWgfRMQh0aeD5d6MZpA+7GnVF9H:4s/mMWKMVRD5d6MZu+729H
                                                  MD5:5D73DDC4635BC87D88559D2507D9834E
                                                  SHA1:BB2D0722362BCFA91F8AA8790A0352615DA590D1
                                                  SHA-256:605CD86DAD008896EE2583252C66BF6602C8F48F720A9584233EC1330071571A
                                                  SHA-512:CEC008EB72BF2C6647A84C64DF15AD902A9DE3610F18BE2EE8EA1E1C9B51BB660822088DB7A910E6E3A64CE41CF811A797FB64CC66457A8109F19630455B28DA
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx...x.G......dY..e.....0333G..,Cpy7...ff..9.,...b.43.]u_u...:........VOb.......3.....k...\$t.w..li..".........o....@*.;*.,...@T1.....t..Wt...r*.R..J.u..8.@@D...0.})e....Zy}.q.y.-...H.../,e|^.q..\.B>..6d......t..0...B.(4....L...~...T...;q.cBcM...S.X.:.......l.4i.Dl@.mt.g......g.z.{.6.Ii.........F..{)..F.=.'...!.....R&....0k......".1......r...M.,qP..QR.#[.$....$.....D.t% *V^.t.,[..L&.5.B/.Q.....@Ah|M....S. .UR1....d.......yGD5.....8...{zzP.T...<..4..(Tk. u.PE.Q..7.Q<.k(....".e.2w....!5J..cN.."....^.c.=..y.k...P.-...r.?.......c4.`]....F..vZ....B..).J..0....;l....at.D...........;q.^2O@.qH...Da...O...5.P[.e..0..0.k.h..T..q.@.P2g.b.T..b........&...C..@..5.I.!..f.q{...&.Xq.]n.4Q.P..Y..`...P.F|.G...0..?._..5.. .:P..!.8.k.5..`.Y4..(SY.(I.._z..*...... AP...:..u.=.J.Ac:"2b....2...T...&.!..|..[...3 ...PP..A.K.G.r.3.t.[*.k..e.k.!..j(h....N./.....L..Xm.>.?..}.......d3.E2a..O`......7F..yS.g.....L.f..:I<.....8@i...~[B).M.

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\48x48\upload.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1415
                                                  Entropy (8bit):7.809729910170398
                                                  Encrypted:false
                                                  SSDEEP:24:SZtQY0DaopQMqrZe7SVPMsuZDuWSaS6LnpKwmX2DxJgpT5wGi+7359gdWvcb:AtQhfp3qgSytXfZLNr2T5N59qQy
                                                  MD5:8A375BA8F9478D5DDDA1E56C5B712F43
                                                  SHA1:C6D2ABC6A1DADDAB007886CB915C86DA55D40CAD
                                                  SHA-256:6191CB83840BAEEFDF9CC0B75863EDE281503497649F7FEAB93A3BCFFC35ED3D
                                                  SHA-512:43AE1BBE597B879E5DA5884FCB269687FF7A8DAB38291505370FAAA87C970F0673AC2E5796ED655F8D1CD4227B1CCFFA2FC2B34D807BEEECBCFC489C521F50A8
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W......NIDATx....+K.@gw6y.m.m.m.m..g..2X+._...8...z.{v...5.....k.<-.\..ccC....y.`.i.@.6m.Ina..g.e.8.......u..5..g.={..N...8z..II`.?.4../H6..Q.../X.... ...-.Z..PU....=0..,^.....|....z......%...:..D..H.D......\.R...:c........ .<}..#GB...$.l.U.r.t......k.....D.X...c..Q......Wd$h.6.y..}.K..3W......pp9...h.W.C.@f....9P..l.e...%p......D.D.n7......A@.%D...r..m[.e.....U.n..q..A.....l....iSH.j!..K....#I.*..Sg..../..U*.b...W@S........a.@.:.......SD?~........+..P..g..Ui...aj3..\.c......l...*0`.h.5"...Y..$M..........?...D....>].y....jp.:.M`.B0t....A.2%../....A.7/y<......`.w......{..w. ..c..(...............Zb...(......A.!..`.1.........M.q......H..]...D2...97|......}._.... .o.1...?..w=.k. ...s......JR....k..%fYr..."l..X6.pK....q.!.GU."...i.|.6!2.N3....l.].Hy.`..O`0Ck.,Y.....=.O`..'..S.^....|.{...}.%.@.. ....nR+.......PW..%..V....~..W....|iT.V.....y...w......u^.#.}K..5....F.q.......K .)J...O.z.... ..K...P......

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\48x48\uploadadd.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1687
                                                  Entropy (8bit):7.864312517363015
                                                  Encrypted:false
                                                  SSDEEP:48:uhTNfqGX9DMjOQzKJ4JjEBAHpEgzaW90ixGIs9:uhTNfqs9DE99JOIs9
                                                  MD5:72B0A7F7B84E12502744371AD1F06B8E
                                                  SHA1:802ACC403D8F9F3ADEAD854118366974F059648D
                                                  SHA-256:A68AF73B86B1466578841F4306D3ACCF7E354807EE9C295B3BF80A4D94BB408D
                                                  SHA-512:FD53B341CF431B9C05D423A02DCBBDC59F76C9D33A66B6FF1B17623FCA2B8BBA00C5B8D08346BA7BA51C3D970ECCCE788FACEC7813531368A486CBD1F0CDE120
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W......^IDATx...t.]..g..f..a...m3............X.......l...s......{;C}(n.1..{...w..\.t)`......p.T...@.AHH.H$.HOO...PX.r."..!...-64|.Z.._...'DDD........K u...%K.S&M..J........,#.0aB..d....6A.......c...s....?n.055.~..I.$?..<c..........V...1c.J`.......7..?..:t. .H[..z.#PWT.$.|}.'sV..-(y....v..[.n.c..?r......=z. `aaA.bF....RO.~.....XZZ......[.B...."......F..d<<< 11.D"....CU\.)...m..r........Y..;......3..>y.....ot.kk.....>K....$p.r....j.. y.(...yj...>}:..?..3.K.,....L.......,..w..8u...b.7/_.'..3.....@..Y..w.@|.Q1...F........9r$.W.^|.........$-@&...{P]]........Nd.e 62...P...._O.0.b..6Q..---..<...7!......Q....7n.\...L...Y..&+.J.. V]=/ZIIYn.#F..`Y5.`..P??.55.).<z4..].... 66..0.....3...@....3v..*.`..b..H .......26.bZ....(...........Q.b....c.1...L..^. VC..[..(>.J.......\.6.]..E.........x.G... 11.....-H..#FE.*pq.i.<....X.+...6;[z4.qg.....m...."..~<.j..:t.Sy``M.X..8..q.@....I2.E...du&.w6.@....V''C..u.....D..28...#...u.{G.S3.

                                                  C:\Program Files\FileZilla FTP Client\resources\lone\theme.xml

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:XML 1.0 document, ASCII text
                                                  Category:dropped
                                                  Size (bytes):272
                                                  Entropy (8bit):5.0635375478303075
                                                  Encrypted:false
                                                  SSDEEP:6:TMVBd6OjzwgK6GrE5aQm37lrKLDyZCs/oHUTUZBOHWXdQUGOH1QIKe:TMHdtAgzGSm1aDyZCsgHKABOHW+LOH1R
                                                  MD5:E1935C1F19C9BF407804F802F4D0E447
                                                  SHA1:96950304E316ADE7EDAA34C93D77760081A053D8
                                                  SHA-256:FE6A9AF558557032B43792980C29A6C425F6C2162CDF4CF91721E3228D6B8116
                                                  SHA-512:BB1FFC48346AA7FD659A444FE5EA43394551156AD6BF8B136FBED8DA2894827B3432D9301441384D2964E6606E49B553150100D73A0A50702E4389B71678E5E4
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>.<FileZilla3><Theme><Name>LonE</Name><Author>Ricardo Cabral</Author><Mail>ricardolcabral@gmail.com</Mail><size primary="1">16x16</size><size primary="1">32x32</size><size primary="1">48x48</size></Theme></FileZilla3>.

                                                  C:\Program Files\FileZilla FTP Client\resources\minimal\16x16\ascii.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):262
                                                  Entropy (8bit):6.363373624193421
                                                  Encrypted:false
                                                  SSDEEP:3:yionv//thPl9vtt/yyzZ66j3aRsSV4UBaM2wG4miXCC1kmw//+RQhl/+xewdcP+B:6v/lhPfySaath2dckY7sL5uPO43Yp
                                                  MD5:7F3A43B9D43AE40886EF23FDAD044E5E
                                                  SHA1:13AD1D12A72AAB3A6CCB614D236312D1CA678621
                                                  SHA-256:C0D5EA62B0BAD930198D75B62A08FDD5A34B1F042EAAFF84BEADA907A0565290
                                                  SHA-512:9C73E5DD8255963B68581BC467B3ED79BDC3B9EA019171B7A8800CF1ABA14B75FBF334864DCD31474A36442B0A15DB2CE74EFDB6A2A48DEFF9B23F3B48377091
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............(-.S...QPLTE...???777GGG............?C?......'3'7;7///..../.....{......p.......'''.s.OOO..../......tRNS.@..f...cIDATx.b .....+.........Y;.......@...B.U..7..*x.{..s~.....\..P.z.Zq.aa...'....y..:.u(...a.[.p..<......0.f.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\minimal\16x16\auto.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):270
                                                  Entropy (8bit):6.493229775851387
                                                  Encrypted:false
                                                  SSDEEP:3:yionv//thPl9vtt/9s7SCshSSRmpiiMCBs8y6kuS6Xhl/DojWz7WK0BoH6sMJyVt:6v/lhPf+h9oWNa549qbsIpolKKVp
                                                  MD5:07A8D183C3F4F232E309D9C223EDC582
                                                  SHA1:D8ED3AD5126D2CFB3CC58B9B34377BF7791603ED
                                                  SHA-256:ED7D1AF4F214414A0959F3F172FB4287A09FD3DAF525A2CBB35B20D0CB1EE52D
                                                  SHA-512:0000C8F595E5BC2F2DE05736AD1C483D50A0F6984F11656248846DF5E0D330F3AFF30321FC331958143F21D8BF7CA9DD2DFE981E1D4B8D95A2BF30B784124D0E
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............(-.S...HPLTE....{.......''''3'///7777;7????C?GGGOOO.................................Y.......tRNS.@..f...tIDATx.mOE..0.+ZU..../..[da...$.....Sx!.,$....a|..C).....vt.C.....@M0..W.S.f>=M.#..+vh....`Zs^.W.Xj-..PJ)._....O8..4.OSv....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\minimal\16x16\binary.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):255
                                                  Entropy (8bit):6.506559859382529
                                                  Encrypted:false
                                                  SSDEEP:3:yionv//thPl9vtt/B1SbRFbeMqS3S6hU9yUXQRpKvl/kR3Qhl/d6jFfxT2LhB/73:6v/lhPfBNis/hyjJx4znWPjkC4p
                                                  MD5:B8ADB48407C71383C9EC32F725BAF04C
                                                  SHA1:B555E0BF4F874EC1EEDCF1E14F2D0F5A326865EA
                                                  SHA-256:66F0A9E4BC950786FD81B69C2A296DEF1D39BC91E08AA67DFF42AE1FB69FC62B
                                                  SHA-512:871FDE29E5EC1E624620E8716F8423D9A4F57EBF8111112BFC2887FB68233D815018D64311E353B393BBD5E14EBC8ECCDB451F9F597AD157CDBFE0302C7D3B71
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............(-.S...KPLTE......777......???......'3'///OOO...7;7..../.GGG......?C?.{..p........s.....mQU....tRNS.@..f...bIDATx^..G..A..q......)-4..'.c.|..%.....~d.U1......nX^....k.!... o....9.^>Gi.L)d.>C..#`.zJ...'.L....4.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\minimal\16x16\bookmark.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):275
                                                  Entropy (8bit):6.64635030976887
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPf+sapJMuJVLNwllhNnS0OUrsQ84uWupmvWvI08up:6v/7dapVLwllhNS0OZQ84uWhWwVc
                                                  MD5:6181E6C4639D7B0B83422B2068E8FCC8
                                                  SHA1:26DBEA9138E3920BAC74B667BC06C38413DAE437
                                                  SHA-256:BB1230F4448E83604D0F13CFED907E76E444435B4577B3CFFBCBAF9D6F237A84
                                                  SHA-512:81B6F3C71D33B42C3CCC880993678BCDF592E1ED7A00EE3EA430CE2CAC525CB9BAB1416E55B78002D6B6ADB560ED5FD8DC4A777BBFA4F08233CAA3ECDC34F90F
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............(-.S...]PLTE.....@._.......1..t.p..J........D..H..L....-..5....4.......h.9.......8..<..|.......+....tRNS.@..f...dIDATx..........1^...\./.t../5....r.....rP....._%.x...1..Q.#b....S......w?.........a...eq..{`.;;.V... .....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\minimal\16x16\bookmarks.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):284
                                                  Entropy (8bit):6.6795619482457615
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPf+XJDxSjZaUMEEp5/ahgKD+uIl5ghek4lDurmYPCeKfHB0Gz0LFhAb8Tup:6v/7mSIFZPahgKD+uIl5gh7oDkmqzOBD
                                                  MD5:5077045C5791253D61D133254D40CE0D
                                                  SHA1:76397DBBFCAA0A572757CABF49AEC9D3A0EC6D56
                                                  SHA-256:B8007C3FE22D9AB1BA1162ABF9FFCEF977EA559D7C4DEC24815BC4A57E1C9AC0
                                                  SHA-512:408EF7AC27A0C3AFB2DF0EC6104DF573868F02C2008329C0D1EACE8FC0EC49384DF6DC2C06CB7BF1EFEC6184102E8318EB0E07511410E154FF038B5127A8D586
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............(-.S...]PLTE.....1..@.J.._......5..-.p...t........H..L....<.....D........9...8..4..|..h...........v....tRNS.@..f...mIDATx.m....1....r}...yk.N...o.E..b.5.4....../..}.@s..^.V.W......D$^U.....f'.V..a7.."rU+.;tx.;.oE..........m.SD....;.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\minimal\16x16\cancel.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 4-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):196
                                                  Entropy (8bit):5.8489096014909405
                                                  Encrypted:false
                                                  SSDEEP:3:yionv//thPl9vhSFlsypha/vKa5lllkqhl/mxjvJtP/3x1oST103OOE/dyVfkEza:6v/lhPIFlCn/lkqh+tDVTQVfkEzxybp
                                                  MD5:94202E205D87CA5BEE17DD254429708A
                                                  SHA1:3EFB5E026836C62B964202B6B02EE49DB06F3B67
                                                  SHA-256:4C82DBE6F5E908A685DB0A99777405B7313F7F78269B2E6389DB218A2B47E234
                                                  SHA-512:0AF7391CA9CEB5889473EEFED2DD08549D44C036F6399C01A37C5FA043D8E649AF042BED736BBA7C7DBBFE8F2D4BC71C457BF99A3631BE52521D7F14E76B1E59
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................R...'PLTE....//................''.............??.h.5....tRNS.@..f...KIDATx.c......@4.Ih.!.!...(..0.l..1..3{....R.{gI....f...Ap......90..v!......E).....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\minimal\16x16\compare.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 4-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):156
                                                  Entropy (8bit):5.6950909402652785
                                                  Encrypted:false
                                                  SSDEEP:3:yionv//thPl9vhSFZXAZSDInthl/Ok18Q6lp1parZs1Ywbp:6v/lhPIFZihAk1G6+Rbp
                                                  MD5:62972FD79A0DE5F47F72876A8B8B2085
                                                  SHA1:CACE27632B9A59C0764BFC9EB6D424F153D1C917
                                                  SHA-256:9BCD4A6BF93F0BB529901FCDF52C11D32E9D34EEEADDE69CC0969FF1BCCB14F8
                                                  SHA-512:EBAAA51B60B1B25988DBAE6F5B0E9938B61FCEE7173B2B64C30F71F6E70B51A460D325A21E0508452198338B0EF3842F49ED682D1F47DFC90FC0D0D457D7C3F4
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................R....PLTE...777...OOO???.77...7.7...4.#*....tRNS.@..f.../IDATx.c..F%Ef .3X@..`...i.(...\1...............,.3........IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\minimal\16x16\disconnect.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):286
                                                  Entropy (8bit):6.923372188895155
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPmNpo/lDtLhQKUtbKKD54auIf7yWDvxUMUmCHWhwzJmS//sup:6v/7uNpQzLhQ3tbKw54audkq0C2hYJJ9
                                                  MD5:6CAD00290A05FEC073A4B2BFF0A61E91
                                                  SHA1:B016EFF7AB3824A1723DEB492E2B2E2F78437E94
                                                  SHA-256:C120D51344E33AFD21E3FD347CBC7C1D3439E2B6C1FC10A6B29BAF929C904EFD
                                                  SHA-512:E863311DB2D31317B7B45A4F207986FB154C75D73203761B5AFAD27FA53D1CFE40F17F227BC04959097719D203A0F38AD6D7F4D35013C1CBEB0E5FB98C34E191
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...............h6....tRNS......7X.}....IDATx......0..s.......!G....-v..&.`(...!..( ...V2........DE9Y.0.h...M.......`.{....^>....F..eY.+.I?5.9- ....X.>.........c.v..Q.q;.12.".61....P.:......6..t......R..b..r.)Ykyd.G..._.7.8...Qhp..RJJ9.....`.~...K.&.........IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\minimal\16x16\download.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):131
                                                  Entropy (8bit):5.6289507100680956
                                                  Encrypted:false
                                                  SSDEEP:3:yionv//thPl9vtt+NTlrRSAalD/lQd7ikY58OVWmbd1+Gm2C08Rwg7nRZlbp:6v/lhPmNpo/lDtOm8MWkd1+MCF2g7Zbp
                                                  MD5:5EB0F873C514DDB3AD34A73CD5BAF190
                                                  SHA1:A9FF2EBE4E3572E03AC35BDC70F64AE0FBB74F92
                                                  SHA-256:A0B7C151A640F079ABBA849E68B84565E3E6BC91C119397CF29906C646CDE723
                                                  SHA-512:C3B3AEE787F74A6E30D92A7238F61C6D7E7A8C534A742826C94975DA68FC9FC760BCA1684E0C9E9B1DEE839FAA84B1EF3BC8404E23FE814CB67D687284260A91
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...............h6....tRNS......7X.}...8IDATx.c.O"........A}..|.<.....7...x.8P....6.L........4....?.t].....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\minimal\16x16\downloadadd.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):139
                                                  Entropy (8bit):5.744529615316549
                                                  Encrypted:false
                                                  SSDEEP:3:yionv//thPl9vt3lNO+NSXX1CS16AOmJFJqh8+oomNftR9qjp:6v/lhPdLS86oh8+lwcp
                                                  MD5:6C1C086823111EA331268F43D06F45B9
                                                  SHA1:916D2B4AA2163B19B59A5836296D7CF27E0535FA
                                                  SHA-256:9C7C53A72AEA5646DF4A0ED9FDD9943E94FE4806B7CE76E2D3D1FFAC8F14AB88
                                                  SHA-512:E58BED6DA9645F3BABE8CF3E01EE082472BD8280768312DFE9C61C776E43844EDDA14F38D275BE1CA683F384197372DC91373C4CE161C7F365EA12A6F35EDA7F
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a...RIDATx.c`...........'.... .....l...................t.t.....`,.-.6....6.O[.(...@......A....8....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\minimal\16x16\file.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit grayscale, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):169
                                                  Entropy (8bit):6.225579260203194
                                                  Encrypted:false
                                                  SSDEEP:3:yionv//thPl9vtwvR32H99mT+USnUAEGWjKhjWv3N6bUDM7F/l6U08g1p:6v/lhPmJemT+fnUAvWjK8RM7F/ip
                                                  MD5:603D8B4370A671D690D5D422CA94BEED
                                                  SHA1:4D6C2E7004A6440D473A36ACC3FF55D0F8ADC772
                                                  SHA-256:9F89DF560BEE91CC28527460E0F72B5DBB93271519BD0D8C8A967DC97EBD52BF
                                                  SHA-512:74A481CB86E85E26C02B6C0F4726F9A2B65FCF10C51EA42124FC18B6E99079BEEDEA9440D22554B8E199FFACA884E021B531871B4BD81FDC58DE4A3C0D6E2A6E
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............:.......tRNS..[."....bIDATx.mO).. ..*#q..".L$.22...v.q.4..+...&.jDd..QT.|.$..H3.}...d.....X."g...WF...1&.....l..._R..^/.......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\minimal\16x16\filter.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):205
                                                  Entropy (8bit):6.272357355149204
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPmNpo/lDtAxEso4vZSkcOhJylV2p3mAD66tx/0qmKGTp:6v/7uNpQzTyBXRhMZADvTXmKo
                                                  MD5:5F7487F77EF2E2718FDF49D70F5AA78A
                                                  SHA1:5A13AFDE197CE88B46F9F062B9985241F68D3C9D
                                                  SHA-256:76ED54BC79E6F2E3992483D4C18C3135A47EAC6DE8D3FC30814453A619FECF81
                                                  SHA-512:73E9CDECC2788525E263E8C751CCEBA59FAACCF7D1D4B0452330D2B7704D3E8A187BD245F2AAC2CBA50841FBD93F799A8F170D78944D7C4999420E71A60DA8D8
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...............h6....tRNS......7X.}....IDATx.c.O"..............8.`....qk..G }}....j....t? ......9..Z.....#.........5 .<.P.....05..6.. .;......t}.~y.zy~q.x ...~ .Z.j....f.x......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\minimal\16x16\find.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):465
                                                  Entropy (8bit):7.465307282556631
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7qz774BWbCtfWz8lOFBzdSjz8oIPZO:pz74Wbj4o/5iQ2
                                                  MD5:9DF67D4F87DCF1A08ACAB597C3612846
                                                  SHA1:3E598C880A90B750588EAD84F6487883137F4635
                                                  SHA-256:9C062C7A4FEA4545FB69E4318616741B29207CBA0A59877074F04C87469C6D8F
                                                  SHA-512:470916EC02FC0B20C8E95E9311610D9960BBE563B5D896968D856A251D32C95BA3665EA63FA57E8CB49B9A3B2D12630E1E55BA066D3BEB90FA46FB93486B529B
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx....l.a.._........m.m.v........%.<<............M.O...|....Z...x7I.........]11.}+*.....E=a).9s&.2$..6........h.........;.-C.3m#...c+JY...v."K..5.....K...N.UxI.]di6.q...b...9.w.....G.9!Q.>&Y.!:...Gr..wF.............,a.. e.....,C3.....V..<XR.....q...l.@..0n.f!...AI..^.8....o.r[[.u...3.z.^...YA.F.......Z...s..r?O..O..e.]...;v.".B.r.+WN.Y.U.......7o..^2......L......#.),.C@...............y...O........IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\minimal\16x16\folder.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):337
                                                  Entropy (8bit):6.89163841151448
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPfuf2nPt1ReP9QNJ/7KQcQny7GRgwEp2akghzdQ2BsVU6EgNTALVut+BFGC:6v/7JV1a9QNJ/Oenyy3EFjhhZBsyngN4
                                                  MD5:BCA16103B467F279200CE0B7490028F4
                                                  SHA1:2FC6A33D1348DCE568E677E73C6A90EBA4481057
                                                  SHA-256:B1F088641A1FEC949BC505B86CB55FDEFB23D892EED6DB3D84A2A480F25C78CB
                                                  SHA-512:DC671B52DC64EEF88C7E85FB4B60A33BEB70EB72DC1CC95F46D2BA7B76A00CD7F6913281F15CC6DB482891A04216E06E62287EB73FDFF9783DB899843674FE5C
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............(-.S....PLTE.....H..@..L.......E............8..6.................5..2...............{..)..3.....-..0..z..4..q..)..}.....A..h.~%.y...m..y..>..7.....tRNS.@..f...rIDATx...C..P...Am.s....YuP..=...X....4..j.Q..Q.<.63...&X.Q......l.....@...S..Fc.....4. .....oA.Iz..,..w.......&....+....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\minimal\16x16\folderback.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit grayscale, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):108
                                                  Entropy (8bit):5.237170807735363
                                                  Encrypted:false
                                                  SSDEEP:3:yionv//thPl9vtwvR32AsyxdkxjQ1MB67JN7Aljp:6v/lhPmJXs+kS1j7cjp
                                                  MD5:E24D25C8AAB877F2EDE30F036195DC4C
                                                  SHA1:88D1348D98478D3E2572C271418C6E0A5DE45989
                                                  SHA-256:F1E76BE59DF5C0FF5D83F262E446F7C21E39C52463AFF2A7FDF8AB39B9BF7FE2
                                                  SHA-512:1FC62A07A163F420411153D2D50808FDC93CD2DA475BB6C3EFD529F7B16A8C1EF1F01FCE23B6B1A8AC97C0AE63E2EA02FA0FDCA3FB68CEC45C535232F9AA588A
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............:.......tRNS..[."....%IDATx.c....'..&..*.ii.......-x......h.m.......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\minimal\16x16\folderclosed.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):242
                                                  Entropy (8bit):6.489358696428888
                                                  Encrypted:false
                                                  SSDEEP:3:yionv//thPl9vtt/yycYgckUvK6NZvqIRV+0SV4aQhl/xqlV9JFWslQqmjmxWcv/:6v/lhPfyjcFvjhUNShXil0y8A/ljp
                                                  MD5:84281E2E1318A18D057378DE38937E91
                                                  SHA1:0CA6834B0E7B48A0F489CA42FDB15C65A6B94453
                                                  SHA-256:B2083F672D8D86EBBBEC229028352BB76E330F8890B4FC0D4B9A1F8185705E76
                                                  SHA-512:24C45DA8F8528EB95510B2C1AF167E62CE42AD21C74962EA417B898D02FD48A19E51F5785917E1C9FFF187AF2C3EF99FA1ACF506BC50A465D6871D43B5D140D3
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............(-.S...QPLTE.....@...-.......t...1..D..L..h....5..<..H...4..8...........|.........]:.....tRNS.@..f...OIDATx^..G..0...lKo.....APo.9...@.....+.^.N..Fh.V#.y.ZX-".@.%=.h....-P.L.FYu...B...7.t....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\minimal\16x16\folderup.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit grayscale, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):127
                                                  Entropy (8bit):5.51099826887013
                                                  Encrypted:false
                                                  SSDEEP:3:yionv//thPl9vtwvR32dshnjCADNRRsHA1k4/d5q95xlB1p:6v/lhPmJRW8R0Abd5q/xljp
                                                  MD5:1C64E432ECA60AE46C9C12C7B80ABDF0
                                                  SHA1:E4E137C0B02118AE0515E8824EDA866E08C9A9DB
                                                  SHA-256:FBCAAC3E7380B257A536AEED385E063283E4169ADCD7B155FADCF09C1E05C230
                                                  SHA-512:51FCE2BE5C8FAEFDCCA01644EEBC79179D82621B77E7FE0D2C36D1EAA440C8F37F12A91FB1405B98CA402A9BF1967C5073DEE192D068523E270E2DF2C8A14FA2
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............:.......tRNS..[."....8IDATx.c.....psC.....B.........A..-.n>>>...x .!..d....".=uW......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\minimal\16x16\help.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):237
                                                  Entropy (8bit):6.62857492175376
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPfeP9U8sDKJOckcBtXhwRB6ENrr76BAfSWSm9ncGQSltjp:6v/7OP9lsWJOckcBtXhwRBHVCAf7S0cm
                                                  MD5:368D0EECED2C75D5445879856ABF2ECA
                                                  SHA1:CBD9BAD4F6296D78E60E6934A3D7EB43F1C0B316
                                                  SHA-256:1DBBB0FE6F576CE808D544A0C3A8EC066BB2C5C40B6AB5D21A994A46B256C06C
                                                  SHA-512:8D0C39C29DE76BAD8E2F1DA3E1054D2013E80FCE80F1B91522386A59634B29CB3E89E4861AEA9BB3BBAB264DF92704A147AF81F178ECD09ADDFB4E325C27DAD4
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............(-.S...<PLTE...cY^.;f.Hp.Ft......5a...Nt.?o.6^.R}.Y.._..3folmfY_.9j.Ly..i.....tRNS.@..f..._IDATx^m.7..@.DQ3sc...W.......4.....`^..)%...,....D{W.......@.......T.E.a;...!..G....!.Z..\.....h^..7....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\minimal\16x16\localtreeview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):259
                                                  Entropy (8bit):6.6613622157195564
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPfUDfiRsyKhbbHRo7ZqheShPlM7vOdljuZtVp:6v/71H6P24heSMDO/jo7
                                                  MD5:2510DDF07F2B9A525BA656D37DE25A9F
                                                  SHA1:45F273D29A83442F118D9F6B0B128A12E66E0E63
                                                  SHA-256:D7AB3B1AC31E864CFE9F76A5687CBC3CE538F1D76C05C7B702AA74AB39DEF230
                                                  SHA-512:EFD11B3C837E597D4D69E24E076F6E1BD26A1CFCF1E68A6A1343E66C26F602DC852B5BCE76A7A63ABBE56A53ACFE254D9A59131C177B4FCD72F8E0532134AC29
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............(-.S...NPLTE......'.D???..#777..8..@///.N.N..vE?2..}..4..8.D..F..<OOO=7*...9....NL.....tRNS.@..f...cIDATx^e.G..P.EQ.....7j|.@....8..r~...m.O3....C...J.......:$.V....x.....A..)h...A..DX..I...J)..."c.!.d......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\minimal\16x16\lock.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):297
                                                  Entropy (8bit):6.800199709510365
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPf1UFluPRNV1YPq6Re3/th4QpTXQcBdc1fA28jhhG50u6kYp:6v/7EuPXVKqb/th4QxXCa3G5Uky
                                                  MD5:F2073372D899FE4E0483E90B0653215D
                                                  SHA1:17383AA8929692DD99B854D8FDD12F21E1189CC5
                                                  SHA-256:D18E5BF43483EA1EE2B7860EA5EB5F4E90EFD0FC04BE57EF114B66B3C56E7D89
                                                  SHA-512:9236493DAE406C93F80B520034DE3578348EA757892B1E410D62D214618A78F90427F90CBFF9926E1CAC05080526D9CFC773ADDAE2E9F243B48F9EABAC23CFB5
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............(-.S...oPLTE...jjjcccooo........ggg...[[[hd[..`[N<7*IE;.i..r..l.d.d.m..s?:-.a..o..q..{..{..z..p.s..rGC:.^.a.b.cG..c....tRNS.@..f...hIDATx.l....1....v.5..V....L...!d(*N.."...B...*.#AS.. .D...$....[..5..eIW[.......uH........s....(`.8..>....t.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\minimal\16x16\logview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):367
                                                  Entropy (8bit):7.018199834661965
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPmNpot/7PBgoGkhoQ/Oje2ZtrdaBgdVjD9FhGZsnrsl/UuUmNnzQWUi/Cup:6v/7uNpAuU1GS2ZGBWD9vGZKwlMuUmNz
                                                  MD5:2226DCD0F25AEE9BBA5C64D0B4A8128D
                                                  SHA1:0B9516F28E642253146CABB80BEE57027A6EA373
                                                  SHA-256:99AD52EE1D5EE29AF9CD09C3EF7884453B943682E9AEB99FAFDC57C56D74A08B
                                                  SHA-512:6D4731DE82B4B7DF699EC48A57B83EA5FF9F2D9B016E53415339CA1C14F11F9478CA194E5799374E347F62786A2C48687E0CCCB7116E009F5250E59AECD2B2B6
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...............h6....tRNS......n......$IDATx.b ........Y..A@..vvP..B.s.o..$..T...h....A@....<.J*.z.&x.P....T.......}....P.E..'.T......).....P@."j.@0.......o..s.^.....i.^....}73..@N..8.ey..a`.RJ&..z.x.Y..T.f5..G.=....6..... \n..k.x....|\.5.g.............ZJu.9.X...@S..W....8.-.I.E.2.<.%..|...m.;:*.5...m....h.."..1..U.~._1.0....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\minimal\16x16\processqueue.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):315
                                                  Entropy (8bit):6.823503061584567
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPmNpoczEAaiNUUp8lBEiNA9nieFK0mhan+0fmQ9W5llsup:6v/7uNpbVHUUg9A9pvIannfmnllN
                                                  MD5:6B267D137E6CDBB599E67DC7D3B4ED32
                                                  SHA1:8B2F70737B90375515CC6D3B4A0D5E80DE424F1D
                                                  SHA-256:CF6E2E84255A9D0552734C2647352CABE7202BA9EB26411EB4E8134913382E82
                                                  SHA-512:040DA0E15CF88C81003E8D565DFA83BBBC197598D2C535D0BF77D5D9B61343AAF301D5F1D4E48B53AA941E9E694A98ADE16BC8BB22BEE98CEF6C77931BB3FAEB
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...............h6....tRNS........pR....IDATx.c...;I...{{{sss{0...i.5.:~..}....z.h8<...L..Sm6...I .(.......6,k4.p0......J.>.}{....].....V.Vz.fZ.v...7.}.xx....@.h........ .(.....vFdj.z..JDi......P5...^.~...J;'Z.....`p.h5...D..bw|.djl.f.|...du..<).....|{ ......D@.....b..lh.....;.B.'B....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\minimal\16x16\queueview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):267
                                                  Entropy (8bit):6.585867058983375
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPfyo3HB7qWWW1hWuyFCBUM0A8R1q9IWHL9Bdp:6v/7/3HB7qehIFCBUMTN9IWL9Bz
                                                  MD5:075CF93A04F8FE691C4F80CC075DF4AD
                                                  SHA1:F8A4B6DA00E0825CDB5CCD3B505F700E2E91BF4D
                                                  SHA-256:6E197169A68E7522122EF51E07A4593AB62C56F69B3360E961ABABC3873AEE48
                                                  SHA-512:7303B627D0DE5D050A8078FE6E25E9242E1030568DC39B05D0A154BB5AF71395CCA22D32CCD8BCB9310FF2E2C7E012F2336AA6F4171379B651DB533F5276B6B1
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............(-.S...QPLTE........@.E.N..u.........=;...m530:7...z'''..2???..9..=..5=7*...??377+??)..x777D..S....tRNS.@..f...hIDATx^u.7..0.EA@99.....I......o...$..^...C..[.-...".]...........r.pp...s..........j.....{.../_..5..zn.N...d.^.?....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\minimal\16x16\reconnect.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):318
                                                  Entropy (8bit):6.9401860173289265
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPmNpo/lDtrPKCl0ltiDHWIiozsVfuuO4CFUgSf+kDfbG83oUYkG9NfigTp:6v/7uNpQzrPKAQUzs9uuOBmgy+0bVrY9
                                                  MD5:FBE9EE1BEDA6A08863008F7496352E97
                                                  SHA1:EA8B483E1ABCEA7290B88DA08BBE44C0D14A42AB
                                                  SHA-256:8A4E3397C871747968B34726470330D6C8B7A64FBDCE7230FB9D3A95E83C428A
                                                  SHA-512:599D290940A74A3F40B7A08B8E4CCCE4FC491888785E268EC3D64FDEA3EA4251F0D3BD4AC5DD5F6AB23D650B2ED5350B0AEC8218D37F2620354DBA1133891A65
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...............h6....tRNS......7X.}....IDATx......1...-&''....I...@ ...b.r.1..@L..@.@..@ 9v.h.._.e...........1.j...T.H.9.SL..1"JI..4&P0.\..CE.K...s..]S.... K...s........k..,...~.F#..&..a.$.@..J.w.aN......<E..Y....u.Y+QD.].n.C.%.k..D...j..{>..I..k...!..D....1J).2.d...n....0.........IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\minimal\16x16\refresh.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):277
                                                  Entropy (8bit):6.954009971516475
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPHj6DXe7LlvTH2EpUoMUPkWPHIA9E7bp:6v/7fE8N5OlsHne
                                                  MD5:24B13549181DA2656B0FC201CCCB995C
                                                  SHA1:0FE5DD149620499A4BFF6449BBD2607894FF153A
                                                  SHA-256:BBEAC0FE83D3449CFFCBEF985600ABD8F6D87894C40F0D73887F9536C9E61501
                                                  SHA-512:ECB8E1C2CB43C897056A80DB59EC2AF52102ED05987B68E29607F90DF70A660B1B35C3C1D5A1AF8D29B182260457B5BE267ACB79D4503EAA3E5B6B08C6ADBB8A
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx....b.0.E...H$...D.....Hd.iO.f...}...[...cd.G|.......R......r~{g..V ...6X.(E..]..V.2K.b.%......5.4A.0.....`...$H. 8...v.`.m.....>.-...[..].q.[..h.....p.@.=...9;..f4&...,.$.XA.om]...ma._x....K......!.y.7.3.#._.x..\{....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\minimal\16x16\remotetreeview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):271
                                                  Entropy (8bit):6.680491562314409
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPfd7NsMr8v4Hv6PEthvFbPbr0P1Q2Zkdp:6v/71x56Mht30NZkz
                                                  MD5:2F61E637B813BCA9B871ECF235026B50
                                                  SHA1:895C4638F7D537468EBF8570F12F9A3D86BBDDAF
                                                  SHA-256:DFDEF00CBFE4FDE826A47733A8EACB3E141D27A649B017769923B0F0BEF7B5B2
                                                  SHA-512:615EBCA503854D008CF32E66DFF8B57A384FF12BBDC7731858B2296A76896B5C781D75399DFF602D98B01115D11824F295D2756923556B670A145D8FF9AF9036
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............(-.S...WPLTE....N???..9..}...D.D///OOO..'......'''.....#..v..@777GGG..8..8..4..<.NE?2..F=7*x.{.....tRNS.@..f...fIDATx.e.a.......q......8...0.(N.,..........|AQ.n...Z.....L...&..0..5.A..!..,...m..6.|YC.!....h.'M.....L.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\minimal\16x16\server.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):253
                                                  Entropy (8bit):6.589199519868932
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPmNpo/lDtwx7bptRnDfOFF3zw9bPl+zWnFfvnYA+5p:6v/7uNpQzOtRnbOX09XlYp3
                                                  MD5:2A6DE504BF1E7FE5E0F257C91DF8B46A
                                                  SHA1:3647BB4594AF43EF4AC4AFBC97D1A939E8245B7D
                                                  SHA-256:2E219AE3D40DB24218BD07BF3A4417DBA9CAF4640AAFA488F7E4C5BFFA08A047
                                                  SHA-512:CFCA6BC6D383FC150C2F43142DCDD619B8774519312DF0DAFC41D07D5438ED9F0F121A9A22568406638E856950E30C89EC965511C25C5EEE9264135D6B10FA74
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...............h6....tRNS......7X.}....IDATx......1.Ds.....E1X..%G...=J..*.U........*mi.EG.....y.>.c..:F.V.....x.SJ...A.. .c...^..#.pO..0.....3'..J.9.{...s.6P.5..B.3.h.Zk).z......x.'.......|....Z.".....y.;.X..>Fo..A.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\minimal\16x16\showhidden.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):256
                                                  Entropy (8bit):6.60715121340722
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPmNpo/lDtZz8Jo7pxjRimf9+IWDIVjXpXt1jdGC4cEp:6v/7uNpQzZz8+io9eDarpvjoC4L
                                                  MD5:EE697ECCF7B40949F35206091B062423
                                                  SHA1:9953AB99BEEE24A31073BFA7BB33BEACCB156C8D
                                                  SHA-256:0A7DB44E27BF1601384E20BF80FEBE3C0908873B74E730CEACED27570E0EBEC7
                                                  SHA-512:DA91770845450D8B2EC8811628CE7FF7F54EAC48F65E259822D347F1BCF0FE7B6CD593FA5AC371A7D03790159DB40B7C55EA45E29C4083F3FE8B7A975A2FABE4
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...............h6....tRNS......7X.}....IDATx.c.O".@....z..$Q......O.X.....$.....h$B.n........M]...|.].c.-\..6t..n..~.....pk?6m....n...z......6...5..B....h@h...cZ....m./.e...!...FU....T.zl.z...!...&.5....@rZ........k$b.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\minimal\16x16\sitemanager.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):578
                                                  Entropy (8bit):7.26658995284276
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7y8T9ROM+AXyyvP8zGEFVsitMyrvkcnHTQURK:CROMpbvP8zogHTlw
                                                  MD5:BBCA2D3CC54608BA638116EF0D874979
                                                  SHA1:5CABA58951EB7EDC6EC5BB11FB76C20813D501EC
                                                  SHA-256:1162CB65F6D772E4332D9A01D22F5BA5CB1E44AF462F27706CB2079923B3D1F3
                                                  SHA-512:A4464565099F19EF4C92CC4DC18AF197468F63DD3874663CF65B17C5A2C38EDD830E9198F2084B71E3C4B78C2C758EA16CF9032B9CFB5EFB395CA2DCBD912230
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............(-.S...JPLTE......{.....|...+'B[V.............CbJ...............:^?u{.}.................{.4.n..Rl.K..Y..t....???7777;7'3'.+.7I.)H."|}-..).7*.gI.Y..........{..d..0.$G...:5..4..3..'./......7.7)1.'B.'e.+.]1.!2..4....2..l*N.$A.,.X5..1.......!. y..3..z..4..............q..)..}.....___.....h...........~%.y...m'''........8....2$....!tRNS...................................3.....IDATx.].5.BQ....=.2vA..s|.L6.....O.........^....P6.<^i.s.H.k.N.........j.......W....E.....'...d..E8.T|.`..B k..<.*.~`)..6..>_.$......".s.......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\minimal\16x16\speedlimits.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):287
                                                  Entropy (8bit):6.641511483184927
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPfakP/FrbS6XS5WghN+4Q8YsEqqaiG/CMo+p:6v/7XNrbS6XKWghNWmvQGqMT
                                                  MD5:CB8FE1299A47ED7990A83BAE9B3318C8
                                                  SHA1:1C9A2F39C70946C55FDD7FC8B693D48299409EE2
                                                  SHA-256:979C2C56AE97F3E32F932ABE6D3ED2A5D09406EAF84A939AA001A70E48878880
                                                  SHA-512:58F9AE64A4ABA02CCBF62E5C394F2D49B473E463CBC39C9C132047DE400035F8A8FBBC8A4FD9E93471E59E33E26854DFBB8BDA269F0DC43A0E9EB75262318684
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............(-.S...iPLTE...OOO///4>9.&!.../..G55!4+1.Z'wO....11.;;G##/?7..\1.b,.Y&...77.==.99O11&3,3.^.==?''/.W.99???777...'''...;m2\....tRNS.@..f...dIDATx...S..0....}.l..~..-...L<.... ...........2...a>..kn0....>...h......O...|.)...w.mg:Nu{]'.......MkTsa....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\minimal\16x16\synchronize.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):414
                                                  Entropy (8bit):7.179085426324849
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7uNpQdmC+bpjrkH6A0ON1mJUf06AjmZLgY:nTim7VjrYOONQUf0xjup
                                                  MD5:BB3914C0242330CAF1177D874D38ED1B
                                                  SHA1:F6BB59FDEB8E4E9F886BF2F72BA0F43B111AD920
                                                  SHA-256:0BCC6BFEB6C060AAE459E937585257F9606D74F3EA9849D387E403531319515C
                                                  SHA-512:E600839ADBE2F4BA62DFF2EFDE906035CC7CE7CFB827F7821825D0537CFB21B838F527F1F248E1B9BA2CE06E5860125C7D20ECEE142C192B5F3D3CBBA862FF0A
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...............h6....tRNS......7X.}...SIDATx..R.l,Q.ll..m.vc..m.n...j[..mNuv&...].{6........U.j.r.....e".M.._.;....-,........k.....y.'G.E..d..!..J".0...1"G....)....'C.$...6!..6f.J".I..[.^.....1..O.......Y_H.....V#aJ&..s...^..~.H..hu.....O....2.p..H...-u6...J..t....\i.DE>..!..^..0..JC.J A.b`<WRU.......-.2...x..@..J.y6&..V..`..Q\.=F..n.!M........K..-F..n.a..........<...F...7....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\minimal\16x16\upload.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):126
                                                  Entropy (8bit):5.510290850843103
                                                  Encrypted:false
                                                  SSDEEP:3:yionv//thPl9vtt+NTlrRSAalD/lryxOdsDM4LWWDa3WqElM26VX/ljp:6v/lhPmNpo/lDtrPQM4LWSGx/dNVp
                                                  MD5:DD96FEDEAD6729D37FD1EBEA04301DCC
                                                  SHA1:33352BF613A0953A537A106BE07FF0021B9807C2
                                                  SHA-256:9F6F305FB9892B704BE8F3045EB026D33740A6168E94575A8F3B2BCA47A1E6E3
                                                  SHA-512:683478492AAA1743BBCA41DF9AD7E8E7318310B35DDE869C206DAF3CDCEEA1BBE16E8D7967A15553D93F3F7EFB3DD078025928DBB2DD8261E084D3346D5C1FFC
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...............h6....tRNS......7X.}...3IDATx.c.O".....I. /._]...ss.........B...i .$.<=".......{0.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\minimal\16x16\uploadadd.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):154
                                                  Entropy (8bit):5.812500575542161
                                                  Encrypted:false
                                                  SSDEEP:3:yionv//thPl9vtt+NTlrRSAalD/lXhndZdZO3agaYrxsnky/t2up:6v/lhPmNpo/lDtXhdZaaGxsnH/tVp
                                                  MD5:A532BC7AF411B178E07C9A0AFF7A02FE
                                                  SHA1:BF9626BDF573383C6F1060A0EDF3472B1FEED203
                                                  SHA-256:081507F7D6340F2F34960B82C1EEA8CC18284BCD2EB3C64DE676BB494BBFE7A3
                                                  SHA-512:E6C25776E86604ABCCCDBCD888F3ED5AAC697D194167415B8F6A9099CB7724CA135CA59F2A903EBF45098BA40F71CBEE24808AC04CABA963ACD11C833BF2E9B0
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...............h6....tRNS......7X.}...OIDATx.c.O"......I.?].....@....@.....~pw'1........`n.T.@.....AH_.<..;...xz.&>../.o:.......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\minimal\32x32\file.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit grayscale, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):591
                                                  Entropy (8bit):7.482771763858642
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7mPlI20Tui4an4j6a2M1tszFhj7sXBeSAhDoyNuc6TVHHbE:DL0Tui4an4xxnsznQxeSAiyNIThg
                                                  MD5:995DEFCB05B6B07983F430988A34A020
                                                  SHA1:FB66FB401038F5542F044B4535174D86299ACF55
                                                  SHA-256:19A88F4BF0C47CF71565E0789D1AE8E8EC6A4B47790A5ECBBB2BFB710F9A529D
                                                  SHA-512:F96C7C6877AF7FB3709DBA9EB4CAF9974E098F3284CEF522334E98F09463D4FC7E9ECE95BA3441281350C5A48F1CCCDA830742BD7D46D1F5B0AFC0195AB32CAE
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....V.%(....tRNS..v..8....IDATx.b.....xd.....*.l..3A....o.6.m.6:..v.i....|......).7.\..4..5..I^..u<..=..7&@.@ob.....-.h.D..}sL.BO...5.?T....._ee..O$.|s3+..U....X...Y...$r..W.X,........'..9.J.v^.L.l.f/w..M.W_...-......d.&.......q"`@X.O2..qS.Y....~...w....~......x...bO)s;VG.Z.C..t.8.............|m....v......sKr....&6's..d......#.b#. ..bX....;..1..a.P.....k9{.O.....0...`.(Y=..52V.G...$.........-.4'Kq.."@.@..HiUv....mu....D..rr~P3o.id.>..9E..v8+.`..n....U...I..-.pPT..n.UN~.....jQ.@,..d....D".;...D...?..d^.pi{.X...1@l..X...mNm..q.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\minimal\theme.xml

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:XML 1.0 document, Unicode text, UTF-8 text
                                                  Category:dropped
                                                  Size (bytes):235
                                                  Entropy (8bit):5.050738743085539
                                                  Encrypted:false
                                                  SSDEEP:6:TMVBd6OjzwgKD4+aQmjBAkKLDWZXRoHUTUZBtGQIKe:TMHdtAg+pm1AvDgXOHKABIQIh
                                                  MD5:9635EA01558056F51261962768AE77C3
                                                  SHA1:E38CC24DD030D14D1BDD753F5EB3123D96B91C39
                                                  SHA-256:BF74E95FDCDCF1466CC9D45D560525FCF7CA87E687AC82885779797BC447766D
                                                  SHA-512:F52D087438E0D594EC64EB417FAACBEB0E85C984031EDC61410C0992D91DDE276D3208C38DF760EFCA28421B407C1385B6C577DA526F03C8C713463BA8C1C38F
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>.<FileZilla3><Theme><Name>Minimal</Name><Author>Fr.d.ric Duarte</Author><Mail>pgase.filezilla@free.fr</Mail><size primary="1">16x16</size><size>32x32</size></Theme></FileZilla3>.

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\16x16\ascii.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):431
                                                  Entropy (8bit):7.265901174227429
                                                  Encrypted:false
                                                  SSDEEP:12:6v/78O0j6bD+0GUND2YB+LmKY2Bka3lUscic:8h5GUNSw8R1Ga+Uc
                                                  MD5:87C5FFC9A15D5CDD8CD569CAF399ECCF
                                                  SHA1:A19EBD33C4486FB3D02B5DFA0FD7445ED6F370D3
                                                  SHA-256:5B7F643B59C9CEB15D6A2BE4F99783DFE881D5E228CB70DD094981CF31B2A15B
                                                  SHA-512:3AD18A4A0A68F9E9FFEAE82CD7732B9F3FAACD620F62B35AA79698BB94949A596E39A3372EA70CF4E1DFFD892C56FF3CE831BF064A5E50F98642D52793A0F0AC
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a...vIDATx.....\..@..?...wcL4.2.RF...k...m0.Cn9.g..<.,FFF,....P...r@.".D.........i..&..E.G.(..e....O.|?...8;;C.4-;.l......r~~...lt&......+. ........g........OtttP]]....'''".....~..IWW7.m.|.....y.'..?.)........~..!.y...D"....{...1L...5...),(.......3...B.6.b...1FGG............. ....RPP@ii)...TVT".x.x...B....C.u.E..t...D~~~fAcc.|$..I.mmm...Z .Jdy.@.c..........'.-...4....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\16x16\auto.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):408
                                                  Entropy (8bit):7.173949680245666
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7uNpA2GMitvGINeD6P3Z2Jn1BN3dvOghq1:nTA2GMOJNeD6Pp2J1BNNvOgE1
                                                  MD5:15E2D4DC877FD021401095D683F1EDCF
                                                  SHA1:D03F70D6412E00F77309B82B67656C0CA0CA2ABC
                                                  SHA-256:BACED0B80BD22B31BA27C5E282F5BDA8D4F9961461DCDDF07F7FE42F731ADD6C
                                                  SHA-512:AD197C0A948DE5988349C7271E40C6E2205BA652DB3BC03A5DDD2E4EC109AF22F21BEEC040089FAB05868E51F2023E16DE17863B6FBC7DF1AF5AFC6646FABA20
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...............h6....tRNS......n......MIDATx...j.P....>.......O..6...!....Hj.HZ.Jp.f0N.\/.S9.E".7.s....o......`....J.....|..0........u.Z......eY3......p..`.6...9.4M.f..B...$".0......t.s.G.u.m..0.g?|..u]/...{.@.4"..j...RF..\....7o.!..D.y...(.4K.>.Q.$.#6.xAq.w].?g'.[.l..?..n.]....cai..........k())Y.x.......333<*.\..]......>.x.w....@..5..qrrr..<0...NHH.k 9y..l^S.y1O.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\16x16\binary.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit grayscale, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):243
                                                  Entropy (8bit):6.677692120647699
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPmJwPd/ghk9VKKU4FMyfBEyUyaYRl/Vp:6v/7OiPlghkzKJoZHzaYRl/7
                                                  MD5:FA61B19B9CC28C333E3BD132472C96F6
                                                  SHA1:39E767B36CAB8F13DE3C4D7929EBA7DCB5C18495
                                                  SHA-256:96A7D4BEE2188BA7678CBD9538039CFE6F7753408C0505092FCBD5067084108D
                                                  SHA-512:A0FD6A5A6ECDFA3531793ED69DE2BFEABB76E260934048BBFDE9B4F9745CF315D5A66BA109578689CEC105249A32838D2CF948A517B8D3E2AB741B673067FD33
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............:.......tRNS..v..8....IDATx.U.n.1.......mo.l..-...6....?B..!_..`h..u..Y!......N..q4...3..."C...v>....C...A.X}z.!...cl.K...p+Ct....4.m.z..8...$S..2&.0t".P}.K)..P..dj.....`.P.......'...t..^"....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\16x16\bookmark.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):659
                                                  Entropy (8bit):7.633728124584686
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7tARA1gzNdHymvUlq3gzvT61idOg/rCK+4Invw3gspYmYeI0ckbbl:w27hdHyf4QDT61s1rCK+RmumYeekbp
                                                  MD5:38575C4B0464A1672964FE6A30365A48
                                                  SHA1:674001A1CC71D73D537EAD4F732ECA88442F9545
                                                  SHA-256:2EEBCEAA84E8E21A2058C81D25C88F268E027C666FE8D08AED67ABB4A9CAEED8
                                                  SHA-512:B70C8AA007BCAD2D7E74EF928A882D248FBC7D561E5AD1F5989DAFC56BAF895FCD5B0B7C81C97AAE4CF69FCCF1C011930A3E9CB48D704C3A6B35DBBD54A33045
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a...ZIDATx......Q.....m.m[..N!.].m.6....?7g_W}.....y..;Xk...4....G...._..eO....=.Q..5.7_baoc.\..K..55.2...4h.e..B.}<...5m..f]....3.1-S.a...N6.H .. .,].L.Z5..S...J.....RsJ..........m...I...`&....y-[.OM...v.0(4.6.......dG.k.:t..3..R.N.h...7.E........p....l.t..W^q.C..E32...\O......"(.....X......#c.s.m3Y.....wjX..($.\"..~,.....;....$......H..s....~.x.-......sHZ....;.7&A.....w...K-..jPf%.{.'.#..%...4u.V..<.FWK..%h.2zNP.3......f...'Q..--...0DD&'GG.h.3.{d.(...4.b..&&. Y#*V.>..|r.+d....9O....&........v%3E....*..[........%..u....N.....V.y..8.t_..[).L..*8.U..Y...K'.h.,...k.....'^.z.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\16x16\cancel.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):643
                                                  Entropy (8bit):7.514071061699672
                                                  Encrypted:false
                                                  SSDEEP:12:6v/79MNJa43nUJ8UIe1IwZxYUzI9+d9Tkul5J9xH5tMDwURVvuucy3Pg1cw2rDxs:gUJaCnUJ8iyQYcIZul5tHXMEo2pyfkz
                                                  MD5:A7C392870E81052B555F190D48FFF8D6
                                                  SHA1:9BFD73A225F627D2E66A494E9506044D21CA87FF
                                                  SHA-256:B1503DEDFCA7419511395FBA3377527BD9983DBF3F373B260A6AABBD89859DDF
                                                  SHA-512:D892E63E9EBE4363B26E3ED8F24440A28E4242BFCA3ABAC3BAE36724B4D7FCAD49A2C612F4620A1EFDA8A0FF5F67084FAE0C394C7D57BF0E04A2923ABD32A4CC
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a...JIDATx........../i...m.m.`.m.m.`..m._.b...oT.Q....}..t.UF...R....Z.....r.i..~..y>>19.+{.....QE.u...n.I.....o.$....ui^g..\.....f@...........A4i0.{.S...t..5*Oo..m..\..<=....@"J..t...Fj.2..Q.AJ.....M7H...#.C?a*..8.Q......Q....... .....@"...H+T.a..(;..Ha..O.0...B..5....B..`Z...A..C .$.. .a..#..A..........O."..d.....,..E.p.,..{.q&..(.@.#..A..`.4............n#.Y.f...NB """.P.I#.....@..H\:..+.!....'.X...%PB..)R...Cd.R}.2;mrLt......$.;..".\8.....%......`...{e...E.k.=.g...9[.....n.....i.#.I26.....a....b.E.......RI.Sm%.."H.-.{.t....K,...\....@.D"...w...{w...G.~.P...C....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\16x16\compare.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):870
                                                  Entropy (8bit):7.706212059387156
                                                  Encrypted:false
                                                  SSDEEP:24:rDbQu6tMc3Ryxz3KWDA//IzZ9tZ161cPpzf6wVQq5erEM8x:rfQulERyxzNE3U3b1rPpzcq5era
                                                  MD5:76C81EEDD0279A4BD28FFCEC055C7348
                                                  SHA1:74CEBD04B70007848B765B60667FCE50033508AE
                                                  SHA-256:98DF84E579D4BEEA20950B22720641203F3ED67C4C845C7B4EC02C7551C85F9A
                                                  SHA-512:F94A6236F4D8DED3EB82B26B859E80ED0D9577A6913EA7F7850ED1177C0BE41B7740FC02AB789C743EDA55AF4FDA492D31FED0D56FC172A7833ACA358491DD08
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a...-IDATx......G.....U....m.6.j.v.T..}.b'....Nm|cC....9...-......uK..-.n...e..c.w.::......[,U......p....|.5...g......Y......*3..,..(.]..T.q5.!.d..c1(...\..n..z.....>=5......WZi6./.z.Y......}=.....z.g...#Y.\..~..F.....[o.z........E4<..V[..f......C..`.2..8..?.(.z.....<.8C1..(......a.N..Zw[.....d.a\lR...Ag..>..C........fC...j...%ERu.{..:.E"..6....a../.....L..eYK.....d...&C.}05.p.I...(Z.T.........*.t..8Pm..,..e..(U&.Q@4A%u..-..<`......'...lR...~Yu...s...jx.....V..[.M..(.!&.r.f..h%..:..O<u....X5$.V......c.6...?...(.}..O.K.u.....V..0:.N.mV......we.U..Z*.;. ....ib..D<.0.*..G.<z..... .v..G.x.w.y..43.kOw.'......c.}..R.....A.0.Yw{.?.T..'.{...........Y..L..z...bI.....P....;....u..v.E.T..q.._...e...s...u.._|......#.%...n...DG../9..3.'........tt"v...|.r..k.rq...C.,v.4.<9.E\\"..}..%+....u.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\16x16\disconnect.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):677
                                                  Entropy (8bit):7.569978264591361
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7EHutTZTQ/FpjxX+29bJvkb015csoGcUIL0ek7le9lSnOW26GXG1:VOfEdv9pC01jlUlSnOWRD1
                                                  MD5:6FDC07BC50534B83050EDAC3BF08C53F
                                                  SHA1:F78469B0E2DAA7BAAF2F5E8143F2A850E0F3DFCC
                                                  SHA-256:A62AD5301207902E9CF7071489CE5F176FAC7E012DC16A532D4FC996EB4C5E7A
                                                  SHA-512:F669A58A085CFDCF6B989253148FB560E0AD1B4DE068942D4932974E977D995EF939DCA504964537C233F218F698C7F3654A7216103C3AF116CBC2B9DBB7F880
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a...lIDATx.b...;:...;....u..o..<I....5...g666^jnn.........b]]...M..;R...O..n..@...XG....XO..W..wR+.[u.k...m[...3.o...9..v..v8..jk..`.X....c....& ::Z.r.P........,....%D.& 22R.t:A!...9.7T.t:....*...."h..a.7.pj...4..I.p.....W../Y,} .....9.'..c.N....P...\h4.p.....H..1...-...)d...V..e.._]..0.@=.eY.}....:u.T..-.7.MB.T.B..es...S....4...AC..........9|.0...r....8..$..Jex.0x\+........nr.AAA..v..pT?..j..h.34....9:x..k..v.8..+,].Tj.O......4.....xFwp..>.].&.g"Q..?..M.I.g.I....R.P%.u..A$.;:..?xp%F.*..0.......h~..!.RB........B...........c.....7._|.7.l..k..x.`.H`.r...sm]>..}..........G..-[..D.`..k.:ij..t.....9mt..!K....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\16x16\download.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):527
                                                  Entropy (8bit):7.429145983514361
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7kO0IdUldogxRLXOB+upUah+JWI4sc:GDpgxRCXUQ+JW4c
                                                  MD5:6F1EE5BBF770201BBCD0801B6C59BA84
                                                  SHA1:ADAD6ADC5B0B320CAB16079DA78A7860EE4AFC2D
                                                  SHA-256:93CFB2FEAEA7A22581BB67DE75F42450AF39805CC2F33F5DCBB0D959C81AC683
                                                  SHA-512:BA56C48B88609B1BD870B58BDC53B1E4F5973FFD24DAC4C789B8EB31300715E67BE73D33930471094458CDC588FCD7564827629C4D5686F7AB0BDE1B9EB0E64F
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx..RS..A.}..m......!...m.?...,.=]....(?.E..~....T.X.R..U0Q..el?_..)...? &..P......X,......X...........6..X..("...,...L...-..#,M.P[g_.6....0W.).,.9.I.E.t9.MJ.".....N.'.}z..0.I.........!.)....=ra.#.E.d.Gy.%.kP.4.r!<..6.$..T...@....J%/..z..G_..0.....vk...x...Y...<....\...@....~^.A.i...;.5.u.<..vi$..}mW..e...B.R...\..g..j]m..._..p.#...S...x%..........O.7..4.......`.......G|...8....K.....S.Lly.el.|.....c..oU.!.}....O.B..Qt..@.......*.....B....Alj.B_..9.x....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\16x16\downloadadd.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):578
                                                  Entropy (8bit):7.518615976512269
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7g7jl86prUDWKYR4BnppWno4B2wxh94MSY:TjleSKgGpaxTtSY
                                                  MD5:D9C835BDC68992D007B4C7D5F64DDA21
                                                  SHA1:8C6C9CEA3DE96604C471A92C8128FBD65C371D03
                                                  SHA-256:C81CF883392446CEDC7776C8483885072F47496B2CAB6E66A2EC367F9FF30318
                                                  SHA-512:9AC3E20D77E5B7051767D5A8349F65FEC14FC47B3A63ECF58751F5E65A697C1AF80586A7C80D26EFA8CC795ABDAFD48CB2CF53AB5D7CDDF81390B843DCA990AC
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx...3........yy.m.F...m.6..L...:...r.........U%...s.o....U..!....'.N|#g.&.g...*.c1.._G.m..Nv;x.....1w....W....B....Q*.....22.d..8....:.A....:.#..!.....pb..%......u.....DO.<.}..%.Sn,.ww..DP......&......aqI..ABdYd..\W..@i.U...X..W_...?Z..f..'............D...u5..2y^"..E~.l..._V...[..H...A..g...7Dy.(....]\.../'x.x.<qN...gD.6....`....../..A..H../.P......7.,:<].0G...+.LW..S:..d._n..|2j...dz..........&=.....t..).)x...I7U.Q'.m.6$.......0....A......*.D..].lH..F.......eO".....<2..,.......C3jE.3).ww....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\16x16\file.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit gray+alpha, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):184
                                                  Entropy (8bit):6.309989587011825
                                                  Encrypted:false
                                                  SSDEEP:3:yionv//thPl9vtJK6Ptash+rWbb9FnattUrA/PKa90+MK1nnR1xglc1fTtRGDtWt:6v/lhPO6vJvn8UrAPLtL1nnR1xbTLG4t
                                                  MD5:52F974BAFAB1FA8618307EA8E96B83AC
                                                  SHA1:8DA59C0A32961CDA4DFB9816F2239D2126D16FEF
                                                  SHA-256:EB05ECF138861F8148B4D2A9118147E5D7B4329269642D60B87638AA70C29992
                                                  SHA-512:1DE291680981141A070A4913E470D7D6681EE3C9560370C7A7E27CE396DB38D6575817910F0363DA5AC6E83ED4D7FFDB141BF5B543E3173E0312BDCCA942A944
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...............7.....IDATx.]....Q.E.....}.X..}9E.N.H.d..rx[y.. ...r........K...I./P8..q..P......B:h~...5..:...#.......H..f.B.'Na.-.....?-<v ..~.X+.0z......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\16x16\filter.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):561
                                                  Entropy (8bit):7.457433216032557
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7qZWLYpu4JWTT09DH2KTJQmeWF1CRpf2mRRTkkml7:ILF46I0KfeCsjtRCkY
                                                  MD5:8E715A8D58D1404D76CA577934514379
                                                  SHA1:6B7AAC2360658514D72E417848B3A949153EABEF
                                                  SHA-256:12D03B79C33A8E2230EF691CE03FDD4B228FCB8B73B6640316CF6D2BBE77C86F
                                                  SHA-512:4B2FDD913AC36A76C1FC6B4698532160A6CECABC82BB47DB5D4B80094DDD29D1B55141283D6EDCA06A9CA72BD8CB067F1EF38A35A80A9FBFD24C76D37E22F514
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx...3.|g.....O...?.m;..S.M.*.6U.....m.......3g..wl...+.9..=....~...v...AcO...k...F.s+...*.l.i5M9....?.K3#'O.....F.A..z...R..?..r.V.R......U6.;o.8...)........"..;...b.R.b.r.5u.7..S.&...s.s..&..)f...gv..."@.h..y....6..[..m...d.....c.P..<...6.bs!.Q.9.U..`..L".5......f.....E...P.....L...O5.<......c.shl.h.P.R.5..1.`.4.4.....UP............'}..f..S.....f.........J....'.g...O....0.(.yhx.S.<......4...O?~....)%!.U........F..I.\...c....E..M)..K.....mf|...?.,L.G......V..Z#._..|.....-zV.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\16x16\find.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):720
                                                  Entropy (8bit):7.535273923212619
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7p+fyUFNbPBHrI0Lk+iemqvvGkT2KKiaqO4MvenaEo02U3Q1vpxPk:OMLBLI0oz63+KPaqSeFz2JtpBk
                                                  MD5:67011F382FD217C10690AE63599E3D34
                                                  SHA1:EF4F9182075DEEBAD12038EA5AA16EF8FECE15F8
                                                  SHA-256:878DC6515328A10C7C0B7522ACFF32FF62B065646E7A3DC916DF6F96134A3FF4
                                                  SHA-512:5ABB89BEFD99A66E56DAF68C272F8BE491F6CF65114EF010BB5C76B845E546659964B2CD3A184EB94FB0DC7B9AEA932CE2A6AFBA52501DC7889C75FAEE83675B
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx.b.:.......O.......7...Puss.LII....3..YAA........I.&},//................rrr|X5...qfgg..0a..Uj..+...m.m.m..m'].:.3ml.8...(............9..@OO....@D..../Acc...~...3Pzz:\]]....}...@~~>...0<<.i..L..I.sNN.(^.......:::'..M'''... !!.....]!..'..h...@ff&...9 ...!...E".)........(......I@.3.8f/44......-m..[+.. .J.9,--EJJ.LLL...E........+++hjjBWW.....JlmmW..b.Fmm-sJ..1tRR..%.EVv6J......emm.....6...... v.........&5Js..5.9.......kg...........R=].'......d..D?OP.9....w.#t.$..O.l.0....5.....T.NN..E[.s..P..E.....[...../..o.../.o.0.h.*_.O.G.-'3..e..X,..z..m...^.H$.v6.w...1U...h_....)iZ?.('..^.Oz.c1.P...?XXX\...j.P(.".Qj.....}._.....Y*.z.P.-i....8N.A#.?.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\16x16\folder.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):549
                                                  Entropy (8bit):7.444281255672434
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7ujrjVmgPGD2nBa3e082hSkd5uNKYWlWrmBTnFxnXB3eLLR9G5drq:TJRuDqtkfuNK8SVFxALLeG
                                                  MD5:6317D91C90DD11F5A148BA8600DBF490
                                                  SHA1:33E9F90465F279C75753035667B4BEC5273349CB
                                                  SHA-256:483A537A084732D6D248104222F4325E2D0550F096325B461F133D2047CE97DC
                                                  SHA-512:38DB07DCE564DC6F4E35CF6FF3DC0D1B4D957821B711074FDB54FC0DCFD916113E080A99C369947B28494693B34AEBB789DBCAE6290BDC25A2BE1791901B8BB0
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx.|.C.^1.@O^>.m{.Q=......{.9.m.....[.n.w.Q.!....Zk.qC.O..6r`i*.).T.T...8.......W;...y@17......1.o..jO.;..x..._A1a....y...F.s..c........).U~..s..ui..bOI..R2...*&fN/(.t...)...J.@...../=/X..A.K."......1....n@T..Cv.....Q~..@b.7.. ...X.Fc.A.Z...o.r.._.....g.Y...B......@...?8.....fm.@........u3sN./..B.1..PJ.7.....w.Na.0.(....4.J...TQR'8..( !R%2ZDK...qQ..U.;.z....~f.zpD...........N..;{...K....S.T.'......|.Q.....]..............I7..(z..[CEQ..o.............2...M[..t:....o.7..J......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\16x16\folderback.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):608
                                                  Entropy (8bit):7.593731206176663
                                                  Encrypted:false
                                                  SSDEEP:12:6v/75INfQSGZoMBWJCyS4QXV5+NxCLDplJ82AJoTwrI5IUO:+iPI82+38Dpw2AJotO
                                                  MD5:204DDCD8271F4E9E14D653F6B55B568D
                                                  SHA1:2502E22BCCE9F28D07729E8BCC73936F5DDF9CDC
                                                  SHA-256:3D3A6FAD6F5FC366D8DD989AC06C747058298E01E5CE29A5B8CFFA650D16F9A1
                                                  SHA-512:B8D9D2305DE5EF2B7EE2ADB0F6B020A2D112AC63FF42F301AB7250EAAAFE9A4250724D7FCA0D65382BDD4EF2036888A68E6CCD5B7B1E6C87A92584253909B7AF
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a...'IDATx.|.3.]A.@...m..2F....._q...m.g\..6.5f.Y"BS......u'...[6.{.v....|.s.]6}....8...A]..l..z....c.....R.!.....K.|.hP0.s.E.:..O....W.C..hf.....4.P..,... .....l d}!..r..h...j... ..Ak!..| 4.A...2...IY......a...$..\R.X.(.E...y.4.......2.T..7..ai......(..q.Z.f.e.d.$.E.NE$K..k.....b.1......?.....|.(.AT..w...k..'....5.D.)`.u....\\9.T.c.,..F!..o..9....+....O.V. .9.....Z.?!.#,K....s...~d.}...a......\\5.6..R.0...\Q.yQ.....!.FL[.._.\.0......S<..(.....y......;..c...Sa....J.bJEg..l..e.g..y....3....8@................Dc~.b)>.\.d1..Xf#...#....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\16x16\folderclosed.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):572
                                                  Entropy (8bit):7.466948882485816
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7VCqKr5vE3T0Nau1RLArtQzV8+kyjKg/RH7I/A7:YKrdE3T0h1hSQCDYv1v
                                                  MD5:F62B4DC63CE62618BD4366160EBBFC31
                                                  SHA1:8B322D2BF48FFD20E613F5BFFB6FE5D7E8D22376
                                                  SHA-256:6377353E0CDCE7FAAA80F66DE80787D92E0629B57326AB1658607EDF663618A3
                                                  SHA-512:9299A0A1E0396CD826307244778E0D951B9E5DB27CA1711F87B2F73741D34DC90D726A6F504D9018EFD78A7DC5C922B18AD2245FD4094B6547F3A23CDA915BB0
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx.b .,?..u...R...1^y...=.5ar,0F....j.|.*_Uy..U.l.5..A.@._=...;D..w.@.I.9.)....3......3k....Z..5+.5..z..S.......,.2..c.y.RI...D........f.M.;.T......U...1|_../C]..d.O.v..D...c....(u.F.....6..S......+.P.......*.0...IC...i..@..TA2X..3..`.....A....b]V.......RB(........B..zR......*JA".......d...n..;...;.z...B..(.C......p...|......./.8f....|...$.....`.....u5Q.O.U........]`.}...+I....Ij...EPD.. )..?.......K..>...........?.u..==..`.sNsJ....*f.....+..{g......]}.f]..z.@x...UW.....k.M.>.....&....$......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\16x16\folderup.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):738
                                                  Entropy (8bit):7.651534126730263
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7vF05+dAbkKbNX3CbcJw443prjfIPg/gsxE1EwseCt46YgFmQvFBnj9:M0Edsso4Z/IPgHOKwsz43uvFx9
                                                  MD5:1A30DB573D845F5EEE2F24D78A7E2201
                                                  SHA1:C3BA6A171615FE93A723873E5BE00B026A5E57DD
                                                  SHA-256:2617350A14E29058F2534A4497E9C1F226AD209D0CED53101393F0E3FF80EE1B
                                                  SHA-512:BEC9DD57AA40487F757E8368805F2D84DFC9F769D7BB94BA5A0AAAB59C21AF477245A8F7C70973621C4E3065A92EA4A0604DB117F544B93046A2DE9CEB7562B0
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx.b@....y*.K...X@.%..0/?qW.....n<....].'....v.ko6...4.h.9y....q.4.lN.igK........+.3.##H..*r..&......g..m.m...q......V.....z.L%/.....H.3Ev$.....#O...s..k....}x..1Gq.... ...~.Gw3E.E..$.:.#....e.(...Y.Q....O......e0(R0J...3o.....yjj.|X..)........&.....~...(.W......L(........ok..9`..[.9lf.aG.{..{.]q..B..1.C.......B..P..TJ..8...5!.H....Z&...=.J..i...'..Ed.M..U..A...E.$.... I....."..D6r...h./JPp.B.x.3.....?....../.....'.y3.R.Tw...%..B.>f.N..:.."..N3.......]z.e-E.8Q........X.rT...4L.3%.}Sm.4g.m...xG...D....X.Z....LWso.m....*...*.f.;9..........t....T."L...\....}o.......~k..Nv..@.BT. h......~.t..)...V^p..#.j...y....Z~......A..)>...d1......1......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\16x16\help.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):746
                                                  Entropy (8bit):7.6338526235497435
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7l+BC1P3A5vjBB+VDpNdWcIU5n3l21fFVy9sh/delKLuX9:WGgY5vj+vRpnV6MeMU0
                                                  MD5:98958934D95A95342F55B2C19DBBD45F
                                                  SHA1:DDFDF50D910ED570AB29FB1D1CFB8359686195D8
                                                  SHA-256:5589048C6E964F5FA1BB4A4FB1748F9BADB18C5A4D4F1F9D403F1CFC08E77372
                                                  SHA-512:820BD24461F45BB589A9E7D733C12631981052C463110CBC4C709992984171B02FCD313719C8FEE955277F683059326216EBECFC170F6D9E02EE82CF3763843F
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx.}S.`#P.ko.m.m.g.m.m.m..o>&..c...D...dg....>.......n.....y..z..~y."..M........o1..6j2.1.+..%\......"...r.77......L..U.1..C.B.q...).:.42.e.>..O..@Hj........Qo..R.< .y.}...../lk....J/1<....&)..Wx.)...[[...;...@i`..............w..~..?.H....@.V{q.....rCM..D.|..ih.J...q...z..;.m...:.H,,....6..8ffD9/W{..3%.c.A.!....bM..........C..../..|...t`...v..l.$..V|".....@.D...<X..'.]UmjXj.. ):..TS..s.._%...P.'..../...x....5......f.U5....F"..N.-4).:....b.G}ay..j.'..fH.u.-...l.-K.@...33...5...h..D.R.6o...j.j....zr......$!`..~,.+...up.r.c.<E.....Z...m..(.oBzI....E.4U`......[.Z.)qm....W~;...CJ..........R<...d2..W.x....nV.r-......B..Zl6fb....}..HD.v^)=6~y].$.....(.s.].......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\16x16\localtreeview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):536
                                                  Entropy (8bit):7.489133032978834
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7ewf3j4Kw98IUvitrjR7Jih1Xsh2XdY+xG/r6TtSQ:a3j4H79R7Jih18ISM
                                                  MD5:23C8E9C541DD306DECB5C066C759355A
                                                  SHA1:B51D1D56EDE598623C5C8BB52050751AC35DAAB9
                                                  SHA-256:4A2F42067FC7CFD6CA98391195F21A8CC68F30089DE0673132C9D2F59507462D
                                                  SHA-512:90E4182366599614C909DEC1B9299DE8B1323C8B60FA04FB5A707D01E7D48BE7AB7AAF475D09DD057E98CD1245F60011B45A9B12F3CDA7B3253B96498EAF26B4
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx.b...?.%..m.....!.. .......m.b[.L3.N....8..m.6.~t.u..;.f)..&...>....;..T..AT(%.S.I...".l\.b.@..fM..<'.=y.. q..%..CjT...R.c....JV..TJ...K.<.............J.Z-.R..J.Y`....5.-_.."/Z_."h.$q.>q....%s..D1S..Ty.q.9U..K.=...Z..p\.K.z{{...c.._&.......0zp..(.!r..m~...>|H..?.sA.D.3o.?*..3...`..|....s...... ..#....{.}7..i.Y.....di.........B.8..x....$#.....(W._......^}......38F.).0..|.".^..9~.'...Uc]OO7...I...}..L..UATq.......ii..fLEQ.g../x..=f.[71s83T.Js......{..qT.<.zX....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\16x16\lock.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):780
                                                  Entropy (8bit):7.637493245707135
                                                  Encrypted:false
                                                  SSDEEP:24:yG0emLDp23hNmim5N/xxKzcHzgyVqOnoa:yjLpCStH0yVGa
                                                  MD5:681B21AB5DABED0CEF13F7D6E0F06F24
                                                  SHA1:8313CB011C469B73AD2FE5FF7D6BA17B1095CEB1
                                                  SHA-256:D4CD5046A3D89A259BD0690CF76D0CF61F6A19448D77149C3AEC2C3194367275
                                                  SHA-512:7B8A705C6A785E67E5060B7BAD05A47FFCDB852C8F2D4E04255D47B1947327160B76B4184566AEDFC964A0A4A467C7CCA42AEA1020AEBBAF8F4540F065701C82
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx.ba@..M.Y........caa............?.Y..456e1.......O.|......|.x.....-.{....W.^.?a..MMM.j.......Y.T.h...K.J.....X.(.p..../\...............r,Y.d.C.....-..//..{..........Ta.Lp....".......4.Ns|Y.m..u...m......zu..).TJ....*....02<.........Y.R......p'J3.d(K...m..j.....f}..#.C..(..c.>..=........O.q]....&....n.O../.......................&..".Z.4H8)|....C.:;...F+.`Y.|*.)...W_M....'.'...).KhL.4q..!........d.a...H1>.G.$.Kb.cX.i.P.".H..eI.m..D............U.{G5....e..op..............w...I...pG...`.qS..W.h..\....W^.[7Bkw..n;.a8...1.E.E.$..i......:7MP.a.2.h..z ....[......(..w...S[S.l..Hu....<_R..NO..'.\yW..x..3''...#...#..,R$E....#R)..s..Bea'l@... ...}].|.P....N.8*}.'.+&.@...>..B..%..,..RvU."D....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\16x16\logview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):479
                                                  Entropy (8bit):7.366617553120918
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7MWOc5U5XcN/YAvvbMQxxxeaPnHbkM0g6rbXI14ToN:ka5e//TM+PHbkM0g6r014MN
                                                  MD5:7ACE832D55D10A22C9B197C59899D06E
                                                  SHA1:DFEC795C5BB67243800EC1CCEA270AABA32983F3
                                                  SHA-256:9E646B0A9C11CB5106C8454D158DAABB2D2F4EC7EDB19E25D7AD7323BA68264D
                                                  SHA-512:0E6E14AF5607948DFEC1FA73170EE6762AF680C94A4E5C6366C3F3B2720DEDC0D8BA9BF193FFE332D0D0B2124E121CF668B36A9D63B2A712FFA773AE36BC7B87
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx...3.\A..cV.m'eR.F.5.Qo...x..m...}....Y.s.........q.._.y...Ax".".........!..$.....Y..rrJ...pq.~g.h..g*.8.N.x..M@.m2"/O...S.R...3(.....a..{.h..o...W....s..........h.V......#..H.......j<..2Pk...)wV..^8... ...=o.j...w}.*9o.z.t]...Z...R.#....T.*.1a...M..D.......8.....a.:<...z.@+].Vn.R.;.\.I.=..J...cT..%%u...8._..C...yI..7.A.... .G....99..a'.Q_...>...x;.._...h6.$.....]+...=..H#....^..Z.r.f8.P.ZLO%Qx&...s...G5c.......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\16x16\processqueue.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):889
                                                  Entropy (8bit):7.726921851618158
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7MRT60TbNnmwLEPi99epN/wmw96/qSWqcyUxasagBLI6+gVlbw+mOk/iJG+vR:ZNBEqSNomV/qS2xxaau+lbbI/pMSLw
                                                  MD5:ECBEB06605C1645E5ABD1E9E8169F95B
                                                  SHA1:3C15475A53C95D8561867DD72DCFFBAD8772B152
                                                  SHA-256:1CCDFF248C2CD29D58C27AF1F29A18A2745AE0DC67723AC67351780EB5FE24E7
                                                  SHA-512:0E3756959766938977BB4652A7A921F7A5143A181A18BE900264503257309D8F4411807D785C251BA8AF9A71FDC278A767EF2C91785EFFB7E4CC4A1885D2A21D
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a...@IDATx.MRC..X....1.....u...m.=...s....UE....g>T%...P.Go....'.X._.4...w.[.o/n......eYnt]...ah1...S.._.....`{.]....].....\3...7.H..tP+.0+K..\(.^..0!b#."j.&.5.0.F..(_q1Ay~t,.....0. l3..2...kP.q=.<...H....'.z...d..T....4Q.........K_.=D...9........eL9T.U.@...F/.}?(P,.!.....S.....7k...iC4e...T.h.......`...LOO..x..@.4@....l.m.L...E..{.....x.H`..._...m7.d.}qnnn9.H|K........s..K..X.8r.G[..g.&.~.l.....MI.....x...{..~[..._..>.m".H..M5.......:.u..s.yg.w.\..$?.....wg.9....ogYv-...*..T4.........|.Et.,R.....A..@...Jco...&Ld<..<.....a9.$...b.b.....(;.lR!k$.1h..k......>..........Hc.....Tl......KzQN-+...P.C...._p......\....(.K...2S.. b........a...TJ....[...q.... X......T..].,.29......BI.....T}x..5....Ct]G.;..h....ZJ.g]..x.....d}...sJf..M.T.M.T...u...f.d....o...md.....K.........x.Iq.....@.....w\..'.....t.2....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\16x16\queueview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):466
                                                  Entropy (8bit):7.333178197092268
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7DdYRPKP0ZfG7vX3HteLw3Ziooq7wIhkq93mrE7:mdY+gfG7vX3reMwNFr+
                                                  MD5:1395C6FCAEB46C0DF3CB8451252A08CF
                                                  SHA1:F4815FF4760E97EBF2021438A2FF9CE621E9FD73
                                                  SHA-256:B90409186AD9EF894F146E2BCEFACEE818915CE14A1D4E42F75979D15323835F
                                                  SHA-512:1FDE70CEF4A5B4D050BEAB9DCD72CB5C4E307A0FE79E025AAACC1EE9BBA29C7CBD0FB13CBBD67B3EE70BCF5A593E809891F875D1EA718163F1D71A3BE184FB53
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx.c ..N..../`.K.....?.=.{.C..v93.e".x...P.6:..m|....q..P.......'...a..D..Z...j6.UasN...e..5.b..6..'..m...h.Mk.._.....s.....e0.P;*........._..[.q.o........Z..w(.S.+._.V.R...iW.f..x..}....I|7.'..B..~._).Iq..O.....T......%.-..a.o3..@...H?..X...D...D...T..2.|..:.Z....N......1..h.*.`..*j.RSXe.4.h...x.0.x.(.D.X.z..3.......N......DG...F...^.......0......../....dF....].@ft!.....[....L@0.p.......p.1....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\16x16\reconnect.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):720
                                                  Entropy (8bit):7.633461318989507
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7p+Kil4D4QvJ+xSmulQbXtSt1T2y7pwp6cZgJXLYkL1POIw8Z84cnO8Su5DSc:OZy4D6Xk/T2yip6cKLc8S4uDZSk57
                                                  MD5:B5CB370FCEC1442120FCCF82536014B9
                                                  SHA1:659BAD40CE3A261D40F8092F0EFDD790C48082BD
                                                  SHA-256:6D3046AD1956455323F8AF98BE89D4410DC3AC8234876D898F8EED9A3D3A88B6
                                                  SHA-512:992F834B13ABB47E6E416D097315434FA37A082670667ACDC577E32F4738E510F2FBEE072F3863CDD96824C1E4FDE018E077B2031081FED3E66F1CE5CC39A8E8
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx.b...CB.B.".'%..G.&.0..,m]Xml......f.........qLf.mXG..zf.u....:W7..nnn.|}}.;.z...s)..V4.(.:+........8....m3.m.o.6j.m...m...3VN.!f.n3...X.w...J....G@E.m......}....N+~J ..ok.z(...E"H.R.d2._.s...b.U.L.C..8...s../..f..%.+..l6.mvX.Vt.....6G.ck.>...e..7...GVE..Zg......9.^...;.CS`....q.?.q#...../-.kG%...V...=..G......=........J,:9..B..F...CP7..8...,D..A.6p/p=.....u.2....t......M..sc.....].1..X.N..{<...BQ.T..C....sC..v/...1.r...2.3oN....ky(8...&.+..~......C....F1z.3..C3.OH \.CsySt....U........J..........'...9.2..6+...?&PRs.4~E.S..w..S...e..d..eCI.......>...r.r..~../..s...y)=+o5.(S..............!19.kt|JUbQ...!./.......b......4..x.6....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\16x16\refresh.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):725
                                                  Entropy (8bit):7.6482137925537845
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7skxOju0F3Or1PQC943QaD9RVxNbW2C8x712WYs3bGNUigKbZcdOF2LvE3jFk:Vkx+F0PQ7377bsw7HYs34hcMoE32
                                                  MD5:D3D1D467B8CED3D081CE9567FD21178F
                                                  SHA1:F891D40DACC6CF100E185C27A251566FCBE0400D
                                                  SHA-256:32EF9005B6C120E5A314A4CA20F1F08F5F02A6584A3B4BBD2711DFD0CD359F5B
                                                  SHA-512:153AC3930ACED1E6BDAF2EBBC6E97E7D5FAD4C873FDDD27C8A2140F6E08E2C9A388CC8B458FD11477AB1C93AFF0BD807BB555B0920A48046FB65C8F070F43318
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx.b ..z.M...VA.g"......h.....fgw...m.Q%u.2f.[ul;......g~.../>...?.....C....:..Z......k.. @9...t.."..0..y....u....\.J<;*..\......8.x.*p4.Ga .,....v..*$\.Y.#._.]..qQ......Q3..i.+....!...c.e.,Z.2.2.t.^".Q.t...}....w.,....B....p...S.5.AHD..E...e#...B..}..{......4....,.N^9o....+..pm..r.v..z..(5.....{....='..D....\.....:.V...%.{..'..z.....)....~..Sl..k....y|......O?...K.-C..]R.....]....C..C.G^..jh.....[}..>.p..!Qv....E_..z.]....=.R.s~...\.......R....M......Y.jQ....W.Ra..I..To...V...w.u..S.}....y0......!...`..1(&....\8*...f..hU...`.....%.6.5t.....AS....Av...H.EG..Fw 1..fh...F................8.}...dM...(.i|g .p.r..h.'V=.... ..2.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\16x16\remotetreeview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):750
                                                  Entropy (8bit):7.673095567638909
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7jx+Q3ZTb2qrneOMFFcnWwIfvS5Jm6uivFkEKcBoiDVonVtBGfhzK8aeA:KZX2qrzO6vvOcVDSnHBGfh2R9
                                                  MD5:879AE3716290A114AC2E1DBA432EFD77
                                                  SHA1:EABEED38702C42F24661635BEC421D45AD86383C
                                                  SHA-256:C72217406E7F3C1BB45A5154E88376833AF99F6D288BBBD3A42C90888F4090DF
                                                  SHA-512:F4EFC928AFE71A565A56633912B028E0D227C9F3140C2568C5C42F8978232BC4A9083DB7E5A5E94FDC0FA9F72C90487821F29853B1162C67C862E766C9107919
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx.]Q..,Y...x....m.6.V.....m..m..i....*..E......[I.;.?9.?.<..|..e.......'.?i`........'..?~C..>(^.-.Z:6......k.......(x....v.z.{....}.q.|n.....6b}..|.....c.G..8i.@.m.3V..Z.8C..a..:...(6t.).p .E.c .p..N.,.V...Y..,...u../D.n8d...j.x.a....$V...(.:./..%.....s...wz.D.+...$B5.mG...b+..U.M..w..(5.Y.y.x....vq.Z..{.pj..km.:e'....(.`.%Q..)..N.x......-`......O.A .. .w..e..$.<...c.].&..*.....r(o`p0.X,.n.J.....+./.@"Ap.m..a...`.'F}...._....eY(.-....l.:lZ...1.z......w.Kf..i.^o........(..B.....{\....?>.._...p8.sb~D}"..$Ib.e.qB.........S>fQ.u86m..$.ZBOU.l4.h4.].qB..;.5....t..E..F..R......B...]....C3>.)......%Q.tp...>...<a....<.`R.N..H..A....HC..r.Q=...\.>......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\16x16\server.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):408
                                                  Entropy (8bit):7.2172892219169755
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPWCdkFaMVi9TOjoHXY+3EkAJhPNpe031V8e6qKH/VHF3lE9zJlIp:6v/7tmFaMA9TdIS4So1V87qoVHFm9lli
                                                  MD5:DCE954754C128B3FE51250C64309E87C
                                                  SHA1:DFC6D57265675DFCED06EFFE173930E52E931CC0
                                                  SHA-256:A6122501B77A7B5C28FE876ACADE9B24A6890D2050EA34B0C8545FE92988C545
                                                  SHA-512:B0B215F116EB2191AFC456C7EFFD5E08CEAB793C3A0C675E68CB97773F1361DAA85A39D34DE95C047EFC37A49A50A3A8B16A3CEAABBDE10C268A3253A6EB7A44
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a..._IDATx.b@.M...O..........5 .d...Z....b .f.|.w...G.........m.c..0...I5! ..?,E.....!D..e.3.....N.y\..r.J.r.J).^tr..5.T......m...v...Gt>..E..f.G..`!%N...'....U..Y8......).(^.l.....|@....J).....dt....I.....y.x2.[..P...<e..'d....TpG..}l.O.......Ab 9.R.O...*N.. <..`..@..U.b..G.AM....,.jl.l.Z...@b 9...Z....6'd.mY..3k..u.. .-c.s_.&.>....@r 5 .0}.wM'.H..?....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\16x16\showhidden.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):694
                                                  Entropy (8bit):7.583789062569368
                                                  Encrypted:false
                                                  SSDEEP:12:6v/76y80HdC+nc0fbqKHSSiSDT2fRsvUKqDhmBbs3l6l4Xrk5tBcZNRI0uS363sm:m8+lnc0+KyVSf2JcUNoBbcUyrgt6ZNRO
                                                  MD5:19C26B4E74D39AD94B8B7F7D9712E588
                                                  SHA1:50A09E98F41963467239BCFE24916281677AFC2C
                                                  SHA-256:B9CDECDB91CF8412F80DB64042B51FF23A48C158A98502BC075887A7FEFB7C7F
                                                  SHA-512:8C0D3BA0C5FEF5F6E4BD47B7EB60EE941DDEB8FEE53F904D81E784964105691B18F6DBCF34DFDD297C9DD2B9B8E37692A1AE8E9A8D640C0FBFD38FB06DEE36D7
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a...}IDATx.e...G....?....w...n..2.b7V.'...Am_m...{./f.y....A...?~.p..]8...W.l...:s.1,q.2.k..../Y..._.y.g.+.Oot...l.6.k,u...z.q...R.&....j.3@"..Xi.}|.=8...7...<.S..$....9V.g..N.......9....z..r..L..e'_5..d~O....`..T...g.(.H....`...$Q...d. .b.R...X...a...."=.....IP*@...X.....A...HH.q....G{...6.<~........F..'Qf0. <8...o@........}.\.es....].....@4I{... t.....0...y.-n....R...7o\G-.R..0*.|.p.I=X.3..0...G..d..N.y6\\..2@}..!...0..1...b..>....u....c.1.............LQ....f........0)'..u1....s.Lu...._...........H..?8.m..H....~....K._?..n.8..3._............osG}.5o8.......0../....x~..$...j.c..*...S.&.........{2M./...(.....4....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\16x16\sitemanager.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):743
                                                  Entropy (8bit):7.661409541092386
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7uLu+4upS74aKg/Rhi7ok8fUU1lEmivcWAJTCtwloYTMfU92SsJ3naGf9:PLubupS7esPUmGAJTOwHw331
                                                  MD5:969D28E6AA56CA62359C57AF9D16AFE1
                                                  SHA1:BB73D37D6A56CA8F3A5E2E01B7DF92405C0E593A
                                                  SHA-256:B129567F65655B2133DED61F0DA9EB68330B892A282E797EC0FBE31645001482
                                                  SHA-512:6DBCB5B7CB976888B90EB5251102E4998C4B004B13313016A9763B7DAB8410988C3409D4F65782CC41A81D43E94384FE50857FE1444F82B01F488FEEC02E9F3E
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx.u...]1...<...m.m.k.m.v.....4....7s....?.....o#B.RSSm....9RJ....|..f..1.?xyy..[.u.c..l6T...>G`.i...@.h.[5....?..t ....e..$AQ........{.k.. ....0.5.Y.. .....).c.5...M.%.c;.}........X.h..k:..X,0.!D...wB.V+.1..\(z..~......3P...A.....EX......o..D....tL..)P......".....(..K...LS.......$...+e.O.ac...TE;.{q.b.A.....m>...7...%".3.....^oh..O'.g.@..@<.%"...b..)5/.itz.X.T.z..xy.:Xmf(.n''.O...+...~Ic.Y5../\}xq.20.b15-1.....F.#T...,..d".g4.~..0n....F'8;."=/....O/........R.1.&.F..>.DS Q.T.H.....+./...u....wvv...$...s.N...;.....'[....{......=O.......F...............[v..B..j.d....}....*...........O.!5jV..qc3.....l........`.2tp_...J...e"#..A@@.V@.f.._..*......]...D..5....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\16x16\speedlimits.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):327
                                                  Entropy (8bit):6.991379176286924
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPWL2h573+cvlblhXcHJq30XvJOY8idoyfKMX0okKrQdoxjp:6v/7UVcvlJhoJRvoFSrfKMFGoxN
                                                  MD5:42DA65F59EB24E40B497BB26C4F32BF6
                                                  SHA1:703920EDA5BAD3D9D2DDD55F1C014B015493FA77
                                                  SHA-256:B1D5B457E485017BBDDABE6B0C8986B58D0C064302E42EB5B7D804E65C8CCD09
                                                  SHA-512:378C0C66A0307BD8088995D211434AD0500CF45203E5D2765DD802BB2CC644F77047C127B50B7C9773B0F5C7081993C9DE2F4F19438A37405C95DCBC5D6AF6A5
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx..O..`.]I..I.Y..a.XI $..:A:A........."@ .I........w....7_of.\_^?.....yp...?..?s...a^..(..4M.m..z!.2DQ...q.....I.`.g...G.......e..m..:.. .8.X....xK..7..4.w..i.P..DQ....l.6|.g..`.i.f..$I|.i.vr...h].0.S.......*...0M..a.,.x.>.|.X..a..9...8r.?....!.......`...i....[C.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\16x16\synchronize.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):729
                                                  Entropy (8bit):7.622890726886032
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7h0TTf6lRKqKxAJxrwxO2WPczMlnYQfzPThZHX+vmw9taaPpnFtz:5TClgHAgW0+n/bDHXKx98alFl
                                                  MD5:921C942CC800D1FCE8854AFE1DA07FDD
                                                  SHA1:0ACA922B5CC61A6EC4DDC8068322C2F513E72970
                                                  SHA-256:351740E63727868E193567F53873C10250471C003DCC8B279D00354C92CFF915
                                                  SHA-512:827CEEDA6E3ED12A6AAC57B374AC182A14E45447AFAE5C3DC23D8711B1011CEA88373E77DF7742AF9C35FF24F174E7A003FFFA80BE17A9E339B95687AE6FE481
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx...C.5G..oU.'....ul..u./..v..&.m.c..c...........d....:..S... EQD.........@..u]u..R......".{.s.\1..rs1;c....=hmmc*~.....I.X/cF.G..@c:.....s.....-.y.2.ro.....b.I........"...4A....Y.T...8.~.........'.....O..=......#. 42.z.....1.L.\.....G5..2k.o.3e.w..s....~M....d.s.|C....Lu.7.I.r.l......8.0:..o.Q,@Dl.]18...x.:.0..J..z0...ac}.A:#..1....5O.j...I........Rm.]...Upg!V....x.....g.Y=........ "..p.[.g-.d.h!!.eLb..Ro.....A#.J....R.I...v..n'*.>.dU<.....`x...g..3......p.J1....Lc...;w-..6.z.5..6.J.....g......M...,d..$ ......[!..."B....?5.....\H..@S8.Y..?D....?..!.0. ...A.~.&.).k....RJM.@ .II....|.>.....a0....5...g.nis.!M{/L...0...K...qAy.!........&D.w..b....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\16x16\upload.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):438
                                                  Entropy (8bit):7.472463767706255
                                                  Encrypted:false
                                                  SSDEEP:12:6v/73dGiQB7KgrYIwGUI3vDElAMug8/NO91:S8iM2g8rHI3rhg8/k91
                                                  MD5:F4456E8B033D43B45EB314741C412BB6
                                                  SHA1:4D6D0C346BE833F01C786E919D028C46E0DA14F6
                                                  SHA-256:1E30A6DDA5993A7F782CB75D2983AE9CB771D345E5CA5CD0C6102B492CAA8F51
                                                  SHA-512:001975168B130E7EDF9955603E6E44606AD6CD4F356A88D048F6CB164F314A529BCEB8FE5287773EE56AA87ACD8D259885609E687C1C7B793A6B44CAAAD50782
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a...}IDATx......A.@...6...8...1k.n.:v..7......~5.....F.H.t.K}../"dKi;.xi8...y...0.yU....h>V.1..x..+..0.r..xh..+.@!G.H...k!.Vm..a.f.T~.y.:.R#..?...$....Mv.\s...{h.......*x.%B-...b..O.mT.m.........._.[b.$Iu..j.t..[..;9.........S.....@M._h.={....3...!i.,..s..B ....4.F.W'0R.G.6.$.1.2..&.j..~...!....Y...S..cH%a#!p.......OU...@9........n..p.......R8..E..<.] DG.s.G?....[3.K.(....^f.7|......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\16x16\uploadadd.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):643
                                                  Entropy (8bit):7.604129644879144
                                                  Encrypted:false
                                                  SSDEEP:12:6v/79/iaehl2fBHa/13T99us6XGqeICPPksevgVKUmp+Ivdifl0c:gT9fBHK3TfusHnQ4YsIvdit0c
                                                  MD5:A1004B232FE3EB85DBCC35C0D5EA9CE6
                                                  SHA1:5D898F13BA4966332614A53D39585A3002B10AF5
                                                  SHA-256:A5FA2C20D415CE65E8ED8D1F8B0474C8243A595AA5F9101E6A4EAE2BA621E570
                                                  SHA-512:0CD394062A9903732515BB1327A224B7E13F007B8806B196A6FF9203610264B2381C6B89A023C35B9980E3FCED88FFFEDAA950C7A7CF54F82E78401BB965C393
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a...JIDATx......f.../N.....W.m.....=x..m....3.+.N......=.....=....9..#+...^.s....}.A.!q.........{.-../0.?.............$bh.......1.Y5$..1R..'..9....N.5.r...S.aJ.}...#/8..1.......x.....7.m......|.).........d./....M...#.W......>.}.*>J......?....3.2.k..X.N..8k.o.....<....A.#..&.E.Qrd....E=....?i....x....`66.i..e....O......s....<.Ct.O?..@.......l...?p.A+..g.W.....r..?..C?..mI.. !..[.....4..esEr.R..%...)V...Y..C..c.M..j35/.S.7!pSI.ZD....a.Mk..`..........X.l......_]..K:.!...v..\...ql....B...S1.}...i7.v....d..Z..^.5C....J.P\l.\*..BI..Dk.x.)..K.~.S....s...~V......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\20x20\server.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):753
                                                  Entropy (8bit):7.64233096673298
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7Bw/C0lKR0YiOVUymmVwdu4wLdb4klPALukyIS+n5G/CIshHhzborRhtl5XWP:v60lsmpQvLdbpl5HT+5fIkh4nK
                                                  MD5:D15EFEE2EA2428E8E15D055C7D1843C3
                                                  SHA1:DC258E603FE7A955360279B2C9D39EA1D92A98B2
                                                  SHA-256:EB2D4C913BF7AF9C4A2B1F6C61C99EBF50E8CC957DEFA33D0317F5AF9FE421E0
                                                  SHA-512:73DD0A126363B26C63C1F032C76F696F35D136474D46C38530B9FCC0FC5B06289F441F64CB200E94B0C35161686FFCD13EA7F2F3121C818FCC5838CD7EFF6E77
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.....................IDATx.b...._g....1.[<y.....O....2....9P....f@........j."..|}w... .....6..?..@6......._....?F.........-.5`.A.~\...ka...Vv..0........XA...x....v........$.K..0..".q!,$.....ot|.V..!.X.....b.r.:,......J....[.k....8q...~.L.q&.S..>.go&...L..uS..B..=X`.....$.ya..........5y.L....l.0;O.!..}&.T.~$|....98...cq..,Hmk.............@L.a&.....=}...r.&....r:....1.>.}. ...NP.;t...l......R....|M..7.o...jS.................{._..:..-u..Ks%...E..Y........m..;..ss.}...)...uD4.J..=VpJ...R.N/..FP..e.....>.....q.).2...Ys...$L.......2$.q ..b......S..]5..W..K..}..G......K.;...s..@..[...o_...nt........,..z...W_.....5P.\.~+..Sg..J.y.7c...E.&...s.1o...^..+...W...@|...O....'.L?......2 s.r).QF......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\24x24\server.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):992
                                                  Entropy (8bit):7.754117743574212
                                                  Encrypted:false
                                                  SSDEEP:24:VU9rwyE39cEJ1+zAlJAyU9W64JxmGstAhHQ:Ywz3OnzcJAyUwRJBw
                                                  MD5:AB62AAC2744EBA861BF3703B53F4F0B1
                                                  SHA1:F6B3A73B2DA6B98E488EFE179F0CD39945B06FF4
                                                  SHA-256:931D088B2DCF596A8EC89536CC022B11129F555716610B099D9C1005C205E311
                                                  SHA-512:9606BE42A2279208441988287999F9F8D141586961EB1FF095517842F520044ED3D09BAF1C7EF236ECD67B5F434692D95EE423AECFA0E5DD87308DBB89BE8A01
                                                  Malicious:false
                                                  Preview:.PNG........IHDR..............w=.....IDATx..SE..P.Mn...0.e..>..{......!c..6..].{.......y.6.zN.I...3.........7..+...+.|.....w^4WJ....G.:...A.T./+...(f...................>5G......j!.D.'...=&..cA...]........&...{..~.....h..d.Af........iNqf...G....(q...I...........s..A(,..<.N.......D =bQ..n.w....ks.{7..o ....Q.6K.3..g..s.....(.9@O.5"..Tk...#.K.$V..LA.I.;.........M..3.a`....w.{.D."Bm.......K.Z]r.z..D3.@o.I.R.....u|D.S.....%.....+.#}Li....%....y.4J...(0."....xd35.>...C..$*.[..x..xQ.2G..d..9.g../.,...2.D.../,M.,?J3..Z).#*..DL.XP..+....i......\.D.p..htE...u......<-..,.*...8{.8",.`.q..........M...r...........Y...1.....e.#....S..x.....0y...._.......^.X..RpH\.6.. ...e.5..h..}......>o.1..$g..\..K@... r..Z..9........w_~2...W..UU 6.bC...q...e.0q.fp]?0.....1.J.k.}5[?.w.^t.l....@..P...7..4'.M....X..~..o....N<...r.?.`p=.....U.......7J....D...*Y...~..........\z..b.w.!....T..'e.....k...J.:.%0...S......a.'..~..\s$}...g.....4..t..d..B.....C.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\32x32\ascii.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1031
                                                  Entropy (8bit):7.733421292896281
                                                  Encrypted:false
                                                  SSDEEP:24:ygHhhOS7zdv+Cp+b7/21tHQPFIDWUf4vRh:1HhhOSAWWeKFIDLIH
                                                  MD5:F91571107734C4EEEF806FDEEBF80819
                                                  SHA1:37CF70B8F3B90E85085D1FE264F2FC6C24F793CC
                                                  SHA-256:33C3952751A550600AFF33060CA7D772FFF8B2A16BE8D51622DBCFF33ACA07E3
                                                  SHA-512:D2F4A594779AB73CAD08926AC5C1EC2793DB608841E4D1E14EB310401B57A3999CE7C61FF06CFD70A90334B31E8EE17773B7AA74A8A3E102C7D317507CB63787
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx..V..kG.,.23.w......Bg.x.03....L.?3.a..]#k..z.,........g...=............o.sC...\eWW.s...e...0.{+++................V........,G...4.......6.i.YX.f.Y2.d... ....).BN. ,.]....ik..$..~....}.1>..C...x........U.6S.}...G(t.##....G2.@<.......I.....M..T........|..ecvv..x..hL.C.@..cZ8........9Z<*..C..y.........;w^..............+I.....6....C!...(tvv...I.`..]...~...H.....l.v.QW_...6E.......~+..y....+..2..XXX...r.|....U....q..q.#}m..T..W.^.......+++.......$.*q"..._..q2..H2.R}GG.Z.....k.)...(. ...:.q..I.%._Z\R.8u...~?J.J.5.NA.8p.N.k[..D........'.&.../c....s'...[8....;v.........Z(..+....+rE.....,.X<.@.pWw...\...@ .....u..x.....e...D...r.e$jI........X..G.L...b.....O..._.o..g.}.._|.y.y.x<....fe....t.-P.....j5v\........$h1....H...u.m...g..bp...kGuu5."..-.hin.P.4.O...C.n...._.....w.q..@ii)JJJxT...Ak[+.......".O.._.I..'.Gww7V@R@oo....H.........|..........,>t..3..h[B...f...J1[.7...../...@..m..n..-cP.1.k8L...D"s.Y..am..

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\32x32\auto.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1258
                                                  Entropy (8bit):7.677520204533597
                                                  Encrypted:false
                                                  SSDEEP:24:hOwNQgQDs9dGoQO2vjilKPE0MQoWY6k6E8poXmzB6zm4Itzj6UAr:hOwN8s9BQrvelKPEZZWsD8pAdzmor
                                                  MD5:FFF6EAACF946EEEA7AC1635BF8B1C23C
                                                  SHA1:C2F9F92D83ED7E851AC212C1A14295392DACC4DA
                                                  SHA-256:DB40390A8621DD447131654B3D5F20FC90AD1506DA70227ADCC62B9AC26FC103
                                                  SHA-512:8D693B51699C2ECF873F3108DDFE35FF3B11732F1FF8E584AFD178BAE939110E954CDA91FCFE985A7BE0C2DA4843A15F91BDF5A58E32D154993A092EDAA69DB3
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....D......:PLTE...DDDEEE===>>>???@@@BBBDDD<<<FFF===FFFAAA...............................................................................................................sss...................................................................xxx..............yyy......{{{..................fff...---...........PPPSSS...VVV..................WWW......YXY..................YYYZZZ......\[\........................]]].........ddd...ggg...jjjlllnnnooo...ppp...qqq............rrr"""''')))..................}}}......555656......999...:99@@@...BAB....CCC...EEE...LLL.........MMM.........Qsh....$tRNS.3FFFFFFFFFGGJ.............................;IDATx...c..Q....v......k.m.6.[3I~.dk....\...J...&>.2+(.....I.<A.<3....!..,.%...X.x..,.G@b..n.....v..l... (H...N..[.Ii.O.....('.....ox...Ap.RfS..]IHv..@p..s..7.{...<...xN...A..yW....Z,...!...P...9`...9.o.....D...4..w.}<......>.3(....ZW.....<._....N..'...n...nH8W..VI...=v..........Z&.3.g...}.....d.Y.{...........*hAJ....]

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\32x32\binary.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit gray+alpha, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):665
                                                  Entropy (8bit):7.543478277845009
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7l5/vHeXyGuLOnT7VyIyAYKvPaabDZdT/j/mRPEKhYi0Iprs9aRNZ/QfxpvsV:G/mC/LOT7YIyqaoLj/cEQYid4ARNZyxi
                                                  MD5:284DA2DA54F4711FD8A8137B229E33E7
                                                  SHA1:BD9BC662335EE2EEBC52398683968E0EF0E6366B
                                                  SHA-256:C9BB4563E2D58BCC4BFD559DE6CA3BF47C8B6354780676C895EFE0103FF1DED4
                                                  SHA-512:DE5E17AEEFF491BF8F5DDCB148FED2BB3DAC0210C881AEC92B90CB935D398E5142B2F60846AAFB08A8A5DADF35305BEC7151343CB05BAC346B22ED3D4FF0B890
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... ......s.....`IDATx......f......l.m.....m..k.gF......Q...,7.......g..4..`.x.l8..P@.+.Zm.Z..C.C..$#P..t.M...3.LP...b/.$h.." .SL......*..*.JT.4..P..G.&f..QP....t...2...df.".z..&4.1T(.@.&.|...s7{B//z..x.M......@...0.(&q.U..z..MADlo.A......v47fw4..[8.9".8.S...E......L...Yt.Y_.....TD.m3`{c.Q.h...0.. .`....y./..e.E.........C1.b.q...H.. ("6D,...sb6..o.`K... .K...C0...:.A%"z.)F1......Bp.QD.....M..+.3...].#q......HAA......|..|a|..@i.......0...Q.......X..eF=.+*.(..uW..7..!.{.Wx.@..v...7..M.+.....F....P....%L.... ...c.........f..5V0..j..3x......{]o/......SV....`bs...3.>...P.D-..Agu.J.....b..........k.n..D.......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\32x32\bookmark.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1675
                                                  Entropy (8bit):7.8530855181907615
                                                  Encrypted:false
                                                  SSDEEP:48:w/VRfM0mHMbrMS67Xd1LAGNqBtgYxv8Oe:wXfMJsfMSGXdpRqB7v89
                                                  MD5:0AD600B0B6FD4B526FB11F90CBBAD530
                                                  SHA1:DE7459211A962F83A396A54962C16DA27D384341
                                                  SHA-256:6EB0C8A463C18C0E240C701ED020BA54327BC2C34B142ECF417B37B1C01F9FD9
                                                  SHA-512:F7C689C9F3178AB739FFD4A5E3D24C5775FF1B991F5A32D06CE33CAA18A055DE66C16E6EEDCEDFCCD7EA4BE15E2DF9F8D35F75E58A27786B40DC714519ACA415
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz....RIDATx.....$[...s3.\.i.mcm.Vhmohm.m..h..jw9...PQ.Q.;=..N.....#q..z.S0.|....|...[.....\!..G...|...>..'o....S.]..U...K....C.n...'o....{..x....wc.../...c...DSx.n.....<.AU<U...+.2`....8..L.h.p......y`..-OT%+......}....mG.y+..`.`..U.}..wM....wcE.YK....O.....,.F..)...b....e.......*~*...Gn}.c...[p.|..#...'.W.A..@h..?|..S.}.9.s`k-DU.j.g`.....m|.s.D..h.../...Xi...t.p.'s...N...8.x..GBPa.[.8.?...oC.B.k@..Ry.SH..M.}..|wftfycw>.7....../..Hg..\..3.....5&..&G.(S_.........Bqye..K...=..J.\..[.[lD....u?....O...n..L*...~.4..D.E..4.[....t@cBH...H....Z\.t..h..*ae..8}......W.._...[..V.....F.M..2......$.^...P.J.N.F.,J.ZX.........;.*..5....;q.T_..... ...@.*h{....`....^.0LP-......G.V*...=...s.`....{..[.A.!v..p..\.V..xt.J.8.|0.x.@...Gi...oG.~et...O...%..\(.}J..-..}...D.C....j..h.n7U.Q.A<J..p]..R...~=r.....=.?@....((.KK.....w...~]...b.@.4..8.H{.]QuD......&g>?Qi|....L..k#...9`.8..'{.....tW.1...X9...j...l..r3....?0Sm|[...E.

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\32x32\cancel.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1705
                                                  Entropy (8bit):7.870408719677622
                                                  Encrypted:false
                                                  SSDEEP:24:ortxIoy+a4yzhN5r4ceW561D+54lyV4tb1pAePuRdDR0c2bC4S9FfOz6yZMNPPhI:GOqtMPr4ceW554lIbeP84SUlZaPhR2
                                                  MD5:F9CD30014105F6D86E81961F23CFA194
                                                  SHA1:84168C3DA7CA619F441377F66601EFFC8921A4B6
                                                  SHA-256:637D05BD0B454B1C019F8441DCBD1B226BCF949786EF45BEF2E70ADFC9B37133
                                                  SHA-512:30E0799783FCD7101337DFA62868FE6D52EEEDF1C6723A8190C73241324F1CF8DDEF6843E3086F5DAEB34ED900B64DA1C7A1CE86AF3328373975DE594F36A0CE
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz....pIDATx...........9I'...o.[..g.g.m\.m.6.w.......uUMuuM?k~U.R...AD..5..sI6...../..a...2..]..w5..n.......2....P.x....-......z..G....0v....<.m....>.....s_..;.|..qWm...)..Z......O.wt6.r.%W......b.O6zu..y.y.X."`D..b.P,....3...).3..}b..g......3.T.@{9.Ga.....[..7.....-..... .....H1_^..q.t.z7.x..CV.....w.m.V....m........'X'...(..A..l..O..^...s.....6.....8&..K!..O...^.....%.Ec.C..~..h.F._*E.i4~...e.XN..._..@3..G..q.......!..P.!,!..5{!.5...JkD)..2...M5M.."i......&m..v....:..,...$@u.+V..t.DNZ..8..~$,..:..]...l....Z#..q.....0...g./.D...(U}.....4.R. "..e.LS3..T.@1..zX..5~2(.=m...a.....i..gi...5.EK....>...E..&..j.2Z..5v.F[T#....V.p.J$p.,..+? .......$....;... ..(.0..i...k..:.".F..C....u.R.S.....$7.S..y:O:..w...*..z.....AP0q.[.Dn..((....x.^... .....J[..`.!.......30..p'..........(.x.N&.....L.~........x9....C..0x...1...h.\...."@...D.j...'.CE(.(.E...h..JS.x).4.....sk..u&\..[......X...7a/_.R...R4o....}..uL...E0..`...H...kM

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\32x32\compare.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):2531
                                                  Entropy (8bit):7.889621341238746
                                                  Encrypted:false
                                                  SSDEEP:48:flFuP7h6ggkhoOlo00JyyMYEfzjp8FjyCkYDPE1l0:flETIpYXlo00RrELjpeLfDPgl0
                                                  MD5:0F35F49959B329237A5B3815DE59A78D
                                                  SHA1:C8925125F6FA54AC6E9B55481997C5033C7140E0
                                                  SHA-256:41744AB44BD1B057196C7D7520DDFC13D8555CAC2309D8893BB0515AD6B4B4AB
                                                  SHA-512:838FDE8720C0CCBE3ABE7042E96DFC9088671CB73AA57D95AC4B5B2D79C2738FF65741733BFF201E105E686759356441FB9F03C896E24FC68546CB786D9CED20
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx..W..cK.=}.g..d.f=.m....m..z..;...#Nnr.......<.T.j....;_@.........D..J(.U#.0s.*fY5D.+.. ..&.R.f`.wkz<.v`...4(.......J....Q.*....X"..!....)......j0K&...".~.....^{...D.8..p.o.....]........Rp.....aG..VE..EVj.EQ.Z:..2.H.G...$.).a.....j55Cv(...%.......8.....Hc"1.0.m.EZ%..;....9.D.W........Y..m..TOt0.m.I...t..4."y.x..m...y...UWE.-...gL{.3.J.^*.Z.cea.....6..6Y...w^j.?....0....m.......@....l.......$.....N.9c..........]g.uk7.`...v.5....N{........:d....j..b5... .....F.'^..#..o.0M3.k...fN..../......v....@.`......f...mm?....x#:,.....N_e...>.dp...0@....g.p._..<y....w_..5^r.'.z....L...0W.G......b[.3lD.....u....VOf...kB. &M.......t..r.%....+.!.g...o..o...v.g;..L.......L...9`.....p......'M%>..M...u]T...zt.!j..Jb-.e.4.H4..j......v.....3`..S.@.>.~...>.x@E....b....VC.l...k@.S.0.Z...X..@3._.@.D"c..xv..._.+.... ..x...,k?..6..~....2.UP.jjA.Gj..E.N.0$.0..jY..&$.zS.v......3g............7d..5.u..c.R.%...>h..:..d&6.

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\32x32\disconnect.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1723
                                                  Entropy (8bit):7.838389318161883
                                                  Encrypted:false
                                                  SSDEEP:24:zl2P5TyMJ8W+YAEcq36KxRa0+KMRL2bIcO4DoPoEvzXYveLCZU2Gx:hu5Ty0jnAzMBxx+dJ6DWvUvbvm
                                                  MD5:16A737D3C1055CC00BAFA178C43508F4
                                                  SHA1:6DA9D992A18058269C6680B9827CFE32AD6C9F40
                                                  SHA-256:B2D9AC7AA7B34D2737E0697713B3B3DFFDC4675966DD58AD2DA026EC80125588
                                                  SHA-512:0C08166732828BEE24D966B1E51D6BF867990EC3E00425D6107CAA7C540CF8121F7D411C7EF65006204FFDDB1208B519C1E39B28F6C0D9F8865D8606A3BBE80E
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx....p.f....l.N]..23'eH....;^a........eL.....eK..:......g.,..=1...M.5..s..c....f.._.y..{.8....,..../....W......-...9...^........X.l......eY....`.....x...%Ji+4M..^.M.....3O..8..%'.M9_..@.SL .........".(..`D..+.....4-.-..}.?.r...pK..@.A...M.....4M..P...A.[...[...*+......9..XQE.."...o.....X..P.#V.../.\......Q.....[....Zz5M..@@p.P.#7....~.W_....o..z<..X..a?........... .U.jm..jK..L....i.4(@UU.k&...h.| .8..Q..^.......H...%.7@rr....5u.....b*.z.q..ARZ.....).)V....r*..._w..a.i...3..[5.....^..X...K...................B.y.x..7.g.N:..9.....a&..4.5.....L.J.li...NW.V..O...#.....|.V.....?V.....^4M..w\..g)g\8..i..;.k.^^.4!....k....2.....w.|.?....!&....g.BV.....bb ......x.(vo.4s.}..L...i!.... ....Q,......{6L>.f...i.uN.6m...({4 .H..LN..t..XFg....a...1.i,....pL.[...]..'..D...B.Dz(..........3..x.K.N.F......-i<...|.....(.. ..h1k...P....Q.....`..'@...L.tT^Q.}7.>..uh......yVi(...<n..."@uT.X@...<..x....D...a8.h

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\32x32\download.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1091
                                                  Entropy (8bit):7.793985864599588
                                                  Encrypted:false
                                                  SSDEEP:24:O6Bqcm5GFn5rcwYsyetE0uvitCx5H+KSLNRgNqvhlpg:O6ccs+SwY9etE0uKU/lMRg4vXpg
                                                  MD5:58A5F17A0A87DF5427CC17759A812CE6
                                                  SHA1:6E35990BA607330F33802EDABFABE9508AD79289
                                                  SHA-256:D9E39066B0D28A8E8041E61BFF8A5622FA02FAA544F97BDE894776867C1ED889
                                                  SHA-512:DD637DF84EA74893331D500B61143DCEFD8B3AA999D17A8D579EEC8953C099C4EC3855478DF266CE2B44939964DCD72305B8B3D17BEE5B3768FCEBFF705B091D
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx............m.vJ.UV.6Kk.*........k.7g.;....U....}(4.o.{(..Sz&...A,.G..F...Y%.....X[.Y..;M..$.h.e......J...;!...dd...c=.4..5."e.y/A..yp|..B...._wV...0....".vT.a.p.........).2...*A>..|..../..Uw....d.*..%.....7...Z5..`......NBe......#@.....U@i..Ud.!.....p.G.s.3........4...3.G......f...^{.e.2 .T..Q1.0...~...."$r....}....i....)(..!....(.....t.#........:M>.E..x`...H.&EI..`..&%].E...7..1..N....V^|z{.V.X...*.PL.;w.....8.SO...F.}_}*..2$(.BQI....e.B.UZ".............W...'.]W..j .......x-G....G..&F.K.qE.D.T@.JUY.u../..(...x.q........v...4@.7...x#b.......w....L.,@.uTD..^...3.Jp.....l..3.1+a..k....,.A...C.JA.<u...n.F.m.....o~....u..,..;OZ;aj.Zk.....E.r......v...t3.....?^..b...4........w{2F....v...|........~....5........=........us...K... p......:.f.[2... Ox2...r0. ...j.....d.y:..j.|Q...../....I....>y].U..*...~JYI.v..Gy#"..^.F.+n.]....".)...8..J...s{....1.f.4....x......>&..U..qot^O..:n|G.I.-.>t.ob.1

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\32x32\downloadadd.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1477
                                                  Entropy (8bit):7.8580915195042795
                                                  Encrypted:false
                                                  SSDEEP:24:kADMdPXbO9FEnG7sl6W+BLKkY6I4rfMyclSwb7eAdaTa8eDHYaK1QVi5CQH9t3tf:hIF8sl6WQLS7eaf8eDnmQg06Bf
                                                  MD5:A293E0AFC56E9ABC738ADBF446BF83B8
                                                  SHA1:44CCF6E6E0685E9BBB2B31BE20598B09F887CA60
                                                  SHA-256:50D381430A7891765601E2A89223650BA237FC733990E767F28EAD4F26B435FB
                                                  SHA-512:B7C4391AFAC292656FAFEB04E29B09E94E2BE273D587F2494299868E2115F1566EC2A0D64F744D61F0B9D6BF8DE3B22A6CF09645A7540EF5DC23FD83CA353DCB
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx....$Y...{_DdfY..j..m.h..m.{.....jc.......;V.5.9a}.._^n..p....R..)(.uU......d.jwt....>....w,0v...0.K9).f.0(.s3.....RQ...I.l.Ol.......R.KT..f.o.a......z.....y.d!N.3....o..:u......[.W.Pf....3..3o...#0a.v@....Rs.@......0..i.}.......f.$...3..T......t.n....L....L03.pb...."..1yQj.b........m..^....X.}.......0..|R.- .B.KZ@.?Xq./-.f.s..q..so<.....ut.a...~[....y..;Xq....2%r.........m[....--%.OU4..@.URQ...yW.k.....p.~.'.-8....5i.rQ)*.H....K.:...........7..v`.7V.....P. ..*.Ph...w.X.....c..=.>5?....k%..v/].6.$.&.b..R......0. P......]....JZ.5..0...w.c. ..^........Bun...F.Wl....JL\..]Js..0.O#.M........~.x.,.l..g....P...".|nXf...F....<.&..j...^-.......5.Pn.9.,.~]kgI..c...~KXX.4)a).........9.J5..<..i.?ye..<o.Es...+.M....o.<......~D.]~.+.F%H.&V...e.2c.tz..R.*S.B..f.>.xu..DL...#.?.<L.....5...>.v.....9.._.[..W..l..^|..'Z.b...D...70..~.H/.i.:...O..L. .Z'j...T$..G.yD..O*.Pc...M.........DK..AB...l.&.W...LNN........<.B!(.z.i....S..

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\32x32\file.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit gray+alpha, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):352
                                                  Entropy (8bit):7.143288160864272
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPN+ggF1XfNZdS90ET9v52cpb76SKRKFdFwg720bC+9Pk8m4rR/RdIkkp:6v/7tgF1X1Z89rT9v8tY9j3Pk8f1zo
                                                  MD5:536F485B8EDE79CE0B026B48BDE42B14
                                                  SHA1:C18B8311B72A633343D75CDBB43ACB52E3AF28C2
                                                  SHA-256:ECA4902B97BC5F63E7D87B4D4D9DD05423107B11B6B8033161515DDBF8A5F9F9
                                                  SHA-512:6B79F4590494D389D84717211911E48F5077BAEDD3E2C5F4BBA8C8D23768F0C57249809A8C139EECA7BA50736F2F72EF96566BB98D5CFEC7C822140A44901BAA
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... ......s.....'IDATx...i.Q.../....M.v.h]..............\.srE.F.....yr.F....n...%...M.u.J.o......e$uR..viM.u.Q.kK..GhHj.k.^=..p.h.P&.c.;&.......6P4k..Q..E,...J.s..#.. 9o.p.....%\Bcu.=..dg`. .(.....Fr...,.-}......6. P..Ms.O[(x...!.M..3.].A&w.-.}......_#..+.r../.w."...J.......C...z1..gZ.O....{.M[.....m...@.}.......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\32x32\filter.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1185
                                                  Entropy (8bit):7.767142044387276
                                                  Encrypted:false
                                                  SSDEEP:24:I0WGE+j3+Gmxrl4sPInu69W2Ebs/t02Hol4ATfMy6EfI1zRO+tVBCz:IeF3gx3PIuGn0Z42f96CI19Wz
                                                  MD5:57AC2651B46E439F4D3A086A37D19246
                                                  SHA1:23E0CED3AA19C28D0DBEBF58FD969BB5C36C855F
                                                  SHA-256:E1FF7908B15FA5B4834614BD58A5FF9FF7D9A8C510D454241091126C7FA2A08B
                                                  SHA-512:740DCCD150FA7E6F06123B602D7283A42D64489745DAA3D90786A1CA9A633F6035752436172594F344D67337EA05CDD14F6B59D49CBE131460FFFE872DBA1501
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz....hIDATx.b.. <.............V......]k..qm.S7....)..v.6.qo..vT...>{f..6;.NN......O...%...h.L..K w]...y..{....w....z..(H.D,........K/.....E.C........r......r.{......3.8.s..%B.E)....Z.xd..cs...r..f.=~..?.........i....X.A-i.JMC.".LC..]d.....H%......h.;..c.0.....eq..A....k9,....:p. .`.a.Z....m}/B.Du....g....K.!.....J.."".w.I.48r./.......DQK.5....R.w.2..~.;.\r..PJ..........U..Ek.~.Cw?..&..'N?.T.. .."......3s..g!..... ...N....`:..L.a.j.f.........L.k.]....8<9 ....v..wX..[..f,4.##...DS.v..Nr.+._.......erF...m..5..H ....-5U.......v.3....2B.Sg......V..".&S...L..G-...-s...[."B(....N...3...t.l....U...<I..~.......n..v....fh..Qp.5.h...C........7.d#>{.."....{......d..X.......0............d.?n8..B,Q..a.........4........Yx.y %....!1_...%......W..h....n8..w3.`.(..&.......rxVD....|.....5...F+_?.z.G.r.y...5...r.F}.`^ihA-L......).g(v.Af.....7.i......L.5~...d..!...@`{.5WX...2...u/....+/...Yg ..t..w..l@i....z.6...6j#'.r.[o.ku..].!.....

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\32x32\find.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):2038
                                                  Entropy (8bit):7.859130744595429
                                                  Encrypted:false
                                                  SSDEEP:48:OCl972SbFx0venBPv+sAPSHBF8yjAmAzHYwQ1OPyJ+4qUbZUi:OCbaSwvmPzAPSHX/AmAzHYF1OP74zyi
                                                  MD5:B9ED9A54C830833812738325C60CC503
                                                  SHA1:287A0BCD509B3ACFCA46FDE2215935D717B7B189
                                                  SHA-256:B9ACDF5CA62EAF29A5C1789AD9EAB9AFFEDB7E7815F37C1EADEB8475466FA30B
                                                  SHA-512:B3FA07ED8FC0ABE5A92C78163B521E040EEB507CADED309F726AB94F692BC536378CD6FC6A12F2000CC137F092B8D728CE3AFC1BF1035631CBCEEBC1B506F6FF
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx..W..,..}.6.5...|.>...m..w.:.m[_..m...........]Fd..2..KT5....]....8...$.^..sss.....6(.~.........P....E......Z.4}.ry....6.B,....>.....N.........r.-k.u........]..........?>.....>...h4:411.|......Hg?*...32...s.....R.....8.%.......Z..6..O.:."[.m.>..$../.p.b..$...........`.0;...-i.Frxx.....].eYu.D.......:".....0>>~.e;...=....w..:}:..]]]...r...-...b~~^.....2..qPUU...z.T S..<.........f../.y..?....R(.....l6.R...D.nP....\.u?...l.........-....'..d2_c..3[[...@...m..y..{.a.E.3.A.}.r9=...H=q..G.......'Jw....I......P..\.v.@.R1.....(3......H....J...c...~...w....8^/.....np7{]..J..g.A.....*.@..\{...2....u....... .9R.)..]...=.)<.... ...L..6.^@..(..}(..RKg.@mmm4.........X...........|.`...B..*\UI.J.Q./...4........51.N.^5..C].E..'O...P...Rm.i.........bO*......n..\e..=.3&U..J..8...!..4.Zu..n........:N.7...c..=+.$.E6..bX.......^.......@...Q)..2.... ..$.k...0.[T.....^........e....G..a.(...F;@...$j.....RE.:......rR..@.......F .%..}h?..k.

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\32x32\folder.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1351
                                                  Entropy (8bit):7.8153398147351005
                                                  Encrypted:false
                                                  SSDEEP:24:4zBRgz7KwrW3x1O2stzUEkC1oR9oW49VbTYsNymx0qBSZHn4NZb58rc:uB47Kw6x5QfkCu9oWiks1ZSZOf3
                                                  MD5:B546C451FEE088F1FF783AF7A7F44B69
                                                  SHA1:D277087D1764C51FEAD4611BA62C66CEE9C4C7E4
                                                  SHA-256:AEC279CB68383C2C1BD05C64B80EF45F569E3CD0D4A9E7E412EAA5EEF52BB0ED
                                                  SHA-512:D02C9990AE68D0FC8597E943DCE17A08474EB29B7965213D8856E27762FD930B7C1FE477E562B89BEC3DCA343548B0401EAE3E7A84065AECECA4E7B243C70B26
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx.....$]....UW.{..g.k..`.h.n......m.;...n..w;y.2=.......sO..p.........l....f/..rNV...V..&zM....n\........b.k.\3+......4q..5.....:.M.Z...H{....4......t.*./..I....._o.y..S...~.~.V...m..k......*.I...xv.=.V....Y...s.G.t...w..z-....x..Li..VvS....^..X.....X9.9Q3....6......N;.9G........+....._63J......WP5@......U=..fL...d.{.A. bs.D.....0...t. ..NL...F..0....B.0.L.....0.jd..-.....9..V`J.......H\Ii.. ..!.A/@...k.r1lIL.Z\Y.....B.(D/...T...B............8......e,....,.....]$.K.r....-..NN....A.k.s..A.q~.+.".............1.".0.3e<....g..j%...TJ.,r..........W..;.....r.py...HD....G...X..$.H....x...y..T\i.$6.7..qOP...6|.G...u..>.>.=.U....]...U.G1Vv.......7..=..........[.{...y...j...F..x..+Y..A#.n..P..8x.3..Tc...........a...ot.{...B.........`...F....`.:#.=.c..c_.....4:B.."I.h...h7..`(F..N.f.........C..`vz.:@s18^q....L.....*........[zI@.....H..M.1[....b/..tb0.T!.o.R........5U.5..S.e.D....^Q......l.(..g.pt....48.i....

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\32x32\folderback.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1599
                                                  Entropy (8bit):7.839553374241611
                                                  Encrypted:false
                                                  SSDEEP:48:obwjq4pjnXwSceRSGTkhp4LFBsQVZWkZEcX:obwXVnXB0GTyrQ/WoEcX
                                                  MD5:D0CE7905DDA7C98318182FCB5DB5744F
                                                  SHA1:BD0B44B0724E60E3F205793C8E33065E4CF9276F
                                                  SHA-256:7205D7DA612A07772E75219D0851AA8D54B137CC4E25F74EC8A84881123025C8
                                                  SHA-512:734FED92EC1F4FDC3B2849DBAB95211E524EAEADA032CC0DD784C1DB60CA7483FE4DFFE36ABBBFF2C9A72F2C9CD81EB2ABAD54464F1FB22FF768CE5DB731AB21
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx.....$A...?..gj.1;k{.m...3Cg..p.mkm.cuWU.....i.w/............U.Z.5.Z....V..T.l...r'..ek...V{.n4....._.M2'.`.xA#_.%....q....Y.f_-.H.k....)..^s|.G..\....dG6.....4.XK..f^[.g.Y.%y.z.4.'BD..1...M{......,..+"..\..cg...Vk^......p5.+..HIa.9........!@W.N.O.0....`D.s!...v.0P......Q.("..N.e...>.....=T.....3..>...k....q%.UF...M..>..:...(<..t.Q...]:.f\...(........D@..x..Q.V.*z5..P.D.Q..o8..EPzE$.....0.hE..!:.....H.8.....A1.+..]F....<8g.F..Z.L0..Kg....W...T^.P.!X...+f...L.s1..)."@...s.E..0..q.Us...S#."..`.0:U...a.]0..A"..|....E...@$f.....#..[...A...B..D....u..q..jJ...Hnq.B....qD..8..g..0.k.....%......9"-.B.,....f.U.](1.........S...l..wI^......7-..a......c.*P...s.Q...==.v....T>..k.0..td..'....*x..j..`.....2..-.'.p...}.F...2.cpy.. .......wk../f.&.y.....7k.%..Q.@P#qB_-a..8.L.#..........+ .C..I!..yO.J._=....#....js.)uB^KhW.xZ.*#I..s.....}......j..q..DsL..N.Q.y.7.3.T.Z.....a.q..Y.03..C.......x!n.

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\32x32\folderclosed.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1357
                                                  Entropy (8bit):7.745370324355059
                                                  Encrypted:false
                                                  SSDEEP:24:w+w8l66j0tM48Qp5PzakhE3pVKi3sUCuhD1jn5czZVTKRODeiyCIQ:w+w8l8DJpdzaoE3pVnOuhV5YZVT9XEQ
                                                  MD5:7A4B9E47257D33B0BD8D44D686846584
                                                  SHA1:3DC0EB8C748D6EA80D66A731D861C7B4E1ED40B9
                                                  SHA-256:265E50D2789EC687C8E0E4C829214EDF5C974FBB1E7E20AC7553BD7B2C64CD06
                                                  SHA-512:C76D3C29AFE9589749578B22CE2A5161A5C7AFFAD98653EF8E902FFBBD4A57D7EF779F80138C3A4752B8D554BDEEE618B562D172A6FB75B10A6B3F4158949BC2
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx....l.......3.z...j[Q..nX..X..m.m]..9.ku.....9S._.;...-_.I..}y.........]................6..n........(....?>?.....Vz[g.c....>n.{..kn./}..m....?~y.....&../..VY...M`..y..z4...*5;{..P...\..z........:.q...:....6/.5.H....s.@...3*2...2KW.........ad...a.....' E'..u>.........].U&....@.H8`.k.3.Gp.%D...(...`.].......i/.H..P.(P....M/0.@.......n..j..*.0...sP.+....]2..B/...`._./.._~..P. .(4.....*.;8.3...C....(+3.t........\..D..b[%.A...Z.....L.g.JI.y.T...p.R...Q.........)...}8.......U...L.>=...p...a}...g0L...]......f._..4...>..n.r.9...]..dv.+..0A...**LP*..F...%g.m.f. &.0...%e...F.P..1W..7#+..9..S!. .1.R....1.bvo.....H.s.....b......=.,.X!.B..W.<..6.F..".^...d...D.wG...8.. .i.l.a..23...)........^.w...u._.5,.u.D."...nP....A...uJvR...og....m_...:u.... r.c?]........0......l.e.........u.....t.JP..d...4E.@....P.....G..Q.0\_.O..|..!%..@.T.w(..d.@...;P..(.........;.`.H.Q..*..c.. .P..8m0t..-Hy~.R....z.........Q.....*...@v0

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\32x32\folderup.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1903
                                                  Entropy (8bit):7.884545231227901
                                                  Encrypted:false
                                                  SSDEEP:48:OEHUN5yBayHKnZTHYnApm7kCZBegSDwUTa+k6IOv:OEHUN5CpgTHyu6kCvegSDh2HU
                                                  MD5:BD2C6CCE2735160A224CD5AECFB30456
                                                  SHA1:132512B864390CE2DD808969EF4738D1B77CF312
                                                  SHA-256:3897DCE652A4B4ADEA00304567A5C4D6BF5C37F7B1651A71C2CE7D246C6D512B
                                                  SHA-512:A815F252F814817622AE64D8129491CDFCEF8CC93F439CB50293BEDAFC577D9528FA6EAF2421E77E6016A5D74CFFAFE7CC93D11D56C9DECD7465B1A57A58BC6B
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz....6IDATx.....,M....jM....m..k...o...l.[.]U..n.......'.....s.Y..U+3..'.............=...R..".E.B....,.......l....>.N....a.t].....~.-....>....~..a...^...3..M..%....nZ\)....~a)........Jd.|6..i..D*.e.-.....3..3.........7$.M...5+.}.'=./.......7.T,,..9cr.i9..f3..~L...N..c..Q......z...3..W..s.;....f...&..c.....X..Yl~.'.Q.*sb.X.xW.."...D..{p.g.}....+......i..>%.nS3P..X..;...o..k_$m4P.QEO h/...#1.b.k-.@..G'3.X.h..<...{.....[..RR..P5P....1...q......N...M=..N.O.V..C*J".....lZ..........._..=ds..O.{......QGr.....T+T...L>.!x;N.wRZ..+$N...h......)d.l.XZ.t._....p`l4.u..).....@Ua.p..s4..1...RZ...c.........^.HC.......x.&`U...W>...q#CQ...\B.R2...&g.....N..p......O.9<d.g..k6.....*....wS.)Xz4.EzT..)x..X..?.......UXm..|.3. ....c.k...l...cg]t..D.VcX.h...l.a...k%.6.J.s..3.{..e..%...8.?Y.f.p.@.:.}.5..a.UjdJ5.m.TX..>....N._...".C..QH}.. .{..2]...E. `.....o0.,.\Es.`,..(h.+...fj....o1.^.Q"....f.*:.F<...:tZ.5}....L\.^Q@D..K.....D..n..#

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\32x32\help.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):2486
                                                  Entropy (8bit):7.887788614689803
                                                  Encrypted:false
                                                  SSDEEP:48:PVgF4kVF5PZaCpANoLtln8CgbUQc5dOAzrd4TDART5wX6YRidF5nn:PVgJVF5Pn2NhCB26qCFl
                                                  MD5:B911DB3473A8B5ACDB6BB97E74F5BCF8
                                                  SHA1:44E139DA71FD400F232E734467A1A4DDEFF8FADB
                                                  SHA-256:E55AF9AC9B510F8EB55213C69CB180AF99400D61E469CD4395AD7FF6AEF52AD8
                                                  SHA-512:5483E2D88F9C89EEE25E73DB4D4EB9672275DF149472D71089B229CAF5663EB3D94C12F75D9C91E70C3305A7B888C515964D6F0ED9A6320AE6B95E91F11008D4
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz....}IDATx....t#k......2q.n...[]...m.m...F.l.6.4h.......k......y.O.N\.9e..3.....i'....L..NH.g=1u.....:..3......>..3/....^=...M?......?..O8+;.2.p.T.l.;.`.....l.d..ti.?c.4k.B...~?..*..x...:..,q._^.R.n%..w.:qH.K.y........u}.[L..:..y.U~..ca/c..tMc...PXf.-.........<qbBV...E...f..p......-....E..:..~....1.[..^...`r../.@..._\_...........+....:2..Y....V..! ..4.q<.........,....Q.B.P....F...M...~^:7..Z...]...a.^.:.6&.yW...+.xA:;._...A...........=.../.`.$X..8E...K@.w......C............~..g$..7...,.A....h..Dt*F..4.u....C{].^\.G.[~........R.....0M.<>.w'.H....?.`X.......^..y...sG.,..........=. ...q..fB[.G.;.[........Z...........k.7.<..#b..V....#...F" L.d3.2.S..w.^..{.......w...L.P.p..o...@".q.>f.K&hs.....}...n..7j...y6&..P4....j...Ol|.g..Q....b........H...S..<w.Q..c.N.m.W.t..-..2].....l.c..MKs....i.....r..WN..?..r..w...!.H..,>.a.`.Yj...Y.L.....G0.l..E...<..(_..9e.3.......T@.AH.....<..S.w...V.....D..T.k?.......1

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\32x32\localtreeview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1218
                                                  Entropy (8bit):7.782537954577885
                                                  Encrypted:false
                                                  SSDEEP:24:+0B1TQN86MILZ9/Co9TRzY5HRiiTlDQ2GeZ/JRhtdh5LuIjVxHsk6N:+0fTx6MILZ9qo9TRz00itQt4RhtxL1Hm
                                                  MD5:1571FBC96BE01FACD9350B9DD206ABA8
                                                  SHA1:325F1F144113B0BE7EE690B0C888205920901217
                                                  SHA-256:43EDD30F00A02084EA4E65A270A181119550692F9E861B2A077FE1AB4C76B50D
                                                  SHA-512:F0C0FCDCE3BB79D8FB1F3B08DB1675CE065B142CFBEE88E30427EB4F379BB48B65A9B4227D99538993D398356CEA62440C480175119E7BA2074FA72DAA53ABD9
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx.b..1..].@kY,I..A.+......N....w.....Y..3.2.L.TVT(b....r.6...R.f:..|TU..D.A..s.<...=...<. Nd4.............r8.."U...)..."1q..Pk+Q#.N....>...3...I..!.N.*D.........C159.8.m.I.Q....wJ@q>.$F....DD#..1.<..M..B.h"......C..#..W...i&'z........i.....".G.@...6. ..W....3.k.<.w.}lyb"...)...w.x..`nn..~..)M..;....".A.#o6N.._.g..n,..s9...y.8...6W.....7.....v...UT..._>=..q....%....lo.g....Z9*d.dt.]....{+....Pt............z..b...x...:....&.q...&..].<.v.......t(G..).....T..%.#Qs..........P....G\..0....v..trQ]8......n=[@.`wO.B9...?W..6{..X......&...).V........m......>.....U+D...{.+.g..y.N.c...h.h..{..>[..iv.....[+&.@D.~.../~f.w............>.........6...........3...0...}....] .+.f}}a.4`....(.....I..q^.(*...3.c"bA].y6.i..4&..t......T.0F.3...l}... ......`B(.+%#.6Y........A..1s.M4."b.....^..j...'......?N.._1..14n!e %..P4.......}q.b..M.*.C9,9>>fcc..H......#:.^..z....M=...Q..tNNN..c;.u.r}.....v..P.h-.J.,7..YD....Z-V.

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\32x32\lock.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1787
                                                  Entropy (8bit):7.862743458087118
                                                  Encrypted:false
                                                  SSDEEP:48:6LHwR+feqCe5icCQamjl2mmZSQrtkDKfrd2Voh1co/E24:67e+feqJktmjl/hKgVoTn34
                                                  MD5:2C94D64626527D4C6481325177392F4E
                                                  SHA1:CC06CB4F5D83B149FBBBEBA43FB7AA95818ECF34
                                                  SHA-256:C479FEE71F104A2EEC517A1ED8E63724F469E6DA68DCBDA7B10F682B0FFE4B8D
                                                  SHA-512:6DB7D120F20EBC3EA46A27A75F64DA0715A7DCE8384C1984E70C69E2A66F27F6AC4AAD9E85D3C7FDB870A56C906E0721ABDD6444AD7BA8F394BEA3380098357F
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx....p.A...W..v.Qm.v..m..{fl.}Fx...Xq...o..>..<...+.B..+++S.H..d2.,.+......................E.....T(..j..333199....0++...$...>>>._........................t...R..%I.H...JUT^^.EEEXQQ...D.....o........9s..}....5j........9./....{......q6.w.'........8..O.>i..?H~...s.vFFF..h...<..}..q..9a...d.....I.Cw..........P..!M...d..C.h.....Cb..3..>|x.t..gW.|.R..j...Vw.....1r.W.|...k0......].v.........9...ho...]....#?.?}.t.[Ax..qX.v.444.......,YZ^WW.s..%.%-....,I...j.....m.m.m.m.n.7.....<.?./W..h.).a2..eJ..h..1..sUf..L&....Z.B..bQ.....pt^.....N..-..L.A.......0s=...:.._.=mY.z..}...X.m....I.9B..8.C..~.O...]].K.K%.o.`U...).-A..*...}.....~.../....D<..x.N..}.c82.Q)5.{.....x-k.=.l..;.#..NL>,.....@cc#..\.L&C6...36.&..'...'....O(.S_..0^......F.rd|.".?:...._B3.L4..a.....L_T..D..g.2..:...f...h.+Y)....j.........d.R$d..89.........a...J..}....y.g.T..........T.IPJ28P@.%..hiR.......Co...F43kG..X(z.m..@.>:,..../}W..8nJ.>......0.}y'

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\32x32\logview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1809
                                                  Entropy (8bit):7.868539144199516
                                                  Encrypted:false
                                                  SSDEEP:48:ANK1EO0ldAHgd6alI9wHtFNPErUpqvZKDFt/Ess:4Ky7ldAAowAktrP+A8ss
                                                  MD5:F59849839E62B9D856BA38A3B3C48758
                                                  SHA1:5E7B35B3DA89E251D14A3159C8695CF8B1026498
                                                  SHA-256:35D59E268B673441363334C40F147E7A77BE6BC1CE86A849F96039F325E8BE86
                                                  SHA-512:E924D47C384F439B5661EB846502ABA66FC6B5DB79751C3A6002588D0BBB2979E597C5069E9F32F30D25EFAF50EDFF1AD26BECC4837AF89CBEFB2FF9636A7006
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx..V...k.....6..6.E./.m....Ol{l.....{.._z.{q.....s.T......T.^.Z...{.n9..7c.Z..v.fm.u.cg.AK..i?t....tu....9.Xf...:.....e[.......,.ql.'..=..?.|J.........M.E.......~.K..-.....I..&=...4...{...z..A|..[.z.]`.c`..`..`.U`6..1..>._.Y..Ns<.).....rz........p.w'>j.c..'..'..G.....Q.`..}v..@...).D..i..c@....V.M>I..;.Wy..K.B.6..;`.3.......).{..m......|..UNN."g....p 1..4y.O..J..&a.b.LJ.......4.......s....zK..9. ..K..s.U...Z...7...-.v.....M}........QV.|.....G...y^A1...PRR...$$$.#&&..........7o..j.....>..U..IG#.......j.Y.....yyy(,,DXX(.........p.433....(....ww....wz/i.}k.~.p....7....J%4....|$&$ 44....buAAA...e"QLii).......O|'y....cf..R...@O..KJ..+[....!++.*..?..}$.E..+..S@.5k..W(...p.Q..$@ "...Y.;.....,.c..s.Z..v....M_...9...^...<{.o.J.>....(..D.CBB....V..(....=.9.......iDU.........}.............yy...D....r.....DDGG...........9..........;v......Wdd$....X.Y+...u..;gy^.4,@..zp....-...`Bn..{...HQQ..*.....B.iK..^.s.

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\32x32\processqueue.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):2409
                                                  Entropy (8bit):7.891958150325809
                                                  Encrypted:false
                                                  SSDEEP:48:Mf0PrjTTqg1G2F5AYfsJ4kuOxzVlBTm1WCGv0Z5eilg5DS6uAuiEg:airt0EYTTmsCGyBO2iEg
                                                  MD5:21C3016F11243C71D1564CE32AC3CC51
                                                  SHA1:C21209121A9C230E587D1D6590EC42D84D7C3CF8
                                                  SHA-256:EF295ECE73C491782EB0F12997760EF4C8A01E563565AD32484CF10C035E0254
                                                  SHA-512:E167F245A6EB8602EDCBF04BB555EF3F8EEA7F9556483ACFD13BB90456F99E198510E030F4FB3D743A00F7189743DD722E13D96FDAC26F686C200111AC6A8D1F
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz....0IDATx..V..$K....,....|..m....m...o..[=...ef.#b....5n.8.Q.'.}.....o0.Z.=.'.O...........k/~...K.5..0p..w.._)X:.@.`-..l.fm.....w..&.)Q(8..hH.F........~.....E..-....Ww.\.....Z..VCc....2..^"./.....t.Td...J/.......p.bh.....o...|....}.i.'.s...;.".Z.f.^...`1.....w1..)1.e..%....D....q...{S....{..%...F1.".5w..S.j.....0H.8..`m......D.1.F.X0x.D...*N.3...e..X.-.#.p.rH...)r........5.*@H...!.R.T"..A"....v.*v.!.S....L;..l.@A.o.....S...4.{....%.......LIy..t.U..8v.1K.i.a1.i.......E...0<......zU.h%.\.U.h...4S3Q..H..@s..`...../..$I..A.t....#...{B.n .e.d#E.I.C/.([e....SB.e.........&j....O.ygq.@.Z..I....q...+...9...t.F...P.PB.(....wFoo.Ss".1=....V:......p...ge\"L......(H1VK..h....\.e.4,..>.PA.s.=.....)....]m.j.zT....hvL.)..*g.hDD.%..D...b.L...04..+C...V.^m...%...N.H..A.S....I).d\..6....a...d.Y.C<....... ..\k..k........V.)......9m.....P+..4.(.~...>rh....}..y.ALK Q.u.C.M.6Ir..R.$@......={.<t....."....#.(.i..}...

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\32x32\queueview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):2051
                                                  Entropy (8bit):7.887490483446193
                                                  Encrypted:false
                                                  SSDEEP:48:O+cRQjxloUzcrQoGd3thAOlUxb8r9bz4iHZGsuUPFUD:O4YUzcrQoGlAOl08rVMiyUP+
                                                  MD5:A50B7A376F9C3BA09B37E2B252E9196B
                                                  SHA1:2FE3A34908B5C6E7D2E3F0037BE2CC8A21F1D69F
                                                  SHA-256:03310FD97655DED583501961FF7EAAD738BB4EBC34357FB3487258C13CB32666
                                                  SHA-512:BCE29E09E6224021E21DB7F15C7ACD4971D68EB54E002C4247B24675AE67B4C059136E2434D97C57A62B632B1CF1F3DA6F5783A6CC527B3A6DE87F33F63279EE
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx..V.td......c'c.3..v.m.m.|...d2V0I+..{...Y....V.U....9..I..l=.-;.S..p..'...t"..e].g..b....{..vuu.....<|.....?.e<...mgS._.d.....S.}.?..iW,.......W......N2.\:44t...a.".N.......8p.....r....W(.....b.A[ .U......i6....UUU......E,..cL..@QQ........0PpPp8.@..h.ae....Q..n....s.....a....}_).3.P(.H.\..8.qY.....@....9...p.FIqo.}........s......3,B..$....'s..... .9..a8.AV4.......Qm........E.~.GG............ZdD ...W....M...A....O.0=.&... .B.@|.\.:..ySkk..u.......qn\j(5...w.3...XQ..:W$..I..A...CyY.}.4I....@..p. ...OA.....i?..-.....("A.JA...D....a.-4..k2.@.D^.(o}>.G6......o..h.YH.hK....lO Y.0l.X.iMW...PN)`i....<......k.X.y..............W.E.1]i..@.......w......&.p".......,.'I..v...J.."....F+k..8a~eZ....u.?.... 3.tO)x..+..X.qZ\I.+t.(f..p$q.I.>..C".xo!_<9.aT..Q.y..u\.K!.z@"H...=.P...q9A)e.(..m175..C.8....<......'.>.vI..$...S.!.dE<..i.`p.b\......E'......9..~.l.T.......UH...B...R...rgO.8.k...g.......;..y.../h{.G....

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\32x32\reconnect.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1562
                                                  Entropy (8bit):7.823906733406248
                                                  Encrypted:false
                                                  SSDEEP:24:/NuNVznykzvBJ5KJkTQnHZAypBo+aTWmGdqpDNFelx1D++3M9RUC9eg:/wVLXzZJIJkTEB/MakqlxN++cYCL
                                                  MD5:74B0E17AA2B3E17E8D18EF8E616946DE
                                                  SHA1:DEBCD44BB5CCF4F7094D410974886E24D5D27CD2
                                                  SHA-256:5582EFF3EB69CAB38F91201DEBEDAAF242C28865F22832084E5C83B1004E771C
                                                  SHA-512:CC46DE841B8D23E07A4FF028A2C30FB95BB69288CCBA7755E7C72C3244ED26B8A1DCE502A8102F8714CFB5A1B20E7BCEF5A92CD34F56317963DFEF2FA9AD4670
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx.....%Y.....U.....^.m[..m..m...6..U....9{..........G.i.y..{.W?...z8...............|...?.ov3.n.i5[[.'..Hkd...>xP..@R...+..x...v;....+....1..h..B..e.{.F.Y.}......>...&...../....<`dd...f.Y.5......,Ky.....<.wW..3Y..O~..o4.u.^1r....aj...............d.d..c4l.",....-...._../.-3...j._.b.q[....,.~..!...H..H...c+.4.........\[.,.$....aA ...H.......o4.^....eZ.N.p...R...^...H....i YZB.+.....>.........v;,.........`9I.g........-.:sY.....UY.K.q.eL...l.-t..s_O.....g....n.&...~..t.I..$%............+1%!..W..*M...^.n.c....F..L{~.u...^.--y.l.z.{..v[.vr|B....XV"f...~.[X.@.....*..G....+....x.5vl{..h......].5.M)A.#p.6/.0...:jh...J."C.Y.`....y.3..".Z.....a..M.7..7.!.2.H..i?9..,..a....h.....t0.c..@.Bg....j..y.7m.x.'....1t....(...:..:.@F.b..Bf..9A@....I...O..TUeX.nO....R..-HU"`.U.+..'w2uhJ............W.......G.._t....*...:.%.eU....N..U...Q.........G.?....)UQi.o..^.-o..].(jJ.}..>.[V.5).>...a.|......*...4..R.V..^..;..e.|..H....e

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\32x32\refresh.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1959
                                                  Entropy (8bit):7.858973006738095
                                                  Encrypted:false
                                                  SSDEEP:48:OM7DJSblpupbr3JzF+onHB6WBxS7BnUqlx2ki0U9+NLw:OMRIupbrZzFdhTByn5lx2l05E
                                                  MD5:9F2F24382E68DEA83ADEDBF84E2AA62B
                                                  SHA1:2D1A372A71D0BF3F2F055FFE4A5E3C89F7F0CB8D
                                                  SHA-256:122D141DA21261646A2921570EDBFBE07AA3E2ECE3528472AA03486E1084D96F
                                                  SHA-512:3833E6385FDA50182D23A6459646D399DFA9646AD51285F343919303762F2E617A389CE2AA3FEAA80806FEB28B1284130D8D84CFE66F0DE301CDE3DDD16609C2
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz....nIDATx.....%I.@.....TV.{..c.m...g.m.m.m..U/....xj.g~y.G.......>.....y2<e.Q...O}..=w..@........6w.....K.<...Z...kZ.<.......?..a.y/DMi<a.e.!.vZ.lM.+......7....U{....f...._.....w....g.\.qk...W.5.. .@..&.S.e@...5.(@,..W@.......,H..AuFx...v..~.o...[__.<..I..9.........F......x...J...QX'x...-.(.G.,#vl.qe.u.........u.f.._`g.xR@...:..O.6...g......j.R....V ...BYxl.....$.L3l..i.../.Q_.7nY..-j.....r.".f..(+....Q...L.R..j P @.`4U.f..4...6.T......5....O%.^.....T...u.w@U.6.2...0.V.F{BB|..l..."P....j@G`m@V..]......@. ....=bliz..I.Aajl.h2.V.5E.u..h'lm....aj.."h.@#....I.CM..).J........./2(F1I?...Y.........8.1.Y. ...2mj.-;..x.H...Y...*.....J.HrGZ8f.......,.I..bboHGGG....{..k./..RLz...x-.h."T.FO[.U......Y...U4+....J....`-.M(...z....._.6X.:)M..-q.o.$.....N. ..>..+.....*..K...J.....&.....q..,..<{s<.].J..BZ.k..O%...i`C..+ ......T...:L..][...........|i.W......A.........:..%.}..K/...(Y..^.RK.....:......k..w..o.._.e.....gN;.

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\32x32\remotetreeview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):2059
                                                  Entropy (8bit):7.84024650702762
                                                  Encrypted:false
                                                  SSDEEP:48:OxxpZD724VM00uz9FIjAsCiFoNt0VhPnS33ZLLOeT3VdPVkPwIQjVg:OLlV3yjAsCiFozkhPSnZmeHPVkPw3pg
                                                  MD5:327727EF3CB9960127601BBA2BE3BBED
                                                  SHA1:0454FF8C789CAB36F36F3C0DFBF4CCB7D8265BBF
                                                  SHA-256:8F7E3776E96CF9656187F1287F0D91E4D70E088AE6CEA15FCC015BCC5B9607DE
                                                  SHA-512:9927C204C1620A4F3CD93CCF57569BF0A78AA4AD5F507383086B1A48D79001CA1E3EC15D4A23C1451232AA4F188B8BD0737455894D3C0E9F7268304973037E33
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx....x.O......iP\k.......k.m.m^..I...gf..l..i.Nq&_.9..w..Z....`.K....#...R....J.<_.-.f..G..T.Gk\..k.^....E..;..wo.I.G..tm.....J.f+.........?.....$.u\......2.!........6.q....g%2......ht<.z'..6.M5..V..4.7.N...w...eL\6.=.Q6Z.tl.}.....;.....`Y.iG.......s...)9l.#.. ./....-O9.'.->.Y..[._.+~...?}bF.....$......yL\.....c 3.P.@i.[..r6.....o.Uy........{..7..pl..z..O?....3......c...:..eP...$.=3.A..#M...!.;...sb...W..3..M...E..........SG.).s..g...L.-8.....]..|..1.@^k.Hi....M[..q.vo...d......\.`...;?.OM6.].#...h.(XB.....`(c....H..+....l.v%..p...6f../..>..yF#4_..,.$..0......el..H..@A.Q.)x..*...Q...........F...a..Ap`.H.S..U.O...~......Kk..8.._..........2.1.....0..a.(......q..._Sux."Ijc..c../.U.b+$i.[>.z.......?..i...{..}.....$1p..k..k.*&y.3...).m..R....LV<zm@s@ [GS.5C..m..Dht"X......im.......v.[.:)..../..5F...o...z...=...%YE.+8.......eL.La[..4.).NF.dI.Z...{jk..a....W...._.M.6.......+. o..0.5.xaL..Z.,..0t......p

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\32x32\showhidden.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1858
                                                  Entropy (8bit):7.851825924477652
                                                  Encrypted:false
                                                  SSDEEP:48:OxhxFlw8NhNv+Q0Oz0ddqwbkgSGKlmcZPpQl7R:O7za8rp+xPddqwZQZPIV
                                                  MD5:65DE055EAC91F828A9D65D02F9E6EFF4
                                                  SHA1:BDDFDE8989C51D15C0591183876ABFCA4527935E
                                                  SHA-256:EFB812C763A5BE67942400578C9F0C41F5CD96251B080F79799ECD69DBEBF483
                                                  SHA-512:935D983CA251967ECE999243FBBFC6DBB22F5BF293DF0A6737AB81DAEF1B507F1D311031CD464588924CB0CDC0BF00EAFB8B98CB78688E136F439502AC79C76F
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx...5.+..EwU.p.33C.......9.3.ff......c...}o...4O...{..U..8!.........>.eQ....TCtXenn..E?......s.By..MS;.$O.(...y.."...D....]...{..!..........~.?64r.5C......:..>....Rd..._.....G.....x..HQ...(...f>.........).P.r.L(.a.6Ei.<+.[.(.....J..`.+.n^?..#..<.....fE....j./........&.0...T{.(RsG.I..4g..6V<..ztW....>..`^.`...(\J.b.i.$G.I..M....=.h.wr;..E .pG.....b..v....6./.dH&.I...G..1....... ..h..f~.A/x.n+..... ..(...*..cP.V.Y. ......'(O.h....d&...?Hy.}.g........d&3u..0..... ..h..%.0..`..A...p[..6....,...B2..q:.;`s..!e..9D.....,..:Pn.....:.@.X.0..#c.c....$D.2..e.B.'..E.@.....I.....J......Z./.O....BY.9.8X.q9.h5..H.D.....@.A.0Gq.....!...!Q`..[''@BJH3Psm. ..JG.....yB.vCr....b...o..bFD....-j.O.....>g!........#........%..R^..P..qxw..i(..........1..........D..gqC..0.YAL..I...K6.....*...l`.=3+Vm.n......iz....Z.....KD....|.+l.g."..f........E..K.....R.sB...nXQ@n....F........pT.ooV.[i.U...m.M.r.....P ..A.<.G.x.I....m@..

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\32x32\sitemanager.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1687
                                                  Entropy (8bit):7.86046184696993
                                                  Encrypted:false
                                                  SSDEEP:48:nOUsTl0e251vz49UfRLMiCvfQ9F+raEEUOSo5tNukPSY7:ITSfPbPBWfocAUO9z1
                                                  MD5:6B83C40D286D5D03B058720836FD150C
                                                  SHA1:1FB13A8C68DB9EAB64B8E4EF57CD3B4F381AC275
                                                  SHA-256:DB2724DCE56D66AB12D3D5598B582E770DBBE0564F9C5483DC16038802EEE201
                                                  SHA-512:2927E00FDB59B5A70104EECE212516C36988EFC81135E7C378AEEE6BA28020D41321E38CB275EFBD0CDE413CA705AB93DBD02265D311D2BC3F0626165FF21368
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz....^IDATx..U.t.1....aN....*33.w......k...3S..9..9.zuZ...+.....d.....P..'_.n.L.=...w.pv...6.e..=...tT.B,.4k...H....[...t.o.F....k.... ..LLD&..B.}}..BQ...Xhab"..H....Q......T.X...i.s.Z.i.P.S........T.xO....m.4....J.**.P.P.Z.I.......!..6.k...!.NS.Eq......D.-.X.t<...C..sc.E..gE.57......C....p.D.PTcK..t<.T..EZ..ClYy9..-........Qcke...WO.........ji..5..Qx..>.O.iK...C..T@..Y\P.k.&.Z.i..Q.i.J..3.D.Y{o.a...;}}(3v....:..'.S[.6......4um0..n<.D.........Ow...~...K..\.hh=..X.s...b.~.....D..t.JU....Z...jt@.....?8.|H0.F....[w.&MZ.d.....g.....-s.k.U..Lt.M.P..y...Q...n~.._z....e..\}...........+.p....p...9s.....v...K$.:..<K.[..C..^.....9i......V..e.t....P. .........5]5w..}...J;.h8.......y}....5......N.9=H...l.z.g.t...}....Z./.k.Ac..?.W....T....G...P.....+..;.@:Q.rP!..'...H...o.L.8g.L.;..wm./].....E...zJ...~.Vv...m.)....F7.....t3#...Q...>3E(..@9t....^..-&|+....-Y....9..T....mf0i..\..Q)..zz(zQx...T.|....}...y...l.8..5......Y.Sm.Y.

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\32x32\speedlimits.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1371
                                                  Entropy (8bit):7.802705458504437
                                                  Encrypted:false
                                                  SSDEEP:24:G72l+4HwnHzWlg68PVXRnzYQrMbuvRaUIy1n/K4YCkEFzok19tsa8LgDeRV4:9TKzWKdPVXJ0+q6dIGy4YJENz9saTDeI
                                                  MD5:8F5822A03E7A8A0590DE413D73FF92E8
                                                  SHA1:0FDA32FA3A4E6B0993D21CD8CB2E7636CA14D0B1
                                                  SHA-256:51300DC8F3578FE512B4D42A0109465D255057CAECF40E0090366D6B5D06717D
                                                  SHA-512:0CB877F39E5050B0924331D60CEBF1C532F9F4B592C01CC895A5BF14A55F01D3AAD94D4C8EA80634EACC12669224C3DD7306A8B07D01147CF1DDF85E241ED068
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz...."IDATx.b..Q.mia.>...T`` ]0.... .A.ppss.............-1..... ;Av......q............L4...Ab.4u..;.5M....y..g.KYq*H.......@.gG._.1......!..yq.s.{..^.............ZF".G<...H$x......%-..j.....f...d....3pt.P(.l6K.^...j.....b.g..r...m4....e....Z..f.z.J%........0i.....R)t:..F#<??c<......@...F.?..A....t)O..b.........F....l.`0...........&?.....@>.....z......q...}..s...{bmm.....&.ww...[.4...^..K@.l6.nYc._..)..)...0..`4.{%.N.......W.Ce.....Q.Vq}}....0..HD......+Y.G.Qi....@:...V....GpNp.R-......].Kz.....4@.........j..f.....|JlR.N.*.R.P....,......P.vf.......OOO.v..........R.s.P....D8..PR.....3..|B...B...|Z.T.|~.N.t.3r.,2.."...Kz6..O.g)...^..=..$.$......B>.x.>q.......v..z.j.{{.j4..X./v;9F.4 ..7.$]....)..-0.\...:..8....9;..W...`=....'.m.nj...j.9.m....g....1...>W.z.....G/<../..x...8aI..u.......{.o......`......).U,}......a..fq......a.f...^..7q.l...j-.;Q..e"}E..w.S.}.....W....P.' ".....6..q~q..Be......u..l.Mf....c._.....2.....N....

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\32x32\synchronize.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):2005
                                                  Entropy (8bit):7.888174986967833
                                                  Encrypted:false
                                                  SSDEEP:48:O5sLfB9aG3CHGemXa9kU/A6qr2ie4ybvcLHT3c:O5c87VCU/ICcYcHjc
                                                  MD5:9FD2443CD1987845102A5CA2DE3F9957
                                                  SHA1:0F0125AF2842B8A1DE7C0DC9DC33EAB47CFA649C
                                                  SHA-256:F100E09709DE8DE0B8B6F219AD3C9F5FA55DE13EA9494B12977234B77DC084B5
                                                  SHA-512:120E6DA12BFB337F7E0FCAA1E1D6D9BB64EA9CD6A69C39E0461CBC7995AD958B5D563636DC112CF11D7EDBC966605369408B02F17324CDBCD25D8A64B6366DB9
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx.....dY.....2..v....m.m....=.*Q......)._..'n....../...........7....HQ.K...0\.y..#..i%.{&..k?..sV../9J.|.7..)..(.v.....!.{e.S.i'.........Q^.....G.,Z0o?..U&.4v.....q....PX4..W8..cPe2...k............L@..D@.[c...R...p...t.8.R.tp...^{U.'.W...f.....,.v.I.v.......................5....'.h!i..".2.v8|q..N....S..r.{.D.f...]..S.^h<..ims."...b..>....F..1..&...5&..9..._....~.;.qQ...h...(8.i7.Z......G.?2.(p..S|.|G..w5. ..V....Kw..M..-...r...3_.....y....@.z..f..Oz.O9b.e...../.q}.'..(.H...6.FB.q.....FA...u/._...H..N0i....Z.z.....KV.J.n!.s..r..!....b!W.M)..-.].D.V.4Sj....I,J-N....I.b.V4K..~{..x.py..R8.s.3.9f.n.b..~d..k..,.......0}.H8b.q-2...3Nw.?.m`..&B#s.S.../x/K........le..UQ;..i.?|..._..oh...C..D......p.A..K.<.y...(...?...g..B...p...k.u.;.."...|>..~..?.Qh..3w.......:.....h........0...>J.(..2.p>f....[LH.7DG_..|./._...8x.......k.X....8.u.f..C...y.m..y.....@D.=~T.4w..9...^A:......\..6..#....H..3..=.~.-.".^

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\32x32\upload.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1386
                                                  Entropy (8bit):7.824063085785144
                                                  Encrypted:false
                                                  SSDEEP:24:v/ym/Td+laZd62CcCkTzgXktRsSeh0iKIZ5hONXVieZ38ZNZaaMZskRMR+3WoeX5:v9qcCa0XkrG0iBWNXLZi3aaMZskRXmLp
                                                  MD5:A73257C3ED8C413656242CA0C8ED2E70
                                                  SHA1:98B969F77F58B4170DA13FEFB1BA6ADDE826A4D2
                                                  SHA-256:4FFE31C7EABBEC8540DB9BF0AFE39CCC27C198BC3EEEBD04FAF50B1611C80C5A
                                                  SHA-512:AF2982031634326ABCE9C55206D45477EC4960ED1F60BC8DA9E25AB1C403ED358E705869C30540F97FF65C9E24468095A22724FA9E4D6A7E37803B639188F3D3
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz....1IDATx.....#O........-.\|.m.m.m.,}.q.o....$3....U..C....2~.Vu8.\.&/.i..2q.....un.q.;>.....p.[...'...a......y.|.....[-o.......'...e..2.7mx..ou...s'.3.^....p.+^.6.N..c.......M.z.].....'.....s......|....y..O=../....[^..;.....1iJ5PT..Y..Lw..W..W.....o.`..`.....z..6.9S5./..jJQ..@KA;........e.t.;..S...`...fg_.......G.W.G.....G...Z.u......l.......k.Y...W..{.....l..*....R...Pu.....PW....%.......{|..|....'B.C6......];....`.....gtL....).=.(.<..B..15?u.l.q.g......%......=.~........X".%6._....;jy[`.g..f4..).'..l.n{[.O.......}.3....w...u.Q..E[.v..9".%<...0.`..Z.........z$..w..+o.`...6^..|...w..S'..>Mh........z=.$*.B[....G?".!:I.J.....2/....ha.h.|..31..c...S.........Uo..'......Y..y..I...[7...oD...M.."O.]..%U.0F_.Z.......+.$..u&..rz...z7.........?.^............}{... .@..T=..!.t..=5...<.........V.D.....Ox.K.?....i....VG.aR..?...]...~./C..n.........$P.....s...tn]z...!...;v....fI........]..........e.@0x..[..T.D..

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\32x32\uploadadd.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1734
                                                  Entropy (8bit):7.866604030606009
                                                  Encrypted:false
                                                  SSDEEP:48:xayRIbUfwrQZRTyXIFaXG5Sj4E1nx85i1tF6LA8:xjfwrQZ5uG5SJ1x+iF6LA8
                                                  MD5:D610191F5D672B3A91D648F8478475D6
                                                  SHA1:AE04D8FB1682E6F1B08C1C5EE7B678E256B349B0
                                                  SHA-256:09B06F8D4B0E21097A774FBD79B5054112A9910A08E3269DD56C35C018462157
                                                  SHA-512:48119B467896BDC0BDAB906AE9FBAFC98E40E66589E912CA03010A671355F39AC5808AAD45C3E0592DA352580832A2056261754E4287474C748BEC8E5E0A4A60
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx.....$M.@_....3=...q.m.m.....m.....tU.2.Y..o......~i..../{c/.Q.,..~..s.V.yy.iw....yV. f.5........S\.+..j.....nw~...C...^..| .`..JL....=...0....?.....?....p5.]..-.....Y...d...7..........S..'.F.............0......j..7>..w|...7.2.aF.....:;......f......V4.........../`;,^.n.v..<...E...5,..H......q.._...?...O~.8...q....y...............C...D+b..<.pS....'........&..nZ..)..j]........M._..G?..{I...h.R4EH..]....:.t..h$..q...3;.5.F!%#?".*6n..........R.."....6o~........9.hv@S)4`.b.S.......w$..nebb...W."Lf'....gJ.....mo. .&"...k.w>...\,`....ly.k....;.h0KC)..Z...q.%`=.>t..+.$S...,i-.x.h&'...'.#3"..U.7h...#B...S.b..6o~.K.......H..D.F....~.!....)..+.E.....h.G;.Mc.A.$j..C2.c.......!-..Kvn..w=..8y...$..9=&...n....#....D....)!-R.xD......'....Y.:.h8][...dNO.....l.../y.....d85....<.;Lp.s....z.u.|u...F..U..}.6.n.a..w*.../......}H.......m..5;v...z...'O..L."...93....[.....+...5.<.1*A+.x..xyr..w...^o.bP../.....OU...

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\48x48\ascii.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1653
                                                  Entropy (8bit):7.848903233529697
                                                  Encrypted:false
                                                  SSDEEP:48:IQhz7G+3ciq35ka7jB9QkotDSnM7/2gopsm8iSwWb4:IQt7lciEh7jB9z3BVSwWb4
                                                  MD5:46297C04805EDB41238BD691E809731D
                                                  SHA1:CE882D16271D887FB1B899843BB2B0F0DB158BE3
                                                  SHA-256:BF2F064AA74DF7EFE0F04E1DE0A2EAD434B7375F8D27E8A660E5B172A0BDEAA9
                                                  SHA-512:F43B702EC464452FBE204D3FF436B2A59A3340F3C30CD40A40BB552B610A0E078735F17294985B0BED80F7F454C475FE51E5AB90046A3EB2BB8501EB6A862F85
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W......<IDATx..Z.n$9.}...2333........oY./c.9Y.3...Sd..J.L._I..8..{.......?Z..g.9..!..?..;(..D.0......~..!...PH.R.J.x<x..y=..HdK..L&.....J.5i.j....UKu8. ...m.. iZ...Y..^..V.n.S%.l..N.v.}s.....[':..n....BD.........&.... /8...b5.>a.px...B.0@..]^$S.....?....iZ..?..p-.1.'7.....A..."..#.J..T.`U.q..JKK..:..K<`.X...}>.|...b,.RS....I455.....y.S.MbM.w..."......BT..aZ.&... D....X.D.O....F...hT(W..0.1$..... .....%.X...r.."..'h...`ff..D.D...I|....hHX.yItuu..r"...<...3p...-.R.4^.xi.].=....]WW.d<....A\.t..6m2~G.OE<.CmM.+..xB........abb..hD.6K.5k.c.N...U...._.|Q..H.g!....-D"2y.t.2...a..U.+.@(...g..........D\&/..8.......PTX$...1T.T..H/.'...(....L..'.m.....s...~||.....+.j......2V?.........b......>.....xzz..............W..g.].PRR".;q..S.....+..|.R..9.P......4ZZ..Z.y....3.[.j..R.1...7...V...]..2?....ahx....u:]8{..($C.^.1ZnTv.&.&...6o....g6.3Rd....I..............9.. ....p@..a...=....<.X.A..8.....%-.$...ITUW1.y.2..{6..C....cx.^u.....U.....

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\48x48\auto.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1618
                                                  Entropy (8bit):7.804029018238258
                                                  Encrypted:false
                                                  SSDEEP:24:pXmIaGcXF6qHQj+E9sz+wRjhnUhaIc8FTZN7KuXnPKfKLEb+wjEHs0cLCNUqR4:OTAL+9RjhnU8JipXSok+U0cLCNI
                                                  MD5:927E70178104C85F31946F2C2647F2CB
                                                  SHA1:00076FA27C7F449EEDF9954519CF83C373514667
                                                  SHA-256:FF0E8425930242427E9B5AB78DC181B65FEF6B73B54E93423E01225D412ACE3F
                                                  SHA-512:33566AF1AF64BBD2A2F9E54CD9D3F87A7927B97D36EE249D01BDD55FC079EB73B7427E07E465C2E450FEBF8195600A9322006237C8E2832553C1610561632752
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....`......jPLTE...................................................................................................333......222..............................000111VVV...;;;...)))+++......444777<<<EEEHHH...]]]................................%%%.......................[[[dddgfgiiillm...............$$$ YYYFFF...BBB...CBC..././.........GGG...&&&(()JJJKKJKKK......LLL......a`a! ......GFG............III......nmnppp...-,-MMM......PPP...QQQ......RRR.........WWVWWXXXX...............***..................666\\\............888aaa......bbb......eeefff---hhh===......jjjkkklll>>>???AAAqqqssststtttuuvvvvwwwxxxzzz{{{}}}..................H!Q.....tRNS..........................{`;...~IDATx.....I...8i....Fl.g.m.m.OW..A.p...S...v.;......51.&/..T.......`...,.1.9W..a...v.".f..|..J......*.W>.......... :!..|...)pP....{.V=...<.`.....mC.q87pPQ.b.....*.B ..*.....w2..}e.S_c}...........q..+FMp...H(..>..O..t=.8..@|..#.m.,?.........g?X{.......5E.....#`...........i.

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\48x48\binary.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1011
                                                  Entropy (8bit):7.622816129915371
                                                  Encrypted:false
                                                  SSDEEP:24:hSNxveAI7GbfoXEPiV3Oy3/+ToC0tQzPWV+U9:hS2AI7GbfoUPiV3T3/6o5LVJ
                                                  MD5:AA4957FA63DF6685B2A25EDCDE1BEF11
                                                  SHA1:67984828BCA9EA0813D57E75B98E8E9369657718
                                                  SHA-256:195F102BB4FB40DDC34288A1206BC82206DC9FB5F56BF313AED5CAE45DED1008
                                                  SHA-512:1EF4FBEF3C309638E1170995975B72EE8A28B1E11C79D6B98D904126918BB5BF1017F8EED35F3BA058327F83BD47FFD4CC7FF266F0EDA7395E8289E7D964BBFE
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.......1.....IDATx......K...zm.g.m.m.m.ms.u.:.F.:..#.T.J.g......@)..._..GM......cb.......A.10.....-(..{......A=|....P.%....U.l.Q.c)3..(.6..4h.......*.!.{...X.&..y........N~,.w..AE......P.'D.."u...nD..O@TU.aJ.i@.t......k.\@|..bB.T4...h.0.....f4..-,.X...Q...."O.g-..1..\.......}..:...kZrO.<{.H0..-+.+.V@....M..T.......^4&....n.D.nE..g.4Z..=....}.....]....t:..-....&..{...3.1.YEP}....kN.;.".h/.......k1...P.q.;.L.nc. ..-....D.e>......^...*2..WA....LeO..x...vu..*lJ..`2...G.;.*......:G....] ~.]D..&G.ZU....[.E....k......@.. .o...u...R.C...0........F.@..@./..A..j.....[&.ko...v..?.z..7......"..-E.=.~..! .4.W..... .1'...._...s....j..Mp.)..b.w..".&o.I.......~.(A....@.<...F...ZK.&..Mk.f.y.@...@0.Ya.......k.Z....t....ne.....y-.=V..].".Bp..=.`r.oyq.....(]...V0.%A.k.V......y......m.Zxoni.k.:......=....)w.`......>Nm..gln_o...f5.........z.U^n3.Y=X... h<#]..R..C.F..X......-..yB....(u8.^.TP.A.g(z(~.f..7.w{z.........k6......0............x\.

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\48x48\bookmark.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):2850
                                                  Entropy (8bit):7.88078841184119
                                                  Encrypted:false
                                                  SSDEEP:48:VHULjjqZBWbUEebs7yN/AU4iROHY8q0ULDBresT:VpBNVUcIOROSnLDsW
                                                  MD5:17F1CBB8781A293858A313B3565DAFC3
                                                  SHA1:CB7929B5D94D985305C1F46C591E7074CC8A7199
                                                  SHA-256:44D9D04144C429AB147723EBCEC3E4B67499975671F9FD54DBFEEA65341D8ED7
                                                  SHA-512:F66DE2B9FC37666F0732C9B624A7DD3640568739A997A49C77B9279284CA7864EAD90BB004874241002F6B5ED88800DD8B815E26FBFCAD64D13B307E23C3ED84
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx....$.v.?.U...t......fff...(.333.&......26c..L4...L.F....v5...9....l...H@.....cl.....4`.D.k?..&..e.vT?..>s.o..x.o.t.s..J..7..7...`i<.....;.3+[...'.._y..@....@.~.bvl._..S_...J(}..^.....".]z=...B ..G.}....'K..@|..c_V..`.wi..<@>h..P:.l]....._r..@t.....0....O.W9b..P.......8...oR+...i@.I!.H../....i..Y.r.V....>.g.l?i.Y..c.......>...U.5......E_S;...o.W_....`4..&..2.;?..g..7g..".MZ...e..;...C$#..N|.&.k ..."....O..7...fD.K..._./..L..O..9O`z..'>.....o.4j3fAnF.,.O...g<M.l........xM.?.I.Y..o...w...5..9.m..^..<X{.x.`].X.........'.}..N..1.......l.@.)....G>.0.-. <@.u..iM.*;8p.c>.....k>......d.-...Q%..k...l..C?..c.. .5.......T.....S.~.b....Z.q..I.e ........f.Z..F.?X...W*.m...;..Vv6..*.F.6..sO.....P0..,...[.dH.?g.q/.........:;....Q|=L.....S...fL*...oC...wu.......J....\X._Z]n.//.+..*...."....&-.......BH..sBB....`.~a..4.;.i.,...d0..o......d.....$zok..K...~.{.K>..^./..=..W...j.p_..f.c0!....,`....B..3.$.g|W7.z_.A...8`.,.x.

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\48x48\cancel.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):2732
                                                  Entropy (8bit):7.9101997711015155
                                                  Encrypted:false
                                                  SSDEEP:48:tbKF+TBUVRZ9/0bAx1eRcuX+4M5d1HXNTQqIha7IwuoXfpOlgO9x2a:kF+8ZT1dfvFN0J0hNXxMgO9x2a
                                                  MD5:A0395DBC01BC529F3876E7AE9A36C1E6
                                                  SHA1:0D2E3C80B4BB350020480F246297859B44E0D6B8
                                                  SHA-256:E687D47C08F32FC0B1DAA5CD577F3E2112087E36DA2876EED3FABA573C7D5F3F
                                                  SHA-512:5B2C30630AAB23A9A9D083EF6559F4FCE3ACA43956F84ADF0A7DFFC6EA8AA11B9832BDA2A63D14184A7EF31C866AFF1B61A932322E357F0578F6359D5A486DF8
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W......sIDATx...t#......%...sy/........._......e2.Z.4..o.<.\{-K...9e........e.......w......g.~.^d.#..._....\DJ.b.r.|.0...|.3....a.(.*..-R.....b..&.\.<..WVV..."..1[,?...u.;.Y.....y../..ut.u..n.T...z.N......$.}.:7.......+_.._....`g..Tk5j......s..M....+....{.U.Kn..2XK....[.&}R-.l......+.]............~.H>B~......5N.{....H>......[..:{..Q*......00..8.u8g1..lV.1..V..ij..7W...\j.d...q.W..$."..*..g......80??......,.O0...<f_.Y(.Ep.P..M.....MA.....}](....$..a.....h+]Z...}.........V.......=._`h.......n.<..@..Ri.......v....8..!....%......\.g-..JP.vX..>.na.?..%Q...{`...#.......$I..46.bcgL.[..v......p..j..?A."...H.d&...0.2A@.....+.!J.........q...@....(.....b.3..h.....I..6%..4...b.!5..5...}.8.P..U.z.<.X...........5HRH.:.E]p..m..4E.......AF_z%..z....(.......w.a.`K...5..>....@T..*...A.B....[...Ep...z..@iX.. ;..\E.....c.........Q.F...6..0....)...8.y........,.{!r.-............7...........":n..5i.......,TP..Q.5..k).........:..

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\48x48\compare.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):4541
                                                  Entropy (8bit):7.941726318863344
                                                  Encrypted:false
                                                  SSDEEP:96:zfbySKwFIaPnV+f33GToP78Q9bgjrFgDdNbHhO8PjIVlfsmCksJu:zOSKwFIafiWoP41jrKDd68P+gksJu
                                                  MD5:34E1332DD39539CEEB6E50256E1A7D81
                                                  SHA1:7F9C760AA312DBFD3122FD153190127A7F77D73E
                                                  SHA-256:11A2E0BE0FA54EB2AC0D86943447131A42C3BEA0FD79AC46CF71E09E49321E6F
                                                  SHA-512:8E4F4350E1A4888EF1D94688012E8FE773DFEBFF308D507EF79153691C875C1189A947723E70A01CC8D1D60101C03408DC8608F348D8109405CA999AC8B67829
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx...t....3 ......C.9....-3.efff.Rn....+.)s.N..p.(...yS..VnR..........[#./..w..`Yy..HL.M..T..1.n....YO......=.....e.2cM.VV...@YI...T.E.J.0....P=...Zm5}......h..b3......%E.o:h..V.P0.....i.wH...wp.-..,/CJ. ..."..\v..o.......h.0FI. P.,J)pl.O..~S....` ...d-.T*.~...).A.. .R....u>No?..z.sf.T.t....W.....C....`(Xn.fQ0...B*...../.P_ `....:...+%0..~....]=dw.......}...\.r........UU...h.(.I.4y..L..<(..N.4-.@..$...;..l.k..[u..v.......V..;.$.8##x....C.T.4..P._.mc..{.Rf....f.$...hmi.....6v...5J........+.8...8....2..X.O}...[YKp@..;C.(...EI.lT..M.gK.8.A....@.06.. ........r....zp41.ZIi......K..*..]{.....).....s.1..v..z........,....i(...@h..k..B6.B.a...P9..J.W...`Ue.A.....,..W?.........vZ....W.E{JqI.m...8}Mm]].=.h..w.y..g.x...9.7...EC.-[..`......q].._...q...e.Q.&.._....(.....hin....k.(**~.......~.,Z.`.R*+.....7O@..\..v..O~.{....{..v..~...o}.K.,(.#.E..c...D.3.tQ..B..DY6 ..20..R.0...@..=].SW......^....s..>.....

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\48x48\disconnect.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):3079
                                                  Entropy (8bit):7.925529381479853
                                                  Encrypted:false
                                                  SSDEEP:48:DIpEal3ERj+RrV3bBMKAWC9+zvKipYsO0hRrFOAzQcCmkkZk2pmUIzdV8+ZjL11F:Dtal3EIrRFM7ezvNhRrP8cCn57oa20Wm
                                                  MD5:11B5B38783CC4A49F83AFB327EC6FB28
                                                  SHA1:5B1210A096F12793E25AC8385C49170909A81693
                                                  SHA-256:3897B0B6758F4222CAFD6BDD5BBD97EBEF8AC4D44EE8E9E263364A9A5B1275E0
                                                  SHA-512:2F9366D263DA0290FDE499228FDE308924B3DDBB4CD250A700C13224F7EA4E3CBBAD3365CBDE5EF0FE439906AC007C1449F24A151EADFFB38FF862C466952AB5
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx...t.....3+...=!....|4...Pww/r.n....;N.O(.k.I.......I..d....|}.2k......'..n..-":J.-.......J.9...q..,.....i......M.455...|.....pQK......7....g.......(.m.(''...*.t.#$....f.~?....a....F.$............a.f.a..,..g.}}E.@..W.5k....N.*;.;..]K..1..i.AW\qefkk...3m...A.m...m.-....0M..4.!...~.j......|q....j.W\v.E.~....G..........&@w...t...eY....7..|x.h..Pf..4.X.....p...o6#... $$D.t.9;T...~..........?.;.Z...Xs.CK.Y.ic./.........b.|[..u..DW.P..%V.y,......cciuF..cs;.`}x........?%.9\.......H;.....+.6?.t....W....P..=.FCT(L.`.i.`@\N'e..1...k.h:H{....n.AP...*..^...........bY..m&..9..`0..-.......~C-\G..........z"..0M.V.W.4..4.K..T..H..{....^....4......F. ...C...~.C.4}.`Lfl...e......i.B.F...h._..........z@.H.e.x ....f.mw.wV.9.=...r`..>.A...7#....7e.....{.c......O.@(M.I..zk.<.3..Gw...d%.}.. .L*MDC...9.0.o..ig].#&.A.'....@.1..Z...r..k_8.,......?.+n..<..........,...t.......cJ......>...|.3.....(...G.....OLD.A.*.:R...

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\48x48\download.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1778
                                                  Entropy (8bit):7.842014884113638
                                                  Encrypted:false
                                                  SSDEEP:48:VVKzjIQEZk5IjJS/U7PvgiTPTYLW1voI8l:zKzb5EqUTvfki1gB
                                                  MD5:E9F13FDE8AE115E31C3854101D5523F4
                                                  SHA1:8A6428D5A86E95F0F79A5798D8825B4E015D2CDA
                                                  SHA-256:4ED6C9B57BB6FB5609A65472EBDA9A09DC64509C16EAC5BE3FAC966ECAB10687
                                                  SHA-512:4766AD46DDFFF1960DABB909067CFC946BBA75E5A376500173F5CDDAB6D831ACFB2C969906DE8343A4BFBB8721B0A7DB38F342985AD6263343ED02309D2F15AD
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx..c|di....n4ag*.{.c.N..m[....^....]q..42hw:..7O.~....0G.....q..c..%......`.RL.."..d....%.H.S6.U..4........1G.M..Q...|..\..L.^L]R0.7..G(+S..NBI..B.^...@.....4h.(..E..C0.p..L@.#6..B...2...."U*~...(d......p..eB0.L...~.]z..E..D"s....?...."DA#..,.._.%......%..x.......@.(H....%,.. ^'!..HA.(...M.H.".B&..U.Z..-......Q.M;.\.L...\!...Q.Z.|Y.(d.z.i(U..L.@....WE.".8.R...*...J.,"...gZ.`.... .q.,..T#......AP.......|9..^.O...p...... ...T.....BKYD...p[..0V......e.`.IK. .].B.D..`!.~p_..H. .D.0..K...J-1.}.)..w...e<.0.L1.5|.W....m.n.RF.c..D..."`.....5.....<.|.5.....*|.QR..C.k..N;..d...N]...F5.T.A..@$...).!..`y.M)].....zQ..~..rI.?...<..k.);...C..U4(&.H ..PSN.XM..q...?3.......t....<yt......\....%.d....(..._..(..N\.....v..O.$...|...PV...*B.f.....?Aye.!I..w.O.A...Y....GTWDLL9..\.h:.."A .X".......{..%.....-....o.k]..^.m*..2......`.+:%.8.'.....@..<(....!*.0....f Eh8..8Y...-...f...(.gt...7.~.._s...i........-.f.;..{3/{.....js@U...`..F.X

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\48x48\downloadadd.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):2541
                                                  Entropy (8bit):7.895272434230799
                                                  Encrypted:false
                                                  SSDEEP:48:w6i15MGime/967uwM/v+LWi87fhUL9Oxsg7wbbT+y6dB6S5sI:wnkGim57ufPsg7YbT+3dLeI
                                                  MD5:CA56E1B1AC534DC22C691DE0CF8F8BCA
                                                  SHA1:98C47048B81EB5D4616400E44DFFBEACB58512F8
                                                  SHA-256:C4A5E4D2DB551BBFFBBC178E74B4A0F07A18ABA964E4FA929FEDABFB90CAB0FA
                                                  SHA-512:23F34355E30F541607B82472F1B16A8B42CD9DF98255A622DB6E257CBA0D72399757F9A4FBF9565DC947C88BF2D2C7849FE10E3C783378B24E34FF823B4F497B
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx...l\Y.FO.{.k2c.i~.af....,Xffff..........1..M......(J,G...>3.X...9...^......U.ra..9o..UM..k.H..9.>.K.A..N%......o.*0..+a........K.47.A.L....Tr....".'.e.[.\].....k.wEqD......(`....eJ.NjI./`....."}Nl.9)8.D.....0.....Q...0#..."....f1.((`t#......Y)x.qp.0.....6.E.,.....f. @..L\.b.@.ka.....7"...r.QL..D8.L.<1h...!`.`....J.s.*.... ....g.A.|M.8..Qu....U...0.U.9D 8..P4l...... .!.^z1.(.B.].@...4...#WE`..#8.sqB.0@......~.\....9.A.z.F......;.]w......r..H7..r.....L,.;;v..o..F{..S......:..gtl|..w....G~9.hL...%..9.ZHoz.G.4.,............../_.....7...d..t.X.8.."+FG.F.'".c$..;...\..j;.^5.......L..fM........iOB...F......R.<...Z.../..|.XO.M3.)......<8..Yr.r.........P1..........'.....w.u.t`.E....!....i.M.\!q..28P.....>...N}.HsI./.g..6.E........x1p...*..'.r.(.........),........T{[.Y...8.8...?p...J..u$..2......eW..L..>..............R.b.,..-8T.o...[.g9....S@.47..I..@.%.l.... .#.,.t..-.F9ih.B)Kz*.X...&|.O....:....}..D

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\48x48\file.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):491
                                                  Entropy (8bit):7.418307307805135
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7/8HEOTp9lO+4mZlvumOjH24ntz7mX9fBxKh:3EOx4mru5K4NeB+
                                                  MD5:7E6FE83B01D0B919B2DB645EC751EFF2
                                                  SHA1:36AF223DF4160F6DD552E558989BBA8A345AAEB8
                                                  SHA-256:56142FEFA0721D2F0E6133119E3AC1FB5D4E97C133CCDC6AC1D865D8AFF45580
                                                  SHA-512:CB8CCE672155CCC825BC62739BF28FA96D00CA54624F0434348E2A3786EACBF5C26A6951A6C553ED81A0D3210CC60049810E6182AEC3F27AFBAF1C4AA2F2AEF7
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.......1.....IDATx..XYNCA.K._.Kp_.......eB;..g...;$.!..&q../.U|.1A..........p}.M...1}.w...gE./...s.s.......:N..-b...%......_.<Kk@WKD.dh.U"...+..2.H.P.H..3...A@M...... ].R@j..b@+r_..z.@....jF...2BP.\...SL...aZ..c.Q.N.-.X.g...+2"B...X3U(..ES..x.#.[...j'D$.<P.U.-jj.....c&8...D.$h...#.HI0..... .._.......^.A...E;.6..l..._.8..$`..!"..\.JF. ..iU.y K......8..<.m.y.0.H...Ok `z...h._...-jU....Q.E.....9KL.9.'&....4....1.....m.7......../.W............IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\48x48\filter.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1595
                                                  Entropy (8bit):7.809031979096335
                                                  Encrypted:false
                                                  SSDEEP:24:UulLDq/QNiluIDMz/zZMFD9CTudmKLNqleiRzJ8NTwXc44g4gpEqYJ/0yqfh77:dZW9sWMz1MFBCCoeYzy6PU/lqt7
                                                  MD5:2D9CBCE358D8C1B66C2511A8B14CFFA4
                                                  SHA1:6002955CB658FDC4E9B7A39D3C672222FB172B18
                                                  SHA-256:9D2C5B388E3D82CB36BB300628E3D34DA5DB424A84F60EB3489A69D819278B7F
                                                  SHA-512:94CC619BD3E61DAC53260AB975AEBEC742ACCBE4AD17C6475587D8919770C499A749C6FD2302865F976CC2705281EED3468D396346B3BDFBCD1196FD927E2A60
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx....#.......R..{.Fa..D.c....Q.. ........a=..{..7.._.st..\.5.Z.%5g...;>.1.E..%Gv..<....kw............i.3o.?.o.....P..t.....n....T.8u......~.k.r.;...S.1R.gI5...f...Y....;.3..|.5...g..oK.EU.....hH~..."...W..6.......W..^N..1....M..?MY...B.-..L...a..4/8...v.Mm.Y.G.5.9)....qz....4.Pq2).......?.T.3......Gd0....CD..&.! ..|..fk........h..J...#....."au..p...*...!.8D.p.uc....^o.0O....ov3...@8}.$.{.\.z.g<e(" $M..1I.$w.. .$c....O..Mo.TK./<w..{{..z,U.....b...~......>{......3.K-.H.J;.s.....}...[.w&...-{..J.....2..._4....5.....].XY.!(^.....7&@w%.j`f8.g7....uU....|.v.!:}W'`d./({...(..{.Ea|.WyI.........@..,.....\..(.0...Aq............P..|.%k"..........{..'....K..!."..T..;.I..5.!z......@.*%E.R.S.NA.GF....}..U..3..#...@Q*....k....@...(...qO..@..0.QI.I.....].rd.RV..@.*.`.?.Y$N.F..........o...P.}.xD...?...k\....X.......>...B...x.#X...g.=@p.e..a....pQ..........@....q..B.&.x...C.{..X..d...K..@..Bv........"....u...

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\48x48\find.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):3635
                                                  Entropy (8bit):7.93617930345458
                                                  Encrypted:false
                                                  SSDEEP:96:/RJHY8qW7rhMGNiC5OCi6ib7p5US29RLxA4tZULvU0RkML6OJ:/Dl3h3iC5OCi6k01Lzk4aKk
                                                  MD5:49D929E443AEEF38D291EB7D70CDE363
                                                  SHA1:5F35BD73E5DD36AE36589D07A1BFA4E3DDBFF40D
                                                  SHA-256:9DF2D9717F11EA52791C49EEDB35EC1AE2BEA7AE34690F7C459086E284AEAE9D
                                                  SHA-512:A04CEF618B0F21D7B6005CACE2AD1A9721867DF81E338042475A5E2562AF5265A4D00C43A39E595C6A7EDEF7B3790B236585831A00435270A31C06334AF8A89D
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx....d....m.......m.fm#.l.V.....Q.v.}..Q'..F5.....GV%N..'3...S..rZ...y7.|.e..BS]]]..ICCC.......s.R;..x....[.......K.....6....Ia...n..K.b.e..........o>....={.......[........z..L._.Y.....3\.jUd.5...#MMM.Et...}.O>..>..w..q.5!.B9.......S...w...._...7".....[..Pz>i.(...l......M.......LMM..>k...v..ZVV.E".{..L.l.%.....`....v.Zc^.........{.9oEEE622b.?...A.../..B.%(I..`\.6.....&''.....k[.n.+....xd``...Pm...1clff.0..3..D++//7.MOO[NNN...e......_v.MV(........o;v.0Q../^l....c......nCCC.....a.f....a.5k..V....*;..s...}v...x..^..Moz....,q.hYZZ.MNN..F....O...:d.TcNGG.1.vtt.p.1.P\\l.]t...o.{.[.r...W........U..R4.....xoo..m~{....I_ff....o.Y.....=....).>..w..[..$..D.?....G.w...D...1`S"...$..D9....jM......A..\.../P...J........+...u...cf.....Qv...b.5...;.@1..D..mmm..H.c8.\2.ZZ...z.hM..q.].J.Q.....}$>JD06...sb.1....:ro..UN.....7@./55.[h.F&..=.>.`........%C._O..(...9.0Z..9.wt...s.R9}n,.h1.}8C.....#..R.....(..O..(UjC..

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\48x48\folder.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):2136
                                                  Entropy (8bit):7.89517619447082
                                                  Encrypted:false
                                                  SSDEEP:48:VcKnuAVisAJPPzZiOorWAhwfC6Mh/2MdHfBSnkMGqoTlNu0Hn0f:VcC7+JPMroC6Mh/2IUkMGRRNuB
                                                  MD5:D59ADE20B0C7C9B61729B0A19C451CD0
                                                  SHA1:ADED32002FC16564781C812E932CB35C7EA803FF
                                                  SHA-256:EB5CA415E6A81F407521466186E6EC1B6A7BF3EFB0AF1C98563B301F297ED551
                                                  SHA-512:F0B96790CCA74243C83DAC09BFDAE13FD3DE5C80CE7DF18EBD530EE1FEF10312FBA12D90EF8CE75D049F520D9235C9B7C63CF69706215C44CC75ADB34EC2C587
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx....#.....1-..1=:.33333.....aff. ...c.c.E.g.....Z{.;g.n.%........f.O.........}.gW_......9../.i...y....(...e9.M...\Y...M....s......F..yb..e|.....LF6.80.D>.a.x...r..p.?..s...8R..O......&.J..2>T8oA.|dV...k....@...|.5.`.p.T..j.H)b...9.....4......M......-...M9k...7..rk.....G.%g-...n..9Qq.......,...<.&3....w....W...(../ZN.~..T.3~..5.Xkp..D.x.@f..\.../.......q....U#y.[Uj..=.u.....d. ..RL..!....g......g..N..Wl.H..x.....T.TP......0.H9ff&F0..b.xU.Y.....2.+..u+....."...U.V...(.`.......3...J.!*xQ4x6nG.`.......>@J.).J....F....v.....hH1.R/.............B"....1.... .....-b.B.G;`.C.4..C.x.....".....t8Q...;)....m.. .^$.......J.I...U.s"B.K...;P....}..u<...5]1U.^:y/ h....UI...C.k{..N...$....l..=-.H."b...$N.3...c..,..."g...kZ........BW.j.e...A..%.n{_q^1(.:..4.J3.'....JM.Y........Y....!.YF@..R..kcM.V....$.X.a.4`T....a.".......[...(!i.H'.....Y.4=...C..^.M;H...I..A|+.LW#g.l.NV.....}@.......HA(7\(..L.N#..0]v.*....

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\48x48\folderback.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):2705
                                                  Entropy (8bit):7.890826650285452
                                                  Encrypted:false
                                                  SSDEEP:48:HytOUE29oT7fDnGFV7UAzgjH0g/IpyxK1AYDQSc3bRIywK:HytO526jGFFUAzuDIUEuYDdiaY
                                                  MD5:9845AA5006D73FC951F1EC7F8095D9B2
                                                  SHA1:E7DD566D2B80090A1F572DDE62F4C074748A827F
                                                  SHA-256:52FCE71D8475BBE35C945B87F9D65F49564DA0333D579D23F89146C5DB0B7AF3
                                                  SHA-512:063B6B3D0BC7474C9479DB3B0391CE5CA444326BAE49B0A40C34DF67B1DDD2106E659445BFE648D81E9044CF0C3DF9E9495E1E474615F073260EF77D348BECDC
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W......XIDATx....$.G.."2+......m.m.w{.m.....x.7.s*.VM.....n=F.......'lj.=v........[&:[./...[..oyd.g.....r...../...Ntf';....`.........k....1....\,.........'...F.....i..8.%.LvZ...{.f&Fv.w...j..x{....n....N{a....Y.ie$3j......VK^....6y.v.&.._..a.9V..6;.:..=7...b.w..O..v....|b4O.,K.)q+*...Rpq.bj4..|.Vf.....`...........WG..>....A.<~y..5g./...Q..J....@M..P...g.......V.0<yy..W..'[..Q8.....!..@.C..W!F....<...X.8.z.......Q.H..$.@..A.) .B...h....o.....W.......%.)Q.RU3.U.FH4...N..bw@..A.$0.I.JA.&pW..\..{.*.nQ.....B@.PT"..j..R@H....p.Hl.A.,.JJ.Yj....0.)F#..t.'p5.\C.............&0[?hBT.D.u5.4|..bSD..h].r(+ai=...u..A......B....U.R`..B..B......h...i.!...W.B.....n..&\.]..;...G..5q.2.....L...{..}@.u.@w|..l*".H...`.Y.>+af.X..^%B.n.K)tC.........U.. ..fD.).!.b..%#$\.tQ..H.@x..0..+.!....wf..<......!..A.z}./......Bu...!..x.&.N...............a.. Rh.H-.h..i+.....I$..a\^.........+w..P....Q. .z..........1.............5.9..&......

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\48x48\folderclosed.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):2143
                                                  Entropy (8bit):7.87835363717093
                                                  Encrypted:false
                                                  SSDEEP:48:lIz+d0HvNfae9AAicyRO7ByqlfZH6stnSs6VNp2W9F6R:JWvNfncO7ByqlfZH6Qz6P4gG
                                                  MD5:9924AA948E4F8A438CFAD52A7A9FB44C
                                                  SHA1:711D69738EFF5D4CB0474638AB28637EF78F976E
                                                  SHA-256:7EFEE51460BDEF793099C6E6D7B43A77EEC9D252020A2049BA8144054A554543
                                                  SHA-512:78109E70839A215B71FC7C2B919380D75361436BB28B9D413799FF13DAA15E77B7E2D33F451D862B21C35D6E4554246C0AC9FE5C40ACD6F743D18135978325AA
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W......&IDATx...Et$.w.._FT....a..3333.......23...33..y..U....G.<G.....*./..)....._8...GWn....6.....u?s.~_...NO.......>....W.nP.%.{..V..w[.y...[......l....'~...O...........7...:G..`.....{.w...n;8.`._=.......w..............fs....t~.n.%..../..9{.@Exl.I.0.@''.!.......C.....;...7....>....9C...i..i."..D...B.9...}......vh6w..~*.N.6..(...H..4........./3...n.'C......h.........mO..6.9s............'......S.#..mc.......1..!....b~..4..}^...6...v.d.y.V5N..Z.N<z.q`7.......@v.,...'3{k............r.....(.V..!N....4.K..Jv.B ...N....b........u.-oDe...$.S.X.@.-.+. .9......^ *.{#.y1...;......)..x.....0P.,.*h3..B.....9...hM....mc.Jb.E..n......@)l.'...$.F.LWw.......=C...d_...t..(..X..c]).X.;6#..3-...3h.l=.*.D...F..J.n(l*{#9.W.DkA.i.Do}.^..I...@....x.B.Q.&....H.......X........&.....b..1/3 ..v.f..Q.>9.!.yJ.]*=.Y.@.H"u.."-$.........*W.....k.5.pT.Vq..=.....va(..7.c.S..ba.....9....ig......0rj....4.V.8I8AJ...2S.4...(.Rl.SkM.....L

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\48x48\folderup.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):3195
                                                  Entropy (8bit):7.9254572822682094
                                                  Encrypted:false
                                                  SSDEEP:96:juJScY72wUxEE0KSm/oN1UTSHShaVAPNE:juE72wUxEE0KV/oNtzx
                                                  MD5:D21C34B78A9DF856BD28C7C81CFA17E8
                                                  SHA1:23C9BF82DB4D06D642A78AB11E2CB26F17AF05B4
                                                  SHA-256:9A3A4493A981EC73606E54560E12B143876F91E5F1A6A78C2D490867BC5EF9AA
                                                  SHA-512:EE06B6725F3793456433199025E1C90F7FF1CD4300AEF8DD3F15FC8891D324BA5005A7FA032C5626C31D8FE9CB50AF3E92FD652571002DE7067F811C7A2E035C
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W......BIDATx...........X^;.3...3'....................8;.]u..QIj.s.....~.ZjM..........7.....$>..D}...on......r.W...._^u..../...[..S....b.{/^.v..U.;...O..7........|...C.{.vyq..4._*.O.[....W....z...=..C=.%gmX0/...M.Y.~..%|...+..8.V.X....n.p.....F...)...J.^.......b.)...4.........7S.b...j..$2......h^9.l1....A.\7....._...@l.....N..........G.ytu....K..y#..l^.C......=.^}..{......3..#kJiihwO!^.[...M...[.].y...}..r...3.L....0s.....C.z....v.e.U.7JO...+.1g..N...?g../`p."r.*..B-'\3.b...j._P.Z...e.....s.X....|...8..f..$.AE..K...+Xp.a.....oy.Q......{.SF..V....I=....( .2..../_......=..p...z...Y"....H,P...j..e._..oz+Q.. ..!.gQ....?....m..Mb5..W..1+@...Gl~.c.s.......4%...U.T.1..0.He........>...}.6..:@.39..m.......r.5.U..9.......a..G.....~..=....@.J.B........d...5........'<.......z.L.E...QP.C.k!S..(x...K..Xq..^x...X.x.../.B.BQ..*..J.0P...0..C..?.o.}.}..?.>.:A.c..RifxQ4.,.S2.N......C6[..^..{.{..~...."a......3...@.P (.Z..n..j.

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\48x48\help.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):4567
                                                  Entropy (8bit):7.941100424314932
                                                  Encrypted:false
                                                  SSDEEP:96:2BDwDk4xYy+7pciuALuiC7mPeSMVeaRmac+HfKlmMe+FD:OwDpxY96AWSPecbacO8D
                                                  MD5:35BC233BCD612C22DBF95ED0830E8AD0
                                                  SHA1:02628CB445C2AF705AA70A980752967A76955467
                                                  SHA-256:FAA5B4774C6F868AE6A835BF5C82A43FA62C4064246A97B23E41CDE1624AC9B9
                                                  SHA-512:9A1D81AA44FDBD60906CC4E7B648310B76AE6318018D4B28957266B5846771422BAF826E1E5E96EFB0ACFA6220CC59D0D75D504B8D91B3B1BC61970E21F64DB4
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx....tUW........... E...u.a....s.........)N5H B.$7v..~!..X.L.g.w.,..r\..[X.....t.......p...8.q"...n>H..;..F..?.1...T~hid..m...:K.|......_......S.j..m.a..8..#......te.@WG..3..]IMT{.t.^......I.v.].>...<........=.3.'..4m.....3...t.i..p.l....\.B.D.o/.l...x...n..^~...`|.......\..X~.O.k.y..._>.Kg-Zpf.yZ.X.T....r......Y..RM...J)<? W(q0=.l.i.W..%--{.Y.....c)!....b\E....=.7./^.i{.8.,...B.T......@.0...=..@.R...$..........=....p.2bN...R.or....O....caD .,.....2.P!T..l...../...2.6Z..}.^......m.{n|...S...- ./ NB...h?;.C.|...U.!.B..x...8>(@h 5.Tlp.h..i..?...Q..P.......+)dC.\....>..{...G...R..o?...sO>..A...)Af8..n....N.D..O.xVH>W$.$..]..5.)%.^...g....#.%......}#n...z../..?Y@J........>.j.d......L...!........m4)Ik!..C...a......"...m...1...P......=.]..'.2........ ......7....o.9..}....P..P,....'...(H......."...h...>......S.....8.&*........%.......H.Y.8^.[.../......-....g.O.p)V.t. .h.....<_..M.Z...p.E..K.....M...

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\48x48\localtreeview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1872
                                                  Entropy (8bit):7.86915408146958
                                                  Encrypted:false
                                                  SSDEEP:24:qrw8gHSAaUZ5181KPpXc/Uffu5xymuvQs1qOZRKoc5YQY2MT33cLLd4kFBCitJcw:Ow8gyAaq1QujRmv/MbOiitO2fVuKb
                                                  MD5:8BE2218AE8174B8B1ACC9627F040EAC0
                                                  SHA1:9FCD927AB9AD40DACF0AC71103303EF4BAFCD707
                                                  SHA-256:72B9B5493BBB42CF1289721878DD2F60B531ABBF09C36DB68683B9DDD07CB5B9
                                                  SHA-512:95F6CFC8AC97AA026109AE6B0944364AAD677C5CA74CCBA78D92D5362423FAFB4BF83318D61D2CD96AB13118B60CF74BA027A0BF11ED1D82E2B64896B7088EC3
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx..5.,.......^..w>233s...v..SC^.....)13.1...Hmo...j.....V.0..na.....}4.G..7....c.=.|OQ.!.../.(J|5W..2.U.....mPZR.`..Z..v:?K....C.|.n..C..X(.r....'..?.M....>..TTF...>.....c'....T...b...g<.qm._.ak...V.......X]...V.<K..W.]K..P..Q.....c......B..D..u. 1(-...='c..e.$...X.Z._..3......2T?....V..1./..9..m..o|....mY....~.C^k.......(&."..e8.bF=... ...c....*.....Z....c..|.+H.#.C..C{a..........JA...7P..N/."M..>...tY[:..e.;|.f.m...':.'O.:\I..v...........j.e..u...:....Zu.n...3fgg..G...6U....-..Q..<O....$ .`..d..a.....{..R.aTGuO.^K...A...y.'`.vo..@..-.O...8....6\.Xj...$...p..!p..U.de...^..o.y.R.g...T.D...3g..............Q..9.....#.q.H.|./.x.c.0i.`......|.....n.....h....f......).%.D...D..U..i...;. :=1......p...0T.6775.X?.A...sJy..1.I."... x_r^.^..[.f...........w.@Q.t.IO.R....90\..!..f........k-..`.H..p.f.....I.".X..y.z.H..Q.BP=D],.F.g?..........S..q...{.r./.u...f..........."..F...?s.4..:.VJ....].y>...4...1..2.j.4

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\48x48\lock.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):3137
                                                  Entropy (8bit):7.915564721501213
                                                  Encrypted:false
                                                  SSDEEP:96:W8vZ7Ry48SeCUKkVn3L/jk0R0tqXJB+RBwMWw3I:W8llkVnH0FowY
                                                  MD5:31F35396BD2C030D86964547EE6D4658
                                                  SHA1:F2870DF867B40C45A22ED148098DE4E1A867C2D0
                                                  SHA-256:C6C29F35CE5D9E072CAB2B4021A635CF45AE76670B887505D1EBD032136A7C85
                                                  SHA-512:6277AC6BEBA522D967813F5D8C07326D592DA2D299CEFD09D6797C2A9431E4966D9364E438552DD078E0116E23F878C256222F935CD6078183E0A218EE9A3007
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx........?....M&..\f................s`1..f.n....*.....Su|e..t..%[.@...t.R.<..Nr]w%.....y%k.GQtw....A.........Z.^.N._w...?..#..:..}..y3..4...Z...G.^..u...x..o.......&.....\*....g...3.<..l...d...9.......i4.LMMq.a..Z....Z.f.....w...,`v....R.p..........'.w..........q.QG.E..?..........._........!..T*.Z.6d{./{......Bz..{.w.yWt...[..g..e.....X:<<t.g.q...+T6..N@.~.S.z.u..5.\.p`O..dx......$x...a..}......;w~C;z3....&...../_....{._t.I'9.L;;.+.o..-.n......Jze.X|.S...I.2m.1\y.S.....y..G.q.G,iX...O_U9e...]W.......].O..'''y.......C......;.1.l......e.....^y..g....[...L&eZ".200.nK....qbb..."..v.....]7..=.w..~Y.W.....].8.#...m^....|p.%.R..(=...N;.{...&{?W\y.L.R..%...;v|e..S..{.,[.....~F.......Z..e4..6.;9t.m.7.t.._~....J.r........<..O.cc.e.!=v.%.N..h4....dll..O>Yv.|_..P/8..L.\...".1...Y..J..7dcX.t...K..E....Z.F...:.a`.l....Q25.J+2.t..z....<a.JcD&b!`.i..E6....%....P.J.-F......G.D..D..z- =$.Z..[ ...@.^.

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\48x48\logview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):3020
                                                  Entropy (8bit):7.917887535195548
                                                  Encrypted:false
                                                  SSDEEP:48:3tD2UJWml/ne1rNVVTtYbXD89f8mPLp+Ho/GjvceoZzHkfiGXb5ZBEF5k+vnUjac:NXkWKrLYbXD0hLAqGjc7zktbeF5DMaa9
                                                  MD5:067226F96B7AAA98A561CC444BD1E38F
                                                  SHA1:8D5F6BF29E250B45B08ABEC24E160B0F631B5C34
                                                  SHA-256:B2431D3F074E6BE05DA61478FB0241AF9FE3FE14A3D8DFC9A9C5AE8C0581ECC7
                                                  SHA-512:6BB6E2E98EF2DF73207DBA8CC7A354878FA928F40748C7D945D8CC7EAD96231FFB0FD0D76B12DE49A26CFE212AFA66F90BDE29DB0455AB537CBEAA320173D205
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx...p.Z.@k.m.m...k......L.9.~s..;s.q.{....x...A.m.M......m..M..j.oh..;.t.q.p.6w..'.2...k......F.J.*5Zt....U..,.5h.{..g..f....Q.v..^c8d.C.f..r._.[.e...[...`.....w>y=.j\.t....a.H.7.M&.M.*c..$.-.)}..r.*.....-.].6..N..g..S...|0.B9.0..%........X.....F.BO..D|.....9a.M.1D..w..W.Y.....p..!._.....7.0{.=...f>...`..,...f"%...2f......"?O[jMA....n.7.k......-WV.]...\<u..`.Q.Y..^..W......Z|.C....[.E|.H/{.{d.AY.Z.+.`....."?USP....O..c....0..t..W.|.>.K.m.O.u$.&...Px..!..P...",..d..'.....A..t<....z..Dz...P...`.5.tE...`.9......L....V...T..h.....F.....A.Nd....@x..'.A...}..`........k.B...O.&..:k....{C`<d..8|.Z..).,0u.s...PPdAt................K..!..ma.1,...E...<b!.g....U..?.............>.ko.... ,..2.....^...=.+.....p..^E@|....HIJ 55...d"""........B..#***.Z.j]~..J...Tm.......\..+X.....Q4(3!_."+#...EU*.AAA|...'''D.ooo<<<P*.....kd=...^...K.......[.*...q$x.C.w?^..|..33...'!!...<...pttD ++.ye$....HII.@.QTT./..;n.j.........&H...

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\48x48\processqueue.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):3127
                                                  Entropy (8bit):7.9184256749731885
                                                  Encrypted:false
                                                  SSDEEP:96:zszN3/tILzigh/jpZi8q4tAyYcAOeEET8ax7smm:w9/tIHi0pI8lAyYcAOeZ8Ezm
                                                  MD5:4D09C6A4B0195E4B0CF5C054E1A980C7
                                                  SHA1:3C978BEA31DFD8910D39517855665CF5D8877DE8
                                                  SHA-256:0A2D3761C7AA029767A7A531104D043AC350D2B750F5691D94A2337C389E5996
                                                  SHA-512:F93C2980705633DFDE2C49AFB11A169FC1F1356D89C0F559D8572C021A024EE9D1ABF11CB2919F822906EDB4CD20DDF987EA3FC1E4A83DEC0A4B4CE3BAE5C9E4
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx.....H....4L...n..GKo1.............^F{........2...xc...........JI.._........5.E8D/...f.5..u.]./..P.....3........t..m.|Za...@......{...Z.J...v/...(.....'z.X...~.1......*.`.6zBu.b....."...IA.Z....\y.&Sitt..$.`.\.S.V.g.O.<...^.y.g>o.........GL.......r0.V..........{.H...a..K.:`+....^.......*.$...r.o6...ti.I..>ED..a..R...bF.T...f....]....@.K.s..)?.<...c.PUV.Mp.P.}.....|.+...Q...Z. .#...O.. E./...i.\p./. .../t....("s.......$.d2)....I.;.)..*DN.Qb...T.....p....=..N)..I....H...e.....9G.....i........(.B/u.n....y....B.R...........c...T.....K1..P.~._$^$....\.<...?.......E....".x..S.....a..&.TFTKN] ...&...+..4...\?.U..* ..y......8..E.@!..XQ.T........^9....C...@.H.............q..U.oE$..SB.B.L4...Q%w...h.....H..B!..R...0>.........7T5......R.....@...J..@;r....<.1..$A..B......%...a...\.P..Q.P..U..D.M.....h..V.4.T.......Zk..J8...$t.....6.W....[B......d....t....X.(......3..Q.?..7.R.+.@p...}.0.J.......M;a...(.....\....'..9

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\48x48\queueview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1780
                                                  Entropy (8bit):7.855546763918704
                                                  Encrypted:false
                                                  SSDEEP:48://FgLAApwhutgiI+6sSFXPSEN9qwda55w://2wh8giNc/SEN9qwdeS
                                                  MD5:E9B285A0C45379F0D9F851C0609C033F
                                                  SHA1:8F76B1DBE18BD6829BF9C56DB3E8FBF06902F9C2
                                                  SHA-256:C518463E1BBD770237BF0BE659E849C3985440B3D3D45A939D239B7074F5E07F
                                                  SHA-512:4148AD3D1536DEC4D734069A44BEA0721E214646F4FDA5173F6F5A350DC3A8D8BA4EAA865BAC5EC6BC1DBC5AFAAE48BE72ADD71C963BDB7DA85A627BE3B924B0
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx..V..3M....(..F>s...9\.m.>....&..3..NUm.3..{.y..wo.W...b...f.W...].[.\...D..9.2.4.bq....P|......?.k..$.D"....q..].=U...u}q.............OH.]..w.#6..1O.u..kl..1......a...}.....v*..F...9O[....b..h.m..R.h.B.....'h?A@9..?....AB.4...xv0...e.q....;<...Yg..4M].W..r.}....H...aX.5.....(..G..Z.1.L.s.rE..0.m].....c4.H&...h..A.8p....!.D...@................F>.'qD..iO1U..O._at...c"O...U..>[sv.S.=.O........f@..g./^....DzB..a..G.UL...:...B{.>.<.....8..AC.c.....9.f........=.g).......F..r.L..+!........9.H .:.|...N..../(.{....p..;.,......5-.N%.T.)Lv.D.~.$f..s..(!b.,b.,. ....@.9..FC....0.7.^.......rO....l......m...k..._.........3%@.U.8U:tN".....-.$.ZB.2.9P.8... ....P8X.....YqR..M.f-.tV..M....5.k..9.......#.<.....:;c}.....&...d1$....Ri..8.'.w..b*..@+D.g........Fx...'.M.n...X..nB.uh........MHz.....ro...%.Kh.:..#......qz....u.F....*.^"....j.!.h...............:.Q..aC....J.nZ.....lim..}...o...O..D^. .t<A.K....{.q/..$

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\48x48\reconnect.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):2511
                                                  Entropy (8bit):7.875677244487324
                                                  Encrypted:false
                                                  SSDEEP:48:uBsgTtptwMNfJJuze81NHvAulh3lb5TxZsRecgOvFyMmUH8A5JQEg:uBXtjwMfrl8LPLlTb9sQQDH8A3g
                                                  MD5:A4F58BB4E259821DB6A3F302C58838B1
                                                  SHA1:0ACCA291C77A789D8B93C5B7D93B7815D6535E1A
                                                  SHA-256:65E102C9C97BC1DF82A8D749679C6CF183D10D6671F61050FC358746FCD61570
                                                  SHA-512:7154A61F38E542F3895A8EE159E364AE4FAB373E1F9165BA616EC3D5113AB26057F24811AE940B9FB7AB16A1CF424E3E565952FC75F7E0FADA7D413FD0033E1B
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx.....K...j.=...s.ys...x........A...^..8.....}.)./..D...O.m+..:...e...s.....D.L! ..;.n.@.....>OD>........~..N......,..i.y<..N.}]q.>w..5.k|.^G...).k..T.........S.V...j..9w...Z.K.XZ...T.........nw.....w.~6..+".*..q..W.b.E?L.dw..I.....?.X..nAO}..vt.....W..w.c.".q.S..[.....:K......T*_.......\0..>.......q.M...R..H...(..LD.D....y..-y..+.iw.........GW......nb.[.''.V.:.p......)U..+.^@./^.k.Yn...N=.]...'Vm.}........e3........D7.@B(...x..T.~..,.d..o......pt.G.FG........H.#...d.#"....N......`.........1...D.(b@P..4I.g...D.....k..*..)F.CP..L..6.e.......J...f...1^<Y.[5.]...e4.@...5...7.R..<.^/"P.....4..h4...9.x.n.3LH..*#.......9....cB.l.Y<..<[!n;@qd.,}. ....cn..ms^.#..1...vR>..%......m.............C*`.a.L.......gJI.iR^.#..s.......q.!P^.C(#!S.Z....TF....B..'..@J..y9....oiL4..0.w.~}..u...[.....r..%9q.l..0....S...x..1...K...T...x.b.e..tJ-P!......S...m.0......LDmJ7. .........C.0j...n.Z.........Q......;..&[.....

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\48x48\refresh.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):3475
                                                  Entropy (8bit):7.901767540145515
                                                  Encrypted:false
                                                  SSDEEP:96:b8OzXZERN5AskG36JltPFrtyCKQpTeDHBf:oOMbA8KfjpbC
                                                  MD5:B270E3469A3B1EAB42EB388C6BEEBA3F
                                                  SHA1:603FEE50BACB8DCCCFD909C304C3FB4054C18C4D
                                                  SHA-256:677D40A06D4AE77E15ADEAFFDB7BFCA7721AAB970C2D63EC54C010ABFA1CA415
                                                  SHA-512:01FA82CF6F28CC12F24F8C0E50EFCEC36E515CBD4BD9BE75CE8E4F739FD3E69EF488B9F0AC023B86A7149F490585383AF695ADC67F86FC5A1F3F7226B1C03796
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W......ZIDATx...p.....VK.lY...^..f..!P...........>.,C6....[.hfz....T..J.]..rT..X....4...................*\...{...'.9XR%5..q..0..k..S...-.R_.T.$.'?....]..WP=.......)...O~m.%K...t..C..Vi9..$..../.....<.k~..{..>@.J..{F.#...m...i/.....\.s...........T}.;N......R........v...`O.....gph.?.}.q..Gm.s.....R.s.....(p...G.|..nLE(.A.mJ`.Y.yj;me@i..Y.@..........#.V....=...{O....-.>..}?..+.;..=..}..;G...<.......o.~...?..ZN@k.2@;.A.....@iM.L.@|...2.|..g3..w.c..*T...5.C..^.....y.....W.&.Io..7../._.....j63@...k>.y.C......+..o@.....0.}$.......d.#.GRG.;&..Y;....H.wBD.C.r...._p.%.[...w...\8...*z"..o.i4.<.....XCF;.m...3....HR.=...BH:..f.,...' 1d.og... ..yg?m.........}...3..*a2.0.l.H......,....49.1X.V.6....B*.'0....:.i|F^x...R...G....f.RD....28.......c.....S;n.o.b..A4.1...."E.. 3.P4. 1P,@... ..0.`$..!..K..v..&..@..Y$q.4d.:#....T"v$%N...`c...&f.0%.bO.E4&c..|.B...HQ.e.4.e...8..Z0...<.)@EO{".S2.I.$u...J....h....H.yL.c.M+'...]..3t.....NF4b

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\48x48\remotetreeview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):3652
                                                  Entropy (8bit):7.919435511258349
                                                  Encrypted:false
                                                  SSDEEP:96:86fzK87fnPIryQlrlb7CfnPOVWKUU5cwvlZZbqsswZUpOF:86rfwrlQnPOVWmb7somOF
                                                  MD5:7FFC8E1DE04D71113FF28DB7711E9C36
                                                  SHA1:45B5166FB67C314A5EAB266B3F23E73D7B9FBB7E
                                                  SHA-256:FF65CB12D4940B314408E7357CAF7BAC6EEB9FC7E0954F20BAC8DC5EA97E8664
                                                  SHA-512:9F876ECECCEDA82B9D72FF4BCA6D95C82148AF504F1EF6ACC04DCD4497903FB3BFE770235B5D5820881E6920AA4C22A8FB65FF262DE4BD3D8D9BEA9C7B445373
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx..X.t$M......Nv.....m.m.m....H...3.7..Mn....M........j..R>.o.....e.?.........yh...(.....w...F.......#..%#E.n /y.#....HR.V.b....F..^....._........O...........^<.....cj8....-..!.]>U.QlIT...6..4q|....sh..]"G?..._._. L.P...s.9q.\.sc9..|.s....F......A.4...&.....C.:...8r...;...._..o.....uR....._v.%..`"....*z(.].<....^p......"...Q..4....p..z.G.[xu...Z.)?.....>.5.S.....}.I.....M]2S....,>..Qd}.8.p......j@..hC....r.pn=.JN.v.M...e.....7....!..._.._n....)gs..(az8...GV......F...m+w5V....H..45....\)..`...h..r.+...~.?.?.=!.7.......3..-e1=..H.C!.....fq.....P....H...I{s.X#LLW5.e.-.x.@>.`..cv4.'........7>.{.....b....~._@r..e1Xp.bR...`@......84..3Gk..$.........Ajs.;j..B)........+...~...=..}..w.m.@....?..m.....K...f.@!+.9.RpD.F..P(-WCL....g6..9.....7.o.+.8...QA...b|.G....W.K^.....m{...]..g^8y.....r...J....7`H...>fx.*..-...X.3P.l[...V...(.R.A1.`f8....A........O.....K?t.O.M......f..u.|OP.j0...[........dv....nan4..z.W

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\48x48\showhidden.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):3259
                                                  Entropy (8bit):7.891827290849898
                                                  Encrypted:false
                                                  SSDEEP:48:4bQWZLjs/bKKYsfMNKnqD7CLUeV7+qScfbomBeSGdDCfObaS6bjR:bWZLwDKKwFqLfkcVBeSkCpdl
                                                  MD5:47C32DD4059C0345C7B440189374C69D
                                                  SHA1:A6B28D1ECC3F13226DB2CBA39B571F974AF1CDA2
                                                  SHA-256:53A23EA45F894152E14D51550AD53B74E27CCF31F34ACD354E2DC1FD26F69A57
                                                  SHA-512:866AC7C86924543DAB658C9D503D1504A90A4C7DF84F14C8E4F1CFE85E21574F26FB590245497032E72EEAD785E8BAA0295731C5443254777F94E547DBEE2F11
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx....+K.DOdV....a.....I......$Xffff.af..f.k..2o..rI...{.J...q|#3.-.~=....R.9.&).i...r.J...`.H-x.R..ZpG.y. .Lh...J...]........\....1.C..r...x.....Y...SDM...;C..VJ7..i4...:6..LR.-R...5....<)........f..bW"UPk..h.5.u-....O*"RJ..1.}....RsG....l..h.j..m....s6.b........f..X.^.......1W.x....p.V..w...Rj......C..!....`....*.B...G.9.ND...`-k#.....v=C..s\[.d. |..c.Y.....Pz.....>bm......R>....!uR..e.f..n....(..Rc...X...I.C...uF...Z..+.<..D6..6.......@......=8.n.....z..Z)/.I(!.p$......L.Q.Z!....$...L....w.s..J......n..}..:B..J.C..........`.3Xv$\p.P/..CX..lpE...u....]....=.5.. @.d.S.#.....A......f3.J.R.q.[.r..z..p..z&...4.b.$.....uu.r.8...+......A.......5jA.q..P...Gf3...p..L....P$.$$.d.l. ...w.p.>.-...W...H.X.M..A.(c.l.- Y.@.!.8.....0.....b.%..@.!.DNy..|(..\....... .62......mY...AD.1A..d0...d...M..{...Y..G.......%....Q...|.0v..#..u4..t &.b,."Id..s=..KH.R.J..`..S..<...x....vE...^...QA.M.f...J....j..{..[

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\48x48\sitemanager.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):2718
                                                  Entropy (8bit):7.914641155372363
                                                  Encrypted:false
                                                  SSDEEP:48:gxAXtBUulnzNG3bhUN0yi6qoZgKB5RzBWty2mgU6a9UzYy6L8kpKGRVgakTPOwV:ga9rhzyii6Zgu5ZYty2mgU9Ua8kpKGRe
                                                  MD5:352B058EB1BE00FB9286950A592FC5FB
                                                  SHA1:2617BE3A882B81E94471B0996362F521803469A6
                                                  SHA-256:BEAC754532E95667A3B2A9A47F232CC058E16ECE1D76BF6B0526FCB72FDDE3F8
                                                  SHA-512:10F0C2953E083445F7F8D9ADD2A0E91119F2F422C8E7DE3752535E924EEF281AF91C238E3E322B587A5DF1ABF6CD279EC80D6D66A2ECDCD571DCDA90015A59A8
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W......eIDATx..W.p.V.=..2.^C.1..u.uRffffff.33...6...13.j....5..w.....h.<[......;D..W./~..._o0...UU.s...m.. ."t]..W^^.......6...^.7.sg....0=.8`.E..zk......5k...Ft..yH.@..a....A %$<O..(r#;.2..$..iPU.o.s.Q.h.c...h..gn._......@...#AB...7...p....B...Z..VRf.).}nc......&. ..r...3.SQ...7..2k....c.F.&...qf*i....p..{...."...... ...S...F........m.....h.(.f.LE4-...sD...S.$."...V..I.}l...XB:I].i:.t..f...........1.h.b .}..j.R.>t..a*.27....Rf..b$.@.NII1.Ct.'QB$.....x.@XU.21S.}n...(..(....|]..h.>7r...L..P....l@."7........*.....P.~.A.,.e..GMM..s=.p<n...8.~n..7..u...2....6n...&.I....>.....v......)g?..1p.w.x..........a...}..|......m.}.e.|........q..6.}..|....?.g....w...d/.GRC.d.....nE.....^.b.......7Z6a...=1...\.+..c.q3.|2..%.~.{8...W.K.oy....._..wc.......m....E;._6..x....z...&o{tx......t...8..S...%..Op.r.e}c..t.......L.....}.....#.lV&..Cg...{}1~EW..*.!.`B.........|..=.{..pI....X-VA5.!....s...v.}........D=.1c.v......n..V......"..

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\48x48\speedlimits.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):2385
                                                  Entropy (8bit):7.890971026189003
                                                  Encrypted:false
                                                  SSDEEP:48:/ANxOR6yQ47T0564Rj9u029HwhUSqQPmBNg/PDLnqDcOL0kuZlP9B69HXDFt6yx6:/ox/9A4B9uuqQPmBNKHqDekYX69HXDOv
                                                  MD5:B8791DF2018EC7E38D1719F159CB23ED
                                                  SHA1:0CBE401D6EC621ADA178A905AB35882FC2F13BCB
                                                  SHA-256:55F9AAA59E203F9375779912431DC12E2151364CA1B79D994B11F4D9BC5DFF7C
                                                  SHA-512:1C2660F03B8DC9ECA6AD9C6E467DE16438F39C11904946063BAA4405B47A29342E3551DE58CBF68175C69AF9BE13A2089EDC3E8E638E8F16D09181CD00389AFF
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx..X.p"I...g`...[...............{N...nC..B...^UWql.......W.|...Y..?.....0.Z|.V\e..<...o.M.C.}....&O~N........7...9..B..<......`.....8.R..}....:....@0......T...!...O?..K,.dB.1 ..1H)...b.6..I@.(TAH..4..r..jQ..mBA.4.J.B.,^W@.~...|..y`.Y.Y.....].%G---.6l.........[..4.Wh.?....5..^3..i&.A__.*X`.......C.....J...p...(.K........B...N...+.,.T...7.V_X}....9.C..|..d...<~.....E.5..(.x...........j..d@..T.J%..?..L....j..Z.._f.e.4T...|.|.UB..P.p]%."\A.P......P.O.....k.O...;.`..W...I$...P.".a.I.P.O...8.@.Q..L!"........_.=N>.dj.r.....q..W.2MS.I.....eY...3...o.C.a~Y..OA.8._B>...K)..ob.I.T.T..J}....:..>..S$B..<...A."\.....v#.r...%.k..4...X...5M..N:........q..7+.*Xz.q....k....../.m._..f@..:.H}$..^...].)...d.'..#......To0..).?....@.Q....).t.......cu..m...+...~3P.(........BjjT..2.Z@.....;.7... _.Wc.z..... .*.......^<...x..'..s..d.....K/..[....Gq.}...+n.|._.g....f.....5k...#..49:::..!B.|.f...X..R......W..@....\.E<....

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\48x48\synchronize.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):3383
                                                  Entropy (8bit):7.915261035735694
                                                  Encrypted:false
                                                  SSDEEP:96:PiGeCfn1RodedpPnVa6ewR13NdHIsk4BAyPGLqj4MdyOz:PiG7R5BVWwRnjpZP+qDyc
                                                  MD5:B24FE8D9A6564FA51CC09C4D938537D9
                                                  SHA1:D90B7470A9A633B5A91B5A3D865E4AEBF4518A45
                                                  SHA-256:1473B63D7BC91DCE0E31FF05A1B7DA6F17E60743D812A43CA75F9F0FA12CF258
                                                  SHA-512:0A195E0353531CF50BDA5587448A2594B13550663D8CDC24C8BA03EC925FCD4C9B6FBF0D65A2FDC6970A3EF12095F9D6B76338CC69723419FBDEEAD24EA1FC11
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx....$...sJ=..3..5..l.m.m.m..f.;w.Y:'s......5.._DF.....j..8._.. ...r......+..hxh...i.....'$X.8.`..<Y1.R.b].r.F.Y...n..xU02.....+b=0.4Z......\`..^S?.....Y.......#C+M%.....F..!...?..M*D..(.,.@m..'...f...)..@fg..*..(`.4GU.....&...D.Z....]>...I...D.4.....K..^.8......r.......6...4...W..W.@..p......;.....]..8PLO.,.^@..T....E..^..@Q.Y............o}.*/...8!..*....E.......C.....~........o..^.JT...=.....6.N.)<zET ..%..w.1.x...sRl...G..pH..E.e.WD.b#.w...........$....^...!Y..W.i....CU.^ ....."w..J^..{"^.PU.{...C..-...E..\....SB.._}MT.....1<`.EP....". .....X.U.(x.R....j5........1.Yn{.*^..{..w..c....8.B.9.<X..@.3..U.K....f.........5G..`..(..(..7 Dq`.....Q...WR....-y.#.....i.(............. ..".v.\.j.5w|...\.z-.....{8....L.....B.<...y&d..Nc.....N.(......'?..>....@Q.I.^...0....FE.\...4/....j.q...#.=q.." .A0....>.....A.".2|.3!.:..).B....F...x.k........!...`..i6p..*g.B...6f.c....Rb...(T..b...A..QH.,.M.t...N!

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\48x48\upload.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):2275
                                                  Entropy (8bit):7.876659828803413
                                                  Encrypted:false
                                                  SSDEEP:48:sxy6mreBeYVmkUadVGSLRYzorJVgOoXYOHYsd1JnLn:sxy6mrezJLGSLRUorJgXYqYsd/
                                                  MD5:B14E641FF8F0DD167279AE4C888BEDC4
                                                  SHA1:39B25B13117C2E1BAC04155DBBF1E06480C69E0A
                                                  SHA-256:79F888E37D8993693F271762FC74B8592E02C8005C16D4D119637B2170E9D1E7
                                                  SHA-512:81ACFC63122B9CEA0DC941E46378A7791759142827926FF2737657EB948F7D4E7ACE313EF3F468D89A4BF51FE20058407F88706FD13282C5B4B148B3105FA81E
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx....d[.F..A.tm.k.l..um.m.m.m......]....sm.X.._...}N..]....8-..1-uv...Ca...H......}.[.}...x.T.nX.'L.Y.4...~..C.Jx..+y...\VBIKy.]a.OZ..^...}.nWR...$'.F.>/.:..8....G....@..v...o.Ci....D....I%I.o?.*.+.....$....(...:..mw)/g.o....... 4.i !a./2...-....s............ee,x.-|.#.._J..2.M.Hj.%.....TWR8............|...WU.h.p...B......c.T.|....w?I.._.y..+a."...p...lwHm.......-.~...Y$. &.R....{..WI9...j........[.y...UV...o"...........h ... !T.....?.<uEE....#0.....F.|.9.hld....t..8...X.....bb....9..LUa.yM[.~.....I.q...:......AX.B..'.t.....;....!.....`..S^TH.q...|....+N..z...:....#...H.... ..%~n...c...K.....h..2..gFR.C..j:.G...A0.;k..w.=.....9l&L.X...(k.ha.A[...^......Q1......E.Nf...!...0V0.;i.../...!.671o.hLw......A...4.e"d....;BE .x..... F.T .w..K...h......j\.e.i.../.h.c...7n,Q..a.22.L..A...2^d......|`.`]..8l.xm .H...K........SP[0..0.60.......n.....uu!M....{d.Q./opd..t.|..S....r".8.......].......(x.IT./b....3..z.....

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\48x48\uploadadd.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):3019
                                                  Entropy (8bit):7.912407224816828
                                                  Encrypted:false
                                                  SSDEEP:48:PBf10D2o/g8UWsDUmPqlWp6o/WSdxCVVNWwML24HEPnJPFhPwb:5y2o48UWaHygp6kVdxCVVNzi24kPnJtw
                                                  MD5:7E844E152ABF5F1AE60DFC580BFE8881
                                                  SHA1:FF861287B289433B5F0F6172E2C5A972F95B3A5F
                                                  SHA-256:768E0DD28B098F82A5452BC062A231457A9A7B388E2BDEBFAC9B5A9C98A7F4D5
                                                  SHA-512:E3FED01C905D9863AC29BCBB4FF6FA1B5F5D51875C1ADF2E0CFA8F788697E7D36440EEC9D5B04C43C0439935FF46E6FAA05D323DC301642B41DAD79DAE70F1A7
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx....t.[.......R..m.m.m....).f...s....n...z.....Zy.....o..k..c.&./)....x..c.....m|..Y.~....?....^S.u..r..G.....g.......u{.m...mw.n...qG.p.........._../..p.l......'....c6...Z4Wg.Tnb.1.1x.b4.....C.6q.....-m-.#.&....F....g..-...*.2t..%7...B.wX/%...|...P..DqDMD8.._`.<..[....F..v.......X)+1q.q.v....| ... ...#".......7....l....8...0..iCNI...7?.2#.....S...L..d ....4...~.^.i..Fxt.=w]{........|.@I.#.lJ..%.p...<v...5v..!.C"......(...~LL.S..+0...u.=..t.0>}..<..H.'%..<.....@.....cF1h.qc..7........Z.r$*&. ........w.mG...Fk.'...K..a...... .......,......;.:.h_!.8.HEJBG..H...+...-...}.A..0r..<t.JkHb...).i..H .f..?.$..F....og.R.iZy..u.......p.b.."...u..>d...7M.Lmmv...1.`....E..\`axb...]}..#....Rcl....D...@.../z...0.R.V..B..b.b8..:..(.)aP..J.V.....D...c...{.].......8.Tb.....=..{.o*...9.V.y.X>|....#A..@`..:.Y<,..J....~.kLP...w/...C.\.r&.s.,0.KM.VZi....#...D...Qa!.(...%;\+............3..~.....GO?.p....!].Z..M

                                                  C:\Program Files\FileZilla FTP Client\resources\opencrystal\theme.xml

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:XML 1.0 document, ASCII text
                                                  Category:dropped
                                                  Size (bytes):339
                                                  Entropy (8bit):5.086341014751603
                                                  Encrypted:false
                                                  SSDEEP:6:TMVBd6OjzwgKygczO+aQmzrFGzgjYLDVUxEYP/oHUTUZBgmCzCOHWXdQUGOH1QIh:TMHdtAgTmzrUz5DVUxDgHKABglGOHW+6
                                                  MD5:882FFB378C599E3F75FA95790DFEC499
                                                  SHA1:9800945000C71DE9BD6D4BB80B926BCAA406E0A8
                                                  SHA-256:2673D02AB9556121FF2ACFC2B90F1B9799C6B3554C3183D28EDC6D674B946435
                                                  SHA-512:F42C1BE402920F912084906FE6FE6AAD6CC74384CABA477C09A22478E62902D3539DCAF64957FD940EFC459D321B6E7C9D693F8E3C99951CC21F325B91F7268E
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>.<FileZilla3><Theme><Name>OpenCrystal</Name><Author>Stamatis H. Stamatellos, Everaldo Coelho</Author><Mail>ydatografida@gmail.com</Mail><size primary="1">16x16</size><size>20x20</size><size>24x24</size><size primary="1">32x32</size><size primary="1">48x48</size></Theme></FileZilla3>.

                                                  C:\Program Files\FileZilla FTP Client\resources\sun\48x48\ascii.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):648
                                                  Entropy (8bit):7.429571273157272
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7HLtirj2tPWC+IaFl4IQs2JRzH9B10SsxtiePIQ93cCmkjSZKvCuEyd:4in2P+IaoDsc14xtiCb93cgjoYCuEQ
                                                  MD5:4C966E3095C1741CAE0286EC2C35D75D
                                                  SHA1:2DE484DB3521700C7D25EA8DB85FF5AFC1715E4E
                                                  SHA-256:230C5906C6460D660939D46AEF4A4AA474A051CB01BBFD04D74A6E2891F10551
                                                  SHA-512:122CEB1074F290C7F2A0759483389185D54F5A3534944594FDA96E76F20844319CAADC8881FD98670B3AEBB53243D2946A0A0CEC940A87E137712162C702A853
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W......OIDATx..1k.@..M......7o..y.P.y.).'/....6....h.. $8.O.I.tfVu4.............@.h.2.q...r...v34.s..d{]W....T..@.......9...?].m~.&K....}M.{.0..0....a)..=...@......z<.v&>...B...`.x-.bB..E2.w.}bX...!...1b.............U...".<.32...*0'.........0.[..........E*.G..z=.JA...P....!......].s.4............Lw.....A.l..=.!.F&..z.R<.....s/.n.......F........V.......h0.g:.+.Q/.m5....m[.....WT.......P.?..@......H.x.]{`. ..(.m.N..l.m.m..{..9...r.J..7...!T....#.}..WXB..{"..!.. #...@.j..Lb..8...q#\.......0..4...HF.|.%.A.....f(A....3.....!...A..,..P.<d#...F0d........3$(@Q.*C......9E(@..............&%....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\sun\48x48\auto.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):793
                                                  Entropy (8bit):7.527420944317178
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7pyl4c7b4CCJBLK/owrVC99RJzlo2oBlzXmca2WQqQwOXWoCWpZacGyfRr1PD:Rl/nhMxi5+4+SNO6RRrtD
                                                  MD5:57695683E3438E7B488D5E9A7B8164E2
                                                  SHA1:F51184F2058B91F190B992C44CCE5242487A26E3
                                                  SHA-256:AF385720A4ED2527FBA63BE42FF9E0772C1E3AA285BDAABD1B835A1F55A491D5
                                                  SHA-512:F97D6D0018A42C1246046D1C4317130396F234EEC10C8E6904ED98D448E7CB0AB6358C04CFC7FC60EA00E41A74203D86F053E49A1FFF8C972D3E0B74BE532EDF
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx...g.A........@. ...... .@@@@ ...F&...p.wn.....MWJykM...f.Y.OM.....fS........r.^..p8...l+...^..H..$.x<..v.J.....|.&..D....b..@......z...Z.V.v....r.=...Ki[........|.t...'........>.....w..(y)X:4....6!0.@..@.Q..;..P. z ......$/E.L...+!...@a.... ...K&...V.'|...?.q...e.)'+....5D$y).d..p......lY.&s?.....,..,...0..H^IS.#....@.@...B.5...8A.n.@....r.....h"....3.<.VX...4.....fX....q..s]..69.p..?......(u.49.E.Y;..=...`.^...X'..........W_.4..9.R....VZ=Q'....8..&.........B..:V.%..N...!yAi..6..1............v.'.(....Q.m7u.l.vMi^.a.)........=..Z..{...W.!... .|.........4. .............pQ..tcTk=..............%......p....78.!....,a...@..Q.\..>...t../.!.i.C...v...C..5......hA...".1..7.U.........@CAB.....74...2.*.......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\sun\48x48\binary.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):809
                                                  Entropy (8bit):7.624463959445692
                                                  Encrypted:false
                                                  SSDEEP:24:0KKL2uJjklKGOSMfHQL6h+Pl0kssZxOJn9iM:0gWjkwGVbLdTOJ9l
                                                  MD5:2DD096CFD1E5ADF70EB009A39246D77D
                                                  SHA1:7F438036CABB033A56961A51A1DE382B0BD523AB
                                                  SHA-256:1DD1F82AF488876787108D8A9F6DAD338B8813B2DAEFD3BA2227CBF0DA2CE784
                                                  SHA-512:F1CB63BFB0794BB3B209D51B4D49CB47E0CFF5630E00CE349B1926C69F8B1F381A689F407E5AD5405CFECC08A4FF51FE1B84F2FDE6F85DDFC26BC9B4EA093E61
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx..!..@..k.7.o;.A....B\@...P(..3.O4yyY..hi.t.........".}.h....h.].......k.v8.b>...r.[...c.Z.o....T.Y.5...6...C.....9..".9....i.`.\...Rr.U..."|.....'.@....0........@.k..... .=....J.....f..5.h....p...P..yF.C.......4x.n.8.N}.7..o...N...<\d..]U/O.sQ5.@.]..O..x....T.]..i........tN...X.....b.....&..ZH/..Q..cT3)@I.p.".<.ZH/..C...(4 ..@...K*.x..a|O.y.........q]Cb...(41...H@....A.\9.\....c{ ..Fdq7..L..u.S....(.B?R..os....p...B..D..K..@crzhl..Vw.j.....dInH....Wc+.mr.y..l.....A[../aP.hl.t..........b?8....@...E..>rc..4.~.........._.m.......4../..nn6N}.qO~x....BC......F..........F.......XD.....b...Z.i//.y....??.5OO..)....p.k.Y...)...U,a.s.D.ZP.<d.1xA..C7Q.@.".......hE.z1.a.X..B?z.&...."....../........e.. !..._......f....*....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\sun\48x48\bookmark.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1189
                                                  Entropy (8bit):7.77484061058976
                                                  Encrypted:false
                                                  SSDEEP:24:3XOqKJTRfQB/nJKNI1p+a6TkJXGt/m3ncK7zlmR7tvMM1Pq88XD4Bc:3Gfc/Jnobq2/m3Z3Eb9980K
                                                  MD5:59E972676124B8A04321E3837F0EA7F9
                                                  SHA1:BC22436237589A0773FE2A887F4CE74D80DD2F57
                                                  SHA-256:45A3A8668CC26632295745B3FD6DB530FC4190E9957ED1DA4B454C22FE935431
                                                  SHA-512:E18C008883F0D2C94F7DE3048A57EA3A65032D4C2EE35EE59C1E67615FDE172FE0CBFA4942C0252DDA358780E124DECAD164ED4DBF4C1F8BAD6A8AAB4E4EA1F3
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W......lIDATx...c.-........m.m.ym.=..B..6.L=..5.......\_.J...>..1... a..+..v#.42..Y....h..f...K....[%.\...\....'...~Z. a.f..gL.)+....@.o.......|. 5i.U.HX....`./..U. a.:.V.........q....5<]..q.....Z...O.4..M-.,...{.`.wK.S#.Ku..P.7.....QF.".V4@....ed?..*D.V.@..o2...W...LK8. .z>U..W..O..H....g.*U..pl..u.S...V.6mr.....|;Z..-..AM..j..d........Kc.........Z.h..3...z...Xn..Q.H-..x....L.......L.bt...V4.,.L}&.....*.O-.=.L...cb.....#.d...4y.\.:s..U*. .q........W.D.....cR4h-.....0.....,6.2..FV..4....Z.X~.g....rc&@.7.W..,.........V.,...B;..1#]...O.?...E..R...P........//....,x.Y..F.6...1.m..%...".r..RZ .....x.qE.@!<._.....V.f.$.......%n)..8...M.x6.U.5....=.f..m4.^....la.....<.$v.:...z.COt..m...M..[4\..\.~..FV.S...*?.....z&|.S.>.@.h...}:.......;..O3,:l.c....;a;l..=..m..@..[?...p.%\..M.)..)_.a...........Y.Z.[c_...p.\.G.m../1.....8..b.p...V.....F...8..|..<..*}F....p.N.1.G..$.ki.m+........W.....W.[..M,z..W..\.K"i......!{

                                                  C:\Program Files\FileZilla FTP Client\resources\sun\48x48\cancel.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1103
                                                  Entropy (8bit):7.7946202243399005
                                                  Encrypted:false
                                                  SSDEEP:24:3Enx5/yYunqpJlsYs36ZayQAsshNhNh2eFa3qFOc:3EP/yOJg36IrsxSYaagc
                                                  MD5:82816EF4221127FA3E95AD9DFD2ED927
                                                  SHA1:FCA97101A6AC45ADC6114C3F55B0A79F1D63F980
                                                  SHA-256:95E08CD4DFE30D63CBC08367DCD60EC1032A5A31202DE9F4A1CA66B0B87EE0CD
                                                  SHA-512:49227B556823044F1E724278F4AE073DB5DD3B4C0CDB26BB5A299041C4FF500DC69D2AA279C80F58FC5FB1C4E46321D4FA78D12CE70F9712E674FB1EFFC5978B
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx.b............4g.@r,q.....<.m.m.m.vln.nb..T...aq.S.?6.o....D._..i..Q.....4..-.8]...."6..*E..4bQ%ba....q9U*..^)w...`r.....=.....g.#....H.....D...Ce..."V.@....J.C..Y.....>...&...k.fY.D..oC...i..9..H.l(...J..pN.\,qm.."...b.(ej....Hq_.Xl.{.....eB1..2/.2..qsE......2=S..&c...1...m..\k.....L.^...[.+.............T.Y.`..D.yc..+.c...>!.H.(.l........w...Q4..L..(.O....b..7.7..R.......v..YN.d#0%Q._n.g.Tp...3..99....-,|.D...M."..D...".fn.......cb...;.z..'|.>..0 .].......2...3{.....N......BLz.|w.ws...+k...~...5t...B!zP...:..x....>S..Nw..."...=..fz....{"....".h[.O%z0...gG.X..j.v...&.4o.6j&..fH........|?Rh..h.8k.%....F!..X."viG..O1.)...X.-.D....D=...X..b.+9.-C...O{...6..A.)..?[.^.[5.......%U...q.......aE4K..].r..;c...#v..Oi_..].v>7.p..}.=...h...._..Abc..p.N....AG...Bc..t..8...`.$...j.5.....V.68.'..\....L.n...u....r!/.B........B..8.&...U..:.x.........K.'.............bol.U..u..^!...A.,...#..i..p....aX...o9.....

                                                  C:\Program Files\FileZilla FTP Client\resources\sun\48x48\compare.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1235
                                                  Entropy (8bit):7.787320093902789
                                                  Encrypted:false
                                                  SSDEEP:24:3Ag1sCZkB2/qwKtX138WUuRrTGgDmrnasSle5LF35PZ28/+bHsAMAKY1:3AgGjB2SwKh138CrTGgyrPS6rPZ2w+Ye
                                                  MD5:A50944541EA7D6DD25FC82F31712901B
                                                  SHA1:FA8A8C1C8682EF35F84A69F8A86E8004FA11E1C4
                                                  SHA-256:CEDFC9DC75A9B787E17451B4086CE9040BE7A8873B8EE5A0C909CCF4B5191DFA
                                                  SHA-512:3DECBB66137152096058895EE126E9BA122380A9B7D1B974522C829CB30D9A9DBA7A70DA2C8A802239A6B45597D354A7120CBAD8A720A42F2A4A4F0B193ECD5C
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx.....C!....Fo.....k...v..d...Q.;.0.<lXS...~@./.....`...k.U.A..RJ.c..3.I..9.z.u.Q...9g.B8..4t.t...(.)..]=...l.'..|X.n'4...7.<....!.QJ........^.Z..$I.<..8.}.<.m}...o...`....b.=...S...|.r..;:..xg.zV..c.S..*.\-.R.4c.b...{......h].n5`.b72..g,..5.5.=M..Y..I..U..G.b......#.G.I4.....8.;..N..}w..f.d=_...8....=...zHt.a.m.E..2..Nr......Z.k..L.l..J..).n.T.4Q........"b...l.W.Q.!.(.&..j.4..$..|..K......]Z.7..4s.*.]f!.)X.....F..+.T;.,.C...P.:w...J.z.A.i.,..=.Uh.....VE.n%.....I..@.......UY+n-...pB....a...N.'..&.=...}R.q..c.;.~_W.v.z..[.. ~...`....o.[.m...z.9..;1et.[....%5sn.`3\....K..0.u..aG.sS.c....D.>..pC..R..v.}......a...X.G=..Ys~.tv,.N......A...\...m.s..^Y.x.N2....9O..,..M!>..I.....|.,......B..i.>H..1aQ#.F...W/a.....*.`...F .....O#....jtfb.Q.../`Vv+.h.3.v>....b........t.".\..@b.e..A!.3s..m.=..... ..H.(..C.L2....'.B.,.<3.3.*.+........@..........i...U..T)......Q.^.J.F..=0..L.->.W..|....}.....=...f...@ =<"...+p..G.s.

                                                  C:\Program Files\FileZilla FTP Client\resources\sun\48x48\disconnect.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):968
                                                  Entropy (8bit):7.655436577701397
                                                  Encrypted:false
                                                  SSDEEP:24:+x2cjjk7fsUHjJ30L9wZATp1zGIDFZjo/BbRb:49ggUHjVhup15Zj6BbRb
                                                  MD5:E7D43FABA715A2EB24B94E1CE8A573C4
                                                  SHA1:AD602F4D40FF7903939DF2BBE773F7371AEA9DCD
                                                  SHA-256:ABC5391C49A4746F2E07D0DCD889BD07985BE9FF916A6DF63B44E2611C7CFAE8
                                                  SHA-512:0F6520E5453F4BE9B89DB78CE10E86EE7C060451CF36CD3E52602F4319733F8345162C1CC2CFC651F556CF301751A962F11459B72411C40560AD2EC9F178C41E
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx.....4g......m.m.m.m...m.}..l.e.M......(............s~...|...@O...|...<.....Su@`..^i......GO...{.f.( 0].#.|..*>.>.......V)...*....F`.....d8.."...8-0I...YS...*..r....8@A.7x2.U...R..f+....M..D....rW`...i..DU..9._.rl..........^.Z...>...i..D5...x....o.U-....X.O@...Q..owwGo....{.....o..|......|...-..9v*E.. .M...-./_zD.t".5...w..._.. .g.4.o.....(...|..Y~.k@...z.x.t...O......M......$..u.8.......E#...8.x.O...q...("w..E.:?....}o....5.xr.{%^..Z...5.b..4.....%@....D...N........).....@3.........L..vb..x...4_..:...a8:...hD..aBL.Y1.l.$.W.....s`.L..0.-h...m..I1+..bXbk.}.\%.o..i..%.(..L..C(...x...cy..5.g.[y.....`{...X..`~L.1.$.......3c1....)6?....2.#..N......ae,$....f....i2......NKp..<.R...s.<.{;r.v.....a.L,.m.g........07....../.)g..#En.......\.].5.....`(Z....H^>...1=..*..;....q.=|.....)........6.<...6...Sc...=^p..81...t`..c...d...`n..1...L...c<..0t..FC.....6.......oYF....z.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\sun\48x48\download.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):998
                                                  Entropy (8bit):7.726131164929331
                                                  Encrypted:false
                                                  SSDEEP:24:pL90R1k/Hyc5wzwrmUgNK+lddaMIyu9Euuqs86tKOZd91YHN9+p:dO1eonUgE+lH4yxuuqs86HZH1Y2p
                                                  MD5:9BAE989C1007DF6AA4EF3A90F38BF72F
                                                  SHA1:1CFA4A3320D53A4FC73912664B1B61469F6E4AAD
                                                  SHA-256:B239406994D7B8D3E0C30E71EF6AA0E7383EB196CA28EDB4A834E9AC6F551BD9
                                                  SHA-512:4EF83B1542198DF78C63B8057AE8DAD778098F5F7D3923D3127A11FAAE56DF1AD8037383568232E1AB27E1EEC3BBD6A0665CD4F6D11DBDECDF96E718A44DEE47
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx......Y...[<.6..D.hm....m..5......m.={2.}.tP+.3....}j..~M).<N.x?{..o.S...4~....6.l./..C..,..<..eO..j..j.......Ei.F..Y...U_.....RMU.g..).....A..6....K.A....3...;s|.p:.B.2.m.F.P..;.........r.r>......._.F/_.J.....F...o..\.....5....x>...... .O..._>.."..W..M.....QN..'.]....#.!UQ%U.).....P..~...k.'..K<.(..N.p8H.|....?.l..S....Tcm.......@.....C....i X....S6.|.?s^GMG.....+G....p]...)...s.*.....?U.c..#...p}..=ao=.;..1...SZ..N..x...j...........p..d.N.R.94....?.......XG.Iu{.L.^.........|K..../ =.=..E.R7.......`..C.".............Q0I..... ...<@...J...DO.os...Q.o.~...|...M1W.1..:.@x..t.!..`...6...~..v]|-.Vw... |..m......|.;../<z..w.Z..jrM.....9c].\~.O.K..<O1.n....g_]xd.pe..........K;I^.I.V.......N....].O>.W.W...Rc...t.~].y....?.|....k.Z%M..4...RZ,.Q<%...O...~. ...c...2..J...}.F..i=s..BK.~.H.h....D..h......Gsi...4@.i.)h...7.L...PN6.*..........IJ...G:...S.i..D-r.AMr. .Q.`.5.J.(...H.A.TH{.a......./5.f4........IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\sun\48x48\downloadadd.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1004
                                                  Entropy (8bit):7.716830127199217
                                                  Encrypted:false
                                                  SSDEEP:24:QbwM9ADGPGFe6NcdkZ/W+sxMtdG4iy87cZy46BnFrPQiYgN:Qb9SGPGFe6KmO+AX4ihcZy/nh/V
                                                  MD5:E13B8306B9F5EF8F69247FA198CE998E
                                                  SHA1:C8C111F17C2A80F4EF237F2127B65F7C9070CFC1
                                                  SHA-256:12598DC838FCB1F85992565B4877328C2EC7E473BAD7C89762E915FA7C780700
                                                  SHA-512:07FFEFFE0AB8F3B47517608C225ABD185691DBEBDB749B60728A7FA7FA38F7A5ED61A380B31CD88E4B15FEB5015AF9CB0C70104B1345DE111C2A7EF37FDF19F2
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx.....#i...m....c.m{..`..G.m.m.....uuw..lMW}./..{n...!".........dV$g|..}.]........e.`n....*.c...k.]........5..t(.1..1..|#.......+eLp.M.]......C....`.M...j4........A4*Ja...| ...E......<..5*..@..Vb....:...`ofk1..`wFk1.....F.R^..'.3.........R..@p..R.IQT..)oMn/EQ....%...y..mJ...^..!.Sy(kic|.Z..;>.rN.....n..>..1W..\.p....9.:\.].5.q...B....m..b;.u=..&...@.H..DR[.8[..bMt.jn}....ZaUD..@....25.z=..$.g5.v.....q[_{.I."..P [.?.ij...E....../....Y.....i.(N..)...<..>.4.G....$..7O..'...G..uK..A^..8.gG !Q...FK.e.j.cF....y.{..xa`....z._..,....j... .W.,.%.........G.f......2............}^.9k..>.d.uz....g..GN.S.......r...g.7.?.3U?.....q..+j.i.n.0 ;...F........)/.3U7(W*.....U.q......5N.u....2.[,...K,.a?..t...p..qo..!4.kG.....w.0....>>[...9|......I9.....4......` .0S..j..t*..~.:o...N......j}/.Fe8..@....4g.B...h..,.....*..'.'P.?.....@..b(.P...?U\.....g..Y*...L...}:.1.....A..`.....5.......!......R..,|.,.....Cn.../do;V).....IEND

                                                  C:\Program Files\FileZilla FTP Client\resources\sun\48x48\file.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):374
                                                  Entropy (8bit):7.29199762493743
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPHb7RBhA6njljS+dvns4v+02CKZ+cSQuUurCdI1UQgTGip:6v/7jXnjljSMs4G02rTuGIiao
                                                  MD5:DB8361145C750E48A71A28FECB7816A2
                                                  SHA1:CDF713775F049ECB25FC8C46002563AAD244111A
                                                  SHA-256:E48CEC64DB8996CCC8AE60630DA8F37B2507EFDC48F94957D363F63190B7AEA6
                                                  SHA-512:A941DD62D65F1CD73C991AD75936C1CCBC08D7BCD4F66264F9341F665CBC211B20EBAC24CEABD975817B9789927A0C9A47B6125DFABBDF066F8512FBFFBB69EC
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W......=IDATx...j.A.D{.....#..r...u.(t."..]..<zk....M,....-p...L?.7..%..(1....x&L. '...@...`..@...@...8..$...9..y.{..p.g.~.E"...y8%V.....xzN/.e...nfl..'...+...Jl%..[.M.Jl%...'Vb+..8...+.C.6...b=.T?..F).J.R-.S...^U.O..Q.:.......cR... .. ....;x...<.G.1..W..<.._..m0..*...K....O@L.."..p...........'.C.. :p..o....{.j...u.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\sun\48x48\filter.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):795
                                                  Entropy (8bit):7.6294058239299885
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7wjCBmGpww1es4ShHiHmPiqnEtKbFHC3ruHGkgTJjyjD7lJI6ClDpPnZi3XN:UBmq0sxopcTbFwuHqW7s6Clm39
                                                  MD5:6CFC69949D44167746C8B36E3A5443D9
                                                  SHA1:330A666E06EB885A3B3F82FC53911C111DF1DB69
                                                  SHA-256:20B086F67B1F3C8C7776787C01F4103C41086077A5D6BA419C2A4E5C628D28E2
                                                  SHA-512:33F5629DB440FB2D6627CC7677437A2572DB7FEA40326B17CD6253331CA51CB82BDFEAB6E18809145CED1C93D2F41528591AE87EFE48BFA796B32A3A61FB7AEB
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx.....dW.....Y.m.m.mP.Am..j..m..{........d...p....f..V.pn.5.g....w..M..*.%8..D...x..X...........|......rJsF.{.DU....P...U.C.Z...5....l...*....E............t#....:..C.....2.-..).0.-P...^....Q........t.x..lg.R9...l.E.<.W...`..m.B....$vTF..Kb...0$.4gQS1.C.{?#.......0....b..qU.. .....>..B..U...H....FbOfd..$v"!j..S...dd..L.OR>`.t.5...BTi.b...e[..).0.m.v}J..J<-./).....$Z..NN..h.@b..h..~.M...V...Oy.h..9..ux...~c..e6.h.X..7..,....|S...9..X.......#..L..,k...p(..x...b..e5.bN...4..l,..l.....^...r.....:.23m..JFt0.K......?.0.J.&.......5k....I.O.z.c>Va+......^g,..&.5.p$......s.M#..H.....l.....\.+.A`j..sn.X.fW6f9.&.D..|.ev.gM.a?.....[.2).Q.....~.`/.d..fV.i....+O.FZ.Afc>.e.Vfu.d5Vd).bnfc.^:J...J..5.H3-....^./..9...M.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\sun\48x48\find.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1367
                                                  Entropy (8bit):7.797304360371989
                                                  Encrypted:false
                                                  SSDEEP:24:xfVCr9VY++gSSLG+Y1zAHlae0D97xGAivFAGiVdnIxP3IkPm4/TXtMYZ1:xf4r96++gSF+gsFohxGAivFiVZMP3NPz
                                                  MD5:AC4EE9FE044C51B0362EB449DBD7833E
                                                  SHA1:42D2E6BDFFF0EEB86C6363B6E3416E3185C68C5F
                                                  SHA-256:713D47E025DFBACCB2F937C06764305674457022BA0B0B4DBFD55A049092D7F5
                                                  SHA-512:41A3324A1C4D2C8FF5B61FF7C5AA1543CA8DC0A47D47E487A2A0E41C91BF3829C6223FA99CDA0C2FEF69539806E01F75C115872439620A82F0E31D4098A11868
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx....p$....O..m.mk.m.m.6.Agm.Q_.C.T.ov6=..U....?...4........$....*.-.2.O...2s....{...'. .g...(4!m\...i.G...H8....X.....s.^.q.. ....s.)...... ...D..o.|M.H8..oD...._...."H7?/PL.!...........wv...+].O..3f.#.6..k..}}..n.w.Ma.2.:.........t.ZM.$a.......j....,P[[...N3...{k/...t.{.M....>~.......n. ..2kt...ug.zh.sN?=.... ..TY.pCC.}.ft..w....G?J....J<c..2..Q..~.E...{X6z.....|..g:.3.>....-4...&.R....n...ec~.a..)....<.Yt...miI.w..............;..s...4d..>Wt......yN.3gF.(b.g.o.......r.*<!.ad..4d..{.9i........t....R.....iHB..h.@..\....0P....~..BUV...f.g.$.8.b.(>.3...l...e..*.Ko,...hQ...7.6.("6..J...@....}#...?.2...!..!.I...._...dG...0~..,...5.. .V.6.z..%a..._...G.o}.fG.....,....s%..yR|..:...|....n....M.@..Q......fg..).._)..B.}|...<.....g.q.<i.Y(.OT.2D..u....ncS...[.....S...P.,g..3...D..7._.?.x2 ...1..-..........@.O.....hE;......|9.'[{.......-..Z......'p./..d....wp...~....V.....q,N..O.~?g.$.....\..Sp4.

                                                  C:\Program Files\FileZilla FTP Client\resources\sun\48x48\folder.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):557
                                                  Entropy (8bit):7.405255915103047
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7lVVM2ulVXlNAQqk41Z/EdcEPZVaHvudLjteXYFtbq7Q:vVXLAQqp1VEP3a0jLfqk
                                                  MD5:41AEBB7C178D1149445D76AE2E8279E1
                                                  SHA1:3158331BD0F2D6E5A382BC6964CF04F6409D4B2C
                                                  SHA-256:24DA9AD9339D5CBFB3B7D19C6DF4C3FF6910DD22A5A0831919831A2C226AB82F
                                                  SHA-512:5C8B1334C31D7C5C204AEA5F03550CFD76C3190F4F42569F864BE5A49618972B9F87996251BC59592D8286C8166D7BCB88809F46061A751EAF20EEF986388E7F
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx...Y.....6...j..:.....(.+....9.0....[....3..".F..l.Vy.@#......X6....2]...=.1.."...@..(...p....r..6P...K....*.......p..0.....wF...+.k.%..s.E..p.Z!..2.......`Y.-..%........0zE..`...K..!..;....r..b......X.X^4.{.a..1@x.....`..&@...B#0.... ..u....M..%..&.?.g.6@Z_.w.R.\V.....-..... ...._......`...^[...m........y.\7H.[<.....a.Y.Ya.-v9..3.x.G>...-..r...l....L3N?.T...... ......m....5E.PF.U.PG...F.M.SC5..QJ1ox....{. K.(!......A.D..#F...I.iH.%G....H...'N....B....D.....m..g....7..F.Y>..n.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\sun\48x48\folderback.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):485
                                                  Entropy (8bit):7.3634051951422395
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7tgqA4nr5TneO+aDvLKB9KHWQ34DLoUn3LTEUdSaI:mA4r5TneO+aXKByWQ3bC3LYvaI
                                                  MD5:D96E11FF0520E77E4764FAD20C30BB54
                                                  SHA1:6FA68B7DB0DE26F00134ECB1AF2688F96BD8B020
                                                  SHA-256:7EC5BDA097B5D66FFD7ABC25C0FD6256B795CAAA969DF893D648C6A7B1E2C5CC
                                                  SHA-512:FC40A4EBFDBF1B56CA726AC04819447F7F53415D1E635901526A1DF0442414E4EE33DA00EAFD8AFB7DC3EF4A31A682E14803F8F4E3367D7D4AFAC1E161306A4F
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx..5..A...s....t.%.s.%-N.S.5..........v..I..p>.......;.T......+^.^.{.-A.~........mn...........&.et<.B^..x./.........S.*.......*.....8"....nBa....D..+N...E.';.z$..Ot...,.w....|2x....$`_....~Xq.r.Hxy.^....].v............=..!..d. `(..U......_.:.2*TV...N.....X|...3x7...# .....%.a..'...P..$..........T*...*P..&....I.O1..f9e.Ai....CZ&_.O(..wf.%..%.d.%c........`..h_..f.D.w.....D.QL....S..............a.........J..+n.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\sun\48x48\folderclosed.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):421
                                                  Entropy (8bit):7.267829646538733
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7V/+9ZfQsyoNyaBobdW59TNY0ZsiO7zUYG8sUWdlN:bfhNnlNYivODu7
                                                  MD5:1B502DDB1728B98A357A62BB20C81CC1
                                                  SHA1:7DC9D0F10EA8587F23B9F45700964A2E149C5F53
                                                  SHA-256:03B16F81B5CEE7340D7B222BEFE63E03AD08321838E517FD8F843A2536295A79
                                                  SHA-512:0E3C4D1904F2424EF884966D9D8CF78D8B27DECAEFDFB3284B4E14AD661E27099C100D90D7B72FE5C8AFA198B8CF20EBEB12AC0EB8F6ADE73AB6AF96FB58BFB6
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W......lIDATx..5R.A.Eo..5...U..6./.."|...`....6M..n0..z...;.b....Q..F..L.6]. WQ...y<.Hao.tQ.(hd.....,...h........@.....>d.-SD..^`....~.h.....o.W......L .........?DB./.....i........=..)6\.g...<.9....t."/'..!Ht..9..Px.a....ZVS.....z#.9}..?*..*.Q.cL...Q.uT..JG..D..C...m.....n.Kxs......b.....2"&..@.........!|..?.E..c\..*B.Rj.|T.%.R...K^.t.4.pA....U.....A...R....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\sun\48x48\folderup.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):504
                                                  Entropy (8bit):7.305502415484808
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7JLisGBfPapxgY70nwZ+23Qblu7N3w:A85Spp0wZ+uQBOw
                                                  MD5:406F48B09D2D93776759412A436A4995
                                                  SHA1:18B89A668EF32193A4F2849F76B421EC715EAFD7
                                                  SHA-256:72582EE83B8A49F37F3C507CC750FAEC1F464BA522BF75B2D8067FA51764659C
                                                  SHA-512:D3AC8550B583D6AA78BED286D2BF39BB9748F3A5C7D5C4193E34257E809FD83C25C6E5F7C89EF625A6A4EBD186003ABC0DBF59FB9610887AFE8FF8375B9F79D8
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx..%..q.F........X...5z..4"T4.N..$,...\~.....=3...^.X$.@G1..^.6......4^...G............2..A..\F...&.r..C0....L...n.z..>\....$0......w..=....N.......3.@.9<....0.2.m..G.m&....a.Y-.:So........?.8.<......0....O.c$.,.......v$B...{....|?.......Ut.*.?.?L..g.._@.oN@....D.`.^e...o....~ ..........L...G.....;.L............x......0......@/...h4n..=..$/.i..w..|.|.>...../E.I.....iE@./.....,..%+...eT@...W+BB#m.O.,Jh...U..n..D...?.&.1%69.i.C.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\sun\48x48\help.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1387
                                                  Entropy (8bit):7.79435380299007
                                                  Encrypted:false
                                                  SSDEEP:24:OlVzLGIx0UJHZzHdkrMmtkKfvq9c9qDSR0SMeOY1zsBoR6FaXn6sLXMuW:OlBL0URxHduTl69cDRDMe5sNGLMuW
                                                  MD5:F5F0BB85D4971596CD27E2F91394CF10
                                                  SHA1:BA53DF9C2D0743D220647E7AF390BD54CC09D91C
                                                  SHA-256:01168B16079059729EBB8C8B1469C2B65D09BD6347D0E1D03E2C0D437748E71C
                                                  SHA-512:04A9757161C07720596F7DD59783A3DE96EC66A167CBE28EE1B71BA165FBC2D7795A0A872527BCF172F4604E9022D97F1673390EE46176F31F66A98FB7E44178
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W......2IDATx...p$[....mll.~.m.m..`..mG..?U.^Me{.;..w...${.....'+a.f^.9%..w.U..a....O.z....>0f......W......w..0W..N...q....3..`..d0.L..q.M..k.F..."3^.7}o..L......{....h.j.......(....E.Bo^.j..p..V.ZM...j...Vo:.].ZZ..e...-.Z...._...x...S.3[*u.:W........f.b.eG...4m.h...Mf.\....(..=W....,..l...q......Z.v..JP.F.7.d..Ym.c....y....4.L.......:..5..u..:>...Ddjl...(.....=O.......U.s2.K@.@.S..~.3.......N..s.P..-D.5.`. ..m..>;M=...z..k!.>.1.k..[m...........g..._)D@.~~/.^."..9...u ...b....'v?G..-`V.%..o..Y...g...A.:...g...9.U.t.A.Q-..a.p>[..\....o.'/1.E.<V.....;...... .PV.....>.[.....r.c.Rv2..pl...b.VH...n.H.d.X...x.Wh.....H.kg!:}...=G.T..q.F.....ynA.Q...&....x...0...QT..a...F..F.vj.z1.W.W..F...}N.;1......M@..f...o..J4N.j.0|'HQ?.HP..+..K.....{.J.m[%...i...X.`.h...L8....}....Z.-...*`S(...d.._.XR../m...r.x.:..u.e|..<..z.5.%.$...B"..d....x...@i../]R...3..W..'}..5.P.JA!. ..@.....$u.d|-h..Y.?rcm.3e|..4......m..4.j.O..<P...)....Pp48.

                                                  C:\Program Files\FileZilla FTP Client\resources\sun\48x48\localtreeview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 2-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):187
                                                  Entropy (8bit):6.070350361328415
                                                  Encrypted:false
                                                  SSDEEP:3:yionv//thPlclIZzNnAatvt73tuBtyuqkElHQLIep8P0/EtIV8bSrHczVljp:6v/lhPKaZzue1XlkEhQMrhtIVCIHmljp
                                                  MD5:0FF4E6044C03DD44EA861399939D3D52
                                                  SHA1:DF89CCFA89299CA923A5C7CBBF103F4964617F98
                                                  SHA-256:487B170834E45A2F021BBADA62502F534D5C768FD4C9DF088698AE5BD3C3A410
                                                  SHA-512:C008244C0D8C5BE76CA71A10050010A3F5D43152932FE1940AD0235CF11DC688CFC3675BE1FC9F96F94BD7A373F250AEAC942C39A1C33D7EAB0C1BDAFEFF3F92
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....*l......PLTE.............U......tRNS....?$...\IDATx.......E.i.)Z..i....:70#..P...n....w+.....5Y.=....&2Rv`......P.y-.2..aV......7.p.;N....9V.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\sun\48x48\lock.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):683
                                                  Entropy (8bit):7.382565424085944
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7+awNYcZ2uUuTnn0RK7epXe91AnaIkL/hl2Vo82/b5iRPXCk9dhlUZGDmwqV/:SUmknn0RK6A9mbylASd+qS/UQg/X
                                                  MD5:C65E85D023A26170085149E8FC38025C
                                                  SHA1:8EE4C5174DF80C7D71FC064F48BD8B113911DF1C
                                                  SHA-256:6AF7C916345A848AA39AE3F8E37EB89F0E9BFB042CD990B236939E33C67D7922
                                                  SHA-512:0A8B69D36300A4326629456EE1057F47DE1B2B6B5C0DB531131FF8F547C6C4C7CB803FE37B038DF92016CEA04981432F21F6E16A52DE0AFF1EDC55F56684AE1A
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....`.......PLTE...yyyzzz|||}yq}}}~zs.......|b.|c.......}V........T........L.................A..E..?..9..<........6..3.....0.....7.................-..+..-.....................................................................................................&..B..X..k..}...........................*b.....tRNS.@..f...?IDATx...n@Q..{.n...1....oB|p8..:.....&@&.........`M..u...Y.J..."`....3.q...:hk. . sp.*Y2`X\t.H.mM.=....E.......`*...`...U...l.*.S@...;.....*.q`p.".q..F.....0.d..p.t.?....|..I.}..m}.{p.._\|...5.....(..k.&..._.....XC......K@JZVFAQY][GWUR.......[H...U............... ?....................V.....hokceeck.........t..&:.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\sun\48x48\logview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1077
                                                  Entropy (8bit):7.690710474066297
                                                  Encrypted:false
                                                  SSDEEP:24:t4nnPBbvxk3qnvznnJfBwaDlV4+xRRtA8GsnfkfU6odAFty9c:6nnxbnfww4ERDrnMfU6t
                                                  MD5:3FB36C132E4F5EC1D128F03EC57BF29A
                                                  SHA1:427BF31AA443780384158F704ED692573206204F
                                                  SHA-256:73F393E4948E67AE4690AD212791F9A9ED11EB4B71C3355AA84818081E762318
                                                  SHA-512:6D47CE91924AB7BA6D810F816FA06DA16A41DD0C2F4F61E95F0ADDB7966BF12A6431CD0EABB7B52586CA9D7CB6C4726878A401DDEBDD3351335498F3097C4929
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx.....+I..._.l.m.m.m.m.f.k.w...}s...N..9.>_.w.}........t....X...4.4..5^.qw..............po...w....w...L....&h.W.....*/...L.v..:ej1...<.X.-......x...... 0y.kZ2...,2.....[..L..w7m<...R.g.u..7...A.....i..hOs}......P5.....@..1.L......."pL.......d..>3@`.'y!>...N.S....e..p@GF...........&z.wZ.P:.i.....W..:.(.k.=U(.N ..;.x..Z....EO ......-q.=....FM Ek....$...#DM E..<.e1......4...<..1.B..n..R...3.4.......1.....T...K...@./...e.m.@...0....q..;...LS.....D=.$U.....[G..~...........PR....C.........(.D....5C=.=..Q...Od_...R...Vo....hpw.[..x3....,j..>.,<T..P|.m.N..5.A..T..QD....{...."...` ..;..........cl.l..D.......o..r..#`......+.cd...1..t7/6}.N.*..).0......r...b.F...s`.uY......z...`...1.&...;$@..F....bq,5'._.....xiCv.X..aF..a.#YBCB.....s`.....\t?.....y.kb5..E1K.|O.:.F.r...a......\.w*.>..1.....^...1..JX.Sa.D..3....n..10-..J..[..aGq.m.....z..3.9....S`4.C...L.......bf,.5...u.7^.KO.E.o.........w.Bl.U.0....}..E..#

                                                  C:\Program Files\FileZilla FTP Client\resources\sun\48x48\processqueue.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):851
                                                  Entropy (8bit):7.714315786865792
                                                  Encrypted:false
                                                  SSDEEP:24:etsJN884TjygquasnoGfYFDf7EswYtQj16KaKOWcVy:et4CjZUvGAVLw55pFOzs
                                                  MD5:253A884029A69D4DE5F27A84EEA0FDA2
                                                  SHA1:AAD2F8296EEB56CC0CB59329E089F92138B998B3
                                                  SHA-256:9EC6CFAAC2A53E47459E976D5584AA9A787BB4AFBA4DE8D15015795EEDD91F90
                                                  SHA-512:9CFCF6826982AFC5FB8DAAAD58E3FB27F2E5A8D56C6A72CA5EC256CCEF0872773B0704770689E11F2C9ADFC40D917FE7E193812EA8C85E7030C2DA72AA0D8C40
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx...S`3Y....m.m...m.m...U...N......W.......K.2..Y.a.y.W'#.k........<..D.@......u.kF..K.-I%.y...v...(46.h.#.2.)@...T..a.BY...@....../}c.g.P.._......x.[3.g.K$.....~x....1...9..#........2D.i..2._.(...c.z...\..G.'..............( .K.Q.&.xp..u....k.A...9........dV..z\+c7..<M...%z..D.......Q...."lU....u....jI.N.........tG.y...j.g.n...:/.......Y..../F....V|......."Q....H..K`...3...o ..\..<.}.7.]......../.6.......H.....a(.:...)=.r.9...]...D]...8C.]w..u...q......aPXE.G~N.V.b...77C1..D.V..=.B.9.B.t$W.pS*...j>.X...P...$.L5E...q%j...XH.3.pu1...@L......|......<...........".....l.A.qy....=..N.8...!.d9..L.l.~...!2_..o]....|.......~...|}.w.?r?.......)0........6M..........c'.?t...<..Sx..Gvs.x.^..>........s...s.........-..a..W3.9.P.%5.XK....^.r.....&.m.M>q[...X.......{......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\sun\48x48\queueview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):812
                                                  Entropy (8bit):7.5877230014480475
                                                  Encrypted:false
                                                  SSDEEP:24:I2tv0v10NaUBGpbS5pCn9SyoGy78vQIcosHuY9:IrcLGpbGySyP5Q1
                                                  MD5:E5B9EC99980236547FB555C888093AD4
                                                  SHA1:FDBA41B9356D5D39BB98CC96A202032C0D344F4F
                                                  SHA-256:721FB1358B80CC813773AD5BD63C4F895BD5BE7C1769C31E0BFE8F6FD502AFF3
                                                  SHA-512:EE44D198D65BC36C3038A0BB9B7BF01E822B3EFB5925F76FF2468C12C62CFB8E942D955CFFA9793B133352420AD0F924965E8F7CDFA05C438DBDD3AD015FA5CD
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx..C..A..3..m....m..km...-.Ysz...PkT/..>...W.....$... ......o...X:..F.@.................i...24.....4m.p.U......1=......:k.T.b.044.324jU..#......l.H..:..k2..c_..CQJk.?$..[...........".,..;p..K.&.[.$....&1..m.RR1..xNWY.i..z..u.....Q.2|.z..@.@.@.@.x..d....T.......p.c.l.....&3..`..F.B..x.L.M.c.`......F...3.c%.@'qj+ .g.......n..!......`..8.....{.......H5(w,<.#\.....,.'Y.. @.5.f.......@)D..)yNOU............{.......z.Q..P.U.;.4....Kq.h..N...QM..+!.;. i.i.8..u!+...4....<..n..@W.y.....C..t6.....9E)mr.=....o...P+.*..O...3....v....y@.v.G/.....2.../......<..r.P.Y?[..h.,U..i\....@6BT:.y .Ex?.8..Z..b....Dk..%.<P.NW3|F....J;-.@O..;....f..>@..KD..Z.}..H.A7:.....R+1....T.V"..tf!.....B....i.N...z.d....L..t..t6.i5......... ....E......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\sun\48x48\reconnect.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1009
                                                  Entropy (8bit):7.730676075143695
                                                  Encrypted:false
                                                  SSDEEP:24:qnTfNBP6UxnYHoyMEr423MtG2GUGx/150S4wb:qnLNEUUU2vx/v0Rwb
                                                  MD5:203D5A2669348A380CE31CD46F2BB7A4
                                                  SHA1:C2160A86D88BCE2EC71BF11082F8A4DE6F83F32E
                                                  SHA-256:23E2E406DD16C7587FBD2C2174513BE4781C4796C66ED3C7207109BCB4E60870
                                                  SHA-512:C9D7C9A3138F52B2A31E00BD6A9F47A81743557EB5A3A5F54D0C9A4FFF555D4C21834221BE9FB6911E27FD62A3C8404BB3592B02534A664D446AB5C19B9C62F2
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx.....X......m.m.m...m...w..M...N_..$_....{n13bYV.._.W..$.f..bo.Y......._X......<...f?._r.5.(..}E.5A....z...Q.......L......A...M..z.P.?....t...........a.M..h.[.Z...%z.......I.fjy).%u?.....$..L.B...&GN....L.B.(.f-@.nn.....G6......h........s.......L.....(@/..t.....~z....[R.. /....^......w_.6v..n[..{!q..@.9.....K..:.P./.D.{g.W.. .._.....q.p....Z.W.?.-...&.c..........xFn.....=....'q..T..N.....R.N3.........^..|.E.W./2-..|*.p..@....V.7.....J.O.n..xM.5...Q.l.....ZB...~....U...Js..'`.te.........H.PH...5p..."C...*Qb.(..h.>...0s..v.!......q.\....aB%....=P.vC.~nX..n.T...O..R....O.C..a.........ZB.B..`.X.~A.b.zy...n ..o){..J.<,.sA.:..^B...*1.....6l....+W......od...,O.....&,.....@I..h....avX...a....pj.Q^;~w.......~..r..l.........l..>.l.JhQ...k...eu......#./9......m._(";h.5`1......8.?1%>...."0...M.rr.r..>$..U.[...?!..(/../W.......0.].....!.@:t..hWVA..Z...a....cs..0..a..t.Vm.Z{`(...=.r.*X..6.u.s....p..@.T.7...

                                                  C:\Program Files\FileZilla FTP Client\resources\sun\48x48\refresh.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1263
                                                  Entropy (8bit):7.786872572151653
                                                  Encrypted:false
                                                  SSDEEP:24:3lRSamsunkY2pKhRmMMFoLTX7Gla4MJd4jH55m2BtLLWhK:3DbY2pKf7MF0eaP/iH3jvmK
                                                  MD5:1A3DF90C330E57BCB8EAE1684D809F11
                                                  SHA1:2BE1B7E64E3A327C1CA2127D7A0F58D3225CA6EC
                                                  SHA-256:AE3867E790DB34103F8A32396A8090C6D54C4392AD74527B477A18863EDE78FD
                                                  SHA-512:40A082794D6AE49CEA3194E08C1C56B261475D323A10AB6D5A8906F42F173CDC19A78F1FAA1934AF0AC609E83B572C2D96153E1C311740BB9E1305D857CAC3D7
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx....l=....m<.m.m.m.m..[].b1'.S..2Iw23.B=z........c.r...~........s..-...+p..~.~...@....s.................1..!..,TF..n..~.j..KB.....F...}n......8.........Y.....!:U.+..#......*....F........U.lb&......;.6=.. .K.Z.@...X.{n=.rsO>.~..#w..}W...Wq.^4..i....D...e....#q/....3.....V..n3.5..od..........b..........7^.Y..G...........cw\....p..dn...V..G..mW....(6f%.e...&.W..`..`.i;m.87.}.d..A2[.....cU..........6...P...4..../...+..X....>g_..a....].....%7.i.......<...0.s.:$yyh...BC.T...r..Sb.*..n.1N}...x.'S...m...$F........zm.aRF.k...~.2:F>....O+...'F:..8..d0y...g+...`.y..d..wd...N.R...'2T..&. ._d..q..._.D.0.e...{.pxc..?......J..YI..t0..pLD...{".6n3..p..^U]..2.A./..(......N...........a...:../V.....8....>x.:_....|....[..T11Ll5ML...8..kF....U.....'.5..&^..p......._ ....U../?....._SU...:@d..M..^./.].7..'......*M.2......k.eU.kK=>H...9..8.`.... .H....*R.2...U....rL./[..f..Aj..........&..H\.. ?(......N.........z.P....@

                                                  C:\Program Files\FileZilla FTP Client\resources\sun\48x48\remotetreeview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):521
                                                  Entropy (8bit):7.428884083687768
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7LFCEjL1RZxGrDTQswTkEOnuOwORt+TGef2c:GFCEfHZxGHEdXGj+92c
                                                  MD5:BB1952637166CCD58F2771B8A240931D
                                                  SHA1:1E378861435A43BF302EE610D994DF67F1BF45AB
                                                  SHA-256:B8D75F344E99A187F2DDD265E5BB76AE339255261658A9FBABC642465EC3A928
                                                  SHA-512:EDCF1DC7DB5B8A27E9A24DAF1C8DB05812BF7A0F0431B7B6DA10115F31913CEBEB50C9C4B2C25078C66026AC211BC41BCFAACCD106BBEBA87B5451CFA2D72409
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx......A...U.k.......k#nl..*....j...o.;k.d.&..j.GCD.iN......,..I.E.a...CP.p.6..N!......o .......1`1..J.3.........(Moa....%m..v.....W.."...C.`.C.....).0.C..`....L.~.,......[..u.?y....EZ.Or..#_....&{.jE@...3j..s/...*.#...........z.....LQ..W....p..a.9...k?.....jN....'........}..........t...M@..........'..nw.....d....W=..>.an0.7R.?K.o...-.+@......0..8-......'.6~dK..3 ......2x..(....*.!...CJ..B.?.....(.CH.|.;5..q:=*@..j.V....8..$..!..~..O.p..4.L.u)......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\sun\48x48\showhidden.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):720
                                                  Entropy (8bit):7.5454595416350925
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7/i1pq+GYaZ3WfbnmxxL/GMeHU+lCb8u4ezyYfyMO/oHU8nV8qasXjt9IiOAO:zAYDLmxxL6plCb8czhfyYU8WUAdkK
                                                  MD5:2B3064DC53FB2A3133B0F7D6486A8DB0
                                                  SHA1:D9A117A5439063CC45959D0D96B3E45F0CF7B3DD
                                                  SHA-256:E034152A92453C31DC88F1817DFA013B01661CB542E56E4A3EAB9FB6F987E5EB
                                                  SHA-512:228F2169CFAB9B908E9232AD6DE00FDC758E97F981DA2F7F692B0620162B23C067EF3CE69C1B1C16B83FF45B41C9479C8E402982DCA3FCA0AF29AFD9C24A8942
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx...QC1..=.C!T........P..P...s...%k.......^...B........,..K...@z09.x.)..0.2....:.i4.R.*..6...|..h:K.....*S..Sd.y......R.w+.!..X.....T\....+...Vm.C8..^.j.........lO.......sn.M}....|g=.Y.G..!.2f..u,...yF.......Y....o.\s....=...NX.)...Wb3}.....@i....Y.l%*..`Cv..FZ"C..D..Y9.....>...43...*.5.o....AF..?Ip..g.j........ZZ..y.:..B.8.t.@..f..'..........~..om..d...l0d.{..*...>...4.n).-.>..=.N.@.P\[... .........`...bYUn..P....L.?.J...P..4..=....P..g..m.g...s....K&\o.Hr..\.!o...f.....c...Xb.5.Ye.E.f.....Zi..R.q.K.'G...?....'E.....g9.E.s....6w..C....<.1....nq.k\...8..Nr.}dI.%D..=....&B..8X....&K.<92.I..s!.#....!..~x.-...w.>...........3.f..v....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\sun\48x48\sitemanager.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):999
                                                  Entropy (8bit):7.636019833972538
                                                  Encrypted:false
                                                  SSDEEP:24:FDy6ihL3rvhfLMqTzOPMOQZBARl9/YtlJ9HjdoZtjkDieBQ:1yZpxLMcmi0jQtlzDa3jD
                                                  MD5:7C2CB5B9436962404FD7CD88BAC15376
                                                  SHA1:F98599F0BFDA9FFFACFDB089CC7063A8DAA1A705
                                                  SHA-256:E2298622E67F7266036058D8AEB2E282CFFF55EC50B3956F22A2BF1F6643E38E
                                                  SHA-512:7234F05A6E1703096028034F64A87C5DF02932EB8B726AA76B4C165A45FB752F2979B9E322707DC6CF6DECCF96C3664B590D0E5BFABBC53EF46E0F3DEEF98337
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx.....,I....m.l.m.m.m...u.Ml....7.....6.Ue[.$.u...0..,...^.2oU.:...{.7.<X...YZ...".S............S.( 0Y.....Hb......5; .Q.rL.9....5. 0N...I..q.q......M.....u.i...i_...dbJ...tu.........M.q...9....z!'.o@.M.I.....]...L.<..%@...K4.P....D...5..)^...&g.~.,..(.w i{.4n..<..m.P..l@zJ,i..46..T.j8.\..x.k..@.b&.9^.N..e..|4........'.$..H...Gk9@..k@....m.9....{7~..g.....qx.T(g.^`...H...)F ..,'.\(.g...rz4.P...6.i...h....Wd..e.%e.4.Q...+.....qT...Ty..w%.....7.4U..,Y......;.QB9..-..E.....GGtG..x.k#K#m1.)P...F7tD...v....10.V.....'...E><.U0.FC.tC.....~...bZ.#k<..1...8..1............@.....s`>,.1....Z&^...8..`^..0&.d.....Sbn,.e...lz-..D.O..........C..i......aj......Gs.|.L.4~...>..jX.s......v...rb<....6.V.p..<...5...xmK.....k`1.......>....0.f.bX..a..9.......I.E......<l...*..t..}.....d......sb...-......x..*4....M.1>.....rl...$f....>.q..{N.v.N.^.A...aRL..1;..l..Sa"...0....i.h.O..q:....k.tF..$..g^..........IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\sun\48x48\speedlimits.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1532
                                                  Entropy (8bit):7.8249657265416435
                                                  Encrypted:false
                                                  SSDEEP:24:LPTjKzoro3U/g9hqrpmIlU/QbG1pGdV93IK9XMRwHJzihvfYNRUqbMwvsEvP9qf:LPfKz2aHsrY8eQCGdH3IGXMRwli+b7vY
                                                  MD5:5B512F7C1940E6AF9E991DAD0CB28B1A
                                                  SHA1:0B7F693DCC401ED62ADDB7B3D292BD80975DCBCC
                                                  SHA-256:2D1D67BE059CEC8AB770E0333599F1FD95967FCA75513345E26D352A576482DE
                                                  SHA-512:BD7E415A236BB94C59129A5614DAB0DD3D286035479B19C27702389E62670DBAEBDBC2B2975C6ED2287D3B0F8248F317543DDCEE3D1C028D814025469337771E
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx....#M...$.m.m.m.m....q.M._.j.noj..d...{.....2..<.'e.......4-@.....d...g......Y{.i..6+..9h&.e0u.......gF........<.,..wF.. ../..D...z.X+./Vs.e..M...2.....k3..5...5f.d..~....}..g.oZ..:.?....n;3......M."{.S{/."|#.....ih.:...f.w.......0Q.Aw..|%.w...C`....v......3VB.[.i;...M..rI... ......n.}O;.K......LF..J...."....;G._?.._.......ts.... !?..._..e8,...<...k>&.........,....5...._'...pT(.,.....f..g..>.@GH..h..HAu.`.c..3S...|...v..nLH.......`.._..u..UW..^.....Ou......m.y......,U..K...=.<.....D.E...I...C.c/...U.P...".`.......7i..sE8.2.yK.#d...=...q.....O..!0.K .L...{E..t...#...O?M._.].e.w...[B....qAC..(B.Z....Q...'...0^....#a..1 pS..h....N...#........J`B.i......`w..-........6k..@G.E.....6..E.....:....Bm..(.M...m..FY.c..E(..)....H+....F...#..w.f.....Br.H....M...=...Fm...4.&.amD...h..........Y.<.C..Y'.9...&.<..2z.=....@Dm.L\.&% ..<Z.M.C.`c]:..&>..o%...z ....n.......3..]b..x/t......HRE..`.`I`..u..J

                                                  C:\Program Files\FileZilla FTP Client\resources\sun\48x48\synchronize.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 2-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):216
                                                  Entropy (8bit):6.259546212998228
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPKaZzu6d7kWkw8RTQR4TUpctzpQhXwenp:6v/7ZZzu6hLkwA44KctzpQhXwo
                                                  MD5:E2C5395E4256FA62DCDCBA24D521A751
                                                  SHA1:5942B29527B7F5754FD3AADA7C8E5B7A852DFD33
                                                  SHA-256:3CC449A439C84045108F5E1F520A4E1306675CEFEE4CC6A74F2A318F5539C5FD
                                                  SHA-512:EC8826E3906A1F3BCE4243BCB919EABD454C2F1C26C982B97105E029CD489D80829521D2858552B5A2508DA4A2E358C98B7B7F392F0B1C837CD32BB3977C6EF6
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....*l......PLTE............P6.0....tRNS.....(.....wIDATx...1..0.F..P2...Stq...>9JF.)5..dS....c..m...X:.J...:8*A..qR..P...,...%)......Ig.#L...Z.D.yG..q.....0;..:.....N.........IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\sun\48x48\upload.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):651
                                                  Entropy (8bit):7.495034930499189
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7AP2a6xKs+fXKaGhmCI15C8ktTGlbEyrmXpk3bBpeKrWJ05gz:3EKs+ffUUnC8koxEyrmZkrB9U0Oz
                                                  MD5:1EEA7A5DC7250A180F66A51D9722F421
                                                  SHA1:863731CB0ACF73A32ADEC544604990952739D5B3
                                                  SHA-256:FA9CE842159DF141DF7106F21F0D9F528F79791C04DE517B6149943E4A04C3EB
                                                  SHA-512:80FAA4E2DE456DE2F3DF47C6D79B3782E9EA1EEEEA253D83E48FFE442A84DD9C284216167BA27242F2991D377B867BCAE8A934FDA39C8E2BA54DBE98615A08EB
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W......RIDATx...3..a.@...m....ul.a......m.m...}.kM.q...U.......F7..9<.G..=..l..d..)P.m...0.....6l.....}."....b.b.-.Y.iU.....'b..y..p..b...;.....B....F.TA..~k8.....Q..Q.(..c.Fl.....+c..4f.%].&..).$vUU..5.Q..P..Q...F*O~.N.<.*..*.......z^Do.8...L.a..W..7.....@...)e...u.y..`...?h.............j..G...p...:.&.a.....m....0Dgh..x......j.`/.6AmP...."C...8.j....l...'....x.}..N.o.v4...@...H..N..P.tp" ..7.E2.........j......\..5s.#4B.q...B-.....)..X$+..Hp......}.3aO..*..Q..Y.....a@...x...<.F(....0.....)4Ba@.....Q...hx....4S..wE.8N.....M.....WE2j.B.}..6k....5i...j.2zY....^.|.'.Ip.A.......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\sun\48x48\uploadadd.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):661
                                                  Entropy (8bit):7.559908781467013
                                                  Encrypted:false
                                                  SSDEEP:12:6v/79zlEDg1dCQwV4DfHmbHiWi7LsAIBly3nCneZdPAK/13spaKw427s24bB1:KSiRfHmbiWi7LHey3ke3IK98E9427s2O
                                                  MD5:F333E2CE6C8FAB863B826469EAE3BEE3
                                                  SHA1:DF587B2EA65948234FEC96D17EAFCF0BD81A296D
                                                  SHA-256:72163F387B782EC5E089D833C7E53A8735847E187EBDDDBF8195FA38C7670B40
                                                  SHA-512:F769C1B92B62C5E103BD0D121351AA8B8104448B85A6C113C2FB0E553E21FD9592F38D81A1E01769463BC4276C8D503E0A407C94C32DEED543748F246C512951
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W......\IDATx...S..a...S.m#,...j.U\\.......m.&N.?...L..(..'...!..h..X.jUN..n..{....G..ALB...l.....)...X....8...y..g.c...V..b....w.\.r.......#..9.d.{.G..+..K1..0....9.?<=zdG^.AQT@E.7.%Z.C.[....:xp.m.h..*.T{.....46..B=T0s+......k....C".9rL.....;...+x%.,0..D&>2.?3.<.O....^.,.vOD..>.Eo@c.........+......C..../.I....Y.M..^.=.`......4.....4.......j........;...|-h.-p3.......x#2......|;..;....x.uA?'..B]..H...0L=p......3<....x......c...Ph..Qbr ......~......DNW.J..xB*....w%@.J...{4Yu...0...M..S.Fa....h..`.T..a.......0.......0......x..+.a.....b.,...........7.v..).9.)...G"..I.Z..H.........5.II..T....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\sun\theme.xml

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:XML 1.0 document, ASCII text
                                                  Category:dropped
                                                  Size (bytes):208
                                                  Entropy (8bit):5.013181635115544
                                                  Encrypted:false
                                                  SSDEEP:6:TMVBd6OjzwgKJ+aQmKyDLDkAVtoH1QIKe:TMHdtAgqcmKiDXVyH1QIh
                                                  MD5:57D8662957CD827E2D97DDB53E39C4B9
                                                  SHA1:F6E7ABA03D8EFC3BF4259BB7214B19AFBA47C03C
                                                  SHA-256:A1CCE1E84141E786FB6AD8FCB84F27F6729EA7635287B9F00B51A694BB4A5D1F
                                                  SHA-512:68D4217368243BA6977B9FF404D18AEBB32898A096B7D97D20EE3BB2C0DC67BA03177880B4F05463041F862391C782FDD5D4029F3C8A2221A7512C91AC5FBFA7
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>.<FileZilla3><Theme><Name>SuN</Name><Author>Mr.Silencer</Author><Mail>silencer.guard@yahoo.com</Mail><size primary="1">48x48</size></Theme></FileZilla3>.

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\16x16\ascii.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):225
                                                  Entropy (8bit):6.571167968821731
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPEtLaiy0aAUqAca+IX782kxxp3hrgLp:6v/7muiXRUqAcJdxxfc
                                                  MD5:242B43BEA5C3647B33C60BEAFFA30AA2
                                                  SHA1:3239645565C86CA9B9C660F4E29F9C495E3FA54B
                                                  SHA-256:58761FCFEEDFE37252E0DF211429330FCCF699410512EF5EF1CDBF061C4FFB4E
                                                  SHA-512:51C7BE7B1291DBDCEE21E89CBF453BCFFC9A032409E8E8429806FABFE417E94EC46C9C3528261C41A4A76D9115AC169C336393C625458A7B71EA52E6037F4CDE
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx.b.9s.....$.0....b.@.......H......,...0..;......?A.qx.A...~.R....C...Z.c...*.U.A..(.p-.|.Rg.|.....:G ..] ...R.U ..8..] ....V...q..(...8>.~#;/L.:u.....g......B.6...Z....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\16x16\auto.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):241
                                                  Entropy (8bit):6.454110942701482
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPfqZeQnZ6Usb8TW7s+aTPOlR+PbqBp3V8kYup:6v/7mnZ6UsjxaClR+Dqf3V8kR
                                                  MD5:2732C4722673E9F8B56C2DFDE9D8C370
                                                  SHA1:9D2D1A46DAA613978E665D21D2081287C29BBECE
                                                  SHA-256:C127AE5A624A015AAF9980EEABEED10D5F9D89607B00A595CA8229B76A4614B0
                                                  SHA-512:4BEC4579FEBAAC50E77F5165644B5788F75B3824AC4FE174F65FAA4121B3544C802E03C83BCDA674B427108508B491FCDAE7338794A5559D1294AE189C0C0CBB
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............(-.S...9PLTE...9Ux9Ux?c.Bk.Co.V..I|.Fz.L..Ez.V..d..|............/..y....tRNS.XY.........V....]IDATx.....E1.Ek.>........w...p......V.a........`RK!VMp.!....kE/!.k....G......w.../.`.E@...&.>....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\16x16\binary.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):191
                                                  Entropy (8bit):6.3623597179068705
                                                  Encrypted:false
                                                  SSDEEP:3:yionv//thPl9vt3lC/LaxcGlkYU77JdjYRxWlsU6Fz/HpldRLtRgXLoAQ94JIfm+:6v/lhPMLaqLl7vgWWJPp5gbE4Gfm0AIV
                                                  MD5:B5544B3F18AA63B9041FF92A9D404CE9
                                                  SHA1:CD61335DE5681A682E199093D8248D833CDFE94E
                                                  SHA-256:ECC62EBFA9D52821E70B1D06D8F0A6FB5854CCE9838397D3F67957ACC80226BD
                                                  SHA-512:B1CDBA2CDD622C116ADE4160D7A32D29AD2A02F35E5991BCAF5A738A7E13C79D058425DC7A129114391DC548F15A8E0C778441E7F9EB73FF2EED6FFA31F288A3
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx.b.9s.....$.0..m.a.0.......~....D4.. ..,.{y<|}tT.@.3PJI._.."..8..^....s. `...2.2...@.7..eu.%.......a@...)..gd.S.n!57...`.....@.Yh.. ....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\16x16\bookmark.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):574
                                                  Entropy (8bit):7.5290643797830485
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7j/GknT5mXGWLhh9ZQk0hY2h+Qz/3MtS2yfXdGtYl1:jkT0bh7p2h+Qz/8QPfXdGGl1
                                                  MD5:D3AD50547B7FF3C262C8866A60EFC222
                                                  SHA1:DC10F14BB584F382B4700DB788A71AAA8D11EE7C
                                                  SHA-256:EDDD9D37C741484A4543CBE7D7DBEE2180E4DC61487A9E28E84524C2A7FD9E6B
                                                  SHA-512:62B78401C2A2742E4DF0903D0FF27B6EEFE61F64B6455813AF88D21878409B69C536C9F5F2435A033AC5114407216AC8B8AB2B237BFAE5595DD76016F022E604
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx......Q...F.;..4...m.nP.Wo..m;X..q.9.{.....|w....5..A.!.VXM..y.cx.:..5...Z..r-\@..D..?}.4...X.v.(...*0.<....PS......L...d.l .(..HHH....'`.. ...D..u..Y.`..pl.......X.e'.....0l.>..&......u.#..@R.=......&.7...,...m.B.....{....70..{.-........-~k...PT....Z4..`..=8p........y>....."..+.p~....$...F I.FL;......k...C1..n....\h.....3.p;....w#../s.^..7B....@.4.K......f...a.w-.Y......7.....?.......j........M..b.../........./#!.2W|.>..JJJ..:.....YYY...PE&''.....6..K.W%.cQ..w&....z....>|.E.....l...[...T......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\16x16\cancel.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):663
                                                  Entropy (8bit):7.6508418986379
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7p/dJMw9EhUe4xv1Zq9xZfWG2uRdeIxkK7xznsuPplIbdyxb:6siEESfWG2u7bkK1znsuPTIbd6
                                                  MD5:6F5D067D592A12089F3107821FE03853
                                                  SHA1:53CE9A23A1FBB81DEAAE87E1BE1EA91716037CEC
                                                  SHA-256:5A7604D79F362110357686B48598A1ECE1D2DB887F79462CDB639F6C85710618
                                                  SHA-512:9DC953EAFB2FBBBF33052D46E67807BCBE41E2E8D15B9A8DFACDBE0DC638B8ACEFC8219EEB39AE572D5D8E19F281C5EE9AEF173BFCBE53BA8967D3F442B3B528
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a...^IDATx.u..p\Q..o8.m...j..e.x.Q..j...".m..o.......}...q"1QW.....).OLw=.h./_vq...+.HE.:.....-.Pa!..R..It5.W..<@...|...#..8..... ..%.BC...knn...H...7el,zw..U[..aBabF.7.{x.aUr2./X.....b...K..Y....)H.y3.XY..K.L[..".TII?.vA.RA.....\....h..EWW..N..'.|#I...X&..ph|.AA..<.....WW....h>......:.(]..A.A.%......U.....H......s....K.....0@.W.]....hKO.....s.;.M3p.sh.}...ard..........[##...!.o........].8.....H2==..}. a....9,lf.......i.66.k--|[......)..o+V.g.........J..`%....mg..........0EF.P.zz.....[..2..ub4...hG^...........2kk..!.....hgN..23.....D.....Mle5A...f..$.;4...t7......W#.......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\16x16\compare.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):313
                                                  Entropy (8bit):7.057635323350394
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPWdmM+riJFQaLNV6O5PynAE9nLNrsRBBEW6FRhiP2+p:6v/7ydkiXQORynAE9nLaRrEvFvM
                                                  MD5:E9793CB6E2AEB364267DC4A9D96F9915
                                                  SHA1:3B7AF99C708CA5E9B72C04C3368CFBFBAD9B025E
                                                  SHA-256:F0B6C7B80903B96E5CAACAFB25BCEEF99B8CBB033E93BD431FEB0B5DA813BAB3
                                                  SHA-512:62255F8F53EBF5491841D3E58EF96CC136679A74A010C1E5DD42A60ABCAFE3AF6ACB01B228AA3CF178E9A438AE2348365585AE6759D09ED2C4F14035ADACB6AC
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx.b.....D`..l.P.]+d..P..bs....[7;V.s!6..{...............W...wzzz..'..H..$.........4....d..J-n...Z=........#Qg.....#..m..7.8.l.c.,....ONO......M.......7vPMKZ'I....(.....xY......wQgPlF..]....v..i....c..28.46Bmj".....V.mm...y....h... .....1........}F?....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\16x16\disconnect.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):293
                                                  Entropy (8bit):6.963850498310983
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPSY5PTcaWfkUQwqa9lcNpG4KBcVpC9DQAe/PYd0vJg+app:6v/7XhcbQceW4Ot9Ze/P0
                                                  MD5:FDAB37BDAC5E3A28A300D430336BBEEF
                                                  SHA1:491097FB942031EDD81BF2C164269275F12281E2
                                                  SHA-256:370CA0C7C40BAD454B438ED418E11889B086329F04649D1D6A0E7D6A80C3B4B8
                                                  SHA-512:CECEE63F3F064AC3312B0F254936879D5A190CF57CFF5DA397CDBEFF9E59506FB0A21ADF8B134466ED13E2207B32ABDCEA92A355B16747F8E90ADB4C02363D94
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx...5R.A.G..Ajn..t.K......\..oq9..4H.A.....o....z.:....h....!.|>%...$1..`JF..`0h...~:\...S.....)k[.$..@V.,..r.k....H.{...1.cV...~pK.z...k..d)9q..2K&.t.L.I.....u..N`1..A....CN.....`...L...+...D...I..5........Z..'...*...:>..^Z..3.|....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\16x16\download.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):569
                                                  Entropy (8bit):7.531406605083966
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7Qk0TEXCX16InFRYmY+FPRc/Etnhm0zAyTBF+j16oox0wnFXaWj:xJTEXCX1bjnY6PROEdhmaE61Fx
                                                  MD5:6688AD83CD2C07A040070A4204CC405B
                                                  SHA1:E6C001A9EDE75FCBAC0D543AD9473A386217BD6A
                                                  SHA-256:C8A393B8CD7886F30F1036B76E2CA4DA3564C7E3DD90FAD051543439AB0644B4
                                                  SHA-512:4E026F0B67725BF742613E379B364B686A80323DBAD6C3C250912C29DC28E2088EF889743769E159104E03F738352F6BEA699BBB2FF66F89CC850C51A9C038D6
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx...C`.@...X..vO.q.m.V......m.m...<.z...0.ly.qt....`.C*o..`...^M...@.\.D9..|_].g....#....r9TLo_]h.%b.F. .U.v...;M!.V..x..RG...;..W.y..tx`.(o.v.L._.1...a..DD.=.l.R`...s.e..;...^q..@4...S.-...9I.Z.b...N.0t.E....jQO........;..@....qE.S.:.#.B..)T..A5.9.".A-......z...n...x......{..Z._..].C....x]...A.:m.....l*.....b.....)N..@......\...>dl..*.Ni..../....,..yqB..G.... ..C.$^.)._-ou..\.....rC3... .4.YP.o...n..-.8KDt.5..|...3...d..P/4...`.F.M.q....S.~.e....p...|..:.vA...K../.t&W.5.c........k....-...L......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\16x16\downloadadd.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):201
                                                  Entropy (8bit):6.531342860343286
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPMili5l97DBH87GQxz6Ba6JQRKFmHh2wp:6v/7pIlpDBCHxWs6JQXA6
                                                  MD5:93FA5220A2B95C60E9AFDD33B37B2789
                                                  SHA1:E861ABAA12522991F716E788BC4858187728AD56
                                                  SHA-256:AC96CDDC7EFB9771389DA52F4B6D5630EB938920E85890F80B851D55DFD02DB0
                                                  SHA-512:BFBC462BCA644C0B5517FA09CDD0196AB80B08D93126DDE1D1B017927B4709C80493FB96D535979725729AC154A5269797247F0B9A3F8E54469F0403E6D4C916
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx.c...$u.. ...g.1...s.......`..?.....V..\~........1D3.o;....3@........y.......l....[.'l...m....n.._q.......{.5...@.A....."..tyz.....%e...X..C.1.-....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\16x16\file.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):191
                                                  Entropy (8bit):6.3623597179068705
                                                  Encrypted:false
                                                  SSDEEP:3:yionv//thPl9vt3lC/LaxcGlkYU77JdjYRxWlsU6Fz/HpldRLtRgXLoAQ94JIfm+:6v/lhPMLaqLl7vgWWJPp5gbE4Gfm0AIV
                                                  MD5:B5544B3F18AA63B9041FF92A9D404CE9
                                                  SHA1:CD61335DE5681A682E199093D8248D833CDFE94E
                                                  SHA-256:ECC62EBFA9D52821E70B1D06D8F0A6FB5854CCE9838397D3F67957ACC80226BD
                                                  SHA-512:B1CDBA2CDD622C116ADE4160D7A32D29AD2A02F35E5991BCAF5A738A7E13C79D058425DC7A129114391DC548F15A8E0C778441E7F9EB73FF2EED6FFA31F288A3
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx.b.9s.....$.0..m.a.0.......~....D4.. ..,.{y<|}tT.@.3PJI._.."..8..^....s. `...2.2...@.7..eu.%.......a@...)..gd.S.n!57...`.....@.Yh.. ....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\16x16\filter.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):332
                                                  Entropy (8bit):7.1563799073499865
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPWDS6+VuPdEE+CsN6syQE6ixoqaZmTBBoQiy1tRv7aha+F8fnLt2b/kXCjp:6v/7svQulAh8Q0faSo61vvJ+QY/kXCN
                                                  MD5:939666DC67B6ADE8D86A8B6567D82FD0
                                                  SHA1:4697B902C24BD7947FFB0C2C0A147E4DB120E6A8
                                                  SHA-256:5BA196E809E58528953B99B30B7712181D75A6F1FA4185BA16D3D364E513B1AD
                                                  SHA-512:19B122B41A3B9558D026DFF564605AB72A4309EA97DE572B1482981939AFA83DBC8D83F29FBF492E81401758AA0F995CB08F49FD5A5F211182E95A524C6EF63C
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx....V.P.@.ylpwww......K..^....s.I.0. \.<os......x..+."..4D.3h...j.j......F...f..|../(H>.,....404L.?.Y....i...*.u...t.].X\.@ia...0..M..-..$I........i.d.?...P..5..E.. ..-..~.(...{G.....`...K..0..../o),..w.?....i.`.6.....C...}..0.!...<..8P>>...;.e...$.e.}...>.kF......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\16x16\find.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):774
                                                  Entropy (8bit):7.66239023644788
                                                  Encrypted:false
                                                  SSDEEP:24:wPDPiaQgMFF6affiDLGOcRLQ8zjDyn8Eg:8K343GZ3X
                                                  MD5:F900DAC414868E1EFD85617033BB8E3E
                                                  SHA1:C1C46958810E69888E2DE6979FD8E936E1909E57
                                                  SHA-256:B189DBB4EAFFAA19F22285EF1EB61E32736D8950080FEE814F897411567A7CDB
                                                  SHA-512:4BC205613D8F382F39F3D51FB95BF2F81BC2C4197C8FC868F70263153AD2D6BB7187DD2A3E8ED27556DFC312C8D9BC9A293FB3CE8918554E29D342E193FE0AEF
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx.b@.e..+..r......+.........b:.!P^Qj.`......s.C......c.1b..`..F:6...mEu.V.h.q?../.m.=..'H..0*.. ....rR<.w..}v,....B.....S1....^............5....8 Ge.F.........8._.#..r$...s.s.3k....8"*_y5.'....^;.>{......s.P.-.b.\nqkn~u{95.Q.N..w.....j:]...l[....l..p...>..I..Jqrf...[/L..ola...H\l.g.O].a..1..(....@......7<.<.O..G.....@b..?...5.d.h........^.j.....8.......'...D...Rs..H.....=......4..CCCE..W.}kxxG.....%.Xj..!.......g.p....m.V.K.3..V... 6.tm.G.{"s.....[l.)P+...:...B.$0...J......X.W...;\........]r.C....x%..'.7o..:....X..o..%..5o.\[.o\O........6/E..m.C.L...*....F...\\f.....9.. AN....#.^......p.FC._..S....?|....Z.`...(#..:.....V.h..@?....\.WK..n..b1x=......Y........NNNN.j.....a....?..x.......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\16x16\folder.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):404
                                                  Entropy (8bit):7.26076176640864
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPWJrl/T6J1KpAvbA4ChBkNbugMjbuAaaQTZXYZSm4OIr3IKZbhxWdk/Up:6v/7Kl2J1sKC0JHA+FXYUBOIr7ZFx0
                                                  MD5:E38DF703A97FBAE931117568E50BF5DC
                                                  SHA1:9B37405CE260C0322666CA5D41413CBA2950F2BC
                                                  SHA-256:F46648E8C09114DB5C583C2C59A4EA0B6A17B8CF818B6B4275C0CC9590A51D33
                                                  SHA-512:DD57FBEC9F30D4EB55351155717DF32F1AB41AEB51FA326ED985DBE2E19B1F0E34F706567072F21C1C29DBAF808E6AC3916D4C27F0FC6D1E3198508A8B73CD26
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a...[IDATx....nEA......n..m.m.m[.q.w..d......;.... H......t.#.~....T...;....=.A. 0....k...Q..HS&.p.......UI__.....D(..r.,P.....I..i..@.[#..Z@............U.p.......L.'....{U....V.\....9......n...%(..E..D.{.8.F....q..;..q...2....{...sD...y.E..>...+..o=Ex..B[N..|..Jp.)..N..x.....S.g.D.......QP#.R.......W..cx.............KB..q/X.L...O.G....St):.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\16x16\folderclosed.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):377
                                                  Entropy (8bit):7.235383912766703
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPWfO82ENLtP9Uvj+lByj/5oKhLSN5xHBuYmrAalD6oZx/Hnudr+Jd0izjp:6v/7AOzEVVsj+lEdRhmrxgGoPPnUrLiJ
                                                  MD5:2E7B092A6ED3A0AA0026DB8B89CB9642
                                                  SHA1:895C7F9A28757362D30C7EB6D085EE46E7E81D57
                                                  SHA-256:563A1C4A29962C073B77AED42B3A248BE35C88DDFE266E94E90444D206EEC88B
                                                  SHA-512:B17EE0982EAD8FC3D3810CB6CD4E82D0B2ABD5C1E0339575A302967867568370C081E7B752FBDBB03630C4651FAEFDE4F9FDD6AA8BDEE17F3889C74B2F1ACD95
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a...@IDATx....L.A..l.ljF6...!....l.V....>_.....~.{.= .//%-..&.!......g.&......(...`|..O....YyE.p..<.W.@GG..F&....G.z...'.\.x.?'E..Y.lbZ..GJ...&''.cLt...v...Kk..77...{"....w...T.b1..o.z}}M..V...7..F.P(!.)..........c.***T..%c|.../...$r..3..i>.P.fF.._J.u|.0...%...!.S...<.............d.Jj.P.!*{sSt.w.D........@.=.`...['XZ.*=.A....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\16x16\localtreeview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):378
                                                  Entropy (8bit):7.184289233581997
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPW/iUQBn1XHcepRfpX7FpxHRFEDEC1HTt29pkxQ5fv6lSwC+s6mX0kJ3+WV:6v/7QiUKFHcepZl5HRqg2Hu6bE50kJh1
                                                  MD5:2D8AFC5BAC213191EBA76678A1846817
                                                  SHA1:8B049D7213AAF2D6BCFEB33AC03F9BBA703D14F1
                                                  SHA-256:0A4D965E5173855649A30B45C6C26D2A8BA0A6FA2FC7B07F5FBCE42716C0AB70
                                                  SHA-512:6D3C490C1276BE44655CA161C33376AF3462490C7F8FD827FC7B8738A56A1EE6D7A3023AEDD60509D4C02C91E04CF8F23D2F19C7CE0B4AE20BB901AC3B92151D
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a...AIDATx....r.Q.D.N.K..b.Q.m.m.s..N.....m...t4B.\....."`fnb#|.(<??....c..2....O....H.H...p.^....P^^.%.......I...Oj`..I.....I.j@.0.y....oAY.yj@7..'.m.|.[X>..S.^`bfD...|xgg.x.p.....s....|.K.n@....Q..(.>|.@..u. .q..-x...9o..]....z. .g....p.[...e..V$.}.YPUS....8...!{.."w..9Xg..J<[e..2}..i.....[:T....e.A2.....I.?.-~mh..]......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\16x16\lock.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):341
                                                  Entropy (8bit):7.08301148035934
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPWe2Tb3tsgWtI1tnkCPZLST3g6vPrT7D03sFC3EBMXjp:6v/7Nib30IpPZyQIPrT7DOsFXWN
                                                  MD5:D50FCCAE30BCC58EEDE752301EB81C2A
                                                  SHA1:4ADEC1131F2962A71574F14B6170769001759D5E
                                                  SHA-256:2DEA6DB15AB2B9813F9547F44C0B94CEB33A408E74974DCE347DFE99821D300C
                                                  SHA-512:433E8B23163A4727F1E4CBF462EEC14871EEBD81863BC11EB46C497809526533C424F5501460E78E963F7B6C9866ECFA3ABB0F232663FC889401911B003413B3
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx.b..jM......B...\......O.<!..........x......G.1X...6......2r.6.v.66v...r...........|v...>.....%u.N.0.p9..R.>.?..H..O.[....`.....M.7hv..V..:.M.W7\a4..d2...{...\...y~x.f..-bv........~.EQ..!...:.......D.._....~......=.......;o.4T...$g.@...j..l8...x...,.4M#..;.K...n...i.2=......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\16x16\logview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):519
                                                  Entropy (8bit):7.488980698354808
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7Uh19kgwYKB8hO8gngP9DzWuRYIfyPLrw1qF+P:p9kUx8g1DRYKWrw8FW
                                                  MD5:C5A7A7A7AB1ABCF5DBC2B9F6B13BF44A
                                                  SHA1:A1D6A25962DFC5CD15851780FB9BC552C4E905AC
                                                  SHA-256:207C59A844A6AA2101BAA4DCA5A867BF7F74A53A65912FB54649F98F5589A012
                                                  SHA-512:D2737250D8FE27461A49E077D98D451A46FA015F5C105ECEDEFD53A954987431FE55A83D5C9C74A2705542626437A5E36BFB7B5BC3A2B5170B9EFC7FF641092D
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx......A.....!.]C..!.m.a.5+...m.S....[..9._.c......a..).x7x..u.:.w..(.|.#....\q..{N.'........p]a....).$S.......]^..D.......&{..Y.A.2.IBj\..U.!C;....Z)sX(..A... .....Bb+I.2..2..F..t.y..-.R.1@....p..k.;...#...-...uPJ.=[..)~.A...V..N..f?.....Lhz......u:T..!...0....w.H.z...?N.@."9.Y,..[.`@.QI..|e...-.0.[.8.k<?Ho.b..;q...R. 4......gJ..|Y.\*........}&"+......X..)@l....(...1+..c./W..#...~0..).^./..f..1q..x.._?..}.1..C|..{...~2.......|......[./K$Xw.X....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\16x16\processqueue.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):529
                                                  Entropy (8bit):7.46981725870873
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7KzqnmFxjW++eEo7ZXKUEf+ZHEufKY2rJ6LIpSlO1P:rqnmFR+eLaUlr2roLFEP
                                                  MD5:D5CE09461036A025BF5A2917231A8E6F
                                                  SHA1:F55ADECBAAA912DE6EFFCB5B80470D0208837049
                                                  SHA-256:AA624FF13074B4FD2E21A4A4950AFDBE18D64522D91CF51FBE2789A384FD48B3
                                                  SHA-512:750B40E554C3B36B4BB51A8885BCDD49C8DA10FF3F96A921CCD80C166245BFE1B86EC0685B4F4BCFE4C5D05CD1C3AA4A17580E3132DF224A5CE88C8C39BDC8EC
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx.c@.,...y ..bfR41!s..].JHHX...$[/&**................cQQQ..] "*............o.{...`.......63A.D.....!..........k...{IZVj.......=#.../0...B....AHX.!,4.....;<44DCK."..{.... Z.!.x..-....W.............<...._?.......Q.|....N...)...XY ....+../..>..?..8..r...e....-/....`^T/.!.........0..H0...3,X0.oK[....~...H&KJ..ihl|....V....N.......}......./.SY].}...ek....a......../.....q...Z...O..i..Z@9n.....+..U.:.Z..5T=8p`...W..N..^........_.z)...+FRR2(....8..S...0.......[...]....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\16x16\queueview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):579
                                                  Entropy (8bit):7.584084173180431
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7OCcydvfCvueuO/ABOrt1tyQd9Icg5yx1II0ftz83lH7:Kl6vRrh1tyQAcg537fob
                                                  MD5:911E241C6F54A2E4D9C59B218430948E
                                                  SHA1:D7470853C14E1E661884D98C51DB0C8D73A47C21
                                                  SHA-256:60E035211FBA639384604778F4855330360DC715127C73624EECFE06B16DCFDB
                                                  SHA-512:4BEE425F4DB466B29E48E9DDB8B58EBEA39F004C418590B358376186C4B89A064C8936D25FB823175DE5AB29C26D79A24FE22C75A243253892C8AD9C46C2205C
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx..S..]Q....X.v......:.m.q.8..Xm\..g].t.......f....k..\-..i.v-.uQD.W.].J..e......B.o....:... .._y.Z!.H......_.....>/.).........ST.c.k..]0{.l?9......y..g.o.6....&......)L........-J...W.....1;b5..I./.+.9.h...!jH.....n......a...*..~..%..^.#'w.O.;..]...~...`....8...Z~\.v.3&.D8...OnE4...&....C.!K9.T_=}....rs.......g\N.#.../...U.?s).................RMd.{...'....w..D...F.A9`..]..D..8...^n...R...$..$"Y..R......L.U.V.......a}X..z......O.'.={.L&...QX..(..,...6.9..........!..F..qt.OZ8..m&.;.M.........^.......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\16x16\reconnect.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):258
                                                  Entropy (8bit):6.670897253248914
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhP9+37be/o81Ur4psmFaO7SC+EAWNfwM+o86HG+/h0bp:6v/7/g81Uy7Sk69eGeU
                                                  MD5:4A2684BB12EA28587CEA33C2B60004D3
                                                  SHA1:4B834303D8530BEC7C07C8938B9CD928164385C4
                                                  SHA-256:3DBAB7B4BCB5B6339A6A515EDB3519775BAC0D2A0E7BA6A274CF128641294589
                                                  SHA-512:A521C4B92ED4F5BCCA621FB66B546E2339BFF5523092A3AECEDC81182040BD99F1D8804964DCB7C35F9150C5618C80E8F02C6B26C702D845931FDA346DA40583
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx.c...Z......x:>...8q.....k....g.X.M..N.+.1X.....x...XC.3@|.J.....@j..kMk...C..k..w+.b..~u)... .@r`qb....7.X.bs........+.\.b.K.6.~}..5.~..-Qa.7.....n..?.b....0..4_.7.}....7.~.......@..5..+KZ........IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\16x16\refresh.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):726
                                                  Entropy (8bit):7.656878133234371
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7rZ874GsyvRkvvUwR1fDGmh0TMWpMmrvP7k1hsawImiQbWmg1:S22vLRZGa0wRmrnQj4IubWx
                                                  MD5:F2FB93109620A752ABA1BEA43B80BBEC
                                                  SHA1:CCC1C45FDF9E2ECBAAFE8B6155524396E6D1F703
                                                  SHA-256:1119BF65771FB8649DBF3A2DFCA641D53F044D0BCF0B531CE77D64D709042A4C
                                                  SHA-512:F0CA07251BFE4149E296D90836E32A305913ADD7549074127707272385F9026540215EDA416DE5ECBB56D257BDE67F5E4FB95916B6351BE2A68656458DAFBD6D
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx.m.C..a..c..8.m[..m{..m......K...oPx.....|......3...S...3.......&.I.%.Kg.r....z|..K/...X..d..;..X....u.....=..(~..U.?C..<5..o.i..#..B..3....+(>..<c.i..K..y-:e*...y=8...E.....G..m($8..+..s....&.USjA.....CA.*(....A.;'..k..4..F"....s`0X2]..~.3..ZJ9...T.9.'...v~.....o.....M...]Q`b1.$.Rn...........K........k_.o. ..:.{a.%/De......6.{.M.....t..K..EK.....A2.jP.%P.g0..j.a.\......)..}uLTM..g..iG....9.)|..H7..qS.E~....\B.N....u.Q^...g.n8.hFh.9.y........Zs...C.4U#`0.PT....b.4=.\7....c.w6qlVq..`....y.........T...c..F..........4n.e.:..\.N)#..B........4.n.".E,. ..&4\"!.....i...[n....G...$..J..b......b.l.!...o....Mh..{(F....f..L`..p...AZ.........IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\16x16\remotetreeview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):444
                                                  Entropy (8bit):7.3534210919464265
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7xmloF0FuxyN98TIN6jffhEnBNbljng6gDtv+x9af7MT2BxH:EmloF0Flb8T46YhBgDR+x9aDR3H
                                                  MD5:5F9EE179D1CA0BBF31A283CB8A16149F
                                                  SHA1:00883B5F76B210C2FE82D3EA307E40177E2EF4B9
                                                  SHA-256:FE2F28AEB056A89662D53CE22F2D3C5CBCDA67CAD8892A8C3CBEE972CEA81A8A
                                                  SHA-512:C2517D085CDCA4DF582857C60F8220970BC0D19ED26B6AACA9FD0A9AF5D2BECC970B709C2DEDC3FCA17D0C24B9BC0E8524ED08215385C35DE56F7526B5742A3F
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx....r%A.F.;..`Q..:.m.m.m.e...:.3Ug......_.^W_..Q.Te(*.s.;h.}}}.....eUE.".G.......}..........iiiO.......&...>Y..U......?.1.L@..E..6.6.......C^.2|.'...e.yEYV.j../....|~.g....n..ROB.......]a....>....!c.V)C0N.^l."*gn....]=...>....O..<.,...*.?j..Z.B3...DH....+.=}=.*k.'....dqq....~.=./.4_...x....5.X...zT.............%ttt.g555..>>.M-m(...o.T.5#b.Nb.8.X....111pss.^pB..sD.)Y.E%?*]....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\16x16\server.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit gray+alpha, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):291
                                                  Entropy (8bit):7.038765793962431
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPO6VsyWFTPRrfm2X0vDJtFQgm+NUDjMGRwREWn33sHdYLqXD5QchcX9p:6v/7PVsPT9ODJtiEU/iCW33s9rQV
                                                  MD5:742C368BC4C19830ED2E088A253015EF
                                                  SHA1:001D2365E26A1D6120BE78D76A34E564F15C7011
                                                  SHA-256:DBE5A7B1DC74E1BDD3075433E8E2DBEE47AD2B765944735F9B0FAA3361371472
                                                  SHA-512:8C3D87B8A3E7EDB83944148EE85BC5A25C41CF6AC3C56A8B32D54BC0338365A6BCF1482C580C3FF24E3744DE9687174337ACFE2549D7C0B6F5C8D0E2078E936E
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...............7.....IDATx.m..n.@...I.....W...EX...mG5.m...[.[..`"..K*......_..x.kHR..[>.qB....X..l...`..$......0..7....+.y.b..;.. cbT..A.6jc;\p*N8.#..y.."w...F.9`.)&..?.....!.q.....M.~.=...1.Mr.@V*.r.AV,..e\..`..N4.N..q..f|8.M<.V."/..J.J,.....j.d........IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\16x16\sitemanager.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit colormap, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):305
                                                  Entropy (8bit):6.806975520920884
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPfMuWA4eIEtZIDTekzMSnG/S1c+NvvKMBr/Rh3xPGWtsup:6v/7meIkorAoA+NviA31Gk
                                                  MD5:C9F6766B443BE33B1E3FA0333814A1A3
                                                  SHA1:A4CDBF0D1236F3DFA619BB1A0E1EE09879C63202
                                                  SHA-256:7D34B722C67738A9096FD29705277AC510C8D0BDE24A94DC784FEB0686AA88AD
                                                  SHA-512:5E86EA210DB9AC04AF50F7950C7689E0A373AC64870A4C5367778F458ABCB7A67756B87E891D957067B8C0D8A1EAE9908A4435097CF8D4B6569525C8E1D81684
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............(-.S...fPLTE...............6HxDq.Ib.r..r...........Bc.............<]....u..|..Dr.Si.S}.]r.]..r..F^.r..Fq..........,......tRNS.}....n....vIDATx.M....@.@Qb;H...%.D..7hXoD'.L.d.!Y...j.=..............{o...T........1..._(.n....b89.j1#..Q. d..k:z.jf.#IF. ..$...%..e._.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\16x16\synchronize.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):775
                                                  Entropy (8bit):7.631703149758525
                                                  Encrypted:false
                                                  SSDEEP:12:6v/75QpBihcjy7+QFox0ebRVfEdxNmzIhTMOSxObgN/uAbvKXn9zIjFIl8Fi:RpBihcm7dFoTzfCsshcObgtuAbeno0V
                                                  MD5:D98C98B92109B06FE5758865B8BD174D
                                                  SHA1:7BF8CF25E3843B703DFD5B13D71EDCDB7ABD1EF2
                                                  SHA-256:4B9A0DFA310370DD63B9446F0DF9C7B8232BBCAB994A773C1CFC64938ECB4582
                                                  SHA-512:88600A543244BEE5B9A29971DAB0943D09FF7BC4D7AA2BA4DA91E380C1B7FAD6C0E21A63B3A03BC776E7B2BF4A1510A9E3951ED66D9A120C0D70682AA26717D9
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx.b0......pd.....FU-Id..0....N.a..a..fl..c-..m......r.y:<}.....s5,.Y..#.....aW.(~.Z/"@/...em.[?.*...<...).F......&.4..t0:'Q?$..[.gn....4..s..2.......$4..(...<..6..Q.5.R.....7.N.f.......B.......i.J.'7@o4#..".L.!Mbk.......g"..,..b.....8..O.t.|..4....B.....&P?.....H..I......{.FSC.N.6....O.y..t..L&wwy|.X.H.X2....x'[.t...!..E.....v"..7..\.._9..8..)`..X..4......LU'..,).2..%..T.W6.V....Q0....~?d.%F.V..eC..."...v......[dw.QG5...@.....D8..G4....BeS.*..8...&..$....p[.0t..+......Y.=.Jl..cE.....j....Bl:..'.U....J...%\.'..=.X,..:.k.X^...L.~...R..G....6....:...\Z...;.P.#.D...3.........{....a.3..o.c..#....b^._.....K.7.7..B......hr'.....I....V...q.....'...uua.........!;...6T...c]r........W...Jnw..}.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\16x16\unknown.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):762
                                                  Entropy (8bit):7.669816282841975
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7nl+7qNchjg0NQNjS9/CU5EyBWUWoOD6f5NvZ/OCz8E47xG9cdWkdgtIhJK8X:PjgRtU+yBAozf5Vsm8yci6hJKcY6
                                                  MD5:3115823FE4FCB61CA3D2F0AF13E3060C
                                                  SHA1:1BC4B1CDE929475C90EFE6DE17F5BA95DE06232D
                                                  SHA-256:C0650E5B87B31EA35529E4A69FE379807043A540D1E965E30B90035B73ABCD4E
                                                  SHA-512:D34C5CE3E1F97E2887F50FCFE96BDD70322073116DCB40876FFE6C1F8C6508FF22D276501318BE7B56BE44D651F166A8984D1FEE0EF625FF30CDA28465007947
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx.mS.s%A...?r.m.m+.m.m...W.n........y..9c.E..dh..I.ordN....6p)...o...\S...z....A..n..y..?2...n68....g...%x...C..A.~q.....cyoJ.A1..d_(....yx .s...V....]}...)..o.x....A>.(..).b9...1.v...e<A......aQ..a..T.......>..(.r.sg=%.4.Lg...L.....,.@..T......S....U...,.b)AfJA#.......-wM...%.....k.....q.'...k:..Z..n&%.......9.\..?..Wv......8X...c*n...B >.Fc..g.%..4.....x.....T....\...D..r.....f..X$..K...L..Q+...@Y..;G......Uu.V.^iG.~,>...>....]X}U/s*.L`B9v=....v8...7e|a........'.x|7O./.T.Vw.%..!.hN.QDS.A;..~.;^j.aJ..%.'...g.1....bl.g.q..d^...z...i...$.o..1%..'......J.I'L...R~.. .%...m..g6~..C.6...(.#EE...0R...>W.6..;."..|6..oT ..h,..Wl9....~a3-....f.3yt....I..h;..B+.... .....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\16x16\upload.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):582
                                                  Entropy (8bit):7.547978947186378
                                                  Encrypted:false
                                                  SSDEEP:12:6v/777VTLPPXAw+wVpIyGJgazHWewbgUSGDB3waNkrRsr9ExFNSDPHN:uJwzwVfKZs9krfIPHN
                                                  MD5:764E387CA1FBEE7561C35E479FAC4C55
                                                  SHA1:361C69B981DEBB0B8C01B94191BCCD7A7B3C06C7
                                                  SHA-256:F689D7C0B8F8DC0C666EF49F548BCE9219F41B92E2371E69BA0A716E449A4C39
                                                  SHA-512:73CB52AF836C2C3A375009DE96862D7FEF5541E2A46C6D1C3BD455DBFC5AD8E3787DF993217BFF96E6E9BFAE380658504889E41D6D328A78552E70EF26E01E83
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx...C`.@.E......m..Gm..7j.m.6o^l..s.....a...>...v.....+.^.*..a.Y......#.i7.j..N.....2.O..0D.K&.e.I.....@@Ic.D..2.,..$.o..<0.U1.%.D.a........J..X)\...=.;.3M.5.,~D_.k../VOa+......v...p.7.....(xA' .cQb@..(...b.......h..N.......v;.9..k..x.C".#....7.88.'...8..<.E.'..3.....I`.....t..1.;..a.wm.1.....p.q.^...}..xd..R.[..l\...I.q=.......Vr..F..u....V......7..W....q.....i%x.|.......'7.8.,..)a.W.w......:.^.x..;`..@qm.yV..j..*........S....ce.d.|>-6..gT.d.:5...$.p..Ob..S..^}.w........r..z.ca...Z.5...:..t#pow.\......1....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\16x16\uploadadd.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):201
                                                  Entropy (8bit):6.531342860343286
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPMili5l97DBH87GQxz6Ba6JQRKFmHh2wp:6v/7pIlpDBCHxWs6JQXA6
                                                  MD5:93FA5220A2B95C60E9AFDD33B37B2789
                                                  SHA1:E861ABAA12522991F716E788BC4858187728AD56
                                                  SHA-256:AC96CDDC7EFB9771389DA52F4B6D5630EB938920E85890F80B851D55DFD02DB0
                                                  SHA-512:BFBC462BCA644C0B5517FA09CDD0196AB80B08D93126DDE1D1B017927B4709C80493FB96D535979725729AC154A5269797247F0B9A3F8E54469F0403E6D4C916
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....IDATx.c...$u.. ...g.1...s.......`..?.....V..\~........1D3.o;....3@........y.......l....[.'l...m....n.._q.......{.5...@.A....."..tyz.....%e...X..C.1.-....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\32x32\ascii.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit gray+alpha, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):463
                                                  Entropy (8bit):7.285591582716212
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7AQJMD0+E77F3+F9OZwyL0vR8R04XOOPNA:FWMwtvwF9AfL0v6HG
                                                  MD5:B0B28E8BCF6FEEA4F812E55DD3FB5C24
                                                  SHA1:D7583FF9BFBC3E4B816CE53CF1C89485B03EC926
                                                  SHA-256:FF9E0FBEBE9D74986BCBA9DA7EEF64D8CCAC851BF0B692ECD38032B4E93BC0D0
                                                  SHA-512:C223ED04489F86CCE866BFDA0A4323CA0DAE38A29527FFC8ABD7E7C83454C0D020049B3FCAF1FC2D4D06E545F90D5E44D7AB48E690A7879EC3ACC33458D7C8B5
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... ......s......IDATx...5..A.E.....%..e.,....)!........k.;tw...S5.q..>un....8.o...tZ.V..h..o...........!..j.......x .f... ...%...HB... ...2.]..K.....H"CVN...P7X..d.V...R. O.;ZQ4XC..5[...Q1.....7..U...W...:._6... ...."..S. .j..L....:.}.....|[[8.9R.PH...f...-.0h.H.9.d........{}...k0dc....Q4.......x......9.(8$I........E.u.I..=...$.+....D.....9......`.e^....m......7...'-7../.R..3j...b.G.<..0j.0y:.}.U...U..tZL.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\32x32\auto.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):2369
                                                  Entropy (8bit):7.906022399828481
                                                  Encrypted:false
                                                  SSDEEP:48:s0Tp5Cnc8PDfuKl9LEYXJLMjTSul+oosPybA8alGeW+A+Smsk:sKQc8bdEOMjxE1sPVtwuBsk
                                                  MD5:16F29DF276C6E99038EF268CA5BE85BD
                                                  SHA1:93CB8D20DD2721585F9B0DEA037E57C5D56E2BFD
                                                  SHA-256:73CCD2E0ADC992E762126B1411147C4B310A2428587098DA49210BF78C3FCD86
                                                  SHA-512:4CA7E870AB96F1125B4CF9E7D5ED587C30D34FD80BFD4AA7B0B497996B91A418D4E87466D1A7FBEEB6B8135A4F12BE244FDC84EBF7C6FE1F892A019A039BFE27
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx......i........N..F...8..3s1.....l....*k....v..........g....N...h+...4.$....?@.[......iK.Y..j1...6<.5..!.,$.[D.n.U!.Uy...8.p...E,..j...D,BK4.i...2....HF...q..U.^B.(..>.i.XCm]..G.........[I.I...+.L.[m..S..ig1.~......[.A..eE...w.v.b..".d..?L.N..'...!.$.....'i..s/...lz...TPHB.\+.{.Z.X...5...s;..W..^!.J.....=.K..|.....L.7.....9.?.....x.f.......9z........}..E..$!...K:..8..'._s...H.6..n...k?.9..lvJ*..{.1GOU".......ut.#.=.....Q...%......z..x$...x.$......m..s..:y..A.....Pd..m...B......Ty8t.\7.@/.c..vp..q..$.........:x.}.\Z &M_L2.......7/....`8..M....N.....8)@S... .#A_.o..qE"........-'.c..>..3.,.T.,.F @.....,.A.`4(..F".8j".h.......g........HE..r%...!............@,.......n.6#5..Z....c.?r..:?RR...q.%...M....K-....{....k..N.UCs.VV{.......pIQ.B.|..:.fdp.es.E%....5.....yl..R...d....H.#X,.IU...C....G.0x.a$I.?..(-.G..r..@iI.6.Qv{...,)....c...Y.p9.M..t...j...d.4u..n.g4...y*j.F!&L]X..j...V........9.Eqi....(

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\32x32\binary.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit gray+alpha, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):705
                                                  Entropy (8bit):7.6142119172828835
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7dB7Ttvk4pFdbln3KtVwUaNtbDjIlK+btMzkq5MptYtPPNZeNx9sLN637YGC:WfzndblnGVwtgfbizk8EevZe9pK
                                                  MD5:F697FA0215B9CF824C67F6874E4EE0A7
                                                  SHA1:7AADAB5517232455F3B6E4E8F642DCD043DCADD9
                                                  SHA-256:327D5965F0815CE72C2294D69CB9671CE2438C474D770F4715F94AED7863C185
                                                  SHA-512:E962C771C96893027C9D6820FB594BA4541D1A5A5200CBBF6BB99C3C51E07FD50D6B026ED19AFD6549F02D3C39633F2FE9FA243ED0D6CB900788BBC8A21A9732
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... ......s......IDATx...S..F.@..$Y..k.O..)j..T....{m...n..).vc...d..K.p...5.\.Q..{..W.....^*.W.Z.T.-...c..R..D^..3. .@r.5..D..V.kDIv....AT..../.Z.....$._. ..].~YP.3.OeP.G..+.~..-h...#..x.8B..UB#.4.~...$.:B.h.di.....w.}..j.8U...YZB@...T..\'n..S..r...$.q.Q+*Un...}.....k.Sl.>_..aP.r.m..o...K...}..:.S..j....{..........d&.}.n.....w.".... .[./.].......[`Cs..kl.b.......S..A.....a.m.I2Af..;.i<...O....}.gKw..*..`.^A...3...b...l:....G.}3...##.0.Ya..:.@...>G;.^....u...?C......g...'r.z.tgx_.S.T...X.[Kn. .9..*@Z........z0.i..M.(./...uh.#F..v.....zg./...|`.....{......:..Zp...N..ce..W/.@.5M..f.b..9..].t~}.2u.c.._7._.s.y....].u.$.n.zt.3Sx.S.F.../..WK.../......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\32x32\bookmark.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1416
                                                  Entropy (8bit):7.811528189217717
                                                  Encrypted:false
                                                  SSDEEP:24:Y1stQBVPSfiRUHX3p1zbEsJtvtCj+bStcfl5hgfPc7vNY6ws2Z2ml1:dcc3plbEsbYj+u0XwsDml1
                                                  MD5:6DBBA28A0845E323B1A847F669505EBD
                                                  SHA1:05B7951B9CB2FF9B54229B1436EFD0DB85D2C6CC
                                                  SHA-256:022D193B8D0B61477E5D8032DDB4C47D820DE9F121BECCE3B446B26D87F55DE5
                                                  SHA-512:8470D281B00CDF986E4C493CD91292E2FB71A8B2FA6C4062621930E23196FA4C88C2D5F8E03E48689D0A7EF19B14967C1ED660C92C5E2A9B2584CF2F899D9879
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz....OIDATx....l+..@........23333..2.J.2s+.....>.s....l.N3JdY^.R]8.5...I4...#...m..I.P,..r.}...z..i.]....7<...'_..u ..8D=.......,.Z.k.YK........*.(..:..BP.U......1_....[..O.y...E=.0..~.;.a. .C..:...*.-.$..Z....0T...S...]'.b7s#..T]...g_.....!Hg.<...b..U...[[>)q...w.../.YA.k[1.v.l.A.'.h.....+.f..%.-.E.Vb..r..%...$./...XO.q?T..$....R.y..5<}.-.1z.%RX......Y...X`Sf....V..D...@K`..f."K5.IS.......X...L#.%...f...... JC.".:..p...@......5.FZ........c...):Z..t#.%.:.C0.2....Ps . ...TF.(......r..I.I..Kx.C.v.>...@.. ..9...`K...$Rm..@u....k.u".133.T*E:.vs.6... ..%J:.Za%....jh.0Z.f@k...S.=..#..............m....2..X.E.+........ ..1...A.w...@{kf+.m--$.q..Q.......p..E7...nk(........5......xO..@.6...r.....l.......-..$......&P-.S.RL.O$*[p..(.)...o!H.#.{.....39............PW.Z[YC.1..31.m4.......p.zQb.)..b....P.....<.A.\r!.w..E*.R.-\.}6.y'......../_.....{...3.AxD.........SE..pQ9.}.......8.....JI.===...S....%I6'q...J+.w...?^......w....RJ.S

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\32x32\cancel.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1736
                                                  Entropy (8bit):7.861944592233901
                                                  Encrypted:false
                                                  SSDEEP:24:zKjtkzp5u9o/HSOWd1iUs1agtl61RQFRjz62XHzEcJjmu2daaiRL3jraC/ANUxuM:GR0PuAAgPaSzZXgkmu2ViR7Hh/AuoS8U
                                                  MD5:AC127241B96FC12E91D636E0AAC4C262
                                                  SHA1:9729CB3AE4A32949291F2DD1187B8A14CFD01311
                                                  SHA-256:86D17932B8ED7339D8086BD73540D223B5982B2395276BC2012ADF6A8E1C154A
                                                  SHA-512:3990A4F6D76804F38C4FD23D20CA14D2966AF54E5032C5081D5E8715EF50254F53B8B20F73412F10B71E4083E05206A97888D476A859A59E00F4350F7148BF42
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx..W.t;.....mj.m.m.m......2e.d..ngO..V...3.>.).b...=........&...&.WT..t...`.c.4....[.<....DC....>...`|3..k...?...t8.......s..&To..~..L$.}.....xj|..ml|...|.*WrA:FD`D..[.O>.D;:..........?u.7..u.X.f..$.N..."..FTn.)~..LGW.c...T...\......_.$9.k.B..a..U.a."1"b....._dzzz...<ls).[....9.....Ph.X@.^..qo.{F.U....*...{...!L....oojiy."_....H..2.....Px.*J|W..a.~g..Huwc(.........}r.......]M....r.uj|..'9.LQPO/R...r.p..........FkY.CD...C.(.;.d....y.......x..n..-..^.. .kh@.=. ..~.\p..8.l.#...G9.~..;.<.......*+QlqF.Bp.g.......D.!N....jo...`f0h...}w....h....ojU.e$..z+d...9.H......Ok....Q....MG.......k...C.e..=.......cJ...)z.y..8%.A.s.a].g...g....... ..}.... ....._r.*..R...0...O6..._D'...."."......_F..o..........k ....1.J....K."N....o..x..wG3..zAl.g$..s..c=..b..qG..z.|.....K.....4B..... @.s.*......Q..@.yg...[a......b....h..q.. 4.....IE....u...|.=.e..o..`l..2'....p-.5.yz-..0.."..B;%.|..k7..U....B....D..S..y.u.

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\32x32\compare.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):897
                                                  Entropy (8bit):7.654133347326965
                                                  Encrypted:false
                                                  SSDEEP:24:O7NXAgTnzyVliOj2ad97pU5yHokRWvvmiqJ60Dts9:O6gTzwUq9KEQHq7S
                                                  MD5:75AC6E3542D2AD79179B69131439D52C
                                                  SHA1:AEA820ABBDA79A5598971B64B224FAE3A2664E49
                                                  SHA-256:D882B522556E723C2231F434F1DA9A1829DED713A59969F6925D86B5099A00BA
                                                  SHA-512:6883821C32944892CD8E4D3F5FBB3572EEDF7108946CB6AB27A3C5AC3E8A8321AC44F4D98F96020D96C96A932FA0B3D107037D9C162898F2D13F7BF940BFDBE9
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz....HIDATx..T..,G.=3.z.q.[..N.m...e;.m.N.qR....Uo....v.:.f....v.s..._B....x..o .[..qu+..Q..A..I)....+?.@..PJ.h."7.....P.9...G..koo.....H.1{.u.JB...c.....ec.o...T.]]]8.._~.e...r.wN...2a..........".....7n..G".@&...a....e.D........O...MO.z....C.b0|.p.=1..{.|.UW._....<Sz...X.p.G.1...N.>.:.l.!0j.(.8p...m..[n..o..._.p3.....[=......a.F..E(..J.8.......J.i,... ...?.O..AKG..t.....D..;.......T....c...=.LL...J..s.8p W....+'t.....-.....FK..o.FD.UAr...S-..9...I.....x...t...a.B...@rue..1s.?.&y q.!`|.M..]..n.&].L..{`.%y.z{..{...Jr.G..G..y?Q,J.3..Bj...Y..i}.....AD......;.t...L.G.y....+.2.P.L...7K.s_}..x..H)..<.....-.@..~.....3...z.7..%?.yi....y..^."..`.-..}...#.+.c..j+...H(..z.Q.......1I............4....X....{'..A...L.z.JJ..i........@...Q......v...<p3...#.|....`b.z..r..-.....@..Z.d......v-....:z...UN...:..._......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\32x32\disconnect.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1122
                                                  Entropy (8bit):7.744166234014491
                                                  Encrypted:false
                                                  SSDEEP:24:yblKd5de+zbEovxGQI8ghsv4HkdIdnJ0B33ZW+c:yblEde+zbEo3I8KswHk6dmFZW+c
                                                  MD5:BD04CCA8D82FEE4DE9E9413C61895C48
                                                  SHA1:46E5985C91096A061161A28653C325CA7A61730E
                                                  SHA-256:F44067334D0A09208A522EF63B3D9375273667893C2D990A9681FE28708ECA23
                                                  SHA-512:854CB2BE988AEBF5A1E81FDBCD967FEBF3BD1CD4226DF58D37635E76226715764F3BE78AE3C43A658D0A2C69F97B5F305F3368EC99A868385874609A611E7D3C
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz....)IDATx.b.R +;=.@[9.IsEQ.c.f..m.v..m+.Fk......8.}rr...n......W.~}....TxB\BL...`..\...../l6.g......f.'_..A..0N.Mbtl.#.....>bA.d.#:..,3"2M.O7!,..4.BR^EP.+._.K".~c.6wl..c......":...."....g....F......._..!O...m.......2..JJT ."...Dp.a..K7#..9.I\v_1...`..6..u......[..\JP$.......{.q\ro..E.......?..w...W#.... ..@..../......U..k}......._e<0:.WR.... ..&05=....".c.."qu.S...IY........."...sS&.qt....u..gq]...Z...f.g.O2.~.._."....j..3>........M..l.y.#...r.W...n.......t..@Wo.o".......@~Q.df../..8_e\.zz;.ac;.ky.o.....f..l.....ln~....+.>Q#`.[..... ...Qy....=./.Z.]/...."..k...w^tl.............."..N$.(qK..`...'u3>.......-..IQ..B...vr.(..*....;..d.,dz..7.w,:.?.........3]....QQ.U...].Y..Kd..;>....f..*..<#g..J...\.W>...d..f......[o..3..4.:.\..w..J`ff..?t......."N....&N>...Qi.bs.....'..p...]H.....MC..JH%..lI.f3.../....{.........??.-.l...|.^...H@a....."...`@Cc=z{.QSS.*..5r......mx.'=........0..Jmiy.......P..==...B....lT..E[.%....`s|..g

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\32x32\download.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1100
                                                  Entropy (8bit):7.745181227936584
                                                  Encrypted:false
                                                  SSDEEP:24:YQBF/55BRU+11tGtrUUV9ekFc3lw14nBQAwfO1Gt1TdQQIQ6gya/7WV5UF9Gn:YQD/vR11w1UUV9eBlS4BfQHQQIQ6E/7s
                                                  MD5:147C19751CD71C957E0E8FE38179A361
                                                  SHA1:F1D315FAF9927056980E5A7E4CA72B64A2B9631E
                                                  SHA-256:BB3C41D5E5B5A3105C7721BEEDB804A220135A4F847E81515BCD3942B058EFCE
                                                  SHA-512:218452B00524069F49F58BF43DC65C2A75C5D9EE1BE5449A9962E67944465B013EBFEEDC7B780E0D1990CBD22E6CE501DEB1A43D29090E5B48F1957556CFBC32
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx..c`-9..O.I;.m..[.k.F..m.m.m...6....X<.......uim...m.....(:/.Q.5~.[.....C'.E9..R..E.7.4{_....p..Ubx+..[g.7v....(......[.{.O.[t|.a.G.o.{.S.-.0.2....z.....S..g.....1h..../......E...9p...1^._k..T.Z+..4..3..H.. ..ZW....H..E.{.......?PZB)......*.......8..o^(.....G.c5./n.....6.....Z...r.ly.....a........d.....ro.....-.....#.g.....!....b.2......p...Z....(....5...r.J....W..&.>@..8((".=.A.4.@.{.......6.dT.{G..T.G~..g.7.....{..J.'.q.53Dd...DE+..AI.....`HqcC.....J....Z.uh.VC.8..pF..K......BS..q..f.6...4.0H.i.........*G..o..../....Q...}..)...$b.$.P....%...$.B).H...P.D$....j...?$ .Zrt...<..5..%i.G...x.2.....Q.$H. .4.......:.~H.\.nH.X...w<..W.........@.........h...$.....A....gik.R.G...Ff!.M....u...^.s..5O.*..X....e.......[....N4.js)..uT5|'....]\.X.[..6...O.k..A...s/?..T..b..*%.s....?.W......WM/.0...e8..S.:..@8.!.x.]...+ ,..$n.....~..*.....i.;...Z...V(T...6....lr.......N.<*..#ca....v.......+.p.d{...".......=...

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\32x32\downloadadd.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):508
                                                  Entropy (8bit):7.450638491357663
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7ijEDTbtWGwTa70cV33FItF5QirGBrTqgjsfvhSQ+:90sTWnFEDGdOmS5Sf
                                                  MD5:14D993A7709C9E5114A01AAAB315493D
                                                  SHA1:58FF2E58A01AED53205829D14E013891E67691D0
                                                  SHA-256:FB7DFFEE4A53DCAFB847B983015483198446B5844EC700D7DBF9C47209141A95
                                                  SHA-512:76BC3A90F205A31F798CD98A9A9C0A71DC286B67D90B6C178A5D9329CB05B1622BBBF2BB6A9157C04C42B009B81694C094F19235BAC17763E9BA58C77D26D086
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx....\A.E.....j3...m.6b.1k.u..m..m....emU{..|...*..U.....Q....J..E...}_6o.b.y...@.k.?.,...S...Q0>..C..R...5e{...5..G..VB..3yS.t.............(.......<A...v(0.!X2g,...c.....!.M..!j...J.D@b..c...'...a... !.. ...s...9...9....}..O......q..4....{.[$.A.S.*..9..!.iu......{...!.1..."..D!.$....w8}.yN..b.-f./.a4p.ok....95..=7+{......s..Vl~|ze#. @]r.).Vlc...R.:.....J. .....{....eMh..Z...$.Z..*...U.I...km.y..0..3.f....8.j.3.A....@.*~K.J#.].)....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\32x32\file.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit gray+alpha, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):463
                                                  Entropy (8bit):7.285591582716212
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7AQJMD0+E77F3+F9OZwyL0vR8R04XOOPNA:FWMwtvwF9AfL0v6HG
                                                  MD5:B0B28E8BCF6FEEA4F812E55DD3FB5C24
                                                  SHA1:D7583FF9BFBC3E4B816CE53CF1C89485B03EC926
                                                  SHA-256:FF9E0FBEBE9D74986BCBA9DA7EEF64D8CCAC851BF0B692ECD38032B4E93BC0D0
                                                  SHA-512:C223ED04489F86CCE866BFDA0A4323CA0DAE38A29527FFC8ABD7E7C83454C0D020049B3FCAF1FC2D4D06E545F90D5E44D7AB48E690A7879EC3ACC33458D7C8B5
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... ......s......IDATx...5..A.E.....%..e.,....)!........k.;tw...S5.q..>un....8.o...tZ.V..h..o...........!..j.......x .f... ...%...HB... ...2.]..K.....H"CVN...P7X..d.V...R. O.;ZQ4XC..5[...Q1.....7..U...W...:._6... ...."..S. .j..L....:.}.....|[[8.9R.PH...f...-.0h.H.9.d........{}...k0dc....Q4.......x......9.(8$I........E.u.I..=...$.+....D.....9......`.e^....m......7...'-7../.R..3j...b.G.<..0j.0y:.}.U...U..tZL.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\32x32\filter.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):717
                                                  Entropy (8bit):7.578087610312301
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7isR9AjSCFGsxud4h2nkwHQsRg9rTxCSkmHtLO10WoRSnKuxQAPW:SR9AuYhSkwH6pxHLOG5AcN
                                                  MD5:BF5D35B2275410721E663F3867167007
                                                  SHA1:10352BCE64796AD813781757F0D5AF395798158C
                                                  SHA-256:7159E988C41E1066526CF7CCB59AC6520533D43272B28CFBD9663492E1669F96
                                                  SHA-512:A58522CF6A29461A593F7D6A2B45C4E02D58856C0516AC95DAB0B56DDBA9782C5CE4F2512F16866259A241E3AB803819D9E238E29EB643F72A53C0C0EE5E9121
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx...l.Q....r.m.N.'.m{.j[A......n.F.m..w8....O..|....].o......%~.$....i.5?.e...zR(++._......577w.099y....#....4....2.....................4.M...wsrr..622...QR.R.>|.P....c.!....Y.....{.F."..AZ.......?MN..8*.......c..5.^``. kHKK..o....."!!...........................[.n.|...'.`.N.J.M#..h..B...:s.L...BKf...{.....]..V..{...C..V2..R.`...f.Z....Y...>|8.{........j.*^&.Q!....=2..T.g.h4.^....m[9/,,"GGG....<.....THH.7s..i../...q...~..t:.|...........k..\...........0..5.v.Z...gE...m.........\... ,)).u+..EEE.Q1fKKKy..j.8...*G......w.i......cm.bi.8S.b.|x......FJ.K_..........KD....;.....t7..y..2..%Y`.t.n....}q..HV......A|GG....T...X. f....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\32x32\find.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):2003
                                                  Entropy (8bit):7.887061191090399
                                                  Encrypted:false
                                                  SSDEEP:48:O4KNT2N0n/2t1NlFHTtp5NPj3Gbhfyb5pMFOnN:O4Z6uNfKtdFOnN
                                                  MD5:3A4BA1F439585373A7292EBBC37D73A7
                                                  SHA1:26C39B91D8EE1A3FDE0A86E767E05B53119FFFC3
                                                  SHA-256:65F2A8D3629FC46A60934580A3A03AB04FEC6D82F6E681F6267EC6FE7FBE5D3B
                                                  SHA-512:9DC0C5402C23F6EEDC2FEC675051A9719D5A3FD7CDCA40089EB29DA106B7D30F6C66E419C01220CE0232FB2C4CC7666718DDF03AC8E677FC46FEF95C06E40F40
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx..W..+k...F&.8c\..m.m...zk........{O.*....O.V.............&..o.Q...H..sq=..y..Y....e.........U.w.}W.J...l..]..jkk.`0.. (C.F...Z[[........ccc..;..Y...~..V.8.s*f.E.h.b.."D..8.#Q.U....)...={...-..,y..G..i...*.^?x.5. ......O.......t.N.N...T..W.W3{.Z...g.}F...L&3..'....~.aQ2.....p........".e......e4hc.Dc......u../.i.~...s.v+.:tH...F8.4......q..W)..92J.~..#......{.<.mf...............h.P...up.-.....#.O[.l.........#..h..I.7.=....v.{..hvE%..s...T.`^...........z-.....&......AW.......~.M.....6l...].R4.... ng/_.\M.ao4.IW.d....WT..4..c.F.l.1.....5...../._.|..o..wIv.......]H...@.WVVF.x.~.....i.Y6.nS\..d...tVJ.2%.(..Kr...c.P,.DedJ...oon.).RQQ.....Vh4..........Sm..Y@....Og.XV....K2).6........E.6......d.Z.X6.$.e..M&....Fm.H..D..C...'Q..XF.L.L...P+1. .%.A.D....I.t:.*....\.W..[y&...s2^e!:.q.. .dJ!,.NW.......c.1U.... ME.#8dWJ..c.h.......i.(...8.O..%.h.{4...5......#B$<.EU$.]DI.08......E...j..:<Qg.P..c...kH/.L"..'.

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\32x32\folder.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1301
                                                  Entropy (8bit):7.801261393390284
                                                  Encrypted:false
                                                  SSDEEP:24:FWqWclpY2a9oOSDG1X6S7P1Q5IUhd8eiVI6p4LzxxbQvff/oGOcKz:NTY2aDSK1X6sQGUPLoI6p8303f/LOlz
                                                  MD5:C13A4882A6686CBCA2E973294647518E
                                                  SHA1:49596958A896265876BA64B93ED0D3B3E21A7B30
                                                  SHA-256:C319D209C43F7BD11B19EE79F6CF14EC7F89240801961090B0A96284216CF2FB
                                                  SHA-512:4219BBE56782B92218084F3090D8ECC51C512E5D14084F7804F2DDFB2A5B5479E70ED9A840B71AE357373C132F87D9009FE0CDA03A9B6AF8204EF6A9C82B727B
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx..W..lW.]w..A.m+.m....G....~E.m.z....<.;..9o..?..J...{.qf\...O...~..B...nw.......N..M......).....kl|M..u.].x..#...~<..SA.0@d....1.k2A"....o...\~...i.v...V.....`..0M..e.c....n..F...1......02...}.]L.....e.P*...e...-.g...; .Z.b.9`..'.pBs%.......8..e..(......B.Q,..j.*N.....dq..G.!B..._.......e......?.S./1.0&....v..]......0.=.."........P(`...Gww7...P..1U,\.....v.2.6.{.. ..UU..788..N;..d..J.]]]l.......b.dz.u[..Q.d.)Z.W)....k.m.6..Lb..H..HOOO..m...qR@..=........ok...IU?W.|...}.F........Z.d...y..g...-.p.;*.. ..o..[s..h..E.p.p....p.A../.1m..\{.a.4..N4....._...^.$.7..bxx.....G.....@........a.5..A!?r.2..|....../.....,..g....d...B...FS..)..c...r`.@.b..{.....`0......n.dY`...J5...C.s.Cy=2-..0..8..?.(.>wI.O......F<..%.-...u...G.6gv.t.nX..\..jP5].f.....1Z..s...0.i.l .s#V........$9;............s.......,OEN.Re... .k..M..R.p.dx\N...V,.zN&.Cg79....c..5DC...........c.....v(....X.i..w..H..S...[nA1t8..v4....#1......./E..

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\32x32\folderclosed.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):920
                                                  Entropy (8bit):7.674515518232267
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7io71NtFbCbQYTAjU3h56KlgpaS09JqDqanFSKXI2YdZVrCWDCBe3nsCtIqIj:4FkEmeyeZ09IHI2YdzWWGBe5u22Sebyc
                                                  MD5:7E4E4E47715E5742A716D73B51891249
                                                  SHA1:365D590DF03B95486DB196BB67A2222078CA4969
                                                  SHA-256:7D2192A44C1BC190FE25A670C98F740DD9E41F303E877EE95E1A2D9D6BEA7D40
                                                  SHA-512:72EEF61D460A740FD93E78A6BECC8738C2601355E738FBC80B4B6A2A4A1E2D9B0444E529C0379F721AF465543A8FCF5EDB54A903F4B7239A93427421661E2A60
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz...._IDATx.b.h0..a....=..Z.v#.../=....3cd.....NM?......bfL..x....s.v.+...U-....#).n.>...+q....mpD.n....n.i.c..Zk.........7.x.5......G.._..(...~...w.i....'.......Z..[>..SO=f....a.}7\/...<..."*..a..].N|.........p..16.R.o.A.&_..[o=...}%0..p..q.f..pt..ieY.!n...=7....c..d..h.....v....vd.|LJ......N..w........?q.FA..../.w..l:..N/..'q....K..Q.....2..^....T...R.~7...'.g..-.O.`.....[...e.,H..%..I1@...R....& .@.K..9\...Zqq..JD.[......2y. <1n2..V+..s.R.....iM...Q.!/%4hX7...8..$... .....,.d..@VH@...:....:I.\.....ZX..'h..........g.,...q....b].=E.N...O5..8...G.V.......*.s,+.A/@Z..1m..x....../.\..Y....*.1.:.....RCi.....V..2..#.......^../0K*..B..R....f../ k..;.X.!...._..W.F..AY....M.`%........T.?ar..?),W..4:...g.C......p.i........$ .=......>D..j.....e.....x....`1_.H...$.n...F...o........l@.........].rk..o.h...X..#.%....x.@..fn........,..D.]......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\32x32\localtreeview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1139
                                                  Entropy (8bit):7.772299499383635
                                                  Encrypted:false
                                                  SSDEEP:24:+Ac4u5OORqWoGfn3rETFhIMNWkKWPxlFG9BUG+W1HYF0QTz:+AduNPoGfn3rtSjKWPxG95dHC0QTz
                                                  MD5:30AEB749D4F4AF4F557B4AC3CD23D456
                                                  SHA1:5C6EE30CD6B10920854C2A423069D04CBCADEEBE
                                                  SHA-256:DD79518BA7FD89DE6E00F6E25F6FA12C158D316A922498BB0E77232213BA8606
                                                  SHA-512:DAF8FE7E70C3E851D84D35C567D7DEC4130F2910CA2F1BE5C005B206FEE428B543D24E945980183FF896FDD9874EB2DFBD3D256E191CBDC36BADACC45701C6C8
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz....:IDATx..U..lI.=...}..m..Fk.k.........m...t..j.t....8..WJ.S....lmh.......E.X.....i..>....&.@....J..$IR.q.~9.$|....V*.3.....(..........%A....R,......@....Q...<C)...1U.{.......$.}y]O....V..sozz:/H.e.d....B.P.7o....H..b..4.....wn.p.:e.T*axx...L.$..)[..t...K.}M...l...j..r..a...8Q...h}f...>a.jX..l.v.m..u.Y....\U..?%l&P.f?y...~.8.Z-U==;.KN=.......8.......?.f......4..T.U@1o..I.S..6...d..3T.6/G~id<.9...Fz...Q...........&)i?..........97..f.H.....S]~.2.w.~8..EP.. ...^.... .V..D.^..2.M.A.f..-......v...=i.....=(...~.....~..|z.....y l(B..0.,.`.8.E8`...n.Cb........~..y...$..C...(......aiY6....t...{..N=pA*..#YV..G...?U..weH...K.......!.fq.E...E..>q...mA....c....s.n.X0b...&.r.T.e..8.....M.u..".......Cl...'p..K1Z4zj{u...../&!.p...F... .<z..0L.HO....`.'...@.......)....es.4)....lX.W8..."x..Y%.Rd....s....QI...~....i8!.A..E.1$.A..\...\.U=...RBW.X^.I=.%\.....M'Bw!yA...u.....f....'.).P.#.x..L.d...."..^(...A.m...Q?..O..~..!#.....KF...0.1t'.n.x

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\32x32\lock.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):756
                                                  Entropy (8bit):7.650027473572644
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7ioKOkrj6PIpYgterL1oqsM03/LL9ZhrvJrlQDKIkxUSsLjmlm+CiPz1TyIqM:uKJjPpYh1oqOVTrv7QDpW83iLYC
                                                  MD5:20D5568A60308A123D83796BEAAE7E29
                                                  SHA1:3F1310D65FA19FAEED9C9D37DA547F9F7AB56FA7
                                                  SHA-256:65DE672EDBE6242F051A5703FB3BDE256391662D6FF203152518A23690D5183A
                                                  SHA-512:295D8820F24D816A3C93C320E1FA3FB3E04443DD3048394939442574E0B36EC2906E3E34C8DEEDC79518B1314C22FCF7BB619BF932DE7ED6DA21FB22480B529C
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx.b@..`.9B..._........y.,..Bl.v....../.H1..dm.....sk..+..4o.{......YYY.L.&iS......"....P...3d.4I.rP.p..._)((..........dCC....F....8y......j......../.~|..Jww7TUE ..e0.$..#M........DDQ.h......K...)..b...'..w......hlj......3<~...^..W.onn.y.....c$.......==.....c.\........$.7.....AGG;.)..n.=.....]{.c.N(J.......V...^..=g......D.1.;....d.].a. D2#../S..tC.3&...H.......g#}.X...@.v[[+8{..!P\__.sr.'...[.........c.Y]]E.f...o.>B...8&N.r..y;.9.o...\.&..8.....y<..+p.....z.?.'...&..x<%..l<.%9...C..Q;.n.1.o.....u....f ...h.F5?*...l.;...1.!.A....***.....&..'OKKCee.:<<|...U..{nNNN[ii....!..YVV.eeeu,\.p...`.o.m.s..aAC&..O.<.x.....,...! .../.Rp....\#.Jp.`&8..E0]0C"S..`....D..o.....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\32x32\logview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1769
                                                  Entropy (8bit):7.876413498361021
                                                  Encrypted:false
                                                  SSDEEP:48:wmWZw3bG7v4xiKaCM0qrjEw8Vi6rsAxeF6uLNXka9ITKd:X3bDM3rjh8ViCxq6upXcKd
                                                  MD5:2C02B6DDC4EBB751F97995900A462DA8
                                                  SHA1:88D5B973FF0A7707649DB945C3EE2649CC10C38F
                                                  SHA-256:3E388755B702AC9C6207782D29594980678B8645DBAE56CC1A6FC465F33FDF96
                                                  SHA-512:F737465DA65D762FA1A5A838BA365924C160D02E25617561E810DDCA457E12A38EB8593D932FA7D08AB70A36208D570C0039541DA2105850578B62D4EA8EDC3A
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx.....4M.........m...l.S.q.m.m.}6.....\oF..-....VM...^...O|....o...R..s.QgS..M...I......R.o.(z......O~.*....v.m.I.0..!.{...l.[....|.3.8....1...w.x......*...+...Q.n...k..jl..Xg.Jq.9....=.../..].Mar..)q...~..}.G....%..T.V<.!7......_@..W...\.f0.....s......J....hE1...8.@..=>.\>.{..e...N.n../.....z..,.,@H_.@s..\t.$..%..*......x.....8.....w.'.$ .5..:I..+.:.Y..z|......c...,...+.4{. ...si.iE...._1z={......Z..T...,h0N...%j!v.H.w..3%.W..H`.. .#1...av:..p.|!..N....N.Y....y7r.=.d.T...s._.K....mp0`|4O!.24.X:...bfF.}..Y!ez.N..;....f.j..1V...i}....h..G...\.p..e.*!..JE........eWL...E6QC7.N..Eqz..T....)...[W..yz....'...Y.Z.&..J]...q...+.-7.f+.0Xqd..L^.}.g..id..G...$..@..d.d..F'z..Y.-q.!...g..\z^99.....;..........l....=Y..Q.4x.k.2....Pp.....q.....bz..o....^s...].29..O;O'.T...;o(q..#h4..f.BQoIByX....!h...#U..........{F.n...].s....w .....t.m{......%/U0r..n.!.lF....=UP!J.(...5H.....3..Z..@.?%..j.....7..9v2.. c..h..!gU....n:.6

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\32x32\processqueue.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):851
                                                  Entropy (8bit):7.679467645169867
                                                  Encrypted:false
                                                  SSDEEP:24:Rl7DPUG+Zy4rP78pnJBbD/lzPGc+rrVuBGB:RFP1CF78PBX/lzPGtrVuBo
                                                  MD5:68FD3F6DCD98DD9007A07EEECEFF296F
                                                  SHA1:4869D25D4B1756D5192635DFD06016F9AFBE638C
                                                  SHA-256:D6BBF7732BD701770530DF7724F3A7729D99758A171DA947552D98D2EAB62DAF
                                                  SHA-512:534777D5BBD71A1774E4A2A25CA9D1627C66A79BF15B13686BDC1FABC615200169A5B44FD57DB63BEA76340C3ED78EBEB157231546B672F2D6AF98FED5638EF3
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx.b..`...) ..b..r.....:--5./..XG....m.R..c..v....S|.m....6......[....#n.D......5....].........A:....../..it......].v....#..D@.R.@...X..n\.{...^....Cz...O.!..B(..Bxd......).l.QH.. ..\.K....w....9:;....\.~(....O....DD<......=.'.Maa."...h...>}z..ZI^& ....D.k...pVO..f-[..9u...H.f.......F."..c..L......m.........2;;......$...G.4Z.H.....BJmc.."%...=Q.+...\.+..DD...W3.............w..K../*.?.._.n.c\<.A.j_&...w.N...f36S.a2...^.O....bO..z.....I.I1.*.\.}..U......P.....[....9s.......M*AFF.d.OW..e5V(.)1.DM..u...!6>Z....&11ferr..;w.4o6.{.n2.E...P_*W.@./.D.x6.M.T*!-=U...P.........x_.........z..&..j.j....G...!...........g0.th.A......Jz.GI`.*....p]Ttx......h.,...... ...L$..9.....kzz...L@..n....BI........{... .82.,....c.D.Fh..>p\(.N..w...>{<.;{II............\........Q0......p.(!....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\32x32\queueview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1367
                                                  Entropy (8bit):7.781283060302408
                                                  Encrypted:false
                                                  SSDEEP:24:cMiNeraT1CWQHwghcuSAwK+pcuPHqeXs4rfV4B3XQ0V6W:2NetVQgoAwTccbXsoV4BHeW
                                                  MD5:84222D4A0FC4CE352D34746DDC54AE0E
                                                  SHA1:9F385D46DE6D44E1E67A3B8452B833BA17B0CF69
                                                  SHA-256:9AECEA403F345300968674E0869FDD10B493520ABEA451EFEBE89FA00F80F57C
                                                  SHA-512:6B7455F6A7005145B483A2F2B2AC448D420BB8ACBE1B1E677B421756D4485A9887FECC403591EBFCDC494ADC9CCCE63BAFFA3C557DCE2C47B43EF026E3ECC5BC
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx..V..%I.}U..<.m...8...l+p.m...w...UY..nGEG...M............y.....v2...S._.c... "k..................x....|..}..6n.D.b1..`.l..a..-..._....V.#...{`iyY..y#.R......a..I3J_~.....).AM.4c...)~.~1..D!.....q....|..$:tj...U.6".J.bR .d.....?,..%_..................y/.w.ih.=.).yn..@..5G)...W...k./. .\.9.`}.9......q.e.BJ..UJ...X.Ja........!T.....%q.\.$...L...$.0.."p$.y.P........L..@.o.1..X..%..>|)(_c..*8.....`.......F.. z.OyH..H..N'Q[Wc..*D |..p.N.A....@b...i/p..m......#..C]..i7.,...).. K.._..O`.vU.m.`.9h.;>..mlZ...U ..'..^.@.^..C'B@.X(.....@.$....a..o@.c@..8r.)X..[|..;8.c7.b..Ie.=.x..F.......T..........k..|_a...Pf.lY..........8j..x..g..;.#....n?HS.u......).G......7...B. ...`....3(.6....".@r..B..-.0#..6.....8......(o~(....q.'..aM...q..`.. _.l.B.W....LV..S@..k..G...SO...q.7a..@%...8.N.yC...a.^X...R.|...-..a...+... ./.........x......7.d?........_.h$..DC..<_.?TT...&.cB...s....3.]:um0......?..i..ST..!.

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\32x32\reconnect.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1037
                                                  Entropy (8bit):7.739052263685285
                                                  Encrypted:false
                                                  SSDEEP:24:XftadLiO/XIwU9S+Ctrn0KA5SaGXWy3IuHTwlQ:XYwwwS+Ctrn0KlHYIx
                                                  MD5:901CCE92D0A7C4DEC01BBBE6FE988C70
                                                  SHA1:61E676E36CCC8C4D99DA5B8FACA3D5273FEAC860
                                                  SHA-256:5FA645026CFF5EC73D41EDA3C21DBDA0CA008401FBD7BA61169486E3FF462C56
                                                  SHA-512:024D8AAFB095778E50064C268413FAB34A3809B8334CEBC025B2C8A158B486F3251CC59565EBE4770C219F1F28DD7B5800E5224C461E3488095B847C89C2A16F
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx....,I.@.m.q..g.Z...m....Zc-......g..P./z...._..Z.qQ/...A(d.f..Z...E.LfCP.\./.......'.Jo}f9..'..O..j.$d.......Z.-...J..+.n.......#P.x.*...E..I.._..C.?.,.t9.`.[:P.].MH.J-.-.@.1 ...P.h....C|.........u8N.k:...4w..E..P..Q..5.4P...A.......&m.;...C.p..[...zhB.Q..oI.Ih..=.T.v7.|'0a.>........m...h.40P@.5..x.7..{.<...s%...]04<...D..zx.P./......=..S...@$..M.I.2..V...+%.u..+05=.'....._.........Az.j..~.....8...".......EdwM..9...@......V....Kp.`....9...i..K....AD..x7#..?H ...,F....<(e.........I`L3.}.j....wl....-.s.yIeu.....ID_][q.~.....=......M]&.0BZ...^.8d...6....%6>.....;Q*.%>.O..\...mk.$..Q.}.e.Zy...%C.k.!.[.+V....!P.U0g.l.(*).QX.7........ ...8..0...!.....bll...:..V..V....v.=..^}..(..j....C...~e.V.....8'..z'. 8....j..$p......>.Hd..'rC.c...i..H.Li.-/GN........%.>b......6~1r)m..J../v..I.Q^.g.}.!6.....EF..f..b...4._......}$K")%..9.P~...q.}...8...i.h4..s.A5.c......Z..^.........O.A6.c..........y[v..Gp..X...d.......

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\32x32\refresh.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1911
                                                  Entropy (8bit):7.8489044757606194
                                                  Encrypted:false
                                                  SSDEEP:48:OtIbOcDexb9oPeSU4nwCd4IeQiK/Kn6kgCIXrrm3q2bJlxR58d6a2:OwEoSadgQxK6BzXrr/21FA2
                                                  MD5:F92EB5774133689D728AF776337F0945
                                                  SHA1:F66E00CA29940034BCBA79D4F0641CF4AD67D77B
                                                  SHA-256:1E21712503290748CBFC1588A3746A74D4EDA5F846A2A8E0F3B8E313CF3A58DA
                                                  SHA-512:E8D541389F30CBB44DBB46BB4BB2E0D066B2E6B77A804309DD5A2EFA2550B95F4BA9D4E0AA6784DAA1C49CA127381751E814733E97005B9D68FE5E02981C9E39
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz....>IDATx.........E.^..w.m.m.m.....NG./IM....N...u..s+..[...G|z......w.B..RV(%.....s.T..R|+l...a....^.......|jH:..2.Gje{...).Y>.%...!.B.............Nt4..#a......D..-(~P\89..Oc.QB..X.]........J..4d.+.L:........../.t1.Z~F(...tf$.8g?..t...2rO.2>....qG.6..F...\(............L~..../.r1....'.....-w........c@,...k~.q.8.....j.H...3.J.D.lAk ...PYe.0.`..&...[.-6>...~....{.r.^.......].1.w.../.._.&..~.^M.....t..^%&....p.....R. .B.~.....wP.8.x.....0-.H....b..Gv..?....W[i...4."qMS.@..H@.....G.]k>.Pw.u%.u......R.M/F/.XZ.pn....+0....:|dj..._O..^-q.).[M&.M...C=3.;.>.Q.{V.{...S...~..|..7....:.P..A........1.v.B..^j0.&..1.D#.s.H...k.Ho..?...._.3..9.,r...HE)A...@s..E.M7.i.3e...kY?.B..Z^J...L......s.f/... .....x.)...^.^...J.#..;=.%.."%.?.X.........-/....r......d0.^....5q....[..q...a.ne.z.C..,.%....H."H..e..E.C..8......._.,.%....gB.(...k..sHIs..).S.z`.j....0+.P....s{.....,............G....P.<..6. .?..+.......@.j..b....

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\32x32\remotetreeview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1281
                                                  Entropy (8bit):7.827872038681461
                                                  Encrypted:false
                                                  SSDEEP:24:Ki4VOXeL64iWmLh0MUcKEw2lCJppyfu3QA8OG6yLXDO8R6uOPwQfH98qADCK/OcK:wVOuL3BMRi00ppyf0ydDZcuOPLfHwehf
                                                  MD5:DF82DC8672F50E7C523E90B0E84188F1
                                                  SHA1:90235C8EEEFE25A534EC07EC5C45B7496FB998DA
                                                  SHA-256:F629CF6AAB12FE6850F1D120637A9ACCC6D0D759C8330D1969DE71A5D1DDF81A
                                                  SHA-512:D096206DF48E5257CD846ECD51C3498454FC46CA007257CDB7E1E2C1A63CEBDA0F39A1BBD4D53E13829623C163204C3044723960B2942761E712E3AEB6F2E378
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx..V..,I.=..<.m...mDk;v~...U...|....iT..d.vgv....S.V_...?..7a.^..`..7..^..J....p.n...v.R.Q..{..&.s..9m.....fl....[...a..eA...FH.P....c.@....4;.#OQ....$...#..K{0.;.}...Y.f=>L.~..y.....j.t.m.0..|a.w.........e.......<>...b....|.L9...f...T...k..#M.}.[*..e...@*8...rp..d.|-..k......%%...+b,0..O..B......o...s.S..A..i\q..8..0...J..J*....^...*..%N...G!.`...6...D2E..1........p.]...y..).=.A(1S(b$eL.^..@@TS.(.BN...........?.L..B.bk..V..@.ZE/..6.@.-x...X................A.,....(.80.a[..^..rC.J..E..j..?~8.j...R..J:.pL.r...d}V..$.na..e....7.S.P@.TspI..%.j.>.J)....n........N..`....=S..s...J.JJ...=^n-o......$ F.......-_..[.....5.Y0Pi....8.I........".}.+..i.........D.......YU.D...g..4B.....d7. 6.!..9..qG..s[.B.v .]t"%..$.J.Xe........>L.6 ......D(.=.i.z......VmB.........8..B............Cc.wyb1.......~...;......s7.x..Gx....Al..J..1...... N.{.{.w.9e.zq.'.q.p...%Kt[&I..........jb.(.1L..._o.?.~.r.R..).......7n.s.3u

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\32x32\server.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit gray+alpha, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):455
                                                  Entropy (8bit):7.386413558957136
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7kB78LwM5ozMUKAITJ0o5peIUD2/pXhVgO3X/ztvD3B6Ot:9BtzMGu6oTIDERjN3Ltrnt
                                                  MD5:93568F9276505E35C4DDCEF82C8419F7
                                                  SHA1:7AE90AE578156B56E0484F35315F927963A4FAC9
                                                  SHA-256:D44678A0C955ADA88F5335B791F258EFE8B29D7FE3F91FBF7410CFB05C0B949B
                                                  SHA-512:ED24D581E56CC4238F44C23357598E71842463B96000390532292474A710964861CF950909F37BD942500A37B61E57BDECBA838908B0F2646432AE5C0A7D190F
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... ......s......IDATx.....A.E_....j.m.6..6b.m..h..[....{r.ygD=3'_.Bk.].8~....f......I<.....B#...Q.S5....!...V..C. .JQ.A. U`..A0...t..2P.A......MbF..>.......?...7.+...*8....o/>.v..TB......n$?.{..5..J..ZP...?c>$=.z.q&|&.m..m....^n......*A..0f.;....o.........g...8.ap0z.o.s.......PV ....K........z...B.i.%.3j,.T...S....2..J...4V...ILe....T.`.N`...Z.Xa..C..R0....&..0.....F.<ZNkxXF.i..d(M..<L.a..t....6.s.......IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\32x32\sitemanager.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1243
                                                  Entropy (8bit):7.753032737249562
                                                  Encrypted:false
                                                  SSDEEP:24:wocTcaOxGzMrw2HZd025MMcBf3AkeD4adfbpzHF0pKw1lglRve7+M8lCq2OYVZ6w:Jc2xeMFn02RcBIkePdfhlq1lgjsalCqw
                                                  MD5:40968C1F1E8ADE30A661B901B152F927
                                                  SHA1:8DE6CCBAD8676EC750297EADA024C3BD3981ECED
                                                  SHA-256:B0074CF43CC1C0349757CDC96132D752A1A8441243FDDC11FE70BE9103A01488
                                                  SHA-512:DAA87FD309265051123D6F1E0D1CB360673D8841A42407CC6D91383C2E566DC6D24EF7CC26B88C72F57213875E141C23A9AF70FDACE8BB82A1E98F6119FEFCC6
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx...pdY.@.}/v......vam...rl.m...f..L.w..~.......dq.f....)...C..^v.].v.N'H&S/<...m.@a..g...uk...j..N.4.....@&.]z...F.w..I..<...D<..)..)......PU.......s.c.....g..|.2JlYm...).P...G.D.......4'.....x.%.TvJ@..."..7..Q.9...e.f..4........Vtz....$..$......%...`K..........."..\..D..d.....6x...3.........7>q...........1pl..&.%0.<x..DJ..t.q[R...OfQ."..?..pAE.......RR....#..+/...Z..A...`.....aa.i...P<U....9..w..l....s(4...Kf..&e[..[.6..4n...<.....cP.T.5......k.........Xki...x3..u...5....EQ.....9C&..6..vC.C..B....mb.%.0E..+.`..."x..u4'[.(-....[...IS'Q.l&k..]~KQ..q'.h....1.<s...nK-...j....?.t:M&.!....7_.f.=ZD..v...9.=r.I"r..7.....@..*...*..&X.K.a.7...5..O..........s..E.VWWM.......U.kX....58q..f,..H.p".R.8p...Q.c...oP.aH$...8.L&....A.^|.J..Ru..X...,,.X.og...P@0.......N....$.o_......0`.u.u444...../..............^b.o.ND..eK..4..n.. ...[.`.r@..x.*.$..C........yzC}#...9s...4N..N..X.z..@.H...-..E.VF.@...........'..`..n.

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\32x32\synchronize.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):2059
                                                  Entropy (8bit):7.884713691058794
                                                  Encrypted:false
                                                  SSDEEP:48:OOMRdNTdEqzcrus2KekXcU4WpvICYWH2RASDhhQq2ZYSMz:Op/NTdEEsu874WxICYfASDoGSm
                                                  MD5:516DC24F3EE5A9FCD4BB5997405FADD7
                                                  SHA1:0D97462B2AEE06A146C6A6AA87647788B566902C
                                                  SHA-256:2700DAFAA6CAF16BAD4D6683EBC95670B67E92EB2D2EF3F44D5A2EED8A8E2639
                                                  SHA-512:5397132F58065FB2914442A330B602F80A65FD8036E735BC305F6938437D22714C6410488D76A1DA309CD229B8930FBB4D3F4142582FB8AD0E267B927AF104EB
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx...t._...Q..&......Y...)....uS......$S.J.fP...}.,.......}W.....o+zs._1.k..@hz^...O7..@`.D(<.*.X..mD;QBx.+8.+..U.........3....j.."..O....... ..1.<y....J.z....DE...&.;vX..3g..?[1).....B....G..&......B..[.....(................%"<..."s........n.yf.7n..F.g?.A.w....I..Th.UR.Dt..A...G_$..d.....3......ho.D.<..O..,_....D&e!9[...:D.W!;.XkXQQ9v...k..+g......k.{.........4.!uzs..ec,......^$.PP.DU..U.}P6...(x..B.d.|D'.....mmm(/..5g.....U......S.@..#T..8.v..1...R......"Y..BU#.....Q...CQ..M.-l....n.....#.6'Xbj..o....*.......J.l.A..@l.FD.C..b[...i....BTR.*..P..ht.....R.;....-GQi....)A_A.Rc..K`I..p....[U<.+.C..B.!)O%......6F......U><<...I.h....P.................,......J...I.....5<.j>..........~../c.o4s....s.FS..`..br...,. .-@5.."....Q\..CV^.**.......!(...j.o...T...|....)..d@......hx...I.y..)..f$.v!M...!b.9.>..TN0......hD......<......H!.Qr..8c......T....:....s.(.Cp..q..R."<..1E....-HL...|xx.MMMH..`.I....uKv&.......qb..

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\32x32\unknown.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):2045
                                                  Entropy (8bit):7.895687206217452
                                                  Encrypted:false
                                                  SSDEEP:48:OBS2RHIZj4IgsrW4V+d8HSErk9H4HetAYBd5GTUFJdqvgO:Os2RMvgsK2pHSP9H4SfyTUlqvgO
                                                  MD5:EA15E0D9E67BA036C4583AA35E840538
                                                  SHA1:15DD3E2CEE29F34787CED98288557334FDE46BE5
                                                  SHA-256:A71C00264D99FCF1A1BCC2BCDB5B0F3B8CC7AE3EBB387C4D88B8432EE5CABE1F
                                                  SHA-512:0D06971C3C66A6FAFFDB35CBE937580986288FF505EFDB3A0B13AABBF36E1BBD9102F815D20F0834732C849A4720B47F686995E80BE073F865EA4056EF6D3676
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx...T.Y..wU..C.#....=.......g.....{\.g....+.#..Mk.w....w.oU....9e4.6..?....2.....=1.-1-.p...m....O....mlR.}D...-.Mc...c|.;g=?...7o..g.=V.*Z....wL.yg..zK....~.~.l.S.OL+.;u....<V.....s"..v_.27?..~..7....0uQ.}........E.......'?a.....=.My.Svw..6k.Av*+_.9z......*[b."^..!..P.II..j....Z.x..Af...W.1{.A.<.....P......d...s...!.=.EG..."e.f..M'...:...Hr..=....1v`....3[-&,.z..L[..g.`2.a...u....`&.^..#o.....@._.{.y...5.......S....68..!...[......nU...LM...d...4....a..CbB..6..C..F#.=.....K.E..|...&....=F..._.C.....VH....{t(>N...O% ..~.<...C.2$_....[..Q....4..Or/...L..a.u.q2;.sV.....t.:.......Gt.1.Z.d5.V?.}.G#..}./q..jP..>.p...k.y\.n..%...L.p..@..I..p.M........G'..#&a4.O...j...o............0o.Q0..M.h.z.......H...F.Zq"3../......ps....O..S_`......xb..,...%-.j....87'..g..!......rO..)..]..B.v..D.U..\..W.L......FQ.K.|&......]..CN.S..*.\C.7.TT......Z7........bi...x.*..[.c.6.y....j....y#.y..j._....2..Zu"..URQ.U7.. ..)..

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\32x32\upload.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1126
                                                  Entropy (8bit):7.76197553556176
                                                  Encrypted:false
                                                  SSDEEP:24:5Hoo09A8o2aUoSfW+kvL0MM2j1FoJ3ojxMP3UyWGZ4LrgnuZ:Gooo9x8XM8JkyP74L2M
                                                  MD5:25BC7296E2F6E9BBC20F50A0ED45D8EC
                                                  SHA1:2807BB2019D2A5F04A254B18D29E439DC75E06C8
                                                  SHA-256:76BBE1F83A136633E30FCFF0A47AE88CA4D149A595FF8320AE47A53722EFD408
                                                  SHA-512:276F503054E2B4E8F6369111A5421C717A36EAF7E8CEFCD815BA61E151D0D8C13F72BBFA08622ACBE589F6400705DAE3C81DF68AD748F28962EA2D5E659CB641
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz....-IDATx.....H..Ow..?.6.m.6.m.m.m.......6...g....7.*._.yQ.J...n..=.....d..Co....@.+..W..-.~....!..M(.........S'@).S.....;..(C.X{cU..S.....Kqy...w..U&..e.-....4...0...._.....k.#W.|sn.F{.)..K8..H$...?....g.I...'KQ..P..gu1.....~...Q`..@.w.A..PP.B.....NJt.:0....9..G...(....Y9.\.m.r..O.i...#=.5......-.o$`.J..sp!<.N...y.w\.p.\9..6m..M7V...he..E.`..a6.n..~...=`.ypU... ..u.+.LB..%.W...p&#m.....".Bp.f..f..T..q..[V....9.q.<...}8vq.....[..7..2K.ly'.Z..:.W.9...((..&..R....p....y....8c.".pb.~..{.^{......n...[..}4....}...a..\. \..\...C.Y......2..?p.! 8.Bl?..%.J.4..}../....fPh:.P.... .=...<..@..e..A..%1bz..Kg;z.....E@....oBUJ.oN...& .%.d.u....b...H8...l.......#...DS.`.......d2r....`.=...^8,..<..Q.?.!........}?.".AVB.YG:.q-.:_y2...9......[..9..}..J.U..Te.^..@..M.L.?... .*|.\...n..c......:.}s.4B...j<../m.f...... .U... .....*f......<v.u....k.......#X".\.<\.V!%..e..e.U9...Q1xj.......y...,..0..4.J..&o&.p}...n.Zw.....o..v.

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\32x32\uploadadd.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):508
                                                  Entropy (8bit):7.450638491357663
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7ijEDTbtWGwTa70cV33FItF5QirGBrTqgjsfvhSQ+:90sTWnFEDGdOmS5Sf
                                                  MD5:14D993A7709C9E5114A01AAAB315493D
                                                  SHA1:58FF2E58A01AED53205829D14E013891E67691D0
                                                  SHA-256:FB7DFFEE4A53DCAFB847B983015483198446B5844EC700D7DBF9C47209141A95
                                                  SHA-512:76BC3A90F205A31F798CD98A9A9C0A71DC286B67D90B6C178A5D9329CB05B1622BBBF2BB6A9157C04C42B009B81694C094F19235BAC17763E9BA58C77D26D086
                                                  Malicious:false
                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx....\A.E.....j3...m.6b.1k.u..m..m....emU{..|...*..U.....Q....J..E...}_6o.b.y...@.k.?.,...S...Q0>..C..R...5e{...5..G..VB..3yS.t.............(.......<A...v(0.!X2g,...c.....!.M..!j...J.D@b..c...'...a... !.. ...s...9...9....}..O......q..4....{.[$.A.S.*..9..!.iu......{...!.1..."..D!.$....w8}.yN..b.-f./.a4p.ok....95..=7+{......s..Vl~|ze#. @]r.).Vlc...R.:.....J. .....{....eMh..Z...$.Z..*...U.I...km.y..0..3.f....8.j.3.A....@.*~K.J#.].)....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\48x48\ascii.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):709
                                                  Entropy (8bit):7.564612361908848
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7x015G30ZW7iF7tG4Fwc4f2aTQEy+y07HqmCqHGUm91AgFxk9Ki1yEz/0YD/B:S+GAN7tXzwQ9+yUqlL99KgFxkt1yE7d1
                                                  MD5:12D8C74406C83D429F22171ADC4B7C69
                                                  SHA1:00B725F1D485D76AF564E3AFA4E2A21B35CD842A
                                                  SHA-256:7DC03B1EB21957A539D11D8DD73EA60FEF37F56ACEF5401C0DEE3DC06977580B
                                                  SHA-512:45029B351061DF6A5284D167B0CB8AEB0E88F227BACEFB4F45AEDBB436702E61EB620003292CFCC2DB4C93AFCE44FDD98D7674BE3692983B3F94C586F2E4E746
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.......1.....IDATx..7..@........$xO.%8.7..k..'.s.2..........b.J...vOO...H.p....K.F$ S.1..L....L]....K.."..a....%j.,.]....V..le.w....\.T.e..Hb...h...b$(.V.(.0.'.....}x......(....T....y.^...$8H.F."....z..1.a.H....!.}.{..t..x4G.d..98......b.......8.3...(. ._0.0..,0..T8..Z..M.E.G.WF.hD.....O.p..n...!9..9X..LG..K.EN..z...........C.N....D<"9p.G....Oq.2.).t.h.......I.oD.q..v...J...M....<....).............o.Q'..T.."._#.t..5.......C~....AnpPz..L..yD.9..w.........{E..8.....S.w..)......a...jh.0./0e.J..`xz/..s..:.%O... .I,0...3a.%P ..u)9e....&l.........*...t.......Ru.mv..Y.i.....%..^HU.._7>..W.}s.....0...0..e.....ao........1...g.#....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\48x48\auto.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):3958
                                                  Entropy (8bit):7.939912815756129
                                                  Encrypted:false
                                                  SSDEEP:96:zvfDi8+Y4SRfcC5nEjMoNJJ2OyDO0UAwrDOzB0kronSeEY4c8g:zvbCGcSEjMoL4GAuIo7EY4M
                                                  MD5:19F9B1196AF410D6464FBE5372A883B3
                                                  SHA1:73F8CFF476C2094075BD10D93E748FA85F949159
                                                  SHA-256:4F19F553355FEFAD7F97214FDC8D5E5F3E13BE39C29E0D1EA32729C215D8A392
                                                  SHA-512:449D9CC7B65D050B7CC2ACB24F948E90CAFEFC0867CEDA608B2DBA427F8A327AFDE2D5BE69676C8D3298872506DD52A516618299E1CD96CE681B2E8578111D53
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W......=IDATx..Y.t.........2....R...0.k..].1.qG.[q.B.T.6.'..7./...Yt..w..+g.....i..k..<3.....1h....&Vev,^...8...4..3%F..Mk....P....b?.r..,+....QX.f.X..~.nj..}.[...gvD.A.x...I...?...n.9....w......`-.. lv......S....f.......!!....=..0B.....&.x.5af....q..y.t+.8Mf#dE....F...;...qba\..o.[<Ms.M/:e.......v>..F...%s...)...z..n...*8...8.E<N..P.y...N.C...[X2kyvn.....A2I.&L.q*..:...........%c...Mv....\%3_.8p..6gg..=Y8qf....u........\..bq.i..r..#...).8k....]..(.G.....]....2.5.dM..9.^hJs..,,.>....qd......m......~(..g.............Sn6...r.........P8.#u>..!.=.0.....2.VH..w..;.l......i...=z.x...8\.g9.&.e[..O?F|...K...C[.0....7.@vv...0L.t.QD....;.p./..>@..b...{+..*.*NW0t-}M^.D...Vd.@..:...j.N..z.<.A....|@.|.Z.T.w....?*l......8.2...Y..0.O.....6...`.e.w...OU.*..H.3.{.....X.@...X.H.....NDC..._..c..........8{.'c....x.H....]!h-...x..H*.T......N1.:.|...4....P<.._...m.........7.85'#.Ix.I9L...4..l..}.T............s.F...3...?..u.g.

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\48x48\binary.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1143
                                                  Entropy (8bit):7.770380882141665
                                                  Encrypted:false
                                                  SSDEEP:24:x3uhV0ZUxZOGqBvQIF8ikLFZOKRfWHbi6p/zoUo1g9VDI5aHWEDmZwITN:x3W/0dv2ZfOsChzoUo1g9+YHciITN
                                                  MD5:766B3B9AD4A2C694C2A13A64793F58B9
                                                  SHA1:19C2898FFF76AA47E2A182521B9558D0112F2BF4
                                                  SHA-256:FC37900AC076661554F18A6F7D27E5ED6B7E254E945B01F61BEB0650BD2E88F7
                                                  SHA-512:32E93CEA74BAE9A329EED86134809BF8D596AA70DFD7717D91D16C6CE6E6FFA29EA2F98F9DF0D3FB4C81FD8765B14381D6807F9D15483928B097F28283FC1092
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.......1....>IDATx.....<M...OU...:.m.m#>#8[..|..m.^kv...J.I%..u.J.....}.4._C......i5.....N#.....N.b........Z.......R..zu....4...'....y.3....>.J.r...q(.R.}..d...UA........B.e\...}.(B...a@..8.@.................ut.GW..fB...}.eD...j.!.@.........W..(#.o.. "/.I......B..4`WuD.Bo...Y...Y...cZ~.Y.z..n.P9...D....\..b.E:@..D.o...]....{......&..7..E.0<.....d..J..kx...f.#..z.'i..*..u..y...=b..)..........\..]...g.......QZ..o..-..gk....{{O...!.....[j..B...".g.7...b..i.W..+.L.2 ...eDn...$....F.\.c...%@..9.\.d.....'Z.K.ss.s#........(.h.p?..}H.y{..N....u...'..] !JW....-.......ys....Fm...&D.N....s.......O....^%...2.......E...G........US.WKK.f........C]...:....w.....@.gA2WY.....#..P.**.A............`..dIk#..F.L}&...G ..4._.......T..jb...p.>.....3(...O.....FT.sB...0r...}... .N......2....T;.K..=..../'{...O..t..`7....T.5..>..3....s.....FR..?..}..d:..N....=Y.Es9`d....r.C.....`":n.<.Mal..g..t.!.....G.>..Z.?.*..'....N...V...../*

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\48x48\bookmark.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):2183
                                                  Entropy (8bit):7.8657371099779265
                                                  Encrypted:false
                                                  SSDEEP:48:otTG2TnhhfYqHMfino69VSE+R4PQrAqZDbF81mOQY9gRfkXE:otTGqhh/einoXRNlbF81v4kXE
                                                  MD5:F40C9D0076DA206C215C315BA0412A1E
                                                  SHA1:DB2349C249F1AFD8AC4114333C1E55A381D28246
                                                  SHA-256:E6E7A14AEC6963C787C6AA5FF142433154F7875825323E264A6F896C55CCEF57
                                                  SHA-512:C826028CD4BD023DEF747497A7170E69C38778BC9E6CBB6AD0660C56D1A35E0B0484E614F1648A2D8EBC9F010E5839285FC2AA28E10DED215AEFE5E1DBF3B896
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W......NIDATx..............|...0. x.0333.C.0s".333.-3.0....Y..Lgw..~.T^..__W.-..I=.1..c... x.....0..N.U....;...e........$lRw<..o?...KN...d.h....:.P....}...p...7.. 3G....8A/....0RC.ETm.....8lNb..?|p(..4.....v..98Z..r9..5`V.....g;..GL.Q....7......Y... k....?....c.... .....r.....o#.N..}.k?.n.A+C..q...............Ru<.....4v.X....?..8A0L..o.........|..:=.............c.6..FDs.m7s..1..;F,3....s.a..i.....@.s.j...X......h.S.....L.)....=.V.T*.....1..>.F. ...z0&`ee...yr...B.W.3..8.Z...j..4H."N.......I...u|...Z..U..x..@k...j....N&..D..>(...%t..,.y.Q......8 E.O.\..+U...1sHm..F...:a<W....|l....[....h]B..0..I j..aD..I ,"R...1..(g.....^V.l.@.#...R....:.=.....UC.6...,.....#....(=.2.0=.L#..$F'.Hn.@.c.`..Q..Y./.....x.r...r.a...0V.e*x$q\.4..$A4..% ....HG.A.t$.I..Z%...}.8z.(.....Q..|\....Z.A.`......1.".|..6.S.....>5....t..`0....:B.X. .3C&...(....9.D..\..x..'...f..?t./.....d.[.P.m.D. ...(l.."...3 &.d?..%..<Tt.."TA.1FE.~..$....?....."T."..p...%@.I.

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\48x48\cancel.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):2737
                                                  Entropy (8bit):7.904920179634178
                                                  Encrypted:false
                                                  SSDEEP:48:3L9q+zEvj2osZz81i/tDRmfAgvlIGIHkLLz5C9mz+gHOdV9jHKZeUkio:sf2o+Qoxg993/R+guHRqkUkB
                                                  MD5:1D8812ADBCE952079C66FD545C289879
                                                  SHA1:ECB48E63D0A96F4A2607B98AF55098FDAA35C245
                                                  SHA-256:014005FBB489DC11E0E778CAD03C090054B93949727298109B05F5EF120B4653
                                                  SHA-512:894F59993CA937721E66BD0344143862CC420049025F1629DB672E0BB406203C06A037889B1A2A80403728E5A6E8A27435187B80C650AB43FFFAB04F9F8AA3FC
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W......xIDATx..Z.p.G.}'f.2c....8ih.@.k...N...........fJD..:...vd.vG:..;.f.....K0.Q..~..<.....WV..tfp.....`.C.(.R`...~......'bp(...#u....4+.c..qY..<#w.......O.@..29...;.j.....S(D.#,.9a.YX;.N...../.,{;;..x.#...`...".........>.#'I.... ..:../.wt`.)...%%...,..x...ow.VT.....b....:..p.'...x....@w...e..z..{^....Z....,O/eV...d.xL#H..l.y...\EE.....E...@..bam.UO.._|....B\..1LD....E........$..8.&....S'...&.....1LD......M....D.5*.d...n../...F...+....E .m(..e..==.W]m!.._..:.$&.9...B.7K...K..d.$h....+..w-..[.X...a ...{=.... .G........,.........g..^....,.>...S.o...2.<..}.NJ.?f.c.:..KUBU.D.hGa...TZ$z...q..3e.......n".[x(..&........v(B8.z....c...V...D.U@.p...............:.../.......-......c"..r....g.O<....F..o.f0.......0. o.=.f....a...M../..bs.....7..b..E"(........Zh4.(%%.z..8(.x...H......g#p.M..!/...f......(3.....Y.lZ..+1.q.......w.X...n.....w.m...M-5...j..f.JKy#@.H......|..k2...!.O<.htQ7.:..5...)...^~.W..I......1.N...G

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\48x48\compare.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1328
                                                  Entropy (8bit):7.8086479793218695
                                                  Encrypted:false
                                                  SSDEEP:24:3vB9vF4nUICorkgFn+nC7O0DXyS35B7HmRQmDMTLhmOtt3/ibJPC85KYdyHnk/uv:3pTm1CQkgFn+nCCiXRzbmRzYTL0OtFVh
                                                  MD5:A092AA11A5F86EBF2B5241BEDD53181F
                                                  SHA1:2E57B77062B0639E517C1FFB1B4C35002EF67EE7
                                                  SHA-256:43794E4BCB9932D45C30A2FC560689648E02C3D9F7234221680144527EF527D0
                                                  SHA-512:2572075F4338C6E810CC83DD055D1A62E73E8272572A6CFBA32A5BF353CB8376A968591D862F7644E01BD092D506E29133D525CF6823B55FE0F70420C63AB3CA
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx..Z..,i...z..m.}...m..^.l.1..L._.f.M..s._..~..Y.:......_...0....>zV(..... Pv..T.9.)..}.......H...4.'..<.........{.r.F..0P.gE..9%...n`....T*.r.......F.5~...*..<..+..2...H$b.;w.....k...??'..:....C..t_W.N..4M.d20~.xc.ak.3.?..C..mb..^V.2.Xh4...f]G.....9r"...}..7......O?..........w.Q.!.'.IX.x18.3f.....`..7....M....f..(....3.O...X,..V.t]..rB+..k.#...y....R..q.._c....RL@C...Q.r....ygg.p....)S....iw.y...\p..d@a.Z...}........T*...+V..y...,Xe.U.S.N}..{..q.9....@.i......$0..6.=.......w.i.......66>..F.....'....uQ......-..f....H.G.m.m..T*.P...%K..;...9....F.y......A......'.d.+.Q.n...}5#..~.w..7Yw....}>.F..Q.x<........~...gz..`.E......Z......g...Lg....<........G........`...mt.}.%^....|.kb......X.?B.2.QFNG..V.dA......&,\.C..9..;n..m.}o..l.4p..o.dx.{.b`...OM..Q..l.`... .7Y.I..m....1...K.R..;&.W.eu...|c.3 .!.2.... .@..3k...e@)z.-..MW....A{5iG..#/....j..|>...;............L.!...e.}..2.y....~p.j......q.QkJ2....3.

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\48x48\disconnect.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):2739
                                                  Entropy (8bit):7.898208279576645
                                                  Encrypted:false
                                                  SSDEEP:48:LOi5QgunYUo090rBjORyDXJzFLmW+CYBEarlpuF7H7L58mHq88axlRxMBR/NAX6H:6i5runy09DIDX/mW+lEarrm7mmHq8Lxa
                                                  MD5:DE1036EBE8D46AB7707F81B71A0AB448
                                                  SHA1:683D88B41B50C8E64AB85E98610463CC53F94075
                                                  SHA-256:5D86F04F2D70B0B6394E9594E4BB969D3DEB1212B2B67A0EDD8458A67867A171
                                                  SHA-512:D5B656C24AA3F90DB3E4AA55AC451FB47CFDD5348C4EBF4999164FF9925A9B2744A7EDC3C031C8957CD90FA18E2733CF78B67315E05AA3DDCA17480DB9ABDF8C
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W......zIDATx..Z.p.H.}R....{.........-3333..333333.233...[......WuE.sv&s....n}[....J....6Q>.............R.Zk.<.+.!...........(..].z.....G?......#.:<.J.,./..E...Ri}.x..=...[...?...;......R).f..[..;<...Y.%..,...g.1..4.|..@.=...I.l.\&..J.......B6.#.#..x..i.`.na.k.k......,v....B..d.*KN..b6....T.cI@...%.&.#L..$.X6P.......D...._i.VK!.......s8dY.?{H..$J D.@...E.......($.r..q-......$iaj.f.E.q.....a..*l...d2...R.....+......cc..........(W..HW[7Zz.R...PJB.l..}....`.61::...I....&-..>G.j@YN.KN.lo....z))..z....%........>....9..|@%.....E....?....?0....e~..?...{l.R...."J*.V'M*".q..M7ILL..x.4%...==h%-&.]4.\...#.:b.b....t.<u.X\k...kca..}......\...IS#N$2. ..8..._....x.XS,...O....z.}.@zH6..`.5..;$..".>...k....._...<.<.wI..Bm6F...T.H&.....3. ...fh..U+$..m...TX.K..W...v...a.33.Xn.....m.|O.Vo.\....\N..%0...^K.VK.$..8......+.lI...V.2;* ..r!3h.4.)..".$.w."~b<.`+l....v.../...h%u.^%...}...0p...Z..%i....&.q.....dh.....J.s...f3B.Q7.*

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\48x48\download.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1801
                                                  Entropy (8bit):7.8529649753404875
                                                  Encrypted:false
                                                  SSDEEP:48:oV6FhXBu+tacF7XXsuKD+v+lx+aSM6qTvFqsm+O:BFxBu+DXX18+vlsFqsm+O
                                                  MD5:855E4A2B22F216296E1889D2E33727A4
                                                  SHA1:AFB12C6D49688CD3048F81237DF25A187C1FFF09
                                                  SHA-256:A83414762041356CD4AF6B82936626B558010C34886A4B6C49E4DDE51DF7564C
                                                  SHA-512:F6654497BC1BB8CBC8EEF126480C872FB85B2E74AEE0D2261E1342333B48E7F945C865B3EAD6970CA6288F01193E9282A5AAAAC07CECAC0DEB969C538B360245
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx....$......b...........g..{k...g.*dd.sOv.....E.:...t...F...\..\_..r{.O.m..a...b.ME.-.SKn.+.o.......I..*D.PD...q...../Sh..h..(.........o..Y../C..k`E..K..].q..?.G.q.....E...._.....n:...zU...!./~.(...o..<fx....n.Y..5..!./z.p:|...`R..O.|mx]..T&v.... ..V.>.d.m..=E..1.u.Jh.]...>.e..E.?.r.}....b..O..1.....!.Qv%./.....}..~.D...O.l...3..YRb..Yl\....A........".;..:3...w.........[..;..{u.0....S..V...........3......V......+y:..9._Ba..N.......;}.5...+QQ.-....t.......hR`....BSp.2c.r.........N.0...U.sP....T...<.?.p.....$@...6a.N.+.0........#..?.w.X..=.U....Ap.b......x,XA.z..{...,-.:wG!a.ya+..&......ny.J+.wBx.....G ..gVzh.g.S6.3-]@.~H....A..........7..,.....m6..Ux...2..f....&..F...~.........u.~.{#[.W`C.RH!..... ..H..u.?@.q..J.D.S......P.... ..B..!....%m....@x7.{Y..V.m..?..Hyb.....23....... ,.A.]B....t).n... .1........;....?...l%......C....zZ\[i,..>.v..p.b.8l.....8HxfkP.*.(...i.@...f. 6.(.....w...|..I...fw.6e

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\48x48\downloadadd.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):652
                                                  Entropy (8bit):7.573388378416767
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7YQawA9KZMHQ3/DM7PvqGowqiVdw7gwqUvlz5nZWpFJV:5Qa5tQ3/uPvH0iHyJW
                                                  MD5:B1392720DE6F62CC053754418ADE5AD8
                                                  SHA1:DDAE0F4376F3DCBE99A094C9A9410AFCDC0DABC0
                                                  SHA-256:54906BBDC39B746A9F373B3F58E63B29B579BE017F434110EE47147849B03405
                                                  SHA-512:7BC21473EBE015ECE58EE59AF5BF1B5669B0D17F8B92A73D5806D7997D85EFA82D729B68D51A0B12E16EB04C15011EB99CEF3E46F83EF04ABAC0B50466C6342F
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W......SIDATx....TQ....fl.(..."...... ..X "..a.H.%..@.........De%;......5....}..g...=..1?............)v...Mc..)..;W.......;@U..>o.f..qJP.OH.q............-@6......4c.... .J..U.?..M.`.0........{....kt...\.7.z.... ...).qE...{./.M.<a.QH.....r`P.....KE..s.Gt.........o]....;|.0.....h...HL].1.S......q..vXc2-..o.....y.[...j.y..J...*.V/..%$....w.%....-.......)...P...2.......{a..*"w..?{S~..s..y....>F..9.W.3......e.Y....y.q... .......V.|.k..*.p.d:d9D.........o..T....r.......q6...l..,k.0..pz..]..3......].a\!.>....U...p.k..|....I...g/]?..e.....'?.O(... c.tV^[..<}>...9@.3.A30000........1....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\48x48\file.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):709
                                                  Entropy (8bit):7.564612361908848
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7x015G30ZW7iF7tG4Fwc4f2aTQEy+y07HqmCqHGUm91AgFxk9Ki1yEz/0YD/B:S+GAN7tXzwQ9+yUqlL99KgFxkt1yE7d1
                                                  MD5:12D8C74406C83D429F22171ADC4B7C69
                                                  SHA1:00B725F1D485D76AF564E3AFA4E2A21B35CD842A
                                                  SHA-256:7DC03B1EB21957A539D11D8DD73EA60FEF37F56ACEF5401C0DEE3DC06977580B
                                                  SHA-512:45029B351061DF6A5284D167B0CB8AEB0E88F227BACEFB4F45AEDBB436702E61EB620003292CFCC2DB4C93AFCE44FDD98D7674BE3692983B3F94C586F2E4E746
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.......1.....IDATx..7..@........$xO.%8.7..k..'.s.2..........b.J...vOO...H.p....K.F$ S.1..L....L]....K.."..a....%j.,.]....V..le.w....\.T.e..Hb...h...b$(.V.(.0.'.....}x......(....T....y.^...$8H.F."....z..1.a.H....!.}.{..t..x4G.d..98......b.......8.3...(. ._0.0..,0..T8..Z..M.E.G.WF.hD.....O.p..n...!9..9X..LG..K.EN..z...........C.N....D<"9p.G....Oq.2.).t.h.......I.oD.q..v...J...M....<....).............o.Q'..T.."._#.t..5.......C~....AnpPz..L..yD.9..w.........{E..8.....S.w..)......a...jh.0./0e.J..`xz/..s..:.%O... .I,0...3a.%P ..u)9e....&l.........*...t.......Ru.mv..Y.i.....%..^HU.._7>..W.}s.....0...0..e.....ao........1...g.#....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\48x48\filter.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1285
                                                  Entropy (8bit):7.809843045291506
                                                  Encrypted:false
                                                  SSDEEP:24:3IEX8vZZjrU27eFYjBYB+PGMF4iVBoy0Ov08uAm4o54ldJZBWgqU:3jurgFY16+PfVBosv5uAaM7BWgZ
                                                  MD5:6895C926323D8F67FC625117AE5D2590
                                                  SHA1:C41DDD1E18F3E3C459E953C031D19261BE397CF9
                                                  SHA-256:0059D89A1EF5FB36359652B7B2042A422641F7810007B8DFE1A0B3CF7ED0880F
                                                  SHA-512:426E750658034E45895796CC1A544CD33479F8586BF38F914F8B06B7AF2F96BCBA17EE5A986FF9C8247FEE2F2C3AEA010C3346A8DE2355DC59D453F5EC20E454
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx....5W...j....m.6..........gF...m......d.9._/^..O~Y...3..;..$O%.TRITRkkk../.0.....g..!...J....`0H...c.3..N;...A..@(..8CCC..DY.E..M.q.s.U4..A.)........---G.....+....'...~...omoo_:...[>...k.Q.....^kkk...<...Oa@.n..6.2.~...7..........s.r.e+..{d...X...Vss..c.lN.......|....N........@.....gMgg.. .?....g.}.Q...o\I...V.P.....>...$...t....a......._....Y....f.m&.............&...F.B..g.A..........OpH,.u..{.'E.Q>W6>j.....W_.'..j..h.M7..^zi...../.$.(Li.[.p8L.H.v.e..m[......O@......?.........sV...r".p..qq..!...@..P..........T.......)........fS....o....Vx~.O..w.Q.d0.Au_..J7}..K?.I..^VV..NOO.J....}E..-|A...o.......*..........t.).P<...... ..H$..p..&...T.8.n.Ab..f..[..W.V.,\....>./_.L.5w.\..Ja..I...-....^VQQ%.3.Q....>.....a.r]....H...h..$...f . ....\.^G.W@...../PU..,.W..vn.1$...I..2..V...@.=...7~l...x...K...........4M>...:....u/.*8...t..t.....g..X.n.w*.}....UA..R......y.`...?....kkk..\.]..rX.&...B..._kJj`.O..

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\48x48\find.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):3565
                                                  Entropy (8bit):7.93195872640527
                                                  Encrypted:false
                                                  SSDEEP:96:7TdMZqz3hDWHE23fwYvVkWBosfO/2VYzNawN:7T6qzxDWH5Pw0asfMcYxawN
                                                  MD5:AEFFCB818F38E69BFD3753EB0F808860
                                                  SHA1:F83F5BD803C5CF7EC6F29E86CD1706DF746E1D8A
                                                  SHA-256:FC687FF2251BC921E99469FE061BC47B16D036F640672336F234F9218486E597
                                                  SHA-512:10C9E1EF18B9374EFB36792F9C28DDE110F6CDA2C502DEB98B8CF56AE9E624EB52FD35659FEC40A9C0CC03E7D42ECB848FA19E5940734016921641CC318E4B36
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx..Y.t..=.-s..5..........<fffff.23S....1I..Q......'...h,..>83.....%.-^....g...E....B\.1......T._.~..3.m.|....(..&......x ...@....f3..F.f..N.)......... .....#...g..E..f{...~.u..M..&....H]@L'..<.:...M....itt.;x.o~..*..}.C.&....oijj...1...c(Im.q..e(.V.m7..a..*].w...#...g....._9.n;..B.c...J...g<..l.......8.r...>...D.....!........p4..9M..3K..3J.n.Rqq1....~.+.....H|.....?.`QQ...=.yV..........`G..x......7..Z]v..H$..x.5.K'.F..p8Q..?|.,T.7...T{.......~.3....{......0~Y..?.9.g.........._.e..*..m*..7......V.9Uh. ...q8....=...GG..".m.............).../~..B.Z....B..x..V...M.V....._.s;].M.?P../.....Y..l.e...?.$......(u[l...+*.w..X.4_....Deee....W.,Z...;v..n...8......V....Ct.s,..X.-.l....2.QB.HF.....Q....%..+...xKc....#..?..c]].UTT4Y......F@...X....E.i......1.cukq0....5!...m.0..."]..D.z_h.....lp.....#_.C[&.L2c.7o...w.2.....N.s+g.x<N?..Ce%..S.-q.t.B0.\Nh.U.,9"..lVHZN....g.%..";..q..~w.<-../G(......(

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\48x48\folder.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):2011
                                                  Entropy (8bit):7.872260719714297
                                                  Encrypted:false
                                                  SSDEEP:48:xJXo1ikxVG0uJpbW4E4e4lesPdhw5qNAAbk7y5tF0rOWkETH+p:To1iaG0sBlA5MAukWtvWk3p
                                                  MD5:9DC4CB6833ABDE58A8A36D4044BA8C47
                                                  SHA1:067268B9FB04E21B232F76A27FA8A2EE7748D92C
                                                  SHA-256:7F466B49D6CB2D881130CDA76EC35C22C6396F2480FFF80E27034A3CE74CFCF1
                                                  SHA-512:327216AA6205AAE9D2A4F346DB02CD1CB7CFDC83F5B7AFA8644178C0B54E542B31531AF7F7A953DD8E788BCF43940AB82D7B3139537D7AC1FA98B6762E9EA2AD
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx..Y..$K.=U].g....wp'...f.."..m.o..3.m...'............Q..sn..7...0^..E.}..4M.6..'.k%t...:..a..P(..A....p]7".........wN.l`.h6...b1....].h4 A.lh..@x.;..:.....8......."~._dA,G.u.]W|..u..m.H....W.........BF.+./0..y.6."..-..msc....LLL........... L.....crr...7..XZ...,.-....f.B.P.M8. v.....8...("...q.d...J...m.5.......-..a...C*..Ja.=0..-.....\........333..-.*...Yg...l..[.lYv.}}....<gzz..q...&.$..Y...Z.A.....7.R......O..z.".....6....mJ.....M&.N4..q......).......f!....e.\....L&...O..))..q..<.~......`..}..=D.;89$.....g....O.ZW%..\...........T.>...l.....f;.9].$........_O..@...u....{..\JP..Ho...{.......e.W%.HJ...E.\.<..8|/....}.o/.FFFz..".........#.u5*+.../.9..s.v..7@..........X...nE.../......_.w..../..O~rT..h...V.`.>......o."..k$..[.......xv..$.......R..z...{.1..U...^A.]..)..%.]`9p\!.Y....y..}.S..y.k.........._.........[.G<....La(...7?.....O..2>.-.1s.....Og.=>...X?..Kp.....A(..~.h.....vD1.*W..N..

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\48x48\folderclosed.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1437
                                                  Entropy (8bit):7.787810694653926
                                                  Encrypted:false
                                                  SSDEEP:24:uk+Wjt4wxuBvwL27+f9Ogw473fOkX/AlfOzLbAu9RHhPo5J6b4J3ON/hP3wXkdBL:ud3Bv9kw03PANOzLU6aXV3yhLAaZ
                                                  MD5:A0AF1E29C481A5DC89DAA6325DF07DB7
                                                  SHA1:98B1227B4251A6BF6C30781C3282ACB5449792F3
                                                  SHA-256:7109B43596AD9F909FA79418C800783A4F32DC05C9613911BC721952CF1A2116
                                                  SHA-512:B14CE42DA80535A7576581B61A30E92C1459307410F7D269CC7593521FF1AACC5A602018CBA26AF4C6810F09E091B05171825CAAF79B171A03D051CC205ACF12
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W......dIDATx..X..+U...R/..1..w.......<.C.w..N.ww......k.n..{.....$...L.{v..X.........bk.u.....bAp.._)..~......]..!..}.1.$.-..I.......?..g.l.,....<.?..n....Fn.....SYo....o]v.e..v.m.....a...:..$.dQt?....ZK........B.!.n.sC.............0.$L`ll....N!+A....^x.QB.........e.5.;....@..o6..O..0uco..F.Z..u.]..j...R.h....../.xmf...DgQ..Q.a||.###<..BQtq?..3.(....>W..*I...,..$O@J.'...Ma..(......tr.cl...P..L..P........_:..F(rA.p.W.0j...t..s...;y.}.(...{}.]v90..4.....w...R.0....1..%...0(.@.../..w...@...1..<.#..........XA..2..w(+....h4.>H......O.a..@....U..H.$...R.L ...U..v..',,.X..&.p......Z...Z..f.R-;.J[.G.H.b.@.J.PJ.{..gA'F.Z.`Y.X .... J$.53....N... ..D.U......Ts... .${......o...D...^B.....X...Rk0..&L....u&.#....Yf......T.....RJ...J.Q.VB....'*..N.p..-...{..p...Zf...B.q...b2|.A.H.#..P..>.0.X..=...K.\...?p..R..;.f.......{x&..=.`!.."..2ZX....X...h1=...V..&.VJ. ....-P.\.*-....6..$...Ti...S..J.......5.....f..`........N..y@J..

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\48x48\localtreeview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1832
                                                  Entropy (8bit):7.836435017394182
                                                  Encrypted:false
                                                  SSDEEP:48:aYSwcXruZoeFp18yilYBsLjn2NRPOQ2nz:7crlG18pl+sLj2i3z
                                                  MD5:7D2D8047F89E29A825FAF45C2476059B
                                                  SHA1:9E76DDB93B99BC6D3FAF75C87DBBD23092E95A0A
                                                  SHA-256:EC08DD5D9D04F4F513076915F82A1C6FB10A77B20FAC118D40307E545CECD875
                                                  SHA-512:611D3D58707A87FE2CDB4F9F1DD01AB49F585C630F83D0BC47C962032E34B887DA284E1BAA4027C284F3B8241C2B63A200D838B8344756495C39FAE7BC27C069
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx..X..#...!..1_...I.03s.aN~8.0. .s".33~....x.1S.[2..._..lI.=<U].^..{......a..|.+.%.|.;>/|.?.y....7}.;..C..?.A.z..Ck.c... .N...8z.._..W..pd7....z1X]]E..N..'h...w..q.K/z.....o...]!.c.;w.EQ8.lA...p..,,,....;..<v...uDD.EX^^....Ht.].$...t\.h..]k......;....~..... .2..#.^.:..|....G....=O.s..y3v.T....|.+....+++$B.#...v1-..6..E....~n.....I....._..^..=.u...'.y...J..t..#?............]ye.N..(...D..0...T..1.....+..c..u..t.-..U<.m.@..`..........%O8......`..6.P......?\[.?..v..[F._..i..$..?....u....t.Q.rP@"V.....>.......3'B.2..}.wn3..9 .....(...+cl...?....pb_.a......iY........$:...i....gl.B{H.......P.....!..@n.hW....P...Y!....c.Q......X.A4#.R.l...v..._......s...a.(.`..2J.8..Bt.a...n..f..>7?..]w?..}.q.#....B&.L...zh.>.....:.\...:..~.n.Rv.bxl..|.uq...c.@..]..?.~.+.%_H..AD...P.j....+.8p.....{m,v.s..N3`..F'.@.i&..Z.....i|.O..?]`/O...w...y!$`.g.0.B.@.3q_.X>.T.&.F'.p..."A.J...4x..:................B...0..~.<...Bt...N.E.

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\48x48\lock.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1323
                                                  Entropy (8bit):7.7819321259479795
                                                  Encrypted:false
                                                  SSDEEP:24:3XGHu2/uhTvM2r/aBbLNZzz2+9abp/xvqC9cYJ+cYDzq:3XGHL/4TE+ObmbNxpBUR+
                                                  MD5:F6FBCE451E7AC370671E65AAAD372189
                                                  SHA1:900EE8307AC237BA73B0E690E54DD38182D4DEFE
                                                  SHA-256:48B2C9C4743ECB6FBB8B6A22C3E14984441436D25AAE37EC88169997234E55BA
                                                  SHA-512:7DB00BBC3CFDAAB8C02EC71B3BDD2BAC6A768B10D0AE794FC4DE2CB9467F2D3E665F3AB4310CF896C305A868312255AA58F520D6945F476393416C98629BE66F
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx.b.....`..\...+[.p.s.~.={..zc.._.._..#s.Ul......lll...........8..........1.fEFFr....KJJv...j.H. Z;.1$..33.r3.c;W....'..'03...a........j......_4.N.{..%.p....'O.}..wQ.\......xxx..}*...^a..Z...1....)..z.8N.CH..c..k.}.....cccb..H..P...y.M6.E...ss.../>..Sg.).E.K[.nm.....0p^.....bQ2.....5...5....h.,jnn..].].HF....{...R....0...A.A...,./x.....!...<....RQ..<.....1B.XH.....>....\.t^.^.".o\..W.B......I,.:..B.8.....twwI6..j@C.......".v...z..@.}.UD...y....FY.t..Z.Z.,Y*M.M.....<......L!.JCC.....Z.}..=r\v..%[6o......{.../..".H..-!@H.v:6>f.7n.$..@.p.B$d..Vwtl..O y.....9l%H.0~^...WZr.|^.:..".do7..P.0....G...J...s.a...QMM.i.....x...<.|.....TE...3o.}.).y..Y.W.1../..B._.$.B..,...Z..C....F(R.G....\V.8..[..$..x.c.z...I%.Z.]`..mN@.J..H2NQo.........Q.%.m6.{].%...Fs2....9..E*q]....!B..$...Z/..:O!..h.C4.....)<=..z.......H.M.0I..>t..3.s.v.n....C..5..v.<...Ak.+...6.!.E..A...=..Y.@)...LH....k.jl.K......>[6.....}@'..v.E

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\48x48\logview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):3078
                                                  Entropy (8bit):7.930833999366633
                                                  Encrypted:false
                                                  SSDEEP:96:5EHMnuAX23rN/T5S9ZoPcGiqiDTJgCGHD:5EbAX23rN/9S9Ie5gCGHD
                                                  MD5:9D60501A8CDAC3AB34C8FCA4111F326A
                                                  SHA1:BC6FD46CC7BFA1A1D741D8399EBB2DB033DD2B62
                                                  SHA-256:C399A092C5157509775552F82E803771823285DB96D97F1AE23956738A643249
                                                  SHA-512:E1EEBFA2DB3BFB6688DD7F28C99F387CB9DA40725CF2E6DE841E1F674D30F13626FAD2548DC96C6674C11FD73C65FA43B64066CC3F8D3FF41BAAF661F732C839
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx....,...U..Y..m;...|.m..w.c..;...Q1..w..<..b..UY=...uQ..~.....xwj.!.r.a...p.e...m[...m.E...k.X\..C.C.....|..x..'....L....1.v`./.?...x.k..F....=.....g.r.L6.....;H.Gp\..n.ym,.tB...G.I....f0I.....@}.}.o~..Td/..Mo]\._.?.. ...U..r..L....^[..s..E..V.y..?.3?..l......_.b..x....x....l7.....f .wj#.xr)V....3.FfB.dD.Y...S8G|{.F........O.-o|..w...w'...8.....|./...sPQJ.l.m....q.~..U......g....B......_..#.a.]*...=......3b.......S....V..(i....%.R.. ."..V../.........,..c.]..3....TovI.c..".z....P8...Q((.........<.>X.....Ji.e+cm........../.....SkR..:.A.2...Tk......B....h).!.m.0/RN..?.J..{8 .........P.D.K.V.............m@.S..d&..'\.3.n......A.s....<@..".".uy....=.M....6..\.}.PHgOV..#Z.i..)..P .$.....<.!....R..7u..@.+$........D>.H.0.qd.B.g(....p...i}...w.....R...i...d.........(.$..'QeFqx..9Qbe1.Z.hm...E..bE.7%...x.9..ID o..^B.....J.8......T.P..E.;Z$.bfk.ffb...s.ZV.....k..L..K...17.{<q....[t..P.....

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\48x48\processqueue.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1390
                                                  Entropy (8bit):7.810703822240352
                                                  Encrypted:false
                                                  SSDEEP:24:FAQZHazTuRfJSnI0RQ3ThXdw2anL66jR7nVwaq50CYKqXf0tEXuHhL60DC1:2INJSILjUPxq5nYK8f0t7H40DG
                                                  MD5:9DDDFFB20FA0247020676B3B7A1B7924
                                                  SHA1:E5864D06F8F5F9A7A4F16BB5A091A5B1BC7B04CC
                                                  SHA-256:1268FF3542A98272B712FAB43D6FB0FCB11BDCAEA087E7F336D1E5803AB87D23
                                                  SHA-512:C1D2E3ABAC927D3460472DD084FA4E0208B23A4A7E69E47A93DBEDAE279D841CE0CAF1E5DF08518152FD0B774305EAB27F5A8D5622276C53FE1B7D589829C57C
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W......5IDATx..X.teI.......=q2..Q0.m.m...m....M..._.........7.p..7..J..%.V.x.oXwd.RE.pb..9.m....@].f..d..M..!.....:X.d.9 ...V.Z...J..........<.7.:,........G...<a.4!@*..R........sv..fn..|...$."...Hd"J.\D,...........v.4n.p<.....R..F.B.F......5.....s..U.r.(..H....J.XmV...#DD.&.hw.\.r....s.h.Y.f.3..*..l$.7n^s....Z.n.*....g.^..*[.\.K..C..l....k6.`.....+....(Q.l..=.5j.`...?R.(.(c.P[.-f.\..'.3....n.IH.5=.T..|....c..(..)gT..t9...Z.m....~.....-Z..%.........e.Tj...N.....S.T..P..Q!./_......w....^%00.L.~.......f.p45.j...e.0r.p=n.....lH...H>6o..!.......g.^..O.2..G\\......H......`.....1..j....1...o..~.o./T..f#.@d..{..m.#F..ILL.....5k.g..m\!...,Wr.U.o..#...]....B.I.H:.....>.....9$,.....@..\..u.<..:..+......*j.F...?.f....;. .. !!..{...Y.xq..+W&...={<.B.......9.,...AGi0..?..<.7Z.l6...L.{t.DDG..s..].....d!.p.gXx0.Bd.Y......{..E.....X8....m.zw.GG..v...../..o_.?.=y..s.pN..G..:..W\...R{`.v...v:....ggtL......m.......7..

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\48x48\queueview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):2263
                                                  Entropy (8bit):7.888034327189823
                                                  Encrypted:false
                                                  SSDEEP:48:98SAju8Kem+/RNtZm+f6Hdm2tsUcxHCOYi55IIlaM:fAju8jm+/RNtT4w2tsUAHCOYe5IIlaM
                                                  MD5:BA3DF3C0BBE4CA44738E96B70375532A
                                                  SHA1:3D6914353286A62D1951DE5B44E411F5DFC8F612
                                                  SHA-256:A1CBFA558A824E8E799F4EA0CA9CE1C8787F107BDED6A72A3F60C32B6B1D8F6C
                                                  SHA-512:F2FEBF0752B10594CD485BD521DBE10BA69A615E28CCF00C98657587A05E7BD9F5D78FFC8C2866AFAC7E877E6C0A4B1750614C7EE2714EA76ADD1FADA20200EB
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx....k......$.c]...m..l.m..m.xx.dw...u.k.....Uo5....."..].q0...~......#Ed8...... ...".j8'..v:....L.....J.......E-.~...<..'..m[..t.R.....C...j\........V+..|.c..]......#2......E...1.8.l6.y......]....>....4.?..~.u..............o....?...(<?. ../[r.../.###.._..Z.q]0...EQ8..gm.|..l.....S,.X.|.i4......\..k-.....;v9...I.Di....k....(....z.W...=.....h0.z.>'.h.F.B..W...Qh.z.;m+#y.5..'.mq..{y...^..E.......BE...>.J@...hR%....O.8Mv~V...Z................9....D....."...R.H....&..yir.I.oi.O......c.....E..|.DzwU."-5;q~Z\:W....B.%....)@..FG.!..cE......J&..D..BB.............6x...q.:\.B..H.:Kd".}..R..Z..UL.B.g......Zc.z.B.^%..T..&'..1..&......k'J).....x5X ..H...FS..q.R-.6].&.mH...#..........".'...$...ZA...0.]$!.,...i..N,.2.j.Z}.O..0....r....#....G..%2..X.c<a.ZF.R.:Y..-.^.&.S....F=.bi.b.@.....o<.$.-._...l!.$....(..C....x$._q6.]x&...\..b ...T.....ST..Q..s....K....w....H..|b!.......J....`....g.C8.S8...{.Nl.

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\48x48\reconnect.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):3129
                                                  Entropy (8bit):7.90590193685731
                                                  Encrypted:false
                                                  SSDEEP:48:Le9Z9J9KIDb15a14Y+enP33yiI9kKqqw+HZ140TKoWnY7MldA7UP7x8KLpeQ:Let5DR43y99XT5pTKoWnmMMit8KLp5
                                                  MD5:BBF3CD5FBE19966EA81451A29EF3E623
                                                  SHA1:2822295B0AA92A0EF995940E4AF70CC06C4000AF
                                                  SHA-256:757A7823E97501926C27AB77FFF344C693FC842896EF35F2CE8985942B1FDAB9
                                                  SHA-512:07A12BA043AD4A0657CA0617E693F5479D4F64D424720CD16A9E7046E384014739FF9B5790B660E8105515255EB798ADC57B8878ADFDF505B5A7A82B19D13110
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx..Y.t.H..$c..4\................\.^/Wn.fY...v.......e.(Z.o..X....G/..{.}....h.4....9..r..Z{......Ikk.<.6.....V.w.}w.....w.u'?.Lo.O.t.!:.H]..;.^..i..............c.....e.4.xk..5d..$........a...uD..B..;4.M'.".........;....`($5ZbY..+....s....q............K..P.@].ZD.K@...;..f4......Ioz.U.x :k@..t....9.TV.4|...yf.?#..@.....[.p=.. .......S0...<06..-.....I.O......s.Q...!.*...:b...#:fPR`"....L..8N...@.G.......4...T."...4...Of...R./..r.S...F.?..X....8g.B.........<n...C...RI.a*e3.d"...J..(...Px+(..X..L...S.....q.U.)..3...\.8L.&.m.!0`......o.G..5.[..H.....!...>\wO.!.(..{...rL..%.unJ..EEpl.x....B.[w.u...h..a.rDS.....1.y...vUY7.. 8...Aj.8..#.O>.d.G......D.h.r<..B..&..0Tw5=.....5..........p....R]Q.....]G@.i........X8.d2..g.~./".i.Y(**DEi8......KV.!.L..5.....]...A0. ..EaE;bE.....z.`..b.AU..Y....Z...pA...<...i00..Q.v.@@.j.`(.]..'.*...6..aI......uXt.a.N.,.B.u.dT0..8xg.)..4...".T9....@..h...av.a.w....T.#....Z.2..u.......

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\48x48\refresh.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):3213
                                                  Entropy (8bit):7.911617835298954
                                                  Encrypted:false
                                                  SSDEEP:96:E43eHy/MWl3Qen0eqQDYGGqw35lemxDpRKU4ek0X8m+:H3UyU4gew2VO32mxDppam+
                                                  MD5:921395EB0850E453CD56C468CE2A28E2
                                                  SHA1:DF4F292AE783C2CDE7E54D7D988BEF671080FC93
                                                  SHA-256:249A51F84DFAF1B86E10E08C7430C18AFFFB6BCFBE09B86EBC6B727D7E6F3FF4
                                                  SHA-512:8F0DAC6BADFC43F79139D4C6A70EA73CD4725073E32FEB624CFE26C4F49EA84BE9AFBCD1BC224637DC4A2287EC843DC23A6B689F4B23E6DA1009C69D3E0087AC
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W......TIDATx...t...._."S...t.%'L......ef|..L..sx0...'3cf....V.....e.xy.*7.u.~E.*....E..V5...Df-....Y`2.p.%)2.=+ ..K];..G..6./z.g...?PUZo.Z4Z...eA-.4L"......GR...1....Ma.........7=......o7x....}0v.....^y8h}..../_>.X4w.Q.. ....yS......#..;.K...O_..R..m..D..mx....G+.....'$..'.y.X...?......s#/^.... .7......B..p.$..,gE!..k...w.X.@,-...cuW.W.dU.%.B..#.......}!.....\..........A.?.^..{.P.FW....=......]..=..O|{...;...M...{....o.{!.ZS.....myS0.}...X.....z....&...\@......1.."l..w..mx.yeas....'?~....#.....Z.}.Z.T6'ZA..y..K~..BS.-..}e.*......\...A.z?/.QN`zppA..3h.-...qp...w;.ue..-o.M.....n.Q....T.B..>.........(/"@8...R..BH...SW...`..s....................9V,j.*.5..^...&.l~.z.+...K..z_....us..=.H;8{...jm..,).fW.T..9.....UJSc..P...@...n...t.c(.A"...1..."D.t.......u..Q....M...3SS....N...U&$....2u.......|...M.@........{..3.w...Y.5......d.c...\MN........$*.:.)'..8.T..Pz....._...r.@..V'..S.2H.5Ua..C....c...1...'.......T.=......h.)..

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\48x48\remotetreeview.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1947
                                                  Entropy (8bit):7.843487140480695
                                                  Encrypted:false
                                                  SSDEEP:48:u2zjNFcZSef/TDVlR5L8X73lMl2sw55iNUMP17jNc:u2zp+ZSAhdQJMl/45i597i
                                                  MD5:6A49987F2B96B59D2FC706332F2266B0
                                                  SHA1:16C8552344FFEC1410E5CFA297A240B44B4EF24B
                                                  SHA-256:729D421F2408A01474619BA5B29CA72A11B98217EBC42E21EC719C2A5451EDCE
                                                  SHA-512:EB6508086F19724FCF31F3F79595B44983A6B0386E08C4FBA2A56E4C50DF8CD5A32F6CB43C5F0B3D5729EDAFB18A3BB2C5873A61CCC0247855DD28E866AECA48
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W......bIDATx..Y....l....03333333.(......+.....L...e.$+.s.*.ko<..S..z%yA.V.'.2...W..k......Z...u.9c..N?...`............!M...M,,,\.g?....\~*......ann.i...$\.'.k.....!...^....{...-.$t.e...<...N"n.i.`..A....._.......!.........D...'b....2/w.$I..X]].H....A....<.y.{...v.4..?...2q......m..r..t..\.+.-...%/y.....E.E..b.$...}...Q..>....O|.9.z...........t..@..p....4.7...'.{...e...7.@F.{..a.v....&..H..r.c.....|.`y3...XZZ...8t.(c.....n. ....N.z....^.Y.O..o/..e..5....I3..R`.............M{.,.iL.{...?.W'.&..-g........+...+.........._Yl;\..8h.......o....v....@......_..........\w..Y...`....f..A..i.........U.e...^.4....L.i...3,......hW%....+++.....!.........<W..0Uuh....e.5.......;..J.1m2!/.....1.=2V.k....D.V..f...B...A...,...w:P.%fff...}.q...]%..y.X...a.i.....@\(Y..S....*.k9...U.~=..jZZ...+@k."....0N.(.v...z.*!..6h..\.e%..wmd....=:Ph.a.`).;F.+\.+...<....U..p...f../.)m7An..59X..5...N.RY..k,E..t........=....HU.Z.Io....Q...G?.p3..

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\48x48\server.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):680
                                                  Entropy (8bit):7.64523889523795
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7MD5TGTYY8/yi37n7BLX8p5lRvThVA8dSk5aDFPu71jBn6sdSSGt3h15wq:BlTvZb7nFsHluoax0Bn6sYSQkq
                                                  MD5:B4800FCB5C8C98703E7F285699CDA3BB
                                                  SHA1:AA326363A5B4E692F28EC561B68B17AF80112394
                                                  SHA-256:48506E6C4A09E27100C0DB5C789D2EB1780DE58EB5EB752843600D5CE31F6327
                                                  SHA-512:007B67005DFF1AA7108054882CEAA17BEDEEAB03396980DEF5307689852E0E799E11E50C5BCC7D12DBA47B9D9E809E03E869FA14BFE10702C9D7AA7EC198C83B
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.......1....oIDATx......V...o.i{m.m/...;.\0;..y..N.l......l.Us.k|._.5O..,.U...^.^'.>...e.c...+ORB..}.;[.....6.[...U..FnZ...>...~#. ......!...(....7..#@}v...M4....Z.c.C.I?.."....`.:.m.qd...>'.y.?@......= .=..3g..in...$..Y..$9{&...U.....L........x...4G..}Hp...8P7h.!dA .#.& .S...=o.....2..G..o.o..m.M.0U.W..V`.....g..;.w..'._...Dz......l.......q....@.../.@S.hz..8............(...R.0e.}F...&..J+al....W.;?q.......s]E.....0.Ut.?.'..........8.....7C@..).Y,..H..%.fh$.d...,.....k.c..b...i.x...........oj@.2K..&..`..Te.(.<...&..rJ..X.L@a.&..P....$.6.fWh......"..6..(.^.?..:.(.D..G1L....h.P. S.(.F...#..R.x.X...1.........IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\48x48\sitemanager.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):3173
                                                  Entropy (8bit):7.932886055544201
                                                  Encrypted:false
                                                  SSDEEP:48:t8JbBKKxbmOCJmjz5JuVUjxmOKV4JxfgnUmcCxjTALHHxnRbD5mP4kMs3qMXUQxW:WJb8KxGJmjuxQvf8lcEAbHLbDcU0ZU
                                                  MD5:827439559343AC93A533E316063FDA46
                                                  SHA1:8B9338C600A4A990A21CB34D8D5CD4AC72876033
                                                  SHA-256:613A8D75E343673290CCF90BBBCE2618351B96145B84B74B75F390A87596A9E9
                                                  SHA-512:6C4B9F2F8A3D19FB9BFA80F1925D5B6886178597C812E9AC129B416527F62065F35F3DF9DC0A8AFD19F177E59E58B48734F6C19CEA864CFD17989609095E5CD3
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W......,IDATx..Y.t.8.v..m.8............-33.0.lwxJapl...Nt....l..}.)...\...n.}...pII.1..v...sX.%.\.Y....[..Y$.ht....x..+.{.wuu.....q.\..d.-..}.XY......UQ.._4..W_;....+..Xu8\.z.W_.../j.Z..i..T.Wl@...2.y.9g.7...;`....*.*T...]........zU..+.Q..t....q..H$..S..`.2...`i.}C.w'.(J...+......X..H.......D.s..9..5a...^..O..#....Tnq.&.....(...*.( +.........n.^....!.$..\...R'.8VpH8.....a..-As.,..e7.D.4.....>..C3.._.:...r..5.5...A".F*......GU..\.k.n...`..=...s.fr:v.v{.W..k .Y.Y.x<%I.P....#.L.....w.d.j2.0=c"..@.....P@..c..6.m.cU..g..Z..T...=.(%E...;.Pu}....'.}.......3$R$..I...`-H.\..4....ZZr..... .Q^V..0%)......m...PE.]U.<YXT.q....~.4.p..........0..r....I.V...z.l.....+..a.Ux..%..T.....Te..b2[..C.X<..P.{p...........y..CBU9....a..3..3S.T.@...^O.....QVV..J..]&.P.l/.<.@.bb^.:..e.h4.Z.2....G.K...D.DU.h..+..f.@s..(....\.........@..5.[.D........d..T...CX.B..z.....P..D....%|q.@.8.y.},..M&.:Y!.......w.X/$p)...XL..#,@...G.,...l...X...".

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\48x48\synchronize.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):3700
                                                  Entropy (8bit):7.93242842780909
                                                  Encrypted:false
                                                  SSDEEP:96:nMrGWYGc1WwoV4BxcbizqJWjwrp5d6JIFfw+:nMw1HoLb8qc0V5yIFL
                                                  MD5:348FCA67F17E5E83D0126DCFEB12B782
                                                  SHA1:AD4BE19618E2C6DD460A83B092CA6C105DADCBD4
                                                  SHA-256:AF74F84098611387D43535436D4768E2AA3EE910C21F26328295EF3443891805
                                                  SHA-512:2D62AEE1D0E13C16DB42364B8F71FE466B44160DAA4375D9BC457BAB7EDADAED50BA28BE4C1C66A197F745E2AB2A9C381D91391F15D85E8E15A53B4917F354BA
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W......;IDATx...t.I...jI.d..S,;hg..af..,.0C...cZf..e.a.pp..2c....uW.J..DK.e...S-........o..~.|.C....y....;<.s.W..../...C%.W....X...{..s....s...e=~k..{>...~...[.!m..!.gA......YH..%.!..P....-.-..1@.......B......#F....5}..G...47w...z..y._....d@}........~#.%K.......B..., ."6`!.l...?.(....o..sZ.;.\..I.....F..d#....zBaI.....-..{....d.....?6o~...~.H.....de..v..e ...dB|.-X..............K.s..w..m<.j....-.......DO.K.M'..<.:%.&1`..cx...H...9t.!..-[.|..Pmm ...J%..... .@..c..i.7..3...P.PX..F...]..............GAA....%?.g b2|d5c*.X.i+=..`........e....C.I...l\....x.-..k..o<..\[;$)D....^...kW._...k.#.7?...#.O T...e.0..5.4..T..~..?......l<.A....-.7y6...5o.g..Y.L.Ehp.....b.P...FN..P4$.+.\....{]B.........!.T..>...v...Y..qj..:..Qb?`..../.n..'..B....nQX.GG(...R&..EUp....@.S.]..$8.....@+..:u*...J..r.,.i..s.M.] .X..........0.,...5...T..........'j...NO.[n..7N.6..%3k.....c'hhj......k...G.!.f.$?..{.L.]KgPZ<...K..F.\.|.55%....?..R..a...n.0.....r..

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\48x48\unknown.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):3235
                                                  Entropy (8bit):7.9283984063588
                                                  Encrypted:false
                                                  SSDEEP:48:FmlNjx/2qMfRjwKXrr5VrqEp9Kx5VpyVeK0Pf25+LqTrv4tSZ6L7OAF30:FeNhYt/KlrbyVeKQf25+Ar4wSJ0
                                                  MD5:6B99D53FCED3E148D3EC6DEECA0E4D95
                                                  SHA1:407CBAAEE58505A77D85FAE858D9F9C93E9C3728
                                                  SHA-256:D8D42A574006828DBE3C430D2035C5ED6367443F962DF20A6A8106CDB9A3AF25
                                                  SHA-512:6F07A603CAC51B5481564FD90893E85AB20AC8CF371E53C22D864A79ED875C704FB4D1FC77F59D3ACF1C042160A6F3669DC0716D225109D8B6898D58F685300E
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W......jIDATx..Y.t.H....S..b.....L.?c......3/....-.b..R..vlk...Ig.z.c....H.|s.7.H.........[m.O.8.>e....-..'o.J...J.Ke..............7...}.&o.sU.)..=...3./....#..y.....dI~..&".......K:;bO....L1....z)Y=.s...o}"'..0.....FZ....gr.....J,.../|.j....=..*?...........v..#.x..{.d..'7.~.....\_XR...{.QL.......@.....lJ......rJ.D..-...-X.w6..#l..o../..F.B|G'.?...l....ng..x.[.~...>us..&B@.......,%.xi.m......Srp..k....Q. ...?.....).:...K3..k.hhx..d.=.q.......y.......jL:.d..^.wl..9.|..._..`..T...k..<(..I...PV..9c....mVeN...&.....L..~5-lh.6$...J......K.0.DU..h.~.4V.G1>.....8...r..uo..g.....&nJ.W...4...r.l....x.(....4.M.C....H.V[.....z_.....@.[..8. ..IK..8.Lk.....2.H....f...*......Z.!q.&q..i.*..Xu.Sd...0{tWL....t..5.@.i..V.+._.e&.T...~B.. .L.Q.V-...`....o..5/....._L...O..........-`5.I.j....@....|.W...E.2.[./....m......k...G.YA8...x._...$n......|"V.8..L.a...E.b......bB.H+.t..k3{a..#.M..S..Q.e.T...)w........K..`..8&o...d.0.\..V.x)E

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\48x48\upload.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1843
                                                  Entropy (8bit):7.8738847492957476
                                                  Encrypted:false
                                                  SSDEEP:48:DiqImLLnLvgPSTvIKvzzB80qyyPbW5fG+QSRlP:Dff3XXvm0qycafGsP
                                                  MD5:D9E53E4C4EB2CBE6FAD2357F58C0F32A
                                                  SHA1:6A8F3EC636BB4EECFBD50F5E5934B85BEAEC8A04
                                                  SHA-256:2C75A2AE4A4ACA5E4434AF672386A2F30C21A86CF3580CE4E4B68CCBC80125BC
                                                  SHA-512:C0DE3072593B941A69BD66A7A28F73A7894103861D41A1B808C187D00308DC4DE0C9EAFF996FD4DEACBA643E1A5C5BA72FC6F27B757F2382DD8BA199BCA7937B
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W.......IDATx...td...w.{;..d..m....m.....m...tl'.[U..y]/..gu...Z.:'..{W......W\q.v....T..)...dZ........M...0..3....a.0.RtC..@..4...%.$...i.i......G.@...;vo...e.s..e..?T.!86.....G....>.sr.{./s.... %...y..K..r......z..p..........."..C.V.E.....z.g....9'.;...........(..m.+p...y.N.sw.e.<3.}:<@.....U.L....[...".)..{.8.}.....Z=/.5.m..&....:.D.i$$....W.D.....@.s..>P....b.9.._......f~.8..[....@....%...p...0.5..."D.A.$.G...A.....{Lcg...N.w.i.....f..v.!e$`7.A.T.sz....+...Eh.d6.. C..q.l.....Pc..C2=.z..r^....+`.w.Z=.w....J."l.!H.YB.d."..q.......8v.....~L...".8....<..U.2A.Ie..d...0..`....g.^..w(.....b.9G$...,.4W,LO..;@.Nc@..A.YuF...,.W.j$..G.F.o......W..v...f..\p. i.e.....R.a.2H..t.V]....w.6.x..|9.qF.r)vT.Bn.Z.T....U.....l....5.8z...x..>...y"b.....[.KO.!..m......i.0.LF.1P...g. .y......V.c........K..T...W....{bp.$...c.........#$....a....AY..P1J..".v%..7...........=s*3..!yU.`Y&zt.eB.....(`]...u^.a.Le....4..p0..`.A...2.#.&!..

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\48x48\uploadadd.png

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):652
                                                  Entropy (8bit):7.573388378416767
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7YQawA9KZMHQ3/DM7PvqGowqiVdw7gwqUvlz5nZWpFJV:5Qa5tQ3/uPvH0iHyJW
                                                  MD5:B1392720DE6F62CC053754418ADE5AD8
                                                  SHA1:DDAE0F4376F3DCBE99A094C9A9410AFCDC0DABC0
                                                  SHA-256:54906BBDC39B746A9F373B3F58E63B29B579BE017F434110EE47147849B03405
                                                  SHA-512:7BC21473EBE015ECE58EE59AF5BF1B5669B0D17F8B92A73D5806D7997D85EFA82D729B68D51A0B12E16EB04C15011EB99CEF3E46F83EF04ABAC0B50466C6342F
                                                  Malicious:false
                                                  Preview:.PNG........IHDR...0...0.....W......SIDATx....TQ....fl.(..."...... ..X "..a.H.%..@.........De%;......5....}..g...=..1?............)v...Mc..)..;W.......;@U..>o.f..qJP.OH.q............-@6......4c.... .J..U.?..M.`.0........{....kt...\.7.z.... ...).qE...{./.M.<a.QH.....r`P.....KE..s.Gt.........o]....;|.0.....h...HL].1.S......q..vXc2-..o.....y.[...j.y..J...*.V/..%$....w.%....-.......)...P...2.......{a..*"w..?{S~..s..y....>F..9.W.3......e.Y....y.q... .......V.|.k..*.p.d:d9D.........o..T....r.......q6...l..,k.0..pz..]..3......].a\!.>....U...p.k..|....I...g/]?..e.....'?.O(... c.tV^[..<}>...9@.3.A30000........1....IEND.B`.

                                                  C:\Program Files\FileZilla FTP Client\resources\tango\theme.xml

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:XML 1.0 document, ASCII text
                                                  Category:dropped
                                                  Size (bytes):305
                                                  Entropy (8bit):5.108023931259979
                                                  Encrypted:false
                                                  SSDEEP:6:TMVBd6OjzwgKioDIORtHFb8LdDLDzHMQ/oHUTUZBOHWXdQUGOH1QIKe:TMHdtAgr/Ofb8xvDzrgHKABOHW+LOH1R
                                                  MD5:CF05DE857D2A5E3F2C0E1B75F3221BF3
                                                  SHA1:EBE2DCDF0FC5387F6DB01F121D30235BF0A9E5CB
                                                  SHA-256:7D0309CFFCC39770B13F13FB18023F08E8D6B8A8FC9E9E1F7E35B02516229DDA
                                                  SHA-512:8235C8C75717AD627E545837BA0156039EFC93EA96843BD20976941A84507F2CA2397963A31F9623D8D58DA0746CF129ABC7BAD8F8DF30AC0F67CD364E184F06
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>.<FileZilla3><Theme><Name>Tango</Name><Source>Tango Desktop Project</Source><Author>Christophe Meyer</Author><Mail>stombi@gmail.com</Mail><size primary="1">16x16</size><size primary="1">32x32</size><size primary="1">48x48</size></Theme></FileZilla3>.

                                                  C:\Program Files\FileZilla FTP Client\uninstall.exe

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                  Category:dropped
                                                  Size (bytes):102358
                                                  Entropy (8bit):7.06365435469184
                                                  Encrypted:false
                                                  SSDEEP:3072:NnPdzuK8Jdw4TMJw3unPsvbu2xXGGGGGGGGHGGGGGGGGGGGGGGGGGGGGGGGGGGGP:NnPdudwDjPabueGGGGGGGGHGGGGGGGG2
                                                  MD5:9752FC092C400C97771C534852C57EE3
                                                  SHA1:C35F56D30367635E69AA7B38C363C961B1334B8E
                                                  SHA-256:A70E685CB93D88965D0C51D4AEEF3C646D8B9D5D5BEA4BC846B0D5E9AB746210
                                                  SHA-512:2515F94B24FFE04A00C5BAF15E739FBD202C4151561BF792E437393EBDAF9D69BB46F952895A679EF05E20B0DCD53CCB3ED13C31C81938C279BE03CD52987342
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1 ..PN..PN..PN.*_...PN..PO.JPN.*_...PN.s~..PN..VH..PN.Rich.PN.........................PE..L...g.d.................h..."......E6............@..........................P......V....@.........................................................HK..H0...........................................................................................text....f.......h.................. ..`.rdata..X............l..............@..@.data...x...........................@....ndata...................................rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Program Files\FileZilla FTP Client\wxbase32u_gcc_custom.dll

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
                                                  Category:dropped
                                                  Size (bytes):1834568
                                                  Entropy (8bit):6.293695336582352
                                                  Encrypted:false
                                                  SSDEEP:49152:jRrndVVhHn/uy9dG8e4dbyKK/0QXcD0nne/9IvypSHdoVus:jRzjD/uOx
                                                  MD5:03E5C174D99789CC0AFABE4A838BF691
                                                  SHA1:3E72DF6FF3A96719746F287E72C51B71A8CC49A8
                                                  SHA-256:9EF2D686A1FE20A881AB08E08CBF05C7FB2664031C18273BD53576606187783A
                                                  SHA-512:58926C4EAD69D174E24045F8F29E6B3FA752C938FAD220B1155B18AA5FCB2247FD187008143A1782E355AE7706D1D740633B212F2CAFAAAA8405258866854BD9
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......f..........."...(............ .........%K.............................@............`... ..................................................A...........P..........H0.......?...........................x..(...................P...`............................text...............................`..`.data....=.......>..................@....rdata.......0......................@..@.pdata.......P.......*..............@..@.xdata..............................@..@.bss.....................................edata...............R..............@..@.idata...A.......B...B..............@....CRT....X...........................@....tls................................@....rsrc...............................@....reloc...?.......@..................@..B................................................................................................................................

                                                  C:\Program Files\FileZilla FTP Client\wxbase32u_xml_gcc_custom.dll

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
                                                  Category:dropped
                                                  Size (bytes):240712
                                                  Entropy (8bit):6.328416622448102
                                                  Encrypted:false
                                                  SSDEEP:3072:kJjNa9pUfMtALsdAa3o8/BZzLVhtE4EaAgGJokkrRmLSaqF/z7MGHytZoXparzNW:c09pUfAcsqaPNhtEgTAFlLUytZoZavNW
                                                  MD5:35F465D4D0B50667B9D923C0F7D86333
                                                  SHA1:DE2EA1ECBD94FC10517F86C8A41644CAA5EEA0A0
                                                  SHA-256:8E2C9CF446FA000DDB7AB28D4BD569D681E246A2D44B99E2069C4EB69ED64A34
                                                  SHA-512:7EC6F06B641B0BDFB7D2444AEF7CFA1F8A573939FF2CDF43177040A9DC626BB1C1BEF435862A720F06A6ECBE58F31BCA506CB49249983560D52C227BA8A2A1F4
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......f..........."...(.....x...... .........$)....................................=.....`... ..............................................................@.......|..H0......@...........................`2..(...................`................................text...............................`..`.data...............................@....rdata...l.......n..................@..@.pdata.......@......................@..@.xdata.. ....`......................@..@.bss.....................................edata...............H..............@..@.idata...............T..............@....CRT....X............n..............@....tls.................p..............@....rsrc................r..............@....reloc..@............x..............@..B................................................................................................................................

                                                  C:\Program Files\FileZilla FTP Client\wxmsw32u_aui_gcc_custom.dll

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
                                                  Category:dropped
                                                  Size (bytes):506952
                                                  Entropy (8bit):6.274591225270957
                                                  Encrypted:false
                                                  SSDEEP:12288:iudHeLTOkfbIlqYU6W4ZXppA6f+QwqBFd1FpQTzXaGU12p4jGLyyy6ud:noLTOSgw4ZXppzf+QwqBFd1FpQTzXaG2
                                                  MD5:F8393C6C782263A37D522A9E61E31DEC
                                                  SHA1:92C5A48B97B274DC3BD849AAFB6D21F4ED3B2B5D
                                                  SHA-256:8D03EAAC037A0B00D8B11512FBA3C9E2571427FDE35E022E58586D264211445D
                                                  SHA-512:64D471030C4191CD269D5461C2E96DC28DCF3B7949A9A53FDF64B9D50F1E1FF105CFBF7365B20B28F72E39E11586203F8D77DADDCFD7335C8DD05461F94E5AC6
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......f..........."...(............ ........................................ ......}h....`... .............................................. ...................1......H0...................................K..(....................7...............................text...X...........................`..`.data...0...........................@....rdata..L....0......................@..@.pdata...1.......2..................@..@.xdata..hf.......h..................@..@.bss.....................................edata...............D..............@..@.idata....... ......................@....CRT....X............l..............@....tls.................n..............@....rsrc................p..............@....reloc...............v..............@..B................................................................................................................................

                                                  C:\Program Files\FileZilla FTP Client\wxmsw32u_core_gcc_custom.dll

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
                                                  Category:dropped
                                                  Size (bytes):5229128
                                                  Entropy (8bit):6.334362296896882
                                                  Encrypted:false
                                                  SSDEEP:49152:qvZGMb+xf9AgedrjI6I/EqKuX1ZCwFa7ZUdT/ntyzlZItm4NTUem8ZA36Pn7Gunr:q8Ag8jQ/FTXRYUJt9tm4hU+HD
                                                  MD5:2C7D19DF6E230805A9D222EC3F547FF0
                                                  SHA1:3668DEB854C38E653C6C09F692C32802041273EF
                                                  SHA-256:2B4087083F33055DC3FB29E2A7E07C9435735EE88170315CAEE6B07B6D73A403
                                                  SHA-512:7A8AD10242CE10F5145BF7A536A41FDC8CEECA9E14B3BAD55D0E30D3457C8ED8578A8701332875B5BF9C3455FFC27086CD00056149F0920CC4E5407BC748051E
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......f..........."...(..,...O..... .........................................P.......P...`... .......................................G......0M...... N. .....@..=....O.H0...0N.@............................C2.(....................RM.(!...........................text...h.,.......,.................`..`.data....i....-..j....,.............@....rdata..DP...p0..R...Z0.............@..@.pdata...=....@..>....@.............@..@.xdata........C.......B.............@..@.bss..........G..........................edata........G.......F.............@..@.idata.......0M.......L.............@....CRT....X.....N.......M.............@....tls..........N.......M.............@....rsrc... .... N.......M.............@....reloc..@....0N.......M.............@..B................................................................................................................................

                                                  C:\Program Files\FileZilla FTP Client\wxmsw32u_xrc_gcc_custom.dll

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
                                                  Category:dropped
                                                  Size (bytes):746568
                                                  Entropy (8bit):6.1959492322184975
                                                  Encrypted:false
                                                  SSDEEP:12288:iazXhE63d1Y1q3RbN77vizzBiPpS325usQlrc30aSAJGXucjGsywjhj:iaT9cqhh+BwpSm5Clrc30aSAJGXucjGu
                                                  MD5:6A909A320118CC7F561D26997801DAA4
                                                  SHA1:D4C3945FA446090CEAEFC2DB04F9D592A9E6CB29
                                                  SHA-256:18ABF31D7F1C2A633A9D21D4607F2A773688E2715EC50616582C8E9E67082EAD
                                                  SHA-512:F9FFFB5D9C784E137CAA22DCEA9B2A9FA9E52319720D9061241507F626B28311D7417A880B3A076DC11E0E4C5F0566DA2F5391EEB30087D60A2CF38A0F2B2232
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......f..........."...(.J...0...... .........8.....................................p.....`... ..............................................p.......p..........0?...4..H0...................................,..(.......................h............................text....H.......J..................`..`.data....0...`...2...N..............@....rdata...<.......>..................@..@.pdata..0?.......@..................@..@.xdata..`.... ......................@..@.bss.....................................edata..............................@..@.idata.......p......................@....CRT....X....P......................@....tls.........`......................@....rsrc........p......................@....reloc..............................@..B................................................................................................................................

                                                  C:\Program Files\FileZilla FTP Client\zlib1.dll

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
                                                  Category:dropped
                                                  Size (bytes):145992
                                                  Entropy (8bit):6.628387731251868
                                                  Encrypted:false
                                                  SSDEEP:3072:NDMD3+SQ1Vwm4Mn7/STiHpgh2khtUUFQN3oJ:NoySQZ/KpphtJeN3C
                                                  MD5:156FB0FD8FD004834FD2264270A44932
                                                  SHA1:A73E5C7614A98BB7AD969D2F0A67C626E2ECB344
                                                  SHA-256:7B41F364B4DC2E9BB669EC0A4D0F3677DEBF4BEB93C755331DB67E6E3668E532
                                                  SHA-512:C1AF4B0FE1D6F6F5CB8DCADBB8CA46CD8FA4CB4F745935D2AC31D83E506CC511F5B5AAA3513F36814B71BCD2ECEEE925C9AEDE66949C7B297BB8163F72CC659D
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......f..........."...#.~..........P..........b..........................................`... ......................................0.......@..8....p..................H0......................................(....................A..p............................text....}.......~..................`..`.data...............................@....rdata...W.......X..................@..@.pdata..............................@..@.xdata..............................@..@.bss......... ...........................edata.......0......................@..@.idata..8....@......................@....CRT....X....P......................@....tls.........`......................@....rsrc........p......................@....reloc..............................@..B................................................................................................................................

                                                  C:\ProgramData\Lavasoft\Web Companion\Logs\Webcompanion\webcompanion.log

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:ASCII text, with CRLF, LF line terminators
                                                  Category:modified
                                                  Size (bytes):132039
                                                  Entropy (8bit):5.29490634723875
                                                  Encrypted:false
                                                  SSDEEP:3072:CttUoyhKKE8s595Vvu5yF5buAV3Z9DmmomNmkmKmZm0z/OTGm5:GtUoyhKKE8s595Vvu5yF5buAV3Z9Dmmj
                                                  MD5:75A52D4EF29A1EAAE7AF2B168F6B6B58
                                                  SHA1:BFE8A9990BD389D2AFB7CDC420812024327DABEB
                                                  SHA-256:32F047A5F93CD08504F5A8F052A583B188BDAE67C150094405435F93291F43BA
                                                  SHA-512:057B6CB4B687B3705415DB1EDAAB4DF60E9F5741B84B4ED52DAA455DB7605411A03C68FD3B43EEC601D8F73670C86490FCF45362E8B9D33DBF73610550F4F6C8
                                                  Malicious:true
                                                  Yara Hits:
                                                  • Rule: JoeSecurity_PowershellDownloadAndExecute, Description: Yara detected Powershell download and execute, Source: C:\ProgramData\Lavasoft\Web Companion\Logs\Webcompanion\webcompanion.log, Author: Joe Security
                                                  Preview:INFO 2024-07-22 06:34:08 [1] [WebCompanion.UI.App PerformWebcompanionStartup] --------------------------------------------------------------------------------------------------------..INFO 2024-07-22 06:34:08 [1] [WebCompanion.UI.App PerformWebcompanionStartup] Starting Webcompanion with :C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe --silent --install --geo= --searchenbl..INFO 2024-07-22 06:34:08 [1] [WebCompanion.UI.AppCore.Features.Install.InstallerHelper UpgradeApplication] Upgrading user settings.....INFO 2024-07-22 06:34:08 [1] [WebCompanion.UI.AppCore.Features.Install.InstallerHelper UpgradeApplication] user settings upgraded.....INFO 2024-07-22 06:34:08 [1] [WebCompanion.UI.AppCore.ActiveFeatures.ActiveFeaturesManager .ctor] Getting active features.....INFO 2024-07-22 06:34:08 [1] [WebCompanion.UI.AppCore.ActiveFeatures.ActiveFeaturesManager DownloadActiveFeatures] Downloading active features.....INFO 2024-07-22 06:34:08 [1] [Lavasoft.Utils.S

                                                  C:\ProgramData\Lavasoft\Web Companion\Options\ActiveFeatures.zip

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                  Category:dropped
                                                  Size (bytes):17770
                                                  Entropy (8bit):7.988661402540188
                                                  Encrypted:false
                                                  SSDEEP:384:kUi5qCq9OCoRlwaottJYLSX3g34cNPJ2AgHJri1zlSxb:kUi5qx9OCsl/LLWQvNlw+lSxb
                                                  MD5:80E1ACB2C9FD443F4298BCE8AF7CCC25
                                                  SHA1:0CAED9AF7E3E11395246EB697B35532C6D752013
                                                  SHA-256:8FDB29858290D88F953E7EABBBBF6EF7362A54FC50108E9B148CDADC35ED3AC3
                                                  SHA-512:CB89672E2F7B5A596A9D1EB9DF1A405C763E24A65D2C5DEF0ECF9671C5F22B207A48AA44C7E06179B93ECB564DF4ED0F5EDD26873E47985D99939BCBE034502D
                                                  Malicious:false
                                                  Preview:PK........:=AX7\.0.D..r.......ActiveFeatures.txt..+..@.sjp.#...........K1.......;../-.........[.[..A.B.....exq..)7.. 7:^...g.K .!i.bU.V.s....O$v7|e\......W...'...Z.dveU*o.R..>.%...w...$.-;...Q....4.T.......f$.+T.$.&.Q?9...#".6>.........0....o.@..j.(.*i).H".B..1`.=..&0..I8C.R..."y....cM7.g.........\@....8...x.E..4...S.|I.....yy7..~..%W?.7!J..h.rf..dB.^OQ".IDG....!o.+.^6.V...Y..6...<.....w.N.N..P..P2...\.?.....E.Y.^.j.......>i.[.p`.L_...s.Xq.>#~..nY.....>L.O9r....sA..S.+.g.5.FB..i.q..g.Uf.{..*v.BU..Bq....Tp...K.F;/........[.&WIAP..u.S..-&v.3.!...Y'.bM..l...{[:..5.s..V...L3.om........7.'.O4.'(V#...:\.......#.....V.O.O&<...s.}Y.d.|..<P...@...j.M%.O..5....lH.s^SYfa..CDD....w..V........cE.8.~cETL..0.Y.IEd@...._P.Q..~w..\fA.T....7K.i..ywq|........+.#...].N......".>.(..A....0.b.U-.l.D..M#.ET....Ya....-h..}.e.p...<)...,.....y......2..'..g.g\_GJ......=^..!..M....A...DK^?.....d...x)...-.z68....4.R|Y.S.gy.nU..f...1q.b.EFO?'.[.a...`.b...F.\..rs..ZL.0.q\.v

                                                  C:\ProgramData\Lavasoft\Web Companion\Options\ActiveFeatures.zip.tmp

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                  Category:dropped
                                                  Size (bytes):17770
                                                  Entropy (8bit):7.988661402540188
                                                  Encrypted:false
                                                  SSDEEP:384:kUi5qCq9OCoRlwaottJYLSX3g34cNPJ2AgHJri1zlSxb:kUi5qx9OCsl/LLWQvNlw+lSxb
                                                  MD5:80E1ACB2C9FD443F4298BCE8AF7CCC25
                                                  SHA1:0CAED9AF7E3E11395246EB697B35532C6D752013
                                                  SHA-256:8FDB29858290D88F953E7EABBBBF6EF7362A54FC50108E9B148CDADC35ED3AC3
                                                  SHA-512:CB89672E2F7B5A596A9D1EB9DF1A405C763E24A65D2C5DEF0ECF9671C5F22B207A48AA44C7E06179B93ECB564DF4ED0F5EDD26873E47985D99939BCBE034502D
                                                  Malicious:false
                                                  Preview:PK........:=AX7\.0.D..r.......ActiveFeatures.txt..+..@.sjp.#...........K1.......;../-.........[.[..A.B.....exq..)7.. 7:^...g.K .!i.bU.V.s....O$v7|e\......W...'...Z.dveU*o.R..>.%...w...$.-;...Q....4.T.......f$.+T.$.&.Q?9...#".6>.........0....o.@..j.(.*i).H".B..1`.=..&0..I8C.R..."y....cM7.g.........\@....8...x.E..4...S.|I.....yy7..~..%W?.7!J..h.rf..dB.^OQ".IDG....!o.+.^6.V...Y..6...<.....w.N.N..P..P2...\.?.....E.Y.^.j.......>i.[.p`.L_...s.Xq.>#~..nY.....>L.O9r....sA..S.+.g.5.FB..i.q..g.Uf.{..*v.BU..Bq....Tp...K.F;/........[.&WIAP..u.S..-&v.3.!...Y'.bM..l...{[:..5.s..V...L3.om........7.'.O4.'(V#...:\.......#.....V.O.O&<...s.}Y.d.|..<P...@...j.M%.O..5....lH.s^SYfa..CDD....w..V........cE.8.~cETL..0.Y.IEd@...._P.Q..~w..\fA.T....7K.i..ywq|........+.#...].N......".>.(..A....0.b.U-.l.D..M#.ET....Ya....-h..}.e.p...<)...,.....y......2..'..g.g\_GJ......=^..!..M....A...DK^?.....d...x)...-.z68....4.R|Y.S.gy.nU..f...1q.b.EFO?'.[.a...`.b...F.\..rs..ZL.0.q\.v

                                                  C:\ProgramData\Lavasoft\Web Companion\Options\EventSafeguard.bkp (copy)

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):2
                                                  Entropy (8bit):1.0
                                                  Encrypted:false
                                                  SSDEEP:3:y:y
                                                  MD5:81051BCC2CF1BEDF378224B0A93E2877
                                                  SHA1:BA8AB5A0280B953AA97435FF8946CBCBB2755A27
                                                  SHA-256:7EB70257593DA06F682A3DDDA54A9D260D4FC514F645237F5CA74B08F8DA61A6
                                                  SHA-512:1B302A2F1E624A5FB5AD94DDC4E5F8BFD74D26FA37512D0E5FACE303D8C40EEE0D0FFA3649F5DA43F439914D128166CB6C4774A7CAA3B174D7535451EB697B5D
                                                  Malicious:false
                                                  Preview:..

                                                  C:\ProgramData\Lavasoft\Web Companion\Options\EventSafeguard.txt

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):2
                                                  Entropy (8bit):1.0
                                                  Encrypted:false
                                                  SSDEEP:3:y:y
                                                  MD5:81051BCC2CF1BEDF378224B0A93E2877
                                                  SHA1:BA8AB5A0280B953AA97435FF8946CBCBB2755A27
                                                  SHA-256:7EB70257593DA06F682A3DDDA54A9D260D4FC514F645237F5CA74B08F8DA61A6
                                                  SHA-512:1B302A2F1E624A5FB5AD94DDC4E5F8BFD74D26FA37512D0E5FACE303D8C40EEE0D0FFA3649F5DA43F439914D128166CB6C4774A7CAA3B174D7535451EB697B5D
                                                  Malicious:false
                                                  Preview:..

                                                  C:\ProgramData\Lavasoft\Web Companion\Options\FeatureActions.zip

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                  Category:dropped
                                                  Size (bytes):9891
                                                  Entropy (8bit):7.975375679708705
                                                  Encrypted:false
                                                  SSDEEP:192:/zgkm2ZdywX6ypLeQMeq5BRVyvQOa9pIZHASkGuPPD8C4Bp60acklTC:/z+2ZMq62tMVDRVyvQJrInknPPD8FgZ6
                                                  MD5:AC2A022A7441887EA66D3B37CE40D804
                                                  SHA1:FAB3D2C5220BA0E9ABA35D5FC5C98E9E3909A1C2
                                                  SHA-256:2386DAB9C4027E1224DDDDAA7B6998B855535084C9BE46C4B25E40D86043CD2E
                                                  SHA-512:5B6E9C04738FC5F1CE6265A5C6ED8D88EC6D5FA267CE27CAE393EB39B688360F6E39FA8B73C40437E844EA0B67CA5A66837C94CDCA2E985036CAE7B50A329B50
                                                  Malicious:false
                                                  Preview:PK.........I.X6....%..........FeatureActions.txtB..PZ...&...K..E9...(0.p......<a}.9....g.<.D.)9..k@4y..'!....=~.Zk`1J......2.[..)._...,.{FF?.q...;.fL.*...=..1......Z.I.....->.m...%.>`..m.......l.,.s....W.I..TP..u*.;.....P...xx.h..g.l$..M.]I.}..........o..g......Z.L..5..?.B..ZL..x..u...kU.1.P..4.m.W....-Ntf.?..I-/...!.w.9...0./..^%X-....0(..mVP.n..]=.c.r._...A$..<.BW..y..e2.b...K....{j....O..d.x.Z.v.@[.NL.DU|._......1S..p....~Pa.q..>....})$q.H7.,h......m)I......as.<.TW...u.$?......E...y.....@X.....u.@.5.*..UJ..L.ja....0.v..^...Q. (O}k+fw.v.f.z..b.h.FE..<pl..LWZI...*.4#....,.X...`=..b...eV..W.)W*..;.Q,.'x.>..Jq.... .._..T<ea&wo../R.M.2.`rX.F.........E...c:..A.9.7A........4..FT....0..@..wu.JI..Bd.5..B..hw......}.oE.@..N=....Z$.)6.@....s..X...r.........u.%...e.I.g..5.ru.A..:.81.&..."..e._...'....B...e.'..K..`w.C....c6....H..o....?.yn;..~3r..{<..&..vi..n.MG.6..'h...4.V#.P.$...n.../..K...t'.....<.4.o.O..a"xGT.VB...f.E.<e.....G..#....B.w{.

                                                  C:\ProgramData\Lavasoft\Web Companion\Options\FeatureActions.zip.tmp

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                  Category:dropped
                                                  Size (bytes):9891
                                                  Entropy (8bit):7.975375679708705
                                                  Encrypted:false
                                                  SSDEEP:192:/zgkm2ZdywX6ypLeQMeq5BRVyvQOa9pIZHASkGuPPD8C4Bp60acklTC:/z+2ZMq62tMVDRVyvQJrInknPPD8FgZ6
                                                  MD5:AC2A022A7441887EA66D3B37CE40D804
                                                  SHA1:FAB3D2C5220BA0E9ABA35D5FC5C98E9E3909A1C2
                                                  SHA-256:2386DAB9C4027E1224DDDDAA7B6998B855535084C9BE46C4B25E40D86043CD2E
                                                  SHA-512:5B6E9C04738FC5F1CE6265A5C6ED8D88EC6D5FA267CE27CAE393EB39B688360F6E39FA8B73C40437E844EA0B67CA5A66837C94CDCA2E985036CAE7B50A329B50
                                                  Malicious:false
                                                  Preview:PK.........I.X6....%..........FeatureActions.txtB..PZ...&...K..E9...(0.p......<a}.9....g.<.D.)9..k@4y..'!....=~.Zk`1J......2.[..)._...,.{FF?.q...;.fL.*...=..1......Z.I.....->.m...%.>`..m.......l.,.s....W.I..TP..u*.;.....P...xx.h..g.l$..M.]I.}..........o..g......Z.L..5..?.B..ZL..x..u...kU.1.P..4.m.W....-Ntf.?..I-/...!.w.9...0./..^%X-....0(..mVP.n..]=.c.r._...A$..<.BW..y..e2.b...K....{j....O..d.x.Z.v.@[.NL.DU|._......1S..p....~Pa.q..>....})$q.H7.,h......m)I......as.<.TW...u.$?......E...y.....@X.....u.@.5.*..UJ..L.ja....0.v..^...Q. (O}k+fw.v.f.z..b.h.FE..<pl..LWZI...*.4#....,.X...`=..b...eV..W.)W*..;.Q,.'x.>..Jq.... .._..T<ea&wo../R.M.2.`rX.F.........E...c:..A.9.7A........4..FT....0..@..wu.JI..Bd.5..B..hw......}.oE.@..N=....Z$.)6.@....s..X...r.........u.%...e.I.g..5.ru.A..:.81.&..."..e._...'....B...e.'..K..`w.C....c6....H..o....?.yn;..~3r..{<..&..vi..n.MG.6..'h...4.V#.P.$...n.../..K...t'.....<.4.o.O..a"xGT.VB...f.E.<e.....G..#....B.w{.

                                                  C:\ProgramData\Lavasoft\Web Companion\Options\PerformedActions.txt

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:JSON data
                                                  Category:dropped
                                                  Size (bytes):763
                                                  Entropy (8bit):3.9894005417050344
                                                  Encrypted:false
                                                  SSDEEP:12:N5qIGBbUEaCuOjZ/vu5GBbUEaCuOjZ/gGBbUEaCuOjZ/4VIGBbUEaCuOjq:PqHBwE1uW/vtBwE1uW/vBwE1uW/41Bw7
                                                  MD5:0C00A728DC090A34109D8E4F0A948E08
                                                  SHA1:82042DA7B434B9EEB7E14E8E6B2A1C7FEB431821
                                                  SHA-256:EBEBCFDA247C316C270D7D53EF5663A443C0837DA9A033D78B2EB0C0973A4E04
                                                  SHA-512:3DFA79C5D434A87222469CCB10947507D3BF3BD86C1E1354B16B8366659B943D715850B539E3E439CE5A6F6EA8F84B7D4227EB215FE8523607707A9745BB993A
                                                  Malicious:false
                                                  Preview:[.. {.. "Date": "06/02/2025",.. "Features": [.. {.. "Name": "TelemetryShield",.. "Performed": [.. "EnableFFTelemetryShield".. ].. }.. ].. },.. {.. "Date": "07/08/2025",.. "Features": [.. {.. "Name": "TelemetryShield",.. "Performed": [.. "EnableFFTelemetryShield".. ].. }.. ].. },.. {.. "Date": "11/23/2025",.. "Features": [.. {.. "Name": "TelemetryShield",.. "Performed": [.. "EnableFFTelemetryShield".. ].. }.. ].. },.. {.. "Date": "12/10/2025",.. "Features": [.. {.. "Name": "TelemetryShield",.. "Performed": [.. "EnableFFTelemetryShield".. ].. }.. ].. }..]

                                                  C:\ProgramData\Lavasoft\Web Companion\Options\ProfileInfo.txt

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:ASCII text, with no line terminators
                                                  Category:dropped
                                                  Size (bytes):88
                                                  Entropy (8bit):4.627720932750043
                                                  Encrypted:false
                                                  SSDEEP:3:ocALRwWDt+kiEaKC50HE9jnIVXkB83H:oxtwWDwknaZ50HE9bMXD
                                                  MD5:7EA2E54420FD1EAB0FF8E7D06106A032
                                                  SHA1:8C3376FE03D5B4C9CC8A8ADFA9B28EC55BD548A2
                                                  SHA-256:9B2A0AC0082CF54EFED9A64CA9D3282430A84978A167840637FE5BB9812E2CDE
                                                  SHA-512:77411EEF5B84677F15CCB2392EFA4C0C6D9A29572DC5592B5E87C1A1E0DC3F207624CA662942CFBC9C6DE870F6D21A593384DEA7D783EDE652B8858255F23320
                                                  Malicious:false
                                                  Preview:profile=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles/fqs92o4p.default-release

                                                  C:\ProgramData\Lavasoft\Web Companion\Options\Statistics.txt

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:JSON data
                                                  Category:dropped
                                                  Size (bytes):56
                                                  Entropy (8bit):4.44773053835372
                                                  Encrypted:false
                                                  SSDEEP:3:asLGYYwQVmO3klEIXSAB+In:aqGYYwtlkAJ
                                                  MD5:1C096E59BC6FF9C999AC09386B46B64D
                                                  SHA1:A6B878C375A9180C937C6561F6C5EED2334219E2
                                                  SHA-256:693DD4A82E98559E123BDF92573113A271494760808CB6C027715B5B9736E6A6
                                                  SHA-512:D36F044DEC4AC12293983C8EAC0312FE9D2850463075666582A062A080677CB6180077C0C673135D7CF16246616EEE7C50ACD98DFF12F5FE7B724B3B1617A018
                                                  Malicious:false
                                                  Preview:{ "install_id" : "e8d5b50e-1128-4e60-beea-272041df6452"}

                                                  C:\ProgramData\Lavasoft\Web Companion\Options\UpdateServer.txt

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:JSON data
                                                  Category:dropped
                                                  Size (bytes):26
                                                  Entropy (8bit):3.9312089489103226
                                                  Encrypted:false
                                                  SSDEEP:3:anqFfauvY:a/gY
                                                  MD5:CF85989B75515FF6CBAAA6DD23D3882A
                                                  SHA1:3FBBECBCC28E2D4DE5764388BC544DB47AE9957D
                                                  SHA-256:50E3BD90035CA49B3C57050681449C20953F4EFE5711BF4E02E23F2B63968388
                                                  SHA-512:77AC3FA88B08C136C29B907CB1C9B096EE7F97BDE3EC8D6C9382CA9E74060A065EF9AEFC488A5319E9D1570522056584250BE7ABD5ED582E8B4D16F4143E7527
                                                  Malicious:false
                                                  Preview:{..."platform" : "prod"..}

                                                  C:\ProgramData\Lavasoft\Web Companion\Options\b_search.json

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:JSON data
                                                  Category:dropped
                                                  Size (bytes):700
                                                  Entropy (8bit):4.727166525039482
                                                  Encrypted:false
                                                  SSDEEP:12:YWLSHkawuhTpOPWJn9wuhzVuPWJe9zwuhkPWJECwuhD7PWJGwuhzPWGk+c94GniX:YWLSHk/DOJeQVuOJe9cnOJAs7OJ7oOGn
                                                  MD5:359CCE9C2DF62868BF4096E887993CB7
                                                  SHA1:F3683EE9E7ED5CFC3570D9AAF769EEF6F4FA3A95
                                                  SHA-256:FCD6CEBFE6E9D8BDDF1C4B09771D7D849F2FDC105F991337E45D6AA82F33B627
                                                  SHA-512:A5E99FA8AA18E6A7CEB7CFB0C99DC99B606567AD1DDC3BF5AB81D18502F513A9D96D264552F81508317778216B4A4360D87E96AFF302CC7F7FE1DF92C59A6737
                                                  Malicious:false
                                                  Preview:{"version":9,"engines":[{"id":"google@search.mozilla.orgdefault","_name":"Google","_isAppProvided":true,"_metaData":{}},{"id":"amazondotcom@search.mozilla.orgdefault","_name":"Amazon.com","_isAppProvided":true,"_metaData":{}},{"id":"wikipedia@search.mozilla.orgdefault","_name":"Wikipedia (en)","_isAppProvided":true,"_metaData":{}},{"id":"bing@search.mozilla.orgdefault","_name":"Bing","_isAppProvided":true,"_metaData":{}},{"id":"ddg@search.mozilla.orgdefault","_name":"DuckDuckGo","_isAppProvided":true,"_metaData":{}}],"metaData":{"useSavedOrder":false,"locale":"en-US","region":"default","channel":"release","experiment":"","distroID":"","appDefaultEngineId":"google@search.mozilla.orgdefault"}}

                                                  C:\ProgramData\Lavasoft\Web Companion\Options\install.txt

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:JSON data
                                                  Category:dropped
                                                  Size (bytes):165
                                                  Entropy (8bit):4.170978774397561
                                                  Encrypted:false
                                                  SSDEEP:3:CMNYi8AE0fFitZWylAuCYotZWyRfFom3V/HrHuARNQf5Wy/HTY:CMqzgwAqG3NTu0CF0
                                                  MD5:727E402A775662A0771E0ED1AC80B4ED
                                                  SHA1:544DD01EA94E2E9D5A0543A08EE66A92072D1A3E
                                                  SHA-256:24132B4C745A2BC389BEE7420CBEB8FB56B20BBA2AF9C8CE8C7892D4DD2CFB5F
                                                  SHA-512:9ACED697750817D2F27F9590DA7BA97CB2BF6E602B240AA2F4EB3921C7F7219A5597D1AB088461E7DA0638F727BBE5D911A355B3002F597D55A567549D79C1ED
                                                  Malicious:false
                                                  Preview:{..."homepage" : 0,.. "search" : 0,.. "browserhomepage" : "",.. "browsersearch" : "",.. "installbrowser" : "false",.. "setdefaultbrowser" : "false"..}

                                                  C:\ProgramData\Lavasoft\Web Companion\Options\partner.txt

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:JSON data
                                                  Category:dropped
                                                  Size (bytes):48
                                                  Entropy (8bit):4.371115365169274
                                                  Encrypted:false
                                                  SSDEEP:3:a+R2Hg7mFFHr:a+R2A7mFFL
                                                  MD5:C88F3808F8DAEDBBDB3811F52D13CC44
                                                  SHA1:A3CC291B189ECD5796E7C04B65D22B4716ED6910
                                                  SHA-256:4386AE13EE4D1F0C2801243197A628575CF0B93AFD97025C1121135EB29AB6B1
                                                  SHA-512:E05B64458CFF88526DE2176D0808D37502A26B45E1F827289273172B486F8DDB51F720C9DD5ACBA8242C381DF3787AC708428CA157112A94688A4292D98B14C6
                                                  Malicious:false
                                                  Preview:{..."partner" : "FZ210427",..."campaign" : ""..}

                                                  C:\ProgramData\Lavasoft\Web Companion\Options\searchengine_v1.zip

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                  Category:dropped
                                                  Size (bytes):3275
                                                  Entropy (8bit):7.910074234898314
                                                  Encrypted:false
                                                  SSDEEP:48:9K/kLsk+QOUHBNNDr54K5AEC1MuPlC1k4EMUTQfVdeF9iqE2sjJzYRQo1sB+Q:4usYjNDr5l2+G4EMUQLcbsjvour
                                                  MD5:748CF32556309B347BB425E58673CF3C
                                                  SHA1:8B8C7A5C20296883A733CCF22F23BF655D019D15
                                                  SHA-256:9011E705C4BF0E3527C1EBF282F574139268CE877DA4260DD03F801DE6500917
                                                  SHA-512:30D5AC30B0858B762EA0D02783740E579CE3E7F4724A44F60C4475C89684302BEC8FC4F377BA04BAE51AEE74CB1482BE7EAE8F03240BF6052EC6FCE1AA91E47E
                                                  Malicious:false
                                                  Preview:PK.........u\XT..n....G.......searchengine_v1.txt...4.X..q..o......D.....H...."......{...La...}...e.B...L~.)D..{?.....`.1.y.P..........z*}..,.]Oe.M.........M.(..C..[.eJ..T....Pb...F?.Y......f.6..4..4&...k1.&...X...W.....-.O..'.f.P.<q...<6B..........o...u.36 3.$G...4....l.h....J.....M7UoG...iO.,.N}..*F....bt...5u.|/.Fk...9d....u8\2.C.#.._..y.2.O,..Y..K.z...V.N..j...S......i......J0....K..S.9.>..%.....(.V.TE....SjU....s...I.!!...|.di....u....p.oV.......;...%j.KY...!U........q^.;.,..]..a..J.....-.p....Q9J..VH:..zR..WO.I.h.;..+...s...$@..v..FOBK..M.BB.?.....G.N.l....#:...6#T.*..,.-..~.5n...f..y\..Q..x.O..<..:......7B..v#.....bdz.J..Am. ..k......K...^A&....=.J[.K.T.9...w._......p.....>..BEq.j..^....A.]..Qq..B.b.......$../..Bx..~........0d9z:...T~0... b....i.A.F...w.0..+..Ghx\..+ZY.8.-M.&k.TB..1...Z.1aJ....@.p.H./V...c...8......[...R..Eu..%.....0...R..N.7Y.+j............k.UF@.ZO..Z-.~...KW.l.~-...1...g...r....t.)./<V.~.L.+..Vdb...k.E..

                                                  C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft\WebCompanion\Frequently Asked Questions.url

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:MS Windows 95 Internet shortcut text (URL=<http://webcompanion.com/faq>), ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):155
                                                  Entropy (8bit):5.033691523270495
                                                  Encrypted:false
                                                  SSDEEP:3:HRAbABGQYm/0AmgDKYKCLJ4ovst1Jj4I5pEIRfT8ZEWVjkRMQ5TdeLHD:HRYFVm/5mg+DCLJlvstf5TLk2deLHD
                                                  MD5:27B7882881492FE3DFC5B7BA2B5D649A
                                                  SHA1:A28581AE5F8ADE293AE052994572BD6654A96563
                                                  SHA-256:69DD17B153805DD6C1FCE8A8EA863DEE80391A6C52961864DD4777EDE991B0B4
                                                  SHA-512:62D18284E0982F379BBE7BFD18E6BFB270D8B8E6617A296A12FF329E5CD5813D5ED50B222B6FD234121C7933972B9AE36A73541E025A28E50562D5CB57F6944F
                                                  Malicious:false
                                                  Preview:[InternetShortcut]..URL=http://webcompanion.com/faq..IconIndex=0..IconFile=C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanionIcon.ico..

                                                  C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft\WebCompanion\Web Companion.lnk

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has command line arguments, Icon number=0, Archive, ctime=Mon Jul 22 09:33:33 2024, mtime=Mon Jul 22 09:34:08 2024, atime=Mon Jul 22 09:33:33 2024, length=9332952, window=hide
                                                  Category:dropped
                                                  Size (bytes):2334
                                                  Entropy (8bit):3.706069154083871
                                                  Encrypted:false
                                                  SSDEEP:48:80ZVuG8dOFEtsf3Fl3nGyXTdM8ZlfUAdM8ZlqkZM8Zlqxp9qyF:8BQZfVQEtU2jsSy
                                                  MD5:B157766AFB42180E70510C45FDB166BC
                                                  SHA1:7C0ED06B778A0F2AAE4692CD2D46F7CB155B272F
                                                  SHA-256:420DF5D718F56265FCF6B1058F9A24DDC302694E648ABF547C6512C61F1E7A6F
                                                  SHA-512:E7415E09D73119C62DB870BABCC88B9AC1D59AB0342BC8C81902445AC4837F278A5CEDCAC8FD176761B1ADB3CAC899A0A0358640AF34DDE8E7A0841EFB54E9D3
                                                  Malicious:false
                                                  Preview:L..................F.@.. ....Q?."......".....M."....h......................S....P.O. .:i.....+00.../C:\.....................1......X0T..PROGRA~2.........O.I.X0T....................V.........P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....Z.1......X0T..Lavasoft..B.......X0T.X0T..............................L.a.v.a.s.o.f.t.....d.1......X;T..WEBCOM~1..L.......X0T.X;T...........................m..W.e.b. .C.o.m.p.a.n.i.o.n.....`.1......X2T..APPLIC~1..H.......X0T.XET..............................A.p.p.l.i.c.a.t.i.o.n.....n.2..h...X1T .WEBCOM~1.EXE..R.......X1T.X1T..... ....................rs3.W.e.b.C.o.m.p.a.n.i.o.n...e.x.e.......y...............-.......x.............?K.....C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe....W.e.b. .C.o.m.p.a.n.i.o.n.\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.L.a.v.a.s.o.f.t.\.W.e.b. .C.o.m.p.a.n.i.o.n.\.A.p.p.l.i.c.a.t.i.o.n.\.W.e.b.C.o.m.p.a.n.i.o.n.

                                                  C:\Users\user\AppData\Local\FileZilla\default_cancel20x20.png

                                                  Download File
                                                  Process:C:\Program Files\FileZilla FTP Client\filezilla.exe
                                                  File Type:PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):827
                                                  Entropy (8bit):7.678942978649395
                                                  Encrypted:false
                                                  SSDEEP:24:pQtzsVjToMIdS0jPhn0PlZ+BY5fE2R+ntHfOf/n:SsBToMQS0t0PREkCQ/n
                                                  MD5:6BE7EED3137A96DACD17950450172DA7
                                                  SHA1:1431F6DCB4B937A1CD78819EC0D5B1204E26D66C
                                                  SHA-256:16DE9E9B70D7972B3A23116EA4D32E3E6F289A2B1516B5D8CE66883680CCF6FD
                                                  SHA-512:CF10DD421624ECE1D3C00B395FC7868250C6B63A1C6A6AA78C699844E31E1F64725DC0F596A42DA95109D983E755B6FE1E8DA4DFCC912328887DA87B16231E1B
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.....................sBIT....|.d.....IDAT8...AhSY...s..Fl.. :.'C....7*".YH.Q.n...C...E.u#....V..Y.F:3.#Hm.....hu\t.j.....&...w\4.I......9..{....'.m.v.-.+......._ .7.zjU....p4..H.......i....M....+.j.pODZd.F.Y..D.{Wij..o.d....d.t.H.s.R...2......@1........f.3Fd....gl..p.Q.. ....#..,^Lf.....Y....?.z...EV.....3..v.....}.c.Q.C.~^.."rp?...HY.,.z...E.#.ls]}.`n.W#.2....8.4b..gO.|.s......'.m..|.az.....c..~*B.n.P......... ...0=..z7...;.x.G...y..~'.........Ws.....[.0.....ni...T'(.....ov.........b.k..c..@[u.P?p..Xj...i2...D...^..8..Q6\.....D...w.#...".."R...6..`.,..o....#..sI..*.9.....V #.....D....."Uu..m...?...'t8.]_.....3.........2..9...V])"..4.I.=}r,q.p...<_w3iw..k....".E.~........O..Y.Y..s.{............H.S..U..N..J*9.h....9... ...5._-dd....2}...`.R.J.....IEND.B`.

                                                  C:\Users\user\AppData\Local\FileZilla\default_cancel24x24.png

                                                  Download File
                                                  Process:C:\Program Files\FileZilla FTP Client\filezilla.exe
                                                  File Type:PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):997
                                                  Entropy (8bit):7.704921904824094
                                                  Encrypted:false
                                                  SSDEEP:24:A0mwJl1g/5mgdSPMt/UOpCY/L1cnte/VIuJ9:ATO7gbks8OQCKcVj9
                                                  MD5:8B6396D577338CD6EE71133A36A8B010
                                                  SHA1:DA48E07641BAF954FDE4894D8D9443C01521FAEE
                                                  SHA-256:DA37AA17497C5F6BE0A61B08B687A6BFB6765A069D997592B32AA347542E1213
                                                  SHA-512:EE829D8B53D853EF7D9B2A76325FCFE371AC27DEA1A2814D23B773DEAE15C61DD2A0183C1BE028FCF941B7E01F3AE4B618D07AC070EE86B63908969FCD111BA6
                                                  Malicious:false
                                                  Preview:.PNG........IHDR..............w=.....sBIT....|.d.....IDATH...[h.e...gv6...n.....B.mZ/i.66($"..`.A..R.D.B._..(..P,....`K.....>I/..1.4...I6....fg.......H....w..w.o.3B....'..$pH........$0............D..0...........9.?75....$:c._!....uy4-p..n.B./.....H.f..".rT.{..~..,.....0""....8.........[..1V........`.H0$...--.r..Dg.8^K.;.K..ob..*.w.d....mm).K..H..1r.b.M`........}.1.p....&...s.4...g. ..Rmw.....SY.a.(...p.V..wm/W....=......2.,.m.b66...D.~&...0./D..!.......|.......:..?..j.X.......d~..V}...o.+?..NhM.=u....BU..\....y......@.p..5.......X...Jj..R.g7.!..i..zA.]..-../.I..n.N..hh.'.UM.b...z..{......2...r..{..w..b.5..}o....T<P..{d....s..=.2"B..n....|.VUsc+.k..x>..S`....7....&..*..-o............o.Tc.WU/..J^.r.0...`)....&.. ..U..9.?K.L....?....p.&d.u[.\......?7=..v|..-.1W..sK......407}q*...z..>.^~n2..@......Hf......<f.Dk..MU}[...K.....4...J.@.`l%=k"g...$..X.pnU...j.....[...+_........[..n.3..?$F.@.UM.}ofl%sm...X.B.........P..(....z....n.N/......IEND.B`.

                                                  C:\Users\user\AppData\Local\FileZilla\default_close12x12.png

                                                  Download File
                                                  Process:C:\Program Files\FileZilla FTP Client\filezilla.exe
                                                  File Type:PNG image data, 12 x 12, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):370
                                                  Entropy (8bit):7.14065601820569
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPIcssvNHh96ZRQbx1VQqieMLdeZItThHZxlVpujpKyKGjfRVp:6v/7DpNHh0S1VQqZMLCK3p0pEm7
                                                  MD5:E1A12CB9A0331345BE632A87F720D0D2
                                                  SHA1:0788ECE1487C7EFA812039A5B0B96F4ED7F29D1E
                                                  SHA-256:13CEAF1E781DB57FCDCBC30882763FCCE095EDCC99AF0AFCB2D2B227183A85BA
                                                  SHA-512:0F6FB2357BA8D16E2D7347C970100ED1CA1D740C42BA80920B2F0690088FB160E05307B7846C4538FE9D0A0BC5B4DB7DEB0FE9FB786DFB10967F8CE50BED6ED9
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............Vu\.....sBIT....|.d....)IDAT(...=K.A....;....s.k.H.5...v".......?@....3..`aa.W..6.."9.Y..p.VN3........#I..1.....sP...cL.HE..nc.}.........Z...8.Ed.7.J..`.....l6.....k..z)"...|.a....L&w@#(.Yk.k.Vp....rU....^zx..W..1#.)5.!...j..Y..W.4...J.b.x..`WDD)....g.e......@T.....J.K.'../.Y=.a.....M ......n........F.W.....N.h...k....IEND.B`.

                                                  C:\Users\user\AppData\Local\FileZilla\default_compare20x20.png

                                                  Download File
                                                  Process:C:\Program Files\FileZilla FTP Client\filezilla.exe
                                                  File Type:PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):848
                                                  Entropy (8bit):7.6928425469360695
                                                  Encrypted:false
                                                  SSDEEP:24:kNOrRQVpFW/fmy/GwlAVLUtkvEaTz8zWhqe9rL:d7my/1lGLWGEaTzYW/N
                                                  MD5:201C6814F606B793972A50C90E5969FF
                                                  SHA1:90000D5D6FFE067FF2007B70477068E9816F820F
                                                  SHA-256:45A3DE04CAA4F2829AAF8AA3997D7514AB7A71DEF54510D78847779E7767ACDC
                                                  SHA-512:F3BDB04C81E2771D83C4F777526EC8F9C718F3636D8BEF063B36403164783EA53A39439EE8188D2437BEE26D3404AAB0B5C139F2855A59DBC8768CEF78523E6B
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.....................sBIT....|.d.....IDAT8....KcW....3...1.Xu%F.!2......#B?B7...v.&0P).....k...(./..........P:3.o...8unm..\o.......D;............[.Zu).<..?.?.}.?OW....s...Y.0........@...8.i.p.F...R.....3.......B===..X...az;u...Q..kk.....f2.....X,&..(..P.TPU...yR.....o6./@....R......i.....|.!.u.D"A.T...........E.'.]..'..<.J144Dww7.`.EQN6....(sss<..1.V..8.8...H$.... ..c.&......9.%..../..t.;...)O.....xhkkC.4l.n....".. ..{n..R.tj..f+`.i...zK..~?.b..EQ.:.;....`.\.0..4/.\.#.......8.......,..*...W..*[[[......7....[..aff..0(.....,--a......?..&.+...Y6.&.q..j...............QU.M.....n...k.m.......M....gq.V..........i..i.6`Y..m.H.r....*5....T*....'R..J...f.&''g....B.&.........(i...F..d.}.s.Or...0.G.&..M......>^..P.....m...kY...+....z=..gM..j.]]]_r...L&?.,...../.....~x..pu.o.l.....>|.........IEND.B`.

                                                  C:\Users\user\AppData\Local\FileZilla\default_disconnect20x20.png

                                                  Download File
                                                  Process:C:\Program Files\FileZilla FTP Client\filezilla.exe
                                                  File Type:PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):650
                                                  Entropy (8bit):7.512467404371971
                                                  Encrypted:false
                                                  SSDEEP:12:6v/78A9pu/UUanfAQgVv3dLaXxFln9cqNtbPFN+NDQwyB1cepvN:yPu/xbt39KxFl9x/bPfyEvoepvN
                                                  MD5:83A9C5C3B1F35ED0831BF7DDD4C770B9
                                                  SHA1:BF3444E56A17DB38D748E8B41D57BB8B9D060279
                                                  SHA-256:B8AE6364C0E09631E8585ECC9CCBD18FC4A34AA5E46C3C5F7B9B94D0B02470A4
                                                  SHA-512:FBBE07E092F3CC29A03C46A22587F498B0C2B83E602972ED8D91B4EFD7F01B0F13230DB1A14598F2233B0D4B9B49CD813222148507073820EDB2E31F05F5F0F3
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.....................sBIT....|.d....AIDAT8..OHTA..?....[.+...W.{.[..%b.)<u1/!B.Ex..:..&]:...D.@/.!j..A..NBQ........Ow.{;...Oso}O3.......!..!...&..y...\V..M.6.5..`;HX.....-h..>.J<]...v..&.h.s.H...u.@.(.....2.h..c.x..@.../...d..d.7..hP.w.|....'.}.b.H.............`g.7V..{Z.'....=.....:..kPM..w..@7g`._...Rz"..I.h....>..H....CM..H..@..J...?...3M<.D...nj.I.$F....3n)\...@.PJ. @..P|=...Q...&..%aK9w.X..KJ70a.X$..n....c...z.R..0.(..ggg....0........E....h..c.....'...chh.x<..*.?.ri...'j.R.jO.'.....Rt]gpp.Ph../......![.....%...AKJ.."BJ..q.MJ).in..w.fx{...mc.F.g.d.v......u.....h.J..*@.p..H.a..0Z..qE/D....IEND.B`.

                                                  C:\Users\user\AppData\Local\FileZilla\default_dropdown12x12.png

                                                  Download File
                                                  Process:C:\Program Files\FileZilla FTP Client\filezilla.exe
                                                  File Type:PNG image data, 12 x 12, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):198
                                                  Entropy (8bit):6.497648539096697
                                                  Encrypted:false
                                                  SSDEEP:3:yionv//thPlZl+cssrtxBll6+0Nc6Cqxh9WTISFMubQDG/6AG3m2xS6V2mOR/llN:6v/lhPIcssY+09q3KtDGiAiS6V2ljp
                                                  MD5:C3FD3CC255E094B1E22D3B33A4AF1E8B
                                                  SHA1:D0EA20A066994B5DE7772FACC2963B88C99D1B27
                                                  SHA-256:F57C54809C6F56867D167BFCF4763D6A4ABE4E27FDB9C4421CEFD6FCFA68CF1E
                                                  SHA-512:06FCF40DE2CD8208E90E3DEB1C64CBF1E5C2A1425F5EC1231FD46C2261980F344D11D58B75FA1D511D72CF979EA19385A6F998796CBA8BACD2F58530CD332BF3
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............Vu\.....sBIT....|.d....}IDAT(..!..A.E....{.2...%. 9......+F..K [..Lv.v.l..-l.....8..%....$=#.&.4g...Z..;}.f6..>r...r.......}.....zy.3.SJ.`..-..7w8.+.;.....IEND.B`.

                                                  C:\Users\user\AppData\Local\FileZilla\default_file16x16.png

                                                  Download File
                                                  Process:C:\Program Files\FileZilla FTP Client\filezilla.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):192
                                                  Entropy (8bit):6.397135716407512
                                                  Encrypted:false
                                                  SSDEEP:3:yionv//thPl9vt3lAnsrtxBllwoIrUG1UQmtYhP38uF4v6c6xYh3QnFROwrDOT+H:6v/lhPysaoiiQmihv8uo6cUYByLOwM+H
                                                  MD5:4C60EE2697897C9D4F78BA92BC464630
                                                  SHA1:9F051658FA3443CF32F93EC0B06D29356808419D
                                                  SHA-256:7BDC9AFD55536992299C1C92E0E4A74EDD7C9819641B613F012E9AB1086E417D
                                                  SHA-512:D92318301DD5B851BF1EC52E34243AA708188982CF1A8801FF0297A80162B8F47B3D713742CDC392103860CD676904319829DF2BB0879FD2D68910B6969C00A4
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....sBIT....|.d....wIDAT8..1..0.......C..".>......|.i..K.E.B.T+.vo.&$....t....E..!.$u.^.......=....`n........8.2U.f..16[J).!.bas.........:n.j..!....IEND.B`.

                                                  C:\Users\user\AppData\Local\FileZilla\default_filter20x20.png

                                                  Download File
                                                  Process:C:\Program Files\FileZilla FTP Client\filezilla.exe
                                                  File Type:PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):478
                                                  Entropy (8bit):7.43127749218001
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7UJnGVR1aLPz7ccbh0eULibJ8oe0KrGpNOtN:/wR1OPzoKfgcJjVKy3Oz
                                                  MD5:58C60BF4F445CFBF3EAE0327B7253C2B
                                                  SHA1:B2867E3F0D00705101E2C400421D28BB4FFFF2BE
                                                  SHA-256:FD5A5A39708D3890B2D118A523F19D8FCBBA814D4E9D30732F1B67E385836B5C
                                                  SHA-512:4C45DAF4971241597BE5ECFF28C05165B09A44F7966A846E22CAA9AA1F533C7563B84C663B57C2A4C5C34EB522BA8BA53A849FF0F4145DC55448E16D8C1831D4
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.....................sBIT....|.d.....IDAT8...K[Q..?..F..Q.j..P.I....P0s.n..^.Y....J......N"B&Q....,/....g..A..y..C....h.w...~....=.i..`..|x\...d2..".....t....f...j... ....v...O,...4.a.j.N..:...:'.......'..O.=;|.1N.....85...%..qiAdv.S8...........py.......B.v..........kcaXY.......Kir_r..'@..[g[.M.g...F....q.U..f....1.S8=<...D......p.J....IO!.2.)o....dm.._.....-.`aGM..p..+.t:...W...z...T..m.8...zh....'..s......B.[a........3...\.......IEND.B`.

                                                  C:\Users\user\AppData\Local\FileZilla\default_find20x20.png

                                                  Download File
                                                  Process:C:\Program Files\FileZilla FTP Client\filezilla.exe
                                                  File Type:PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):721
                                                  Entropy (8bit):7.63919068429158
                                                  Encrypted:false
                                                  SSDEEP:12:6v/70kLUJQ0ouNP1IGmceut+EkqLxUMEzFkgUfrZudHSjZNJlKmaZcKr+:5zSsP1IGmbtEkIU1zFArkdHSjfXYS
                                                  MD5:3CC73AF5D633F172A9D7081B5D97E440
                                                  SHA1:91CC77BB6220F0AF1BE1A4F4C24DD53243485F5B
                                                  SHA-256:9BD6DBC93CB0EAF8628D176F2E92A47DE39D1E76FF89D71E20A0ADFCDE91CEF0
                                                  SHA-512:50BC5B5BB89C6C785FC75E99B20B0858FEBCFBB16BFE731ECA716A740DF38120BA335DDCB73014B39797CAEDD721FE70D73DC188666AA1BC8636A595FEF19913
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.....................sBIT....|.d.....IDAT8...AH.q.......7..63H.h.Y...t..H..H..J.:...)...%.a...R.a^.,....q....n.......A......_./..rb(.:......H$...B....v+..,...B0..x!"...m+.?...hN._+.<..1.0Z.R.8.s....f.].1....o..i...c..q...4.d...i....a..@]ww.......~S.!Eam...Q.f...\nM)e[.e(....v.q.OMM..F...|}#.(.u]...C......>...W......}.v..v..z......%..nf*mV<J..`0.Q.4MS.k.:...........:::.D..........'.7...n~.z..|...211.@9.W..j.....BJ...iHp..8{.Pm.h.......0VH&...a.6.j..@ p..5..t..R....`i.I.+....e}.....8Nn+..v...5.p...-B.!.....s.....y.X[q"......S..._B.A.....|#.l.c^...4......L+..-.S.';..v.......J9.0M.....N.X.E:..'..stt.....+..?.......UJ.2.......X,..,..J....b..t..VEd...U.....O.4\.wzD....IEND.B`.

                                                  C:\Users\user\AppData\Local\FileZilla\default_folder16x16.png

                                                  Download File
                                                  Process:C:\Program Files\FileZilla FTP Client\filezilla.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):284
                                                  Entropy (8bit):6.892803270827946
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPysBQGaiwp0YsCGjQ+cXPJZ38H7eQwftPLi34dWK7GlrTlp:6v/7+G4pSCm9APJZsbeQotPLi34dWSkf
                                                  MD5:18263DB84790C6905EB697A03CF0584B
                                                  SHA1:75C5A5382FEE6B3BF794EB7F15AFC273931DF1B6
                                                  SHA-256:2E5E33B852EF77A4AECEE518B56629D344AFE40F8DD7DC0CB604480108293CCE
                                                  SHA-512:7C6EED8922190FF5214B9948F17FDD8E263ECFA2A328EB8B3BC5F873DE95EBB65CC06D594AB41B1E683D140660C88A9DFF0DE353A88792D6E6AB7D414612817A
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....sBIT....|.d.....IDAT8....N.P...sZ{..L.7|..#O!..o........+..Bt0n..`..`.M..-~.9.~.9.3......g......5...7..^n&..(..3........$:W....F..#v .......lB.Nl./A.^ R......!@. h...........4v....Ea9.P.......x.....;.l.......-..........p..N0.........IEND.B`.

                                                  C:\Users\user\AppData\Local\FileZilla\default_leds24x24.png

                                                  Download File
                                                  Process:C:\Program Files\FileZilla FTP Client\filezilla.exe
                                                  File Type:PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1677
                                                  Entropy (8bit):7.834265423268696
                                                  Encrypted:false
                                                  SSDEEP:24:crsEjseUosqhKwx6FK52mpOC1QSnLBRXeePhx6grmcycwP1BOTlBKVyUs5Rd7B:KsCTrAC1QwBReej/Pk6Jf5RdV
                                                  MD5:005C61A23448C7364F09A0B8CD9FD446
                                                  SHA1:A8269AA799852AE86EC5DC4484FBC8BAD7F91A18
                                                  SHA-256:CB735A026430D839F9D8381BE8B936D4FF368E13558D0B9284BE7A0D3C95FE13
                                                  SHA-512:FD86194719BE9B495F9524646824E36258D39E496885076841EA9C751FE633B15266D134742DB0269787BE23FCE86FE65B7488E49B873EE876EDDDE8916295CD
                                                  Malicious:false
                                                  Preview:.PNG........IHDR..............w=.....sBIT....|.d....DIDATH.}..O.g..3...a<..m0...4..6..........i..vQ..S....C..../...Jr ..J.K84..X..8^b..~.;3.WO....U...\>.<..4..p.n.I.\.Eq...Ey..{.......433...:..DQ..=...[.n..<...........". x...F...k.=.$.D.z...<.....v].........iF.._..{ I...D.K$....3...l|........&.......J.-G....o2....f.......}}p]..e.1M........Xl.....J..4.]..lg.|.....4@..M...).....=.D....EJ).[....jg'*...M..a.6.(...=z..".+r .HdY.;.........cr...R...O..v...,..Tj.ed.+...6.XG.....jU.}.4v....R.."........R.z.. .G8.S.$)B)U..,....:.....!..e.J%x.._....e..X..~.-....Z.X..9....E.,..8...? |.lSl...J...M...<...~....t).....{.......ncL...,...|(.Z+..BK$..v~^.om..2.z.q..F.@.@....UUM.''..E.`.@......j.............E.1K.m...c.Z.f.0.......NM%[[[...........p....n......RU=....9q..(.s.ju.......l..............z2.....$.q......q._...K...c,....=-.-..x.d,....o.........{.b[..Ap.z...W.....p....tcc...x....N....XN...9.{&..s.f.......7.q.....DQ.(.!....z}..R.E..^.</..H)..<....!.|.E7.N.0*.Nv..'x

                                                  C:\Users\user\AppData\Local\FileZilla\default_localtreeview20x20.png

                                                  Download File
                                                  Process:C:\Program Files\FileZilla FTP Client\filezilla.exe
                                                  File Type:PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):358
                                                  Entropy (8bit):7.070361719332529
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPUygsmJDsDgW4pyUkYfnmZUN63wgLU2FssJ4f8k1FwtvXE1J/jp:6v/7M2lEeZUND7fF1ivSJ1
                                                  MD5:6F1521A05994C29F5DB6711A2A56E25A
                                                  SHA1:02C079BC8B2696C57FDC4CC4E0BCC026F31AD8E2
                                                  SHA-256:C0B2F0998B11BFBC0D5EE0FBCA3320CC79A5AF5DF16800F7EDAAB99C7AF0949F
                                                  SHA-512:4E8C58364D2787DE551EB1C9291E347E5C9C9031906F93ECA667CE5A097C025DA2B91ACF6A1A7DD1AF6ECF59C9DF29B39ADDF9F73BAE35799CD153D12405EDA7
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.....................sBIT....|.d.....IDAT8...J.@.....4T.P...d....O!A\.;d.]|....@.N..Ny....%[!.2d8.4C8... ".M....?.......(.....r......7Q.=.e..A0$..........H...R8.....Q.....n.nO>..f.;.PUU..$...,Kp.a......=.d.9.c}.F....O..^...g....t.Y...~..x.Y..Z?p..,P.......Q.A5....i...t...kqQW..UQ.......o1)....{...S5......F;{@mO..../....IEND.B`.

                                                  C:\Users\user\AppData\Local\FileZilla\default_logview20x20.png

                                                  Download File
                                                  Process:C:\Program Files\FileZilla FTP Client\filezilla.exe
                                                  File Type:PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):603
                                                  Entropy (8bit):7.488562276939537
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7CSYJaURMdwEmJXPV9rqHSdih5/Mc3+jHuYqo43H+Jtlr//y8c:B/J7cmZNNqHSdGl+Hufl3QR/y9
                                                  MD5:7CDD1BBF7FF3DDABA37B94B3A8844EFA
                                                  SHA1:44A9CA2DB9EB12457F6044CCD0361CCE001D1197
                                                  SHA-256:682ADA4732A0D9282BA25B65C17D5C487DEA484A95E04E5C50E5C3FB2550F0F6
                                                  SHA-512:B884AF56A671DB8850450CAD5BACBF9975A377F6EAB919643FE6B52E25553725A1E8748B7A8D115AAEAA5D517344FE7B7E316652CF0D08E662F026A5D86967A0
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.....................sBIT....|.d.....IDAT8...1LZQ...wy..A.....q...$1.D.MZ;Q..\.....ZGG.....v........@CJ@..J......}...=...=..O.Ba.8..xD~..v||<#....xe....iA....M..w.|>.eY.7.A:.&..8P............f...0.L...h..X....A.R...b.o..l6;.g.V..a.\.....w....*..`uz..+a...S........8.......~|.....8..an.c..U..I.g....;T[..."DC......S,...+.T*5.....:..dg.T*qyy..a...?..].1M..4]..@{..m.y...PJ9.....Lfx.=.i}.P0...&Rv=A4....~=..R......._i>.G....J...._<..5.a......h..4Mckk.S...>1..h.h8.....V.''. .....S...-.h..;H$........\ON)........R..O.....&..}..Z....x<..).....0... .k.....IEND.B`.

                                                  C:\Users\user\AppData\Local\FileZilla\default_processqueue20x20.png

                                                  Download File
                                                  Process:C:\Program Files\FileZilla FTP Client\filezilla.exe
                                                  File Type:PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):1005
                                                  Entropy (8bit):7.73980574190701
                                                  Encrypted:false
                                                  SSDEEP:24:llqleVTj+6fEZAbr4GZJQ1NPz2PdonXlqzOJ8:llZT5EGLCpzIoVqzOJ8
                                                  MD5:8981536CE9B6CA800D4AA3E1531F5E18
                                                  SHA1:1ED691150BC93181D6B54AA361EA7E8459F2D81D
                                                  SHA-256:FDF9033E11E9A2573320A4012154D4014AD288C3F6528079F22379566BE75D55
                                                  SHA-512:ECBD333B3B473D4647B9EAA03D26D010B04D0061BCFA6D196190AD05AFE59645A42AA19C7397E03804225C4FA692A102AD3A08CC8F0E9E0FACE561B9AF077D48
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.....................sBIT....|.d.....IDAT8...Oh.e....L&.$n6Q.7.6..V...v.B......x.JK<lHK.AJ.zjQOU..4...H..?.l...nz.Mi.-......k........!...[.s..g...=<.PR.d.Rj3p.....#7z..oU..G..a...0.....Nt..!..wo...u..2\D..9.x.....@..b.000....w#..n.F....^).n.=.0.p...[.zc$.i..D,...z.x.q.......;.`.d....\.I.L.4..\5.0.])e..."...4.Q...y^..`.C1..\.x..t*0.kB.P.0...L&sH).'.m.......h.c....#..R/o..n.^....6477O..^.d2y8...q]..@ .8....>.4`..r.r..fj.|g.2.o.........p.OO...a..(...---..!m..QM.F+......!?S.L.V.....*.V.,.:...pED..8.3.H$.....4...yh.J.........u....D).q....e=.....:5>>~[).=22.n>......./gffv'..AV.,:@s..1A^..V..Z...O3.x.@............p8<eY..P(.F]]]....a~~>Y(..{$T*7u.C.B..d~....pO=.755m.,.i..X.e.G"......^;..........gm...p.....v9......[@.};...V.....o.B0.|N....\6...0...$..,.P;..h~:t...Z.\......w.0.4M..4.R.[@M....R.....R...z+.c..[d....r...y.....ggg..R.e '.........../O...=...5.{'....@..[u{-...Y.2.%...._.2..@.XW..u.n.....z]...Z.|. .M..<...Z........3oV....IEN

                                                  C:\Users\user\AppData\Local\FileZilla\default_queueview20x20.png

                                                  Download File
                                                  Process:C:\Program Files\FileZilla FTP Client\filezilla.exe
                                                  File Type:PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):630
                                                  Entropy (8bit):7.570762115435725
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7bOg8TwLXztCiD0QNxb89vizwxWBLBCGbxO3dzb5BQZUhxyi9:Bggkt1Na9vKUqBtxO3RbMUh9
                                                  MD5:FF1A0CACBDBCADD77C43F9E245345755
                                                  SHA1:43A7ED25D468CF2314923F3234FCD8784206B3AE
                                                  SHA-256:281C277F9144F6E43BFFCEF5AD6888E9B8356AACAD75292DB364EA23BF2818C1
                                                  SHA-512:A46505A82C4700B7F6E33BB9160679F065DA7E684F4C3EA4B87359429A12C0E25066549090A94C3577C9119895EA306C431D4AF81252999ABE09BDC204806729
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.....................sBIT....|.d....-IDAT8...OHTQ......6.+Ql.....).u.m*..P.D.P.Y..jU..Ve..EQ...."b*.i3D-..,l......i.o..73.}p7.=.w.{8\. s....S..V..."VC.oT.....i>1..}"..}...."..r4;m.C.W......`...-"...c.bI.(.HYV...<...R}zQ.....:i.Q|0~.h..{._..:.......q..:.....u.@g.Qm.v....@|..m ....A.e>3.t..8...-..~.~.~.....C@......S......X.jv..+.B.b^.f...~..ak.Bc...=X|...tU...Q.`..y.Cc..`..f.:.;6.b.To._Jj......B..G#P....A..N..!.S...t...O.BX...I.~....o.\.(..'W.l5.."..0pU.`..OM.f.R....m...i...m;.|.!..z1q..Hg.._..>..8...N<...w.....lS[.&n...8ww..`.\...$.w...d...J.)'5...Kn.> ._fy...D.`.t...Rz.,..x.....IEND.B`.

                                                  C:\Users\user\AppData\Local\FileZilla\default_reconnect20x20.png

                                                  Download File
                                                  Process:C:\Program Files\FileZilla FTP Client\filezilla.exe
                                                  File Type:PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):550
                                                  Entropy (8bit):7.446043576043875
                                                  Encrypted:false
                                                  SSDEEP:12:6v/78PAfX9TV1QeRbpW8kIUgcTJ3PKgRUau4MK1:hYftTDQ0bp4x7J3P7RM4MK1
                                                  MD5:0AFE55D6CF1766E96B09E7CA9A663FF5
                                                  SHA1:84EC934A9CEC8C8C05BB376F2F6C0D25F5D3F8AF
                                                  SHA-256:4911B7816BD68BE298B77F97B9042643A1353826ED74A98B4B1549A225370D9A
                                                  SHA-512:30B1EE14016EBECCA27385DED905B5F9FD052650F7F5526661FACFCA3CB79378071DDCB792DF6C08F41A864B9E5FDB0E6511A16D3750C3B102D72DA61AE680BF
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.....................sBIT....|.d.....IDAT8...k.a.....$..M...*.....n......t..A..dsr..."...........".R.p.KJ......b..?.?..}.{.{.Q..R...8...:.X...|.]..f*....y.]`v..k....|=..~.e.g..L..+...A...@o"...P.............e...4.K.p.t.?.:..K..N...s1....Y......'.......w....O.N%x|o&,../..ueh..k..A..-.S8(,...Po...?......P.9.....<.......@.F...........+...zR.....v{.l.[tM.#9z.z..8.=.?...*..(X...R..R.Dc.....@.,.V._|b0...C)..X.E..#.r...8..i.6Z.X. vB..`..vNw...r.:...X".....c.E.....f3.I..vR.7.8.`.d..I.D.n..........?....IEND.B`.

                                                  C:\Users\user\AppData\Local\FileZilla\default_refresh20x20.png

                                                  Download File
                                                  Process:C:\Program Files\FileZilla FTP Client\filezilla.exe
                                                  File Type:PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):901
                                                  Entropy (8bit):7.677118109041778
                                                  Encrypted:false
                                                  SSDEEP:24:RwBR/UExIs26EMU+OWeX9mdxkyrSOhvoL:4R/532r+OWx+yrroL
                                                  MD5:4200F34DDE6326197C308F620DE40E17
                                                  SHA1:65EC5671DFD1379228C3EFCAD08E29CC2744BFB1
                                                  SHA-256:81FAD4C1D3BB7678FCD32B29DCF113B4AB869653C4A31EDEF61EC560CFD1D5B5
                                                  SHA-512:2B268F9D2A4D04BC805BBCEF9214E951E54B6C67DF8A9F28824ECE7EC1A5D137EF68C3F4FB8EFC8F3DAEDFD0E53416861F8BD6F0DD9F890C98E2A6A247FA95C5
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.....................sBIT....|.d....<IDAT8.}.Mh.e....;.....q(.)YK..B.....Cm...+.!.b..1H=.h.E...=.*...~....h......5.H.X....ffg.}<...n..^....x.f.U.8q...q.G.M.[..|..!....j...n...J......i3$R.W../......;..z...^...O..i....jU\).Z=)....8%.7wph....i.Y.k..!...)+nWVD.V..n`....<.q8....'....k..|..C.A...._.N.X.H..P:.}b.{G........,".....b.=D.D.,.......n...|u...@..3......w....3....Q.:.2.t.......%P.UU?.....7.jrV .S..Zz.x^.......$]..J..7.....N.yR.....k}.Z.0.Z.Q.Kr.E.W ._.O.p..D"....4...h....2H.z[.+$[.o.6..Fs[s.uz..d.K... W.......)XU.?.?..;..t..M...2e.....D...Xa..t+...].......R+..JT.0..........F.`.O.YA^.0...nG./...D..6`.fq3.u.Q....S.BX.X3.....qM...`<#Z.s3...e..`6x.4{...}...8..H...........x..w...=U....`Oaw...7.G.o.K.W...1)cL.V.........._Ul...X.....*..G..jWjOX.U..+..=_.,.,..?...&...=.O..?.?.nx...c..;Q|..|.[pfv|...z..X+....n....'......../..F........IEND.B`.

                                                  C:\Users\user\AppData\Local\FileZilla\default_remotetreeview20x20.png

                                                  Download File
                                                  Process:C:\Program Files\FileZilla FTP Client\filezilla.exe
                                                  File Type:PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):356
                                                  Entropy (8bit):7.098917656044776
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPUygsY8xwQ6LmoekoGd5l8V6LnTIPIKoEz+hv72GJRJdSd8Q1Up:6v/7teLmTko48aFKouIDJrmW
                                                  MD5:6C92B93B3D359862261CA013F82A67B9
                                                  SHA1:686D673FEC2C04806D5C696289C4101DEF3485DD
                                                  SHA-256:C9FB39828A6523088FACF944E2DA8BB2844D902C23BF37CBD9A855B316E507D6
                                                  SHA-512:270A42B391EBDC46F8186F18EEC19608E9251DA692C611C36D8511362B12DACB8A4DA41E1F4D6F53F55C7A219396E8A2D029CD1C758BCDC7D2E69C946308C128
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.....................sBIT....|.d.....IDAT8..J.@.E..&.E.q..I...V.......`..6V..@J.!v."....X.]@.V*DA.&1.XE..5...[......e.c..`.).X..O!UU..N....Rj..}S../.c..S!...E..e.8.Z.>pfX.e.aX..m.#.......smf...........g.y...M..(.X.]5....v.75[Ku.4.;......Y.p..pcy..OS.........)..7...Q`...,.'..p5I..,.>...(x....UY.'G..@...J`..E...u..aFO6.......IEND.B`.

                                                  C:\Users\user\AppData\Local\FileZilla\default_server16x16.png

                                                  Download File
                                                  Process:C:\Program Files\FileZilla FTP Client\filezilla.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):404
                                                  Entropy (8bit):7.158000699972321
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7Owh1/PXwybmfGFXrslP5dy8MFmFuA4jmt52:JvfGhr+dy8MFErL2
                                                  MD5:6670CF82643C30A76C2DACA06C905300
                                                  SHA1:FA7D5E4598FB5B0197089789E8EF86C58A1844F7
                                                  SHA-256:DF80C93867BE064951F5D8368C88EBBA3364BBED135DF9D9C563B805A7879546
                                                  SHA-512:58181376F00C066A5F60C64635C9E3C22459F1D422C947567615435EE6741C72E7483FE4A9C60CF4EA3C412B9E874A1D7546056DFF65354FB79A67A281CEA4E3
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....sBIT....|.d....KIDAT8...J.Q...w4...c.....\.J7A............GHj...m..bh$.h.3..."-u....6..w.s.Q.M.T.RJ.M.V.c'".Z.xZ...(.....lw..^...ug..j.X.....b^.T;. .....k ..Z..._.i.6......2...gD._.t_........D.Q./....h.....r.....H.""J.W.h4fZ...8.v.[..X..o.&.v...q..y..<....b..u]].V/.w....B..r..4.m.`/..f..Z.m....J....a..z.o...#.N'. ..{.|.bi........#`0...-.sN.._i....IEND.B`.

                                                  C:\Users\user\AppData\Local\FileZilla\default_sitemanager20x20.png

                                                  Download File
                                                  Process:C:\Program Files\FileZilla FTP Client\filezilla.exe
                                                  File Type:PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):994
                                                  Entropy (8bit):7.695952030947907
                                                  Encrypted:false
                                                  SSDEEP:24:ZEDGAL4qqJmCvvCLAULHyuqhH1vS7if/ApSJ4pWb:ZcG2GmCX6Aoyur7iApSKp0
                                                  MD5:0DA3E808ABE002C20B4451F5D0F2990F
                                                  SHA1:45D6184F6B856AAE69E20FC957A0C7D65486BC00
                                                  SHA-256:6B2CE84C384134C13BCDBF03F3163EBD9B59E6E40D5A881DF02A2B671F8F12A1
                                                  SHA-512:941AA113DB81A0651D5A4CB8BAE4AC3CC6CEA14051DFFB0C1E6A5B4588F40A48412814D3210E89283E1DD9F82A7E2AA24ECB67C5CDF40803EC5DF26F4DF4E20E
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.....................sBIT....|.d.....IDAT8...Kl[E....__..S.k..l.M.R.6J.I..@A.EeY...Db.H,.;.l.`G......5.""...(I.....(..NR...#...{=."Np.P..Fs...9gF#..u...s...F.@./F..k.'..G.'..j.B.....F......T._Wm.kw1....;E8..Bk]......@.Ry..z..b....EN..&.....-. ...k7.p.xP.H).foU.\,c..l.6...)<B.k7q|.U.e.)QJ..~......b-........k.R.^j>.]^.@$d..s..l.b....h..c.h`.....h.....=.kl..!..I.....?.:...M={.....m..+uG..)...........e....q...#..]]]...R...?....a.;5c=.{.T*.e...nu...D,+.$.R...|>?.[[.............X(.......B..........O.....<5...B....*..u......K./.8....s............k.;.}..<@vu....7n7.._...@.:r.h. .z..w...~.h...{......T(.m.j.ru.^.......@ ...&....t..C.........r..#Z.....R..E..8U.q ..."..@.05....?...Z.^.n..40.e...v.2.......M@..M...T...N...h...;.x*..14399...m^.d6R..[..t:}w...l..o.....XZ^f!.).=p.3..6*...Tn!../d2.M.wZ..hT<..PJ.J.N."%e.....T,ZJ.P.-.n...R.l:.Y...........^oUJ.h.}.:.Y..i........R...@.0.c._.U...8....5!e..5\.......p0.....;y...,....a=.....IEND.B`.

                                                  C:\Users\user\AppData\Local\FileZilla\default_sort_down_dark12x12.png

                                                  Download File
                                                  Process:C:\Program Files\FileZilla FTP Client\filezilla.exe
                                                  File Type:PNG image data, 12 x 12, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):241
                                                  Entropy (8bit):6.700196014606134
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPIcssqRxrx1EYk7ntRgLQ0eLQ7DebBNAEup:6v/7DUv7kBRgLQ0e5bBNNc
                                                  MD5:5B2F41923F07FBC8419D35C6021B9556
                                                  SHA1:AEE4E3AC8941E1709C7947F0DA546026555B700E
                                                  SHA-256:751A1DE9926BC71EC3E88A2433E14BDD2CEC9DD7BAB7068AB3574DC1EA87792C
                                                  SHA-512:505FD486009B5F12B50E4C7ECE0FCE39D4A646A11940EFB2CEA8AA18D6C28126867406D69E1173D235A5F8B9968670A9C0ED34566502058E208E4A811BB9C956
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............Vu\.....sBIT....|.d.....IDAT(...1..Q.....`..G...t...Q.<...V.$N...h.........)..F]._vE.,..bf............8u.,..*.4..=.w_.......l..<.1.C.[......GWIt.u.47...9......1.B......t....]....,.a.).....O..v......IEND.B`.

                                                  C:\Users\user\AppData\Local\FileZilla\default_sort_up_dark12x12.png

                                                  Download File
                                                  Process:C:\Program Files\FileZilla FTP Client\filezilla.exe
                                                  File Type:PNG image data, 12 x 12, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):250
                                                  Entropy (8bit):6.742697846748778
                                                  Encrypted:false
                                                  SSDEEP:6:6v/lhPIcssXAOVzZ+us5dpRgKeY5ElKLfOBaeup:6v/7Dnzkus95P5v7
                                                  MD5:4FF09492A391A46A586C6DB49996C3AD
                                                  SHA1:FE7DD314C91E1D975E9260D907CB9985FCEE547E
                                                  SHA-256:1D4B776DBC96F90F4EBCBEF4E9E71C1E4543AF3DF862954D53B8E5A8E4C722EB
                                                  SHA-512:BFFF8C81EE9120059D2388C7D8977F24FD8C8A1D8CEAEEF509734F3C08240DD7A2401EB1297054BE0B84375518DCA625B4C44DCA059453011263F46F83B9A128
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.............Vu\.....sBIT....|.d.....IDAT(..=..@..gWR..S....D,....x(...g.J.....>.vi.}6..n)..3S....1F.ct.....D.`g..S>K.@..Z...,m.u..L...MDz...3.).m.m.a-"..T....c......;.z`5..c "..x}....Z.^.y..;0...."...+...<.~.'.-^.D0.N....IEND.B`.

                                                  C:\Users\user\AppData\Local\FileZilla\default_speedlimits16x16.png

                                                  Download File
                                                  Process:C:\Program Files\FileZilla FTP Client\filezilla.exe
                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):803
                                                  Entropy (8bit):7.602692181010333
                                                  Encrypted:false
                                                  SSDEEP:24:Jr+5Bt76gnXPdf5E7B+mI4mq9mVvGUGARpIRztz:J2AB+mI4OFQztz
                                                  MD5:EF56A56C6385B8E73B8DF483FB2B7286
                                                  SHA1:C6E48244EAABC2F91745A996987267911B9FA242
                                                  SHA-256:8C31386474FBFEC93A303DF0ED1B2D6029CFFD648604A1FB91A9969107D2186F
                                                  SHA-512:218EDB3E3D8F566CA20B289BB0AD4FF667FD12C6F076F21701E07B2D5B6DAA09F4D9A35D0894D00EC46BAA709C425275B655383F0CD5A5048B1CADCEFC89AB9C
                                                  Malicious:false
                                                  Preview:.PNG........IHDR................a....sBIT....|.d.....IDAT8.}..k.w..?.o.;.VB.`..r.....B+.".HC.)?....O.B..l....EPa.PJ.O6..].....m...5..t8....8....%.....>..3<......w.{R.._.v.G.^..<..*...F...B.....t:.+.....V.?;.\.S..v.Rw..B._....177.5c&K.K4.....8..<...U*..m...b..-.0|B.o.........G....&4N9..L..~.VDL............*...d.Z;..._O..n]....:/.^.>.NN....QX....)....X,6. .{333<9|...K7yx.!..(J)^.....=.o..!....d2.iY.m .R^...i4.2.......1.......f.....>....:W.Q..S@...EKX.G.Q.*.....8.C.....!5...B.o..@..d..=.f..W......R).n..a...~...gb...8......z......8..."..PHd.Y....x.x.l?..V...v.%.g.r..#....#...r...O>fmm..W...0|.|~.V...UQ.......R...?.....AY(.<..R.......OC....l6.'''.`.waaa!...&.HLf2.111!4M.u]..:...lnn..l6.;;;..&..A.T*.....Y.u[J9.....t<..m{e{{{..|.x0......Q....9...3N....?....IEND.B`.

                                                  C:\Users\user\AppData\Local\FileZilla\default_synchronize20x20.png

                                                  Download File
                                                  Process:C:\Program Files\FileZilla FTP Client\filezilla.exe
                                                  File Type:PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced
                                                  Category:dropped
                                                  Size (bytes):823
                                                  Entropy (8bit):7.6926478920199175
                                                  Encrypted:false
                                                  SSDEEP:12:6v/7gCzO+2qGfvUXjyfp7K7cNX4YT+QfXu13lGGQG+qYmY5IAiIgIKsKbJ/Peb/F:/zUXapGJYT+QqF9YmXXL+aa42
                                                  MD5:18A1FD4D78B7875FF7A41FACDDEBABD5
                                                  SHA1:EBBFFE12BA1CCCD8FCAA472EEB79DB08F76C56C4
                                                  SHA-256:51ECA3CFC0917F0CB8B439AE7BF55525924A9E12083A078D8C9422B1B0B2CE47
                                                  SHA-512:7C50FA67D970EE35223C6652255896E5E489EE615E0FC940E3D5E7B26933A9E06D9FBBFECC3AFB914D1B6E68A8B9939331E1686BCC348C9638DD4F3C9F9BAE02
                                                  Malicious:false
                                                  Preview:.PNG........IHDR.....................sBIT....|.d.....IDAT8...Mh\U....}L.7...I......A......4.)(A.R.....J[(.J?..".k1.k. .ulKE......Uk:&v.$3.7.}..7.i......?.s....!d{.".:..?..z..5..eQ*....J>..rvJ..n.mYV&f......._...x........a....V.H.S...8.o.G.R.T....I.y..uGY..9c..#...bY.U..^B..(.Dr.N....".........0..E...g.....2.B.s.=e.cx+.F.W...Le..'.?y...G...w.1..k.s.....5.8...Ux .E}&4....?....7..Y.0..'.!7.G7..cN....6..$.F...Zwl.G{...7..".....:.h6.?A.;..U...n.}.t...?\..7...r./O.=.p.|......Q(.t....4p:]....._................-,%. M...;.k6....-....B.{..A../...'...9.@.a..@.i..(N=n....O....W....upd....Hm......Y...qL.$.....-t.i....V..:.._<.z..+....n.JD..}. ..o....R.....,..9QzE..#...2.g...o.>.1EeL..A.|.....J....\...+.....K..n7.. ..y.4P.N#.(B.#..".k\....t.lS.#"o*....I.. H..;`.hwD..`.....=.......2.....IEND.B`.

                                                  C:\Users\user\AppData\Local\Lavasoft\Search\Logs\search.log

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Search.exe
                                                  File Type:ASCII text, with CRLF, LF line terminators
                                                  Category:modified
                                                  Size (bytes):2474
                                                  Entropy (8bit):5.262484821708038
                                                  Encrypted:false
                                                  SSDEEP:48:L2CFTW5FTNCFTBuayaymOQFTF7a2FTN6StHYFTNFFTw2FTyZFOQFTX7aeFTo6Sto:HeQBT5DwSaZTg1zSSFzP
                                                  MD5:97176D79C94D3D1F97763A0AD910041E
                                                  SHA1:0787CC2236842A754595062B6B85E26D3851FAAC
                                                  SHA-256:DD8EC0D59955FB0C9D3AF0CFBE8CEDF77D5530D21DAE7FCCA31F9975406679BF
                                                  SHA-512:14FB4FF38F5F9DCE39F0E902A384A9B13E9646B1705CB1B0465411C49FB2A848F56244DA65A4EDBC66969AF0603D5CA8B3D86D289BB8256439113E43FBDF7168
                                                  Malicious:false
                                                  Preview:INFO 2024-07-22 06:36:26 [1] [#kT.#3V #1V] --------------------------------------------------------------------------------------------------------..INFO 2024-07-22 06:36:26 [1] [#jU.#QV #HV] Getting search config data..INFO 2024-07-22 06:36:41 [1] [#kT.#3V #1V] --------------------------------------------------------------------------------------------------------..INFO 2024-07-22 06:36:41 [1] [#jU.#QV #HV] Getting search config data..DEBUG 2024-07-22 06:36:46 [1] [#gP.#fP #BM] GetCurrentHomePage() return about:home..DEBUG 2024-07-22 06:36:46 [1] [#gP.#fP #BM] GetCurrentHomePage() return about:home..DEBUG 2024-07-22 06:36:48 [1] [#gP.#fP #9O] GetCurrentSearch() return Google..INFO 2024-07-22 06:36:48 [1] [#gP.#fP .ctor] Start monitoring FireFox Browser..DEBUG 2024-07-22 06:36:49 [1] [#kT.#kW #4V] setting search#kT.#pTusing commandline..INFO 2024-07-22 06:36:50 [1] [#kT.#kW #4V] Setting commandline search #kT.#pT for browser Firefox..DEBUG 2024-07-22 06:36:50 [1] [#gP.#fP #yM] Cl

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\-nfivvyf.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):2470
                                                  Entropy (8bit):4.276443691983494
                                                  Encrypted:false
                                                  SSDEEP:48:cFGnvQEAnaUOgnDEAnYGEAn0EAnGmEAnlTZCEAn7EAn8fEAnYJEAnWLEAndocZI4:ZnvlAnP3noAn0AnRAnQAntZTAnwAn3AF
                                                  MD5:A91E0FD48489AFE3EFD608A2A3BE7C42
                                                  SHA1:CE1CC6D9124422E17793A2CA003F1F1975466E6C
                                                  SHA-256:630442B98EEE84171E0659D5D3A86FAA942BCF8DFD74C1102AA7275BE89B1E83
                                                  SHA-512:AF62C1BB571FDEFE4A300ADDCD1AFAACCE7946341DB7ED32715F6F6C2C63F972CCE9CAC8F72D1EDC14458279E5B3204645A9FC937EA60403654C311EC7C471BF
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739164.08:27:07.4570369</value>.. </setting>.. <setting name="ProductVersionType" serializeAs="String">.. <value>Free</value>.. </setting>.. <setting name="IsSearchProtectOn" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="EnableWebBar" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="IsMURLOptOut" serializeAs="String">.. <val

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\-rr3idmi.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.261734131167241
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnCx86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAB:JYlDc
                                                  MD5:5B6205C8A5DB1DEFCE80C642282C10DD
                                                  SHA1:BB9EA95B77DEF1638CC90AFB1F852AF0C33828A2
                                                  SHA-256:783B82FFA437BA5E32487DBCAB4DB8022E2C19E68E99DB22E1C3441376CF41B7
                                                  SHA-512:0576AEAC84367DB41D275E8EC706568FD148D101E89D6F28E7163EB1A541DA5ACE75328A5510F9029E47180F2BDA6D4EFC6898383691F36D8FA3CFE3C7B2F06D
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739602.12:36:46.5958173</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\-ypunmpx.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4101
                                                  Entropy (8bit):4.248908882425839
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnY4L86MnmAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZBAnEoAndoK2:u44fD6
                                                  MD5:7BDD440FF734AA9595614A3EB761DE4E
                                                  SHA1:ADCE23AA4B2A0D4EC3A187504AF7CE37A0015515
                                                  SHA-256:134F6B696EC311A8EAAD73BAA510BCEE3350D260D284FBB0781E8C9951760534
                                                  SHA-512:DF4040D1070B5DDB55649C037221DDED7E7E96F4A92E86BDEE0DAAD878FD0EB247B991586E24648B2315E42DC355AAE925B19A3F870F37FBA3C6F267524098DA
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739181.07:45:35.3065719</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" serializeAs="String">.. <value>about:home</value>.. </setting>.. <setting name="OriginalDefaultBrowserDefaultSearc

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\0b0mykqm.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):2470
                                                  Entropy (8bit):4.275567255936377
                                                  Encrypted:false
                                                  SSDEEP:48:cFGnvQEAnayOgnDEAnYGEAn0EAnGmEAnlTZCEAn7EAn8fEAnYJEAnWLEAndocZI4:ZnvlAn13noAn0AnRAnQAntZTAnwAn3AF
                                                  MD5:44A2BBFEAEE85B736A154D1E6B6250A7
                                                  SHA1:961C9838CB363A33DD945C20286F477890DFDBFB
                                                  SHA-256:77FCC809A2DB996FD4A9C9C30AC175C59F1A99B7699925FD801BC5E936346F74
                                                  SHA-512:818CD3C51035710E47ADAAC55B36D3F3B0EF14B5E4F0B2CE4849134423DC37E4B351B011D4CC2AAF9BEFA891828F0BA1DA42E80CAFFB0448D716DDD07556A99D
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739164.08:40:36.8513169</value>.. </setting>.. <setting name="ProductVersionType" serializeAs="String">.. <value>Free</value>.. </setting>.. <setting name="IsSearchProtectOn" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="EnableWebBar" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="IsMURLOptOut" serializeAs="String">.. <val

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\0n0hm7na.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):2893
                                                  Entropy (8bit):4.279695226975723
                                                  Encrypted:false
                                                  SSDEEP:48:cFGnyEAnvQEAnaFDMaOgnDEAnYGEAn0EAnGmEAnlTZCEAn7EAn8fEAnYJEAnWLEA:ZnjAnvlAnyT3noAn0AnRAnQAntZTAnwV
                                                  MD5:A29B499CBED6405047643B5A393B322D
                                                  SHA1:87BFB963404B8501E94262F9105F501ED6068380
                                                  SHA-256:22CFD977AFA4F37CC52C3534FC05FDAAD86F4D274A3D6FCA738529945F470425
                                                  SHA-512:592F2876B405012C05D5F080D65D69A684FCE14DAE5D22CB60B5BD6ADDFFBDFE7C9492B8E2A918F56146612EAAF66CA5F4D05D11AA895EDCEF52FA234070D59D
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739171.08:44:11.6983146</value>.. </setting>.. <setting name="WCActiveLogo" serializeAs="String">.. <value>AA_WebCompanionLogo</value>.. </setting>.. <setting name="ProductVersionType" serializeAs="String">.. <value>Free</value>.. </setting>.. <setting name="IsSearchProtectOn" serializeAs="S

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\0yzh1irx.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.260889508894159
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAndx86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAB:CYlDc
                                                  MD5:4A491EF2A8C6B40AD4AD14B71919A1C6
                                                  SHA1:F57B6F091D33F3C8CC9F825FEB53B76B57D9CE11
                                                  SHA-256:C627320A92EA68425B0E54DE7E119D3BCAAADDED9A140EC246453E50EF04FCE5
                                                  SHA-512:5C4130DA36E254A09B8A74A88995C72BA91F0BA1DD45ABD222DDFFBBAEA1F0187216B1EC76E12CFCE1FA670AAC9058BB66C62353BACD1818C6C8FFCBD9A73EA7
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739729.15:31:54.6707000</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\1kde_v-x.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):2893
                                                  Entropy (8bit):4.280816938865746
                                                  Encrypted:false
                                                  SSDEEP:48:cFGnyEAnvQEAnafMaOgnDEAnYGEAn0EAnGmEAnlTZCEAn7EAn8fEAnYJEAnWLEA1:ZnjAnvlAnUT3noAn0AnRAnQAntZTAnwV
                                                  MD5:9C3931DA975B9AA5716B3BEC31E887EC
                                                  SHA1:1408FB2D80F5ADA1B7008747886A0B3B16DA08C9
                                                  SHA-256:ED768590E855B2762FEA617CBBBF6E35E3BC3A8F5CAAC1F8FC459B00BEF55030
                                                  SHA-512:66CF831D0816B5DC4E8857CF1FC3B8C87891CA507E0853A45B3CA33A92C74A3C74FDCB3DDA4BBF1AA7AE167A7B29658F2D362C7317A757EC921250F8C87C30C1
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739173.08:54:11.5621761</value>.. </setting>.. <setting name="WCActiveLogo" serializeAs="String">.. <value>AA_WebCompanionLogo</value>.. </setting>.. <setting name="ProductVersionType" serializeAs="String">.. <value>Free</value>.. </setting>.. <setting name="IsSearchProtectOn" serializeAs="S

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\2crzkhfa.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.260914540053853
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnYx86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAB:vYlDc
                                                  MD5:0556322231B1FAA6ACF3F02702FEA1C9
                                                  SHA1:15A3024841E6AEF4BF8FD928CDF0D28ED9E33C0E
                                                  SHA-256:CEACF33F806391E9B805FBC94EF8F796CE43892F84343E64866E9CC880D19DAE
                                                  SHA-512:2EEF57115C47568C9CEDBD1524B08E1B910D89C70A901B5CF55EF89C968ACC8747CDD24F4C0FAFCE30CEFA02A0BD9A13B1B6C8890DB5E8BFA35BD01750DB6133
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739576.09:51:12.3223176</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\2rielidq.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.262058533236512
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnHx86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAB:oYlDc
                                                  MD5:F859EE1AB45083103CE549C2D0808C25
                                                  SHA1:A41858E94D70C3A993704F13979E4CCCB2CA2312
                                                  SHA-256:2D82FCE1A8D363A88783E494C9F59BA266FDE64D5F6931D8B8A8E1C5A9103C6A
                                                  SHA-512:2FF439F15147FD174E34A60E2552EBB84CF5E5EA7039A4AADDBEEBD360F9A46778BE65BA015B75E0C388B1FBD1E0598965D34F78040AC3D9A02910B88AD1E467
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739869.18:45:59.4618122</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\3he_teb7.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.260781188662962
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnFx86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAB:2YlDc
                                                  MD5:C441E74D5E98F49F2D56CC088614EE1B
                                                  SHA1:6D47E029A8BD5AD5E0E09D64D7AE97BBFE03AADA
                                                  SHA-256:A4143B3FF675F868E9F865EB3A48F370E43D859AABD5B357F963EF8932D45981
                                                  SHA-512:53F78B2B077AA251BDB05A288AC92EE83643B5F34B2D392C917D8670CC81762A293629AB35DBFC80E0CB85499CE4F9FF62E2953B60A564EDDDCD6240EB53AE7A
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739614.13:37:20.1777064</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\3iaokxt1.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4101
                                                  Entropy (8bit):4.248813696001658
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnx86MnmAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZBAnEoAndoKH3m:QfD6
                                                  MD5:E0A404968DF5DF7407747EA2E6504488
                                                  SHA1:002A527C852D4BA4760F785B6EF13C3A31CC6C5F
                                                  SHA-256:565FF2DC78D3CA7E11956FCC70B1A761F65637E78DFE1EC42EA091FEE983046A
                                                  SHA-512:A317D07BD5A6D82558D0A53352EF534305762901FCAB91DD454474B8DA90F88E7696F5D927AC5561393FEA03AA0B97565E4E7937B7943166AD731A9AEABF1F31
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739190.07:55:36.0195697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" serializeAs="String">.. <value>about:home</value>.. </setting>.. <setting name="OriginalDefaultBrowserDefaultSearc

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\3ilrzxqd.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):2893
                                                  Entropy (8bit):4.279216803890603
                                                  Encrypted:false
                                                  SSDEEP:48:cFGnyEAnvQEAna2kMaOgnDEAnYGEAn0EAnGmEAnlTZCEAn7EAn8fEAnYJEAnWLEA:ZnjAnvlAnwT3noAn0AnRAnQAntZTAnwV
                                                  MD5:21139B60A8857108BFF49521DF3A0B21
                                                  SHA1:75845904318316D8FAD4DE3C1542EE7ADC4DA035
                                                  SHA-256:1B01F826D4BDABBB3E5B64365C102F2330F11A57135C1959EF7689AE2BC7253F
                                                  SHA-512:E1AFC5F5D4C019F7C46579EC8D32FD575546005FFFB7EB877FAD2128AD1BDA0FDDAA7A60C37FA6E80827D10233EBDCCEC41F551831CEF33D003050A40263C926
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739178.09:05:41.4701944</value>.. </setting>.. <setting name="WCActiveLogo" serializeAs="String">.. <value>AA_WebCompanionLogo</value>.. </setting>.. <setting name="ProductVersionType" serializeAs="String">.. <value>Free</value>.. </setting>.. <setting name="IsSearchProtectOn" serializeAs="S

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\3sz5g85q.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):3568
                                                  Entropy (8bit):4.263344962361416
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnEZ86MnmAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZdoKtAntuAnw:WGTj
                                                  MD5:AE4837D9D9D53118AA8EB8374BBD7EDE
                                                  SHA1:C2961D99D86661A5650C5CC14DC0905CD2670F7A
                                                  SHA-256:AA5CFA2C94CDD6D8B5B86FB89F0A37CE30959FF8462DE7C4E2B4EC1FEC6A611D
                                                  SHA-512:A026F7486291304D7EE8A641492F16402237EEE9B88ADC715446A0183CF94EECD956B7A7FE67C406608F24801D474A074E926C9C17E466BED36E0A61AED86BA4
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739105.07:12:01.2051683</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" serializeAs="String">.. <value>about:home</value>.. </setting>.. <setting name="OriginalDefaultBrowserDefaultSearc

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\3zyu159c.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.261957324956423
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnCx86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAB:pYlDc
                                                  MD5:F981304EA692F753EC98D45CD190DD16
                                                  SHA1:C8A052EA393B3B92CD95B4AE0B00F7559D9879A0
                                                  SHA-256:28AC45805DB937046B637D846CB1C1BCD11A74B80028F8AE580C09973848BECC
                                                  SHA-512:C42AF4A81B2E22962BA860BBC0105F4D54CD60F63E1D9D2B2A470E7CAEB7082137F9D120F7D05F755A3F31AF607643D6F6DE6B4596430FAD65E8EF9D6041D881
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739862.18:45:55.8387084</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\4hun-zo2.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.261217204430486
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnCx86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAB:5YlDc
                                                  MD5:D580B8F28DD79E674940AAE5E6BA2B10
                                                  SHA1:9E32F1119D847EDD88124632BA9ECBAA7D161199
                                                  SHA-256:22B564A53518E24380BD2D6259B455D5CCD53C46F184306349DD17856EE0CE83
                                                  SHA-512:5E75ED2EB6C1F2477B57154799AA6EB553CC9F4EB5CC0DA56583854CE077025BD3041583B4565B88D871E3F794C29E05F9105500EC7B8FC74A6DE54035A7CD76
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739873.18:46:00.8861909</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\4uq6inas.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.261692028949098
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnbhx86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBw:eYlDc
                                                  MD5:E9BDD427F8F5B1A97FF696AC441F0983
                                                  SHA1:59F6827EB1F6799878FD54B768CCC92CE1E7205B
                                                  SHA-256:7861D7F774F2786FD5AA6386DBECFA5FF07B8DA1D9B49B18C9182C8FDA1AFF0D
                                                  SHA-512:FE112CDEDFB92DD0E72A7099DC075D3BE8E05256BA5F9D47AFD8F4EBECD86396CA806763F1F2810FBA957DEB5AAB0C64E674F2ED1F3951301C63AFD6EBEE2940
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739601.12:36:45.8288261</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\5je1bjdb.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4251
                                                  Entropy (8bit):4.276842983102524
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnpx86MnmAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZBAnEoAndoKHW:OfD6
                                                  MD5:DC7AC02018EC451251F8858E7542C49F
                                                  SHA1:9989EA172EBFB44E800AECBA93C3C64DD74AC179
                                                  SHA-256:834107A541D9F150B5458262AA97F05C3A09934EA52E9FF19E463AEAEA707628
                                                  SHA-512:3F6D51BDC3A16C31E72D2A489C975C90218A612D1EBAFB8FC705ABCE5633BAA6BEAD487BE0B06329858FF9F81FCC4AB077D3C051299DFA63974D683A4B3BF1F5
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739200.07:21:36.3255663</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\5z3cgtud.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.262016464625693
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAn+x86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAB:5YlDc
                                                  MD5:A1869FD8871C432966CB66599B229242
                                                  SHA1:4AA393320649796BC83B5B64D9E411E3FBACED5F
                                                  SHA-256:05831A4AA50366E38BE48E47FF149376FA64001A0F5FA6BD75E757ADC481BAEB
                                                  SHA-512:A8FCBFB66FE4E2F3D8A94B4D1D73D365B780C20956B001839577B8FC64CD48D5B85B00080BA71E4C6F5D50702FF6A3FFEDF473B6FF812CE225E5AC271F78BBC2
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739861.18:45:55.4893258</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\6gmejc66.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.261070187761701
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnFx86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAB:iYlDc
                                                  MD5:6FDDC01BBC998B17F3ACED876BE1DE17
                                                  SHA1:30BFCA7CE1CC16CC817DB18BA8AF70E3D2FE044E
                                                  SHA-256:5177E8CCE306F384566A6F49B6F4AA9D57A06E76A5228D8AF9435F478E72F438
                                                  SHA-512:EBE424D0DCCE5CDE84EC2EB31278C903CE3C05235D7FAABF18A6F97B42619A5801D34B02C4AC3CEBFA61F8B560D4BEC3C1362A01CC2015453DC6F2C37B397302
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739592.12:11:13.3365814</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\79alljla.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):3437
                                                  Entropy (8bit):4.270885208144307
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnEZ86MnmAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZdoKtAntw:WGTp
                                                  MD5:788A94C45232C3A83A8EC7F03210DE91
                                                  SHA1:66E5AB47F73B70C4C4E250394A5D95C43EEC0BE7
                                                  SHA-256:06F05507D9B51E678CB1E39ED076E925035469FC632F27BAC04F5AAC9D3B27F0
                                                  SHA-512:F9D46ED9108D784FCD8A5225A08E124027472A3EF4448A0EA5D9243BFD13FEA3FFCD81DD6512D9D63D3CE9EA16D014B307B320366B3C6D2762C735B390280354
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739105.07:12:01.2051683</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" serializeAs="String">.. <value>about:home</value>.. </setting>.. <setting name="OriginalDefaultBrowserDefaultSearc

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\7_q9_r6j.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):3296
                                                  Entropy (8bit):4.255747869308645
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAn+86MnmT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZdoRtAntw:LGI
                                                  MD5:84A402C79E93674C10EB90C8139C7B96
                                                  SHA1:2DB017888D9B70E42911334A91EE289AFB21B329
                                                  SHA-256:039E055ED8E94D417852F252C5140796FACC990677BCB051D1FC27D8E9651561
                                                  SHA-512:D11A48CBDB33249EEBD4612253CFC8F9DD65669C8D8382A1C661BA652498319082435D32B3DE4FAC1A750B0C056CA84052B741204331157B39A91A0FD1BD0ABD
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>12.09:39:09</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" serializeAs="String">.. <value>about:home</value>.. </setting>.. <setting name="OriginalDefaultBrowserDefaultSearch" serialize

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\7ql3xh7w.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):2324
                                                  Entropy (8bit):4.242122953974393
                                                  Encrypted:false
                                                  SSDEEP:48:cjQEAnaMOgnDEAnYGEAn0EAnGmEAnlTZCEAn7EAn8fEAnYJEAnWLEAndocZIEAni:8lAnl3noAn0AnRAnQAntZTAnwAn3AnfN
                                                  MD5:CC088C6E4B2790F16CB875DE6B79B74C
                                                  SHA1:3A9F843A5A1AB1723BBC0E316F9DF5C2F31B1C02
                                                  SHA-256:7C811C11E3E199EC016BF92BDBBC2D481E04830422DD5C5FEF614718EBD8EEA3
                                                  SHA-512:F13F64FAC02059D812125893FCD93090C35683CEEFC62500327C1DA982D6F6FD8BB215A3E6D20121F68CA17C7DDA14BF69F5E4F47C22A8F7753F8C3026EF6ADF
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>00:00:00</value>.. </setting>.. <setting name="ProductVersionType" serializeAs="String">.. <value>Free</value>.. </setting>.. <setting name="IsSearchProtectOn" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="EnableWebBar" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="IsMURLOptOut" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="EnableChromeExtension" serializeAs="String">.. <value>False</v

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\7tu0vlm7.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.261139732849134
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnZx86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAB:uYlDc
                                                  MD5:A537E2B85A27C8182091CDCDE93414E4
                                                  SHA1:773955DB9B0136A4A12E2AC9604B1DCEC8ED7119
                                                  SHA-256:46952B3D793108D946B27795B9480CC6B147341FEE46E7449359EA598C8957BF
                                                  SHA-512:FB462F5BD8B1847423998E16D3FC312B3D0B3583E25B07B4FA9892B67A42494513A03BB0E110FD4120134A0AAF1A937B708BF13947536A53DC1C9B87BDE56691
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739745.15:49:58.0900017</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\7xwe7tgk.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.260960460756048
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnRnx86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBw:7eYlDc
                                                  MD5:ABC2055459C7A898B33AFAEE0DFA7CF6
                                                  SHA1:465970D88598EB4961C2D2B9F663D948CBBD163A
                                                  SHA-256:C9B9D0D32DBDD1901579BDC5F7BAC5F4CDE23BE72D8A89282B158CC0BC88248E
                                                  SHA-512:3BF7BF13795FD0A6736D348EC6A163F5348F8695E85764B3B57BA53FDB974553BCDC3200E1EBF076A86FF913CCC668E1ED9D50779885165DBA8E6B13BD655439
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739750.16:06:00.2282125</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\_faxtid1.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.260706976941342
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnuWx86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBw:kzYlDc
                                                  MD5:18D245546C5B8D609019C030669B7267
                                                  SHA1:BC3545C3BC61AF5EA2D3062F5A45A3F88A041D1B
                                                  SHA-256:A686C5B15D33427A0069414EB7F25274B5B3EDA1347FF60F3F9287A4CEED3B53
                                                  SHA-512:FE459962A1F1D69B8BF9A6B7ECCA9D42ED379B13268F5ADAA9B754D814ABE2099DB98887AFF9A90BC2B4D6F5AC140A7D7ABEB99CCA30569C70E63859B15621F3
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739510.09:49:01.8903293</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\_zlfioy0.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):2470
                                                  Entropy (8bit):4.275832447042471
                                                  Encrypted:false
                                                  SSDEEP:48:cFGnvQEAnaeOgnDEAnYGEAn0EAnGmEAnlTZCEAn7EAn8fEAnYJEAnWLEAndocZI4:ZnvlAnB3noAn0AnRAnQAntZTAnwAn3AF
                                                  MD5:B5A2C839E349013A287DC6F8E986382E
                                                  SHA1:CA1BEE10CEDB649654099F13E5C15CB244913CE6
                                                  SHA-256:59D4699780874A9BAB71BB853476CAAC99AA97FEC91334210DBC4CD04A26CB42
                                                  SHA-512:44622C8965463ACE7F0143AEE8EF7D2C2665A65A4E076B182BFDE7DED09CDC98C4662631265C4B3C629D617CD6062987F4832F99FAEC8A91FA734571F36D9C32
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739164.08:40:36.8265280</value>.. </setting>.. <setting name="ProductVersionType" serializeAs="String">.. <value>Free</value>.. </setting>.. <setting name="IsSearchProtectOn" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="EnableWebBar" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="IsMURLOptOut" serializeAs="String">.. <val

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\a4_utwti.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.262174847176277
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAn6x86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAB:FYlDc
                                                  MD5:D94F3110A897F6D3E371C0C63C5DAF73
                                                  SHA1:F5448E8CB7324957928A81E906A87A389FF85597
                                                  SHA-256:9AA34543A7C5194A154330C4E1FB307A8C93E24D0D0674766AD394C5B8923741
                                                  SHA-512:4BDB0BA877541590F820B4633A0317077222AB6C31193F92A48FC6A12F1634FE1FF7601489038C3A3905DC2BE504F9FB40C4FDB25D17631853D273A7D7A35C96
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739869.18:45:59.4461952</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\b0fsrapu.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.261982356116116
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAndx86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAB:GYlDc
                                                  MD5:8E40CF87CC8433C6AF8A3F5F9E4E372F
                                                  SHA1:535F4990FEB75653210FFA020F1654B8564E66B0
                                                  SHA-256:68377E14F64DB471F12983BF4D04187DD99B8729510D403B7E240ACB4933AA4D
                                                  SHA-512:88EB45AB25C87FD65EB3EBB0565977B116409B2DBE1918D704A59C61A37259BBFA6390E98F831120CC4ECA72A3308D746C98FA0484E9636C25E6CDDD1B2ABEFC
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739616.13:38:50.8474584</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\b7jeoez_.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4376
                                                  Entropy (8bit):4.270267234310765
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnkVx86MnmAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAnEoAnA:RFD6
                                                  MD5:6FEE8B5BA83325088643072EBB861F8D
                                                  SHA1:980217D6F88B26A4717FCC7BBD69BAB418DC57E3
                                                  SHA-256:D0534B2B539E0EE6A9F8E6ABE9186ABAE0037E669F6B698C7AE97B9BC371DEB9
                                                  SHA-512:AD811BD4A26541B0D3E1FC232AF49060C6D7211668DCEC56B9985ECF42E827FDF899C51F9C9198B6B1E110B9D88A44D1C45CED6D61BBB3F75A2286550E941F04
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739485.12:40:02.1981973</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\ba96itac.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.261409695490647
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnBx86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAB:KYlDc
                                                  MD5:77115432D338CF34E743E60A4FF31D20
                                                  SHA1:04A7BB0797173AAD61ACB900D57D562D1B66A1FD
                                                  SHA-256:0DE3ACFE94A924D5264F6BE67721C29A5E7639F97C6019B25071AE3D20B23014
                                                  SHA-512:569A0F78B3E6EDD052ADE342BD571E25F8E843D488325803DD3D0B120249F3483CB803E3B180E4CAE013F3A6B8034EA330AD97BCF71913E9F9B848DC2A8C9104
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739606.12:46:47.6092114</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\bgzjk5s1.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.261551599214424
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnyx86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAB:ZYlDc
                                                  MD5:3357312EABD69B00F56F3678BAC15F60
                                                  SHA1:BEF25DE9EDAC85CE5BD276C2E38FA2297B53EB4F
                                                  SHA-256:93A46976A5FB827CD82DAB8900ACB2FE1518E844B18C8E38F6446D72FFDB088A
                                                  SHA-512:AF1C9FA030F261F6DD7994888514A3AD0B5A7485D80CC3EF9E9C7A1401C100FBBFC2F98925020ED3F787F8BCFC2FC355D1EA44BA0DC04B849F7509E654DBB0A2
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739601.12:36:45.9382062</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\bp0wbyud.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.261541640107081
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnMx86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAB:3YlDc
                                                  MD5:B867574113DC7C8355127A15B5D4C381
                                                  SHA1:18833688BC8C05043AD516244BD42E5E1DA3F38F
                                                  SHA-256:506D2A0E28CEEB93BE82D1F743DF2495072E023AF1482EF709A327DEA481E6B7
                                                  SHA-512:A78B3D7A152E50197F93B0C6F31D5EC38C788F84EA16AC7C79A9F5443618BA465C99753B9EED9FDAE97F46A48CF34D0DE0EE45292CC356BE8E326254937E225D
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739600.12:35:15.5994587</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\bqze0xis.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.261666472772409
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnGx86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAB:9YlDc
                                                  MD5:ECCADF81A6E895A5260F993164048C8D
                                                  SHA1:CF0A7F3668961D9C6A0027ED1C2676DC54087C63
                                                  SHA-256:E947F4DDAFE78C896DE195509AA64E2CD7AA0D98052A73DA51EA71B7D1A3241B
                                                  SHA-512:5158926195542FD5FC7EEB8177A56FCA60E8B620596618AB77B10F7E6069DECECD65655013CC47A099AD6DB4E64245C9E9F5CD84A0AA7D2D61DA8B9F0FD941B5
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739642.13:57:30.8872024</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\bwnvmonn.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.261583708717901
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnax86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAB:ZYlDc
                                                  MD5:6545738D76F47D8175F4685B37B15FE7
                                                  SHA1:1701C4C71F0DADA74D5E6D4918A94D1BEC228FED
                                                  SHA-256:A70EC8CD1A947FE72FDE5AA092499B1A3538D1C01E8771E8657335E0F3F400E0
                                                  SHA-512:20DE7F3562D98B7801EBAFC17B36DF426A85D9AD1FD188AEC20DBB32B6F630FB482254A9E9EEC7BDDB16DC1DD78E3AC59E079F2BDA8E5BA1F868881705217360
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739634.13:57:28.5663207</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\byyfg1ay.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.2617577219451555
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnXx86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAB:YYlDc
                                                  MD5:A4823E8989464B33271C9216A1645724
                                                  SHA1:AE0580C6706F3D3773BC0373E20F28300B430C1E
                                                  SHA-256:65F06294A02382DD006DEDB7E0DDB492153C8FA98D0CF7BFFDEB2D44E9225F3F
                                                  SHA-512:C56233795FD0C35FADD9EBFDD80A12A070A760BD6B4B9BD8B24C073F1426FD5F38EFE0F0CA16D481178DC6FB0D5A0A3FB4FA6FC6581015B9C0E57F8556EF8970
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739624.13:53:54.2613208</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\c5tvclh8.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):3437
                                                  Entropy (8bit):4.27008366973809
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAniB86MnmAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZdoKtAntw:guTp
                                                  MD5:6319AAD3FA7640877C3349BA403CB3CF
                                                  SHA1:142124248DC228942C48732B3C70E730AAF82313
                                                  SHA-256:B72B7490BE3F40D06CDC18589C05F724629447BC79FC1A859A57E51737AC8E16
                                                  SHA-512:3759F20968D184CE7971C5EC6E3DA505B423274276CE862908A9363C645705950B3C79CBA5791DEE2CE9AE6FA087BBF45638BCC4F0A3D13F302AD6D44197C63E
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739103.07:12:01.0582189</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" serializeAs="String">.. <value>about:home</value>.. </setting>.. <setting name="OriginalDefaultBrowserDefaultSearc

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\cp_jfktc.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.261891073336046
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnpx86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAB:KYlDc
                                                  MD5:733A6737F2FCFFEBBBA0BF267F91E05C
                                                  SHA1:F8D9A9FAC338464E4DF250ED9A744B2AC1DB2910
                                                  SHA-256:37BA41556D6918DC04075EB9EDDA542133AB5334FA6018C342B735F21EFDB0C3
                                                  SHA-512:DB24468698790AA7EBDE39E36EE5D5A2DCC724250A4FBA742F4CAFC1370F6124B8ED8107B4D22808BCC3E4EBA2A1B00146DE2A057737922B132B9A3509BDFBB9
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739880.18:46:02.4055741</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\czgvg4jn.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.261982356116116
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAndx86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAB:GYlDc
                                                  MD5:8E40CF87CC8433C6AF8A3F5F9E4E372F
                                                  SHA1:535F4990FEB75653210FFA020F1654B8564E66B0
                                                  SHA-256:68377E14F64DB471F12983BF4D04187DD99B8729510D403B7E240ACB4933AA4D
                                                  SHA-512:88EB45AB25C87FD65EB3EBB0565977B116409B2DBE1918D704A59C61A37259BBFA6390E98F831120CC4ECA72A3308D746C98FA0484E9636C25E6CDDD1B2ABEFC
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739616.13:38:50.8474584</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\d8vffefq.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):2893
                                                  Entropy (8bit):4.281551711426781
                                                  Encrypted:false
                                                  SSDEEP:48:cFGnyEAnvQEAnazMaOgnDEAnYGEAn0EAnGmEAnlTZCEAn7EAn8fEAnYJEAnWLEA1:ZnjAnvlAn8T3noAn0AnRAnQAntZTAnwV
                                                  MD5:919AFDD276A6121BA54BF3CCB4E047A6
                                                  SHA1:D96DA0153BFB7000656ECBCFCA9FC811FD01B921
                                                  SHA-256:904F68BF7E8FFF8D0DE6526BABB39A30A3CD492FC5B08298639CC2FD78AFEBD9
                                                  SHA-512:FDDE193B2D411E3F8F84AC07037653DC62361A96F4ED5FC8A625DE3173CD15292B6AD04403D22DC109A79D2602EC0CCF9434856492BE4085973008DEECE5CF6A
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739185.10:37:08.9455604</value>.. </setting>.. <setting name="WCActiveLogo" serializeAs="String">.. <value>AA_WebCompanionLogo</value>.. </setting>.. <setting name="ProductVersionType" serializeAs="String">.. <value>Free</value>.. </setting>.. <setting name="IsSearchProtectOn" serializeAs="S

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\dflrrzxg.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.26145179770879
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnRx86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAB:WYlDc
                                                  MD5:08F457F0717EAF7D0B20370902826218
                                                  SHA1:FB3D11C80E92AA622EB93589D19C0638AE3015EB
                                                  SHA-256:D9E901B5E82EA58DB18AD1C6F471A785A59BAB9BC0179C6D40FABB63E14A6DCB
                                                  SHA-512:8DC8F091341754EBABD31297EDACE540C88697F321F03877F72F4EC8BD84E9AFB862F6D564882042FC3669CD5F560AD0E29D23F3B8F12DF8C5AC0E0AAD3B1C4E
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739600.12:36:45.5619593</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\di-leil6.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.261967284063766
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnux86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAB:tYlDc
                                                  MD5:523F11DE21FD46F62C133BC5E3CD55D4
                                                  SHA1:BCC567166433F1B977F84D9B78B8E93E0C55C3FA
                                                  SHA-256:A7977612ACD3F6CB2A81B3055D219C47600FABC3998A8740D0580895DAEA1748
                                                  SHA-512:D7B4F22843DE6A6FB46609399BF109D3717439D55B3AA5411A068550FD8ECD7B27DB9E18F64D2120731F6CFE04DE3A396698611686D5EDF87D8D8E66721E277E
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739895.18:46:07.4608156</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\drkz8ijz.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.261299934877671
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnJx86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAB:mYlDc
                                                  MD5:AD02B614F32D283123BAAEB5413BF35F
                                                  SHA1:104974D816F464E13CA48F09D997EC88D0560C34
                                                  SHA-256:AA582822EAFAFDA809F069F7E1BD4D809F4DFEF922507C5E65A1F4927DA0782C
                                                  SHA-512:4BAE6B9F4E8B91C05CD0B5F08CD5A08536D14DD98E9B31F3454DAFEFA826076FB6A76A65CD9A157CADD32CC5A395AA7FA7E1EE7DD5E443E8EE94ED1F4F53F556
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739741.15:49:57.4398017</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\dsw9swq9.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.2613420370958135
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnbx86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAB:EYlDc
                                                  MD5:749256C306474669F3C0F37944B8CE49
                                                  SHA1:BB6E96306C7495350F9F67E226261757FC8E2C85
                                                  SHA-256:8948FF975729048EC11F2203295985801EF07CD876897563F70FD45AF0BE0577
                                                  SHA-512:1B4A0BB69828C9AD19B19008ABAAD213AD3E22A9D0EA2B23A9061481C3A3C071331BCCAEBA663EE4BABB16A2B857866E2BD77F219CA6C123C0A6A1F5BD4FEF32
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739893.18:46:06.7901940</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\dw2s3zrm.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):3425
                                                  Entropy (8bit):4.248833557297467
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAn+86MnmAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZdoKtAntw:LTp
                                                  MD5:64E52A9F510C88982946FB6189963717
                                                  SHA1:9DA010252999228E05B3314F486861E9E13C0987
                                                  SHA-256:AB82B1898620396D3A10BEC3503BECDCC9E4587119E126FE497F31BE4A7C1573
                                                  SHA-512:D289E7AB598C169C2B24186B47F14E5BDFF4EC78AB065046FFC71CD720F21A8D0B9DEC76A9678518EDC08D7A9CF31C9F331B9F9E1D5A38995F3E609B5CA948A9
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>12.09:39:09</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" serializeAs="String">.. <value>about:home</value>.. </setting>.. <setting name="OriginalDefaultBrowserDefaultSearch" serialize

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\e39ibl8o.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4101
                                                  Entropy (8bit):4.247977639935363
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnEZ86MnmAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZBAnEoAndoKHW:WGfD6
                                                  MD5:F270A1D476BAA0A098462444A26548DB
                                                  SHA1:508FE2F3B15D34368A9009A5E28550EB8DD426A1
                                                  SHA-256:A3DA3E6565AAF3EF5D5BD4AE9EB658393F50EB77662B46771BEC958D2209B80A
                                                  SHA-512:51D81FE95B171968E12F248C3A38F0FD87501F5D69F64EA1C4FBD9ADBB7C8093661E25FF204D83ABAD893F5AE38C216AF94129809484E943ABF5898BC5DB2DE0
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739105.07:12:01.2051683</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" serializeAs="String">.. <value>about:home</value>.. </setting>.. <setting name="OriginalDefaultBrowserDefaultSearc

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\e9xy6bwt.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):3425
                                                  Entropy (8bit):4.248833557297467
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAn+86MnmAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZdoRtAntw:LTI
                                                  MD5:018170B22052F9D0C1A6920183F73B3A
                                                  SHA1:E3873205952B34B9E3837DADC8578591098BF469
                                                  SHA-256:0823405E61E6FD95156AC2092549F46DBF727EB834E83465705CA6CE839D794D
                                                  SHA-512:E96A4F27970521F83FBD2AD5C4F48F994A3245D13E1F9DA9C73F30C17D2527C9713408F9B8814B1BE927CD9D562BB1B1D7B2B697F64827E64C4880C439660B8A
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>12.09:39:09</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" serializeAs="String">.. <value>about:home</value>.. </setting>.. <setting name="OriginalDefaultBrowserDefaultSearch" serialize

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\edi4gbkk.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):2893
                                                  Entropy (8bit):4.279342807339133
                                                  Encrypted:false
                                                  SSDEEP:48:cFGnyEAnvQEAnatMaOgnDEAnYGEAn0EAnGmEAnlTZCEAn7EAn8fEAnYJEAnWLEA1:ZnjAnvlAneT3noAn0AnRAnQAntZTAnwV
                                                  MD5:F6A07D40B3C9D68645B94E6D376852C7
                                                  SHA1:AABEA465000C3164320FB1AEDF1B321A432E6400
                                                  SHA-256:A6D2C02B5DC08E39652A53CBD72371A1F8C15EB160020B72686D0F43A25FE858
                                                  SHA-512:8E5E1B73725170487071911B68EB808FFB53DA0DAE20CAA5DDA11FAC995168429D0859409BB3EE0C86F70B1C92749999634B3E5C28C7EDAB5766DD62D0E74F6B
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739171.08:24:41.6480602</value>.. </setting>.. <setting name="WCActiveLogo" serializeAs="String">.. <value>AA_WebCompanionLogo</value>.. </setting>.. <setting name="ProductVersionType" serializeAs="String">.. <value>Free</value>.. </setting>.. <setting name="IsSearchProtectOn" serializeAs="S

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\eqba4zo7.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.261238942123124
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnOnx86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBw:IeYlDc
                                                  MD5:562E2A819A3F061C2530D444E3FB5FE4
                                                  SHA1:8F2B7746248E9EF704E0CD517E6C315E14A63B80
                                                  SHA-256:E8C100C64413138551309F5C02AA096971C7E8C166156591D1522D9753A9FF6B
                                                  SHA-512:A71791AA09E307F891D79A36C58C666E213EB35EA35B7390249160FADBFF48A6C7387FF2D5920E2201E066714D09D2E522F3D3B358846ABEFB019A70963342C2
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739616.13:38:50.8318265</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\eqhdmkjb.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.2619081443944955
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnCx86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAB:ZYlDc
                                                  MD5:D8300858E736562A03BEDDFFC7C3EC65
                                                  SHA1:3E87999FC0F61960979B8521CE5FA597EE90C47D
                                                  SHA-256:6B7D4DDE7FE494FF872A0B171C153FB0BE1FE99E25F624C5A73B4FE45C8A95B4
                                                  SHA-512:EB31B9F87E794C2B5044D999B7F2F81ACEC93C7FB507278317FBA9F8ACF1DA1419A2539EC7EA26950A7B63D811E965D32FAC3537AB8FE5BB1A643D287105A912
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739609.12:45:48.9044549</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\f02xcld5.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4101
                                                  Entropy (8bit):4.2493965683561
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnL86MnmAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZBAnEoAndoKH3m:KfD6
                                                  MD5:581386863A4B31FAD986AE13E2761EA0
                                                  SHA1:FD3CCACA89A4ED29D8D03DFE8A2C4970BA495598
                                                  SHA-256:E55A4B804489E456BBDC1E226DC03F37020586751B2A32119FB3319AD26F4BD1
                                                  SHA-512:7C65E271955C2A7B46B07FBD84FFEB02B99FE20EE4DBCC275FE818261A2370E0CDB3DDC769C33791FFCFA2984DF29FE22F704CBEEA8D9F74594560198C80ACC2
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739191.07:55:05.8568272</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" serializeAs="String">.. <value>about:home</value>.. </setting>.. <setting name="OriginalDefaultBrowserDefaultSearc

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\f7b1yfkl.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4251
                                                  Entropy (8bit):4.275937027940298
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnqx86MnmAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZBAnEoAndoKHW:5fD6
                                                  MD5:D30A931EB486BAB19E4A6260B447693F
                                                  SHA1:9B34FA3F624D37D4D04662E9F0416F55F8FF22D9
                                                  SHA-256:E93245222A50B14741386A2066F498D43A48A77D27A855FEE2D4B120065D7563
                                                  SHA-512:FE92CC12DFBCCEFFAC0F5AB10EC6B5945FDF037F634E545342EA748DC7DCCD82C4700EF29E1DD7A0E0F78B4A22B546CC70C460927B6A2576BC804FF20009BF8E
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739310.11:19:13.9779459</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\ff8hqwkl.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.261196873512304
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnkx86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAB:/YlDc
                                                  MD5:758C025AF6D57C7759788648E01846B4
                                                  SHA1:836CFAAC599D0E7239AB6B6A5A8CDBDA3C56AB3E
                                                  SHA-256:52BFF7D0626A9ACAF99FB93962BD128A9F707A166411A2BC2F6C3806CFF9109E
                                                  SHA-512:20A4A4A4A35F5F3868E05A9C49EEB8A7D7DAEFF4AE237DE9600D8145974A9A5CBCACED362355EC698914C4730AAB89026EC843C8B524BD023A49BC0F0608E376
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739616.13:37:20.2839559</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\fhkpnexo.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.262058533236512
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnSx86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAB:1YlDc
                                                  MD5:6A18DB08A7C8EC4578A9AB6321BA5362
                                                  SHA1:C665590879A967392725C7C7B42773C34012E77D
                                                  SHA-256:B7C6EA76B5B082A8CB0849BDEFD1B002E676E6CB4798B321C7B138D80F5A6898
                                                  SHA-512:2F886A6B62EAA1D506A004CF3F0DB6AED793091E955224FFF641F6ADEADA53D210C4813E0C303B44A4D32C8314A235CA2E179429179B124409229A4BB250CBFE
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739869.18:45:58.5999462</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\fjz6ftzc.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4251
                                                  Entropy (8bit):4.277079054045279
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnKx86MnmAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZBAnEoAndoKHW:ZfD6
                                                  MD5:C1D9C792DD0F71B7C3E14D1503C691B8
                                                  SHA1:2A571B54B8C158067BE91C45AECF1FF2C3D41181
                                                  SHA-256:8FFD9D818FB946C8DFC304F4B33D3E9F5DD8A87727952433C34EC3E58AD66DBE
                                                  SHA-512:28E759E9826187BC3626BBE0F627183DA53E6D0CD6EBF7CB274A447DDB193C2115DBAECBF090809CD19F3E6B743CD48CF99A9D28D6E7181377DD6C274832EE64
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739206.07:29:36.8130740</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\fl6pminl.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4251
                                                  Entropy (8bit):4.276599378670706
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnjx86MnmAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZBAnEoAndoKHW:ofD6
                                                  MD5:ACCB564CDE9DC6F9B59B7756D8298BF9
                                                  SHA1:6A51828A774097527751E05A22D810A1D8389E1D
                                                  SHA-256:0CAF89999298A665F7D0D2C91BBC02801260FB82D495E872245F189015A9AA6B
                                                  SHA-512:EC5C397F9BCEDEB56D1028E167606249385788874C40A3E593D8917114428EC2CC2549F9AD3898ABC351E72795204D95E09D8EDF56CDD2ABB348C12A63468D35
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739308.11:19:13.6666956</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\fl9xgaii.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):2062
                                                  Entropy (8bit):4.258735014340742
                                                  Encrypted:false
                                                  SSDEEP:48:cjQEAnaMOgnDEAnYGEAn0EAnGmEAnlTZCEAn7EAn8fEAnYJEAnWLEAntXw:8lAnl3noAn0AnRAnQAntZTAnwAn3AnfW
                                                  MD5:AB04276054D09E2723F43AA0299DDA86
                                                  SHA1:1BD2A018E5D25529DA67D68B75B538B7E87CDEE7
                                                  SHA-256:01B4FFA198E763C1AD01E51C52624DF7BB4A5EAA8BAB2AB8FA9D84D69EAEFA67
                                                  SHA-512:D5ED693C1F3758196D407FD6564AABAE95E70C888B65E3E9ECFE70F53700F58368E54E7BB8794BDA4814815AAD81C5D97C4E761015B1CC224A3B5D4AE900428E
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>00:00:00</value>.. </setting>.. <setting name="ProductVersionType" serializeAs="String">.. <value>Free</value>.. </setting>.. <setting name="IsSearchProtectOn" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="EnableWebBar" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="IsMURLOptOut" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="EnableChromeExtension" serializeAs="String">.. <value>False</v

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\fleh1vgs.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4376
                                                  Entropy (8bit):4.270267234310765
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnkVx86MnmAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAnEoAnA:RFD6
                                                  MD5:6FEE8B5BA83325088643072EBB861F8D
                                                  SHA1:980217D6F88B26A4717FCC7BBD69BAB418DC57E3
                                                  SHA-256:D0534B2B539E0EE6A9F8E6ABE9186ABAE0037E669F6B698C7AE97B9BC371DEB9
                                                  SHA-512:AD811BD4A26541B0D3E1FC232AF49060C6D7211668DCEC56B9985ECF42E827FDF899C51F9C9198B6B1E110B9D88A44D1C45CED6D61BBB3F75A2286550E941F04
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739485.12:40:02.1981973</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\fuucpvib.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.261583708717901
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAno3x86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBw:GuYlDc
                                                  MD5:C0241B6FEEE1AB9AF3BEDE63D58AF88F
                                                  SHA1:5FD9277D4926DC9B52951B3A930728648F68B63D
                                                  SHA-256:F4A1B6EC04243BC9926417D8B7F0C99EF7E587401AB5F5ACA4FE056C346EBFD2
                                                  SHA-512:B41A7643453C3DDD585FD0B1086E944CB14DFF554E3498E3D9C8C843137D724AC523785180BB458E7D9CA36AE5699006518CF3C992FEB8683857C8844D4DE819
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739626.13:53:55.3940774</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\fux4vyci.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):2893
                                                  Entropy (8bit):4.279815695536247
                                                  Encrypted:false
                                                  SSDEEP:48:cFGnyEAnvQEAnayMaOgnDEAnYGEAn0EAnGmEAnlTZCEAn7EAn8fEAnYJEAnWLEA1:ZnjAnvlAnNT3noAn0AnRAnQAntZTAnwV
                                                  MD5:BD881DE3F686F3C4FD6A2B3F03D35F98
                                                  SHA1:F6341F989CFDEEF45842809F0BE3D91A55A01880
                                                  SHA-256:4019A95F9ED472B54B9BE452C64CF62A378D3842193D3EA8609710DF97A3E973
                                                  SHA-512:0979AF74CB458522E771C899F25DA25BC3E4AD0AC0AFAA95DA9F93046A5C651F2A999D7428D915F10ADE64166A3BE42B6D9AB0275618180965FE84F7C62D8BB4
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739171.08:24:41.6793127</value>.. </setting>.. <setting name="WCActiveLogo" serializeAs="String">.. <value>AA_WebCompanionLogo</value>.. </setting>.. <setting name="ProductVersionType" serializeAs="String">.. <value>Free</value>.. </setting>.. <setting name="IsSearchProtectOn" serializeAs="S

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\g6fdw7hm.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):1795
                                                  Entropy (8bit):4.246343553210217
                                                  Encrypted:false
                                                  SSDEEP:48:cjQEAnOgnDEAnYGEAn0EAnGmEAnlTZCEAn7EAn8fEAnYJEAnWLEAnw:8lAn3noAn0AnRAnQAntZTAnwAn3AnfAJ
                                                  MD5:EDE34AA670226E1C70010FC7C7390079
                                                  SHA1:CBB8C900AD334142E4290F524EBE8C7CADB1F469
                                                  SHA-256:6237228956DD840BE917F262AA264DCF4C93A49F38229912739592DEC681DEC9
                                                  SHA-512:7C81BC8EC23FC5A215F85D056BF78116706E9E3D30D6D6D43137B5CF2EF5F45236D4748C318BF7C0B0793FBFC5A701074A695A9B0C43F2FFC6B251653B770A9C
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="ProductVersionType" serializeAs="String">.. <value>Free</value>.. </setting>.. <setting name="IsSearchProtectOn" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="EnableWebBar" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="IsMURLOptOut" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="EnableChromeExtension" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="HostingOS" serializeAs="String">.. <value>Microsoft Wind

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\gel3ot34.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4251
                                                  Entropy (8bit):4.276599378670706
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAn6x86MnmAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZBAnEoAndoKHW:NfD6
                                                  MD5:F61DAFD77869AF5FE34A7447487213A1
                                                  SHA1:26F408980A61DDD8E7F4D5783E9A8E3D59526DD9
                                                  SHA-256:650536039086062DE5CF34FE505F61C1BD3037845CC18337C1C7EA6983DAD9E7
                                                  SHA-512:59A4D8B6C539F30CC65C617495BC2F7AA29E0B4B8586D96A59A8EF916A985256FDA56411DD62DBC3E3A7393D491BA1D08D9E326CA87CE38E59E0E62EA0B654FD
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739211.07:53:37.0286977</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\gisns-9o.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.261163323627048
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnanx86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBw:AeYlDc
                                                  MD5:42874D68C1810AD9ED416F5778E3C26A
                                                  SHA1:D4D34DE28BD102378C6B95F2A5F987927EF763C3
                                                  SHA-256:8AD009322B9340B9BAE624AC0545831286704E20BFF2F3B32D021DF8F4D925EE
                                                  SHA-512:0601D296D14D2A8F9AFBE2C1832E71DAE1695DDC742B6DE8A754C46BC057B8ACD56B60298EAA66AB660464D942F43C93021F414E1264C012E2BC2FE7A59F9CC0
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739600.12:36:45.5307055</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\gkfln480.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4251
                                                  Entropy (8bit):4.277664851503682
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAndx86MnmAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZBAnEoAndoKHW:2fD6
                                                  MD5:770B7E8958646BC0BE42A9126AEB7E30
                                                  SHA1:E8A6610897BCE9E33DA3B5024327C5D1A6CBC37E
                                                  SHA-256:CECF8FB1AD4FA6DA8B8170143821F724959B20091F77A9CAC3BF6D5021CC49E5
                                                  SHA-512:3059838681A0F7DD499446BEDAA30F6FCD8D5A6F04DB266339FFB6904B2888C0B158E32B7897B5CC0B9A07EBDFEFF367F9C2FC8A7E97CF6FC334DF5458A38884
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739224.07:55:38.5443212</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\glgjh7zq.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):3437
                                                  Entropy (8bit):4.269294305896893
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnHd86MnmAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZdoKtAntw:RCTp
                                                  MD5:AA8D00BBBACE2723C141328196BA8D1B
                                                  SHA1:1AE7847463D632AA18A16E03A15FF1383E6A2362
                                                  SHA-256:EECBEFBFA38772139553A91D65621139098B2FF81C75DFBC76BB734645653D1B
                                                  SHA-512:23566BE180C6F3A34ACBB94E5FA061C8B726AB9D1C9AD2C0DD593CB641038DAF5CF17D203788C711CFD29C24D1B0F40964760D9743A36A865042F654E6BC23DA
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739104.07:12:01.2223187</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" serializeAs="String">.. <value>about:home</value>.. </setting>.. <setting name="OriginalDefaultBrowserDefaultSearc

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\gpt94v2u.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.26206564518762
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAn6x86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAB:dYlDc
                                                  MD5:DA6E1FE88D7880318773A2F5574A2146
                                                  SHA1:EAE1B750538B8EADD5B51A87487DF28758CA69DB
                                                  SHA-256:92A974FBE0AD21716A427C3817FE0A64916263F5BA20970C595AC8A8B693C7ED
                                                  SHA-512:BF255B6B0EC6B2E2A8720A2944CBDDB4338494282F21B964999004097D819274190B55A172DB0AE83CE4747EC447BFF23E9D42900558AE04AC3CC3D8607A65BD
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739859.18:45:54.4375680</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\ha2aewp0.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.261717060108792
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAn3x86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAB:YYlDc
                                                  MD5:B67E88EC0436C5F0B053072117C6CBEB
                                                  SHA1:8D9786E2714BC88C3934A3DD8B41F734384FB72C
                                                  SHA-256:EE5EBCB4887E69BF7137840455A43F066910D5304E6F1405DBD3B6C906B4F3C0
                                                  SHA-512:1579DAA0A435E500025C77A90D8750E6525E6270138CE4CBD9857BB6999FA8EA6E76E62D550FE08B1012BCFED5213917A8C50F67350209DDA7E496A60BE98BA6
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739622.13:45:53.6164641</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\hct2llju.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4251
                                                  Entropy (8bit):4.277135881831725
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnGx86MnmAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZBAnEoAndoKHW:pfD6
                                                  MD5:7238FE64C4DD9EA472E4E6A96C4BF92F
                                                  SHA1:E9931279C5E60EBC8C9C23B741E12B27D7BB068F
                                                  SHA-256:2CC9DFF6E14D34B7200EB9556CA1913198719773C57F59C17BC1A753E1E3755A
                                                  SHA-512:AC0FA8BE596B8218990C8BC9BC71CC96A30B1FA006EFEAE2FF60B2EBCA6CA3BAE2E40C3B07987D41EC54194C8A8802276BDBFC3D8407C9B9AC238963E397CF41
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739197.07:21:35.7662042</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\iqsfel5i.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.261816861614426
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnlx86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAB:2YlDc
                                                  MD5:E82B77A6DB01D5ED064FDB94F0CCDD65
                                                  SHA1:ED9D8AF269274C27A3976A3C26BB700D5B8EE0B6
                                                  SHA-256:FF15B5C0B969B83BFC4752BCBB815E155692F4EAA38AB96BA516BC009C445611
                                                  SHA-512:356E9346FBA9D917A265511A2D5490237FA6966EF52A820FA647FE685D3BBB533B6C92F0B1AC0C645C22ABE7C183999DAC0D3A273660526306A6F3A944C7E180
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739861.18:45:55.5049514</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\jayt_hv7.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.260401019097653
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAntx86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAB:6YlDc
                                                  MD5:5C8EB940FB11B53681A1B2905A0CCC51
                                                  SHA1:3433183316B7BB5B07B5D3D84662EB180FEE58EC
                                                  SHA-256:4266A3D0AF9BFC2EB3BA11B4E903BB162D5EF61B1675470082706F3DFB797118
                                                  SHA-512:5300FBBB0062E6CBF7007250A7FAE7DB2576F075FD585A38A2886111739C1F4244C13ACB3CFB4067BD26CE41FFA58857FC7B8C907E9724CE3149240B6EC9EC24
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739590.12:11:13.0382081</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\joarcqab.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.2616499603382785
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnGx86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAB:lYlDc
                                                  MD5:09605F9E5CED8B7601F5C18E541062DD
                                                  SHA1:EDB7C30E7C618845F23200977E92BDF67B072BF5
                                                  SHA-256:D69943BCE06D96F1526F881D745FBFFA1358BFE0CE909F3FA96905869FBB2CE0
                                                  SHA-512:052ADFF964D4E9F18149547721E0F28CF9EB324AC16856D22D23A93DA389F3CDAE118A7848149E8299201EB7ECCE642EB6978EB1B9BF9DCFD523F32BA5215E7B
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739858.18:45:53.7756990</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\jxp1hzj0.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.262090676347313
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnSx86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAB:pYlDc
                                                  MD5:AE68636F11E815B32EA9B6713AE0125D
                                                  SHA1:23B7B1C58D6458EEBDC97141CEFF47C500701EDC
                                                  SHA-256:B69B144E34ADB460B5C7ACC71F3AD84EC94393E43E09FE1CF23D5AE7DACF7A5E
                                                  SHA-512:9CC949DCF0D8702A419E7D49854D96C974F3C836591E0688579D6E624F7E26D97F975B7A838013BA4514C739718FC7F6836251777FA0BD02E700A4AB05521BC1
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739894.18:46:08.6559481</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\kbt6uvwk.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.261916663120059
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnJWx86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBw:nzYlDc
                                                  MD5:3FDD4DEAA6401CD0397B87BF3EE4FCE8
                                                  SHA1:D24EB1914EEC1B9D0D255BBD7E05710712CF7685
                                                  SHA-256:C671F8ED6FB54BF3B5A848B555A0F53964DE40114E831978D23B4DF497A6299E
                                                  SHA-512:CD8758956D9574C83D1798C7EA15AC3649D865DD6F2A42F32EC270D9B841677EFD5FE0E84833DD68A920F5517664DE42B3837C6091DE58FDBAC6F24B465FB4A9
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739868.18:45:58.2835656</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\kfla0htu.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.261625810936044
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnnx86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAB:kYlDc
                                                  MD5:D3CECEEEBAC707E4B7385AA9FC63F218
                                                  SHA1:76D9E12D04670371FE92D0850D9D8AD42D82EE6C
                                                  SHA-256:0E61C1A47570DF0F3A834456D72CD833095DF7DEEC414923760304BEAA127D43
                                                  SHA-512:E424B870271AB79EBD710F9089B021244ED93BB48860C4DCA58E91C5B81034FD868C764B03C633B1EB83703A02DBFADB0C0572696DC23866246D90F5E728E863
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739608.13:02:48.1389648</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\ktyfzyg8.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4509
                                                  Entropy (8bit):4.266916974922468
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAndx86MnmAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAnEoAndc:2FDc
                                                  MD5:CC4B5817F8A1FA9E0D1F9DE7FBB277BC
                                                  SHA1:3B429FD949A5B929929F902814ECA6C1070D897C
                                                  SHA-256:AFB066AC29065313F473790B9C11F20CDC29EC7782A12F1B942E8D69026514F1
                                                  SHA-512:5B0976D449D12D3C604D8A60DB98FF88CE4EB427124D1FC4F6564C0E8C7795EB4C588D82490CFAB1C42324B5D8ED1D331789BEFCB184DDC84103DC80DC1BD3CA
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739224.07:55:38.5443212</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\l37ilx8i.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.262332347969401
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnmnx86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBw:ceYlDc
                                                  MD5:CF3F4621AED824043A86CD572FB0C8E7
                                                  SHA1:6DED5D8910EBBDBA36B805EA07CAAB06EF61A53D
                                                  SHA-256:86E9C348665261498D37CF9A1DD5E009AF16FA4D897221066596FD7DB42DC1D7
                                                  SHA-512:D50757524DCB2BED749C5104CBD9455C2D350B3562F6C9CC26C8E23F28EBEB4128B039E7B2A2343F506FC5860DE917740C834872F08104E5348E5352846DBD8E
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739892.18:46:06.5784545</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\l8fbtrmh.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.260798226114089
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnpx86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAB:2YlDc
                                                  MD5:DCA89D548AFAD1046ACB3D2014E68E40
                                                  SHA1:9702A8E1050BF9417B93A0C47BC8698FB846703C
                                                  SHA-256:FB4C3001910A1440260F04DE80C040C826FA62B1A2C036EB4993F7F47BB8D578
                                                  SHA-512:38EA29B3946EF5B3A9B4137C2FFDCC7467E18DA1D6582DBBAF7781C2DB9593782A95F656C39F2A0336CE75A20E6B54BBAC4B675CDA9D1279BC3D97E70CAB727B
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739577.10:24:11.6190760</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\lawwk61f.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.261866042176353
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAn2x86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAB:lYlDc
                                                  MD5:175021D5D5C5B4962F815EBFA9F77D52
                                                  SHA1:48F399FD24654308E90726E3D4B5534D3E112D3A
                                                  SHA-256:226B4B1E5342EDC6CC5EEE697467F9A014DBFC607E175D31D6F91011DBEFDBA9
                                                  SHA-512:3656874499FB6240F377A92F6CBCB50BA8DED6477309C3F384043F2DFAB3F2662EE418DC80502091DCEAB5346F179BFF22C4DFDD99859AEDDAD34FC53E666139
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739854.17:25:52.6814501</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\le94sluz.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4510
                                                  Entropy (8bit):4.265049538869726
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAn+ax86MnmNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAnEG:gnilD6
                                                  MD5:59E2AAC0B3AD4E9BB51E389A4888E812
                                                  SHA1:5F3B5739BA7109D181E1F6281242FFF352B3EE0B
                                                  SHA-256:4446A85A0480F48011DB6B54963B8F55E4DB241E3166A118C2B822BC9F2892A6
                                                  SHA-512:B0D13015383D695125E9D5BF2E46E52AB4DB1E495384FA00BCECD23F8525852E7C5438F954C685AFD99B8FA928FA0BDE137835D38FF5A35F73C7627F6B65072F
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739611.12:03:51.1666923</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\ma9aduey.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.261858963832569
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAn0x86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAB:/YlDc
                                                  MD5:D0A147972A50165DCD56CBB410E359DA
                                                  SHA1:9BC7F0573320793E233EA14C968056EC8E87A628
                                                  SHA-256:F8DD77DEC8F6CB9BB3FD43FA4A9A6F56E5599C7F31F80F196979918B81A67BB0
                                                  SHA-512:45C417D525F6F2B8A0D999C23AED2C314890599E1801B4372EACF2C39322EEFFF55B02685CC4F4E30FFAD2AC45EE9169AB1428EA69BDB927227651C859B538AD
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739857.17:49:53.5638142</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\mfyhaxt0.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):2893
                                                  Entropy (8bit):4.279773195343917
                                                  Encrypted:false
                                                  SSDEEP:48:cFGnyEAnvQEAnaEkMaOgnDEAnYGEAn0EAnGmEAnlTZCEAn7EAn8fEAnYJEAnWLEA:ZnjAnvlAnJkT3noAn0AnRAnQAntZTAno
                                                  MD5:967F999C1F132596905587A0180A2E6B
                                                  SHA1:080A9C861CC5EEBBD8E45B122679C365287F372F
                                                  SHA-256:69C98EED89CCC9FD627C2D3308DD4D5FD343011049AB6816B884CA9DBCF83B93
                                                  SHA-512:8DB7CABB4E493033B26EB6EB430FA75507329A84F7410C2DAEBF76A1CEF006C9C277C3381BA9E0876081635985282598853507FC87A6514577BA8E8FA5BB9F70
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739186.10:37:09.0174393</value>.. </setting>.. <setting name="WCActiveLogo" serializeAs="String">.. <value>AA_WebCompanionLogo</value>.. </setting>.. <setting name="ProductVersionType" serializeAs="String">.. <value>Free</value>.. </setting>.. <setting name="IsSearchProtectOn" serializeAs="S

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\mt-nf0hd.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.261737949651293
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnox86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAB:fYlDc
                                                  MD5:BBA3E4769E559F485CDB39D03C657669
                                                  SHA1:080940E0C988F81933F40857FC6978122533CCB9
                                                  SHA-256:F061D26137035A20F5C017CC92C3AD7F54079D5680AD41A6D018489FDFC81FCA
                                                  SHA-512:A61F8D8A7F305AF97753E275156E4CDAE74CA85C3053ECE3CA815E551ADD8616086F8901D2EF10BDDECF2DA609095A0B72147F9D57197C4307570D7E50C4D702
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739842.16:21:48.3599611</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\mvjszwqf.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):338
                                                  Entropy (8bit):4.593235631150064
                                                  Encrypted:false
                                                  SSDEEP:6:TMVBd1IGnOhrPOYYYAP0RXKRF/+uKpvvvX8PONI3QIT:TMHdGGnOhrOXQEN+uKpvvvXCONI3xT
                                                  MD5:0A35FBAE99F45BC0DCCDB777ECFD0436
                                                  SHA1:65E295FDE91F90D55B107680E060895654FE66E4
                                                  SHA-256:19AF84C48A15820C94367390D58588DDAD8164B0AC4056C258A766C726329550
                                                  SHA-512:DB3A0973A373C039603C750F0F196CBF65553CDDB83739F1942402EAACBE178A775BE87C4B034FEB706830AE69D20158C3E3ECAD8D5D3FEBC45146B487C3C42C
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. </WebCompanion.UI.Properties.Settings>.. </userSettings>..</configuration>

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\mwjxl7o8.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.2617577219451555
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnOx86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAB:lYlDc
                                                  MD5:3564FF58CC2A6D32822D2A7E47D5E84B
                                                  SHA1:EFD4E71AEFE5837A987C9628B9F53CD65CF05A3E
                                                  SHA-256:B0082887D9DE60981AF92E660671DAFFEB94B0DE28B89C961BFCCC9255C84B7E
                                                  SHA-512:8F374054E184D77EB4307A9927EA07433C81C767354C3C26AA78B8D3C1A24CE8B8F77CA6E88B03E2E0E654620D8C3BDCB7EEF3440AE0E7EFEADDB9DE02FE497E
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739844.16:53:49.3720767</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\nennhv3b.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.262149816016583
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnEhx86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBw:XYlDc
                                                  MD5:C24B9A65F64BC020E7ACDD112AA3E2DF
                                                  SHA1:CE6FF04722F4E93120DE2B64135F238A11E0FBA1
                                                  SHA-256:F9E3924CEC10A84EBB4709249A7797BEF009EFE8B7B23C5A60B11662C9BA9EFD
                                                  SHA-512:9962607C6A12189B66A0330D6BAB57F2E0ACD91CA85BABA735AECE26503C6756038BE02281F1650C6F17B3183DA0FA93B3BF056745EBEF3D34DE4E8153F36FED
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739638.13:57:29.5644544</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\ngrywr9b.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):2893
                                                  Entropy (8bit):4.280860387541541
                                                  Encrypted:false
                                                  SSDEEP:48:cFGnyEAnvQEAnaXMaOgnDEAnYGEAn0EAnGmEAnlTZCEAn7EAn8fEAnYJEAnWLEA1:ZnjAnvlAncT3noAn0AnRAnQAntZTAnwV
                                                  MD5:F14EDE122B2A9D24A0DD03DB5D8A00E6
                                                  SHA1:B2D0DD13AC1E917C365C0CA26A3673A8940DC7F0
                                                  SHA-256:26C5672EB6C066E26AE8099FAB62E2223DF0301021BCBDDC7FF8E097ECED8263
                                                  SHA-512:02DCEA21D1EFFFCCC906517F8540F344B891AF4B5E03E656A17E555D45349E0C647C886200AF1A126E221B3BFA057FEAF4911E043FEBB648CCDB10F0F58CBD43
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739172.08:45:41.6076821</value>.. </setting>.. <setting name="WCActiveLogo" serializeAs="String">.. <value>AA_WebCompanionLogo</value>.. </setting>.. <setting name="ProductVersionType" serializeAs="String">.. <value>Free</value>.. </setting>.. <setting name="IsSearchProtectOn" serializeAs="S

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\nsankkhm.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.26225813624778
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnbx86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAB:MYlDc
                                                  MD5:A5D71022D910504D7F1DF45FB55C5C08
                                                  SHA1:22DA399EFDB070B5251D942517660A854229BFF1
                                                  SHA-256:54FE8C57F7513AE6570F6BB6EC89190CAEDD91B430F689F9F2464DD410E1E78A
                                                  SHA-512:8D6DE51B8A1B087A3B14342497298236D111530BFDD6BF4879F38D3A3FE536BC4CF266CCC2C4962D67B7BA0FC3762B4993A11036786AAA75A9AE8972FF3885BD
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739864.18:45:56.8445764</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\oj7wqotk.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):2893
                                                  Entropy (8bit):4.281290775546323
                                                  Encrypted:false
                                                  SSDEEP:48:cFGnyEAnvQEAnayMaOgnDEAnYGEAn0EAnGmEAnlTZCEAn7EAn8fEAnYJEAnWLEA1:ZnjAnvlAn1T3noAn0AnRAnQAntZTAnwV
                                                  MD5:273CB342C89758C240ABE895161D966E
                                                  SHA1:5DDC7F9FC4C7CC7C2F71CC318956AF4D7F7F3C54
                                                  SHA-256:C6BDBA2CF538396774F4E55FACCD8EA48FEA7FCFB00E8E2CEFBC16020A8733E8
                                                  SHA-512:E1EA35CBBF7F20BB92AAC2AD2C7439CBE82B3D7B4A9E1FD9A5C3F206C47C6D7F17F67E87FF13DEB9A969C27B15CEB564C7D13A373D530467EAE7483400C8515A
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739164.08:40:36.8513169</value>.. </setting>.. <setting name="WCActiveLogo" serializeAs="String">.. <value>AA_WebCompanionLogo</value>.. </setting>.. <setting name="ProductVersionType" serializeAs="String">.. <value>Free</value>.. </setting>.. <setting name="IsSearchProtectOn" serializeAs="S

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\ojuvz6vj.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.261292856533887
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnVx86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAB:aYlDc
                                                  MD5:3A02E3DB90CEDAB917114B9365F086FC
                                                  SHA1:EA4FD8921AF99A8399ACA1F0C388964A4CE937F7
                                                  SHA-256:77FE567619B8D25406129688FB73306F092165FAE3041DB0250AB94FACC07714
                                                  SHA-512:F26EB3BFBEC4D076DC8D2C6CA444C396C2966F9A6F06D79187CB985471F36EC0A8785D17117E26E4539EC8001D61FD30531F87C75C53BD6F0385DA54F210C236
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739891.18:46:07.4300723</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\ouhflxe7.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.261566671266775
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnVx86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAB:OYlDc
                                                  MD5:BF48A0E25755E7A9E9077158A6B35CB8
                                                  SHA1:20275EC67ACFD5CC0C9E4431E5C7CC6A6EB9D758
                                                  SHA-256:295ADE64CE6755500991066E5C552DF6B808DF5370ED5729EDC64797BB48EEEE
                                                  SHA-512:1BACCAE5A9734E1BA580F66FA58C4E8CA012E33ED6DA30C316DAF4D20597E203E172D5972DD85D22A73EDD59CCE7F27827F1D1BFF1E230D385DCD16EBAEE54CF
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739872.18:46:00.3961994</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\oymbo8dj.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):2893
                                                  Entropy (8bit):4.280464519229157
                                                  Encrypted:false
                                                  SSDEEP:48:cFGnyEAnvQEAnaVFMaOgnDEAnYGEAn0EAnGmEAnlTZCEAn7EAn8fEAnYJEAnWLEA:ZnjAnvlAngT3noAn0AnRAnQAntZTAnwV
                                                  MD5:366EADD9331A5B6480A5C65D35257CDF
                                                  SHA1:6FC273AD897272BDA38D95713DFF53A5820705F9
                                                  SHA-256:D58F4523736EEB385BBDE79EC8BAC0F8BCFE288AD14816C5E5350D3B3CF6ABCA
                                                  SHA-512:A81452BE743F1BD2021CCD45084408EA5CA87A74567ABD03EC974D1DB5959764B77597A908842F46C3B0FECA5540A8F06AF13A010CAF143358246866F2FFE811
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739172.08:53:41.5858137</value>.. </setting>.. <setting name="WCActiveLogo" serializeAs="String">.. <value>AA_WebCompanionLogo</value>.. </setting>.. <setting name="ProductVersionType" serializeAs="String">.. <value>Free</value>.. </setting>.. <setting name="IsSearchProtectOn" serializeAs="S

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\pdsv0igo.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.261193055028253
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnpx86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAB:KYlDc
                                                  MD5:7EA9A55C1C20FDFE68C9880BEED9FA84
                                                  SHA1:5B98C1C7F1F4A9A37A42F57FD1FF677185967C18
                                                  SHA-256:1C06D701876AB9846E9D8BB97C813FEF36BFBC1D9880B7E15AF44CADCD0CA55D
                                                  SHA-512:F8897813BC984D1E8CACF1F4F3F1A40C9FEC0F6FEA5BE70A51EA6B008A9461CA416ECE50FBD341B842391BA8A1006B7E700E5C6977B46A0D953F786C4B66168B
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739614.13:37:20.2870768</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\pkkgljyf.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.261350555821377
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnHx86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAB:QYlDc
                                                  MD5:B44379530044C16FA71977BD8F2A2AC4
                                                  SHA1:6913328572D2FBEB952A47DC2EFC55EC9FD2BC93
                                                  SHA-256:F67CB1770D9A29D4BC35DE6470F2A64F079A041BE85E778729211572A57FD1C0
                                                  SHA-512:A9B7DB793A497B3E099EDE732D11B4B52A9B6487EE8C8C30F9CA8F2AA924BFDF3010F5F9A692F9A701E7C10EDE3D4C2CBCE1DD180116E28CD05237029D42FAFD
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739610.13:04:49.0989559</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\pp33ymbs.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):3425
                                                  Entropy (8bit):4.248833557297467
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAn+86MnmAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZdoRtAntw:LTI
                                                  MD5:018170B22052F9D0C1A6920183F73B3A
                                                  SHA1:E3873205952B34B9E3837DADC8578591098BF469
                                                  SHA-256:0823405E61E6FD95156AC2092549F46DBF727EB834E83465705CA6CE839D794D
                                                  SHA-512:E96A4F27970521F83FBD2AD5C4F48F994A3245D13E1F9DA9C73F30C17D2527C9713408F9B8814B1BE927CD9D562BB1B1D7B2B697F64827E64C4880C439660B8A
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>12.09:39:09</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" serializeAs="String">.. <value>about:home</value>.. </setting>.. <setting name="OriginalDefaultBrowserDefaultSearch" serialize

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\pp95d_jv.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.261583708717901
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAno3x86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBw:GuYlDc
                                                  MD5:C0241B6FEEE1AB9AF3BEDE63D58AF88F
                                                  SHA1:5FD9277D4926DC9B52951B3A930728648F68B63D
                                                  SHA-256:F4A1B6EC04243BC9926417D8B7F0C99EF7E587401AB5F5ACA4FE056C346EBFD2
                                                  SHA-512:B41A7643453C3DDD585FD0B1086E944CB14DFF554E3498E3D9C8C843137D724AC523785180BB458E7D9CA36AE5699006518CF3C992FEB8683857C8844D4DE819
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739626.13:53:55.3940774</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\ptmrmopz.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4376
                                                  Entropy (8bit):4.270678630348192
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnTx86MnmAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAnEoAnd6:EFD6
                                                  MD5:200D1A8D0239CF1271D951DF3A6455F1
                                                  SHA1:2A6378BBBC96B523F578BB4022F0CB34D20CE6C1
                                                  SHA-256:54C70B0752B6905FF9C001E3DBBBF4D0EA02A05A4F77988D1F107DA20C90CBC7
                                                  SHA-512:39A55D45A30CB9375C2BD262919F10C4F0A690C67F75779A948A679C8469629477C93AE3981468A38E265240AE11CA3E35BB6F00D2C3FA4027B1E7FC251021B6
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739428.12:32:53.3880646</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\pvohgn1v.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.261766240670719
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnWx86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAB:BYlDc
                                                  MD5:5179C9FB660711E898E203B701BE6A88
                                                  SHA1:6ADE6D7C815A752275F9B9B02FBC1F59F33CDBF6
                                                  SHA-256:FED90CB161281CB0686133A063333EC92263CF86B607A7486F226F60DF3E5999
                                                  SHA-512:951BFF72786EEAA433A21D15CE0AA42D791E0E45796D1AA70CAAAE306F3D838D00B1C6F5937F26D8FF5267A46B7ABAB45E32361B675F7A96C7693DFE292A30C7
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739880.18:46:02.4680634</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\pwkukl6i.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.261492459545154
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnLnx86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBw:leYlDc
                                                  MD5:558E77E9EA0E4EFE24AC7B5A579C1718
                                                  SHA1:1DA07949EAA9109EFC6B9876AFE7C5CEB7A69B7C
                                                  SHA-256:8544BC3ECD05AC116364D7030734DA601D5351A0AD5CAD4999BA714502CF39EE
                                                  SHA-512:D426447C34E45EA43D55DC14F5664BE891D5B5731BDA09DC39822F2E5200E0187D44762FFFE04F0059B197D642F18132B0FC0EEBF8A71CA6AAEB8AEE1DF06F76
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739583.10:42:41.3997025</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\pwqppx2h.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.261534528155974
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnYx86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAB:HYlDc
                                                  MD5:2712B09D57EAC75382EAB3F9E40B072F
                                                  SHA1:484F059810AFEFA221BA0A46A9CF9061F973452C
                                                  SHA-256:37120E1418DB003185FEB1B067DC0A6B22666F1FEE61C16AE4E0F3CDA4E56B68
                                                  SHA-512:BE51262D6FDC63605EDFCFBDD564D767D740388AD84880EDFF7B20B77AFBED1DAE3C794CF5B21A34C678E0AAC30469F94D3961C82B9F1A9875B1E4A4B58564B4
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739880.18:46:02.4212024</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\pyskvpnc.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):2893
                                                  Entropy (8bit):4.281347739610056
                                                  Encrypted:false
                                                  SSDEEP:48:cFGnyEAnvQEAnaUoKMaOgnDEAnYGEAn0EAnGmEAnlTZCEAn7EAn8fEAnYJEAnWL/:ZnjAnvlAnkKT3noAn0AnRAnQAntZTAno
                                                  MD5:5549832913F0B77822BEB9DA3B6F7852
                                                  SHA1:9D1C03EFF058487843477FBECFAD5A7ABD0A4B28
                                                  SHA-256:BB796343CD355ED01454A4D41590C3C37F4CF119918C4F4321E67869A360CCB1
                                                  SHA-512:31AB11A5421CABD93AC8B83F6798FB194773BC42943DB5148AD8358900BA17A8CA571E814749B772174C9C6B067D57CE602E5EB841490FBC131723B8AFE3658C
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739185.10:36:38.9049378</value>.. </setting>.. <setting name="WCActiveLogo" serializeAs="String">.. <value>AA_WebCompanionLogo</value>.. </setting>.. <setting name="ProductVersionType" serializeAs="String">.. <value>Free</value>.. </setting>.. <setting name="IsSearchProtectOn" serializeAs="S

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\q12ze3a8.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):2324
                                                  Entropy (8bit):4.242122953974393
                                                  Encrypted:false
                                                  SSDEEP:48:cjQEAnaMOgnDEAnYGEAn0EAnGmEAnlTZCEAn7EAn8fEAnYJEAnWLEAndocZIEAni:8lAnl3noAn0AnRAnQAntZTAnwAn3AnfN
                                                  MD5:CC088C6E4B2790F16CB875DE6B79B74C
                                                  SHA1:3A9F843A5A1AB1723BBC0E316F9DF5C2F31B1C02
                                                  SHA-256:7C811C11E3E199EC016BF92BDBBC2D481E04830422DD5C5FEF614718EBD8EEA3
                                                  SHA-512:F13F64FAC02059D812125893FCD93090C35683CEEFC62500327C1DA982D6F6FD8BB215A3E6D20121F68CA17C7DDA14BF69F5E4F47C22A8F7753F8C3026EF6ADF
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>00:00:00</value>.. </setting>.. <setting name="ProductVersionType" serializeAs="String">.. <value>Free</value>.. </setting>.. <setting name="IsSearchProtectOn" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="EnableWebBar" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="IsMURLOptOut" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="EnableChromeExtension" serializeAs="String">.. <value>False</v

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\q1ffzzmk.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.261250754315743
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnLhx86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBw:6YlDc
                                                  MD5:3DEB6A002699830B8AC5EDBC5638B629
                                                  SHA1:F257A96A761B30D87BF5BEAA8E3B51FD1A0A4311
                                                  SHA-256:15F8706FF216D3F1DB8BED21FFBAE3C9B50721E290F2D999C2B7F0A845125657
                                                  SHA-512:7585C538F16376107D71B91089B8E7D1BF019ED776FAD2DAF5312604BC7B73C750D2EF07D448AA19E9EAD8A28741FBBAE6EF4EF684B1E1F40DAB555A64EB7170
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739872.18:46:00.3805771</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\q7os0qgz.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.262174847176277
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAn6x86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAB:FYlDc
                                                  MD5:D94F3110A897F6D3E371C0C63C5DAF73
                                                  SHA1:F5448E8CB7324957928A81E906A87A389FF85597
                                                  SHA-256:9AA34543A7C5194A154330C4E1FB307A8C93E24D0D0674766AD394C5B8923741
                                                  SHA-512:4BDB0BA877541590F820B4633A0317077222AB6C31193F92A48FC6A12F1634FE1FF7601489038C3A3905DC2BE504F9FB40C4FDB25D17631853D273A7D7A35C96
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739869.18:45:59.4461952</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\qdxoof2i.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.261617292210481
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnmWx86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBw:oYlDc
                                                  MD5:F6DE5E935EEBB6EBA585BE7AA226BDB2
                                                  SHA1:1E8A4BD235EEA986B241B5E8A1ACE4ECBEFB7F46
                                                  SHA-256:5045CBF3CD8D53A626011B5D6735D8C4C889C23FF42AFB4A933AFCE31FE7527F
                                                  SHA-512:25FF07B8BF7F5BF796669D2F8B25BDE4C1CB0D002892ECBEAA38D38EF95B7D9E1CF9B1336F5211E6A355837CA4E21BC86FDB49BE907007176529740FA1DD90AC
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739640.13:57:30.5485817</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\qfvgvoi_.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):2893
                                                  Entropy (8bit):4.279047351766277
                                                  Encrypted:false
                                                  SSDEEP:48:cFGnyEAnvQEAnaFeMaOgnDEAnYGEAn0EAnGmEAnlTZCEAn7EAn8fEAnYJEAnWLEA:ZnjAnvlAneeT3noAn0AnRAnQAntZTAno
                                                  MD5:A8EB74CD1C278B220D287A22F050D7B3
                                                  SHA1:9FD9D6C4C4D299451B22F53DD96B324408E69C06
                                                  SHA-256:2CE8620BB67A3C9B503B914D54194BE8702281B7290129A6A4AC0B6377003E45
                                                  SHA-512:65E0CF4D2137E8523C0D31DFC18A6A8E250BE1C8B3A3E82805CCF9544167CE51B8797F806ED8D5EDF1F21B184F475360376D8CAB7CD250AAD52E2BDAF7D29BA4
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739180.09:42:40.8799392</value>.. </setting>.. <setting name="WCActiveLogo" serializeAs="String">.. <value>AA_WebCompanionLogo</value>.. </setting>.. <setting name="ProductVersionType" serializeAs="String">.. <value>Free</value>.. </setting>.. <setting name="IsSearchProtectOn" serializeAs="S

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\qgwszrc-.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.262332347969401
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAn0x86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAB:fYlDc
                                                  MD5:AFE105B193C0ABC2286D56C93B59E48C
                                                  SHA1:CF4F7D6CFCC1194E5D873CD35730290B95DA83E6
                                                  SHA-256:8FED37C19FD1C3B3A5E9B67D0486DAFBDFCF64EB426C1D3ECE37D3AB1F4F9D14
                                                  SHA-512:95AB3B5DCCF8DE3AEBDC42A40A705915B3F59EE3B331BE12536CD2FD30CA44412CDF48E96412E7F0C811EDEF18B36D1D567E1570F713088D5DBEE8A25EBC30DD
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739609.12:45:48.6544583</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\raludzqw.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.261534528155974
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnTnx86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBw:JeYlDc
                                                  MD5:B5F9A45E7C399D1C0A0895EED9073027
                                                  SHA1:A46609A15B7B4E1138C8EB1B885F6D064E98F808
                                                  SHA-256:C0D02F39177714447389A33498F5167667BEC30D0EDAAB46E28C2E5787E4D255
                                                  SHA-512:2DF3C55F98E6229F8CC925641D7CDF8EA0DB257C37D72D6CF3461BE0595560B6B93581E2BC39444BE42AAE173D055C33B92B8B062DBE34E1F76C3B65776E989F
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739871.18:45:59.4574515</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\rjmmbloj.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.261842451398438
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnEx86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAB:PYlDc
                                                  MD5:AE224C97D865BA6FCC6DF4F6EEB35076
                                                  SHA1:1D2319E01FC8C4D78F334B88241D4AFFDE692947
                                                  SHA-256:FDDD1F61B3E1273343F56021205046308A9CD3315C773E66BF959DC82E3FCE7A
                                                  SHA-512:FE77F4C53FF65B2E0B977ACDAE00E09E026D289F3656E034FA73A383B29B495A338E19E0ED0B13A8C05A9191C740979A5B103B7C80728CD3FC57390B5871464F
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739606.12:46:47.5935752</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\rnxcj_pl.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.260914540053853
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnYx86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAB:vYlDc
                                                  MD5:0556322231B1FAA6ACF3F02702FEA1C9
                                                  SHA1:15A3024841E6AEF4BF8FD928CDF0D28ED9E33C0E
                                                  SHA-256:CEACF33F806391E9B805FBC94EF8F796CE43892F84343E64866E9CC880D19DAE
                                                  SHA-512:2EEF57115C47568C9CEDBD1524B08E1B910D89C70A901B5CF55EF89C968ACC8747CDD24F4C0FAFCE30CEFA02A0BD9A13B1B6C8890DB5E8BFA35BD01750DB6133
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739576.09:51:12.3223176</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\roaj66dc.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.260674833830541
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnux86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAB:pYlDc
                                                  MD5:5A98D2DC8C247C4CAC243918A6AE0819
                                                  SHA1:76D9BA1C5AA822BB34D150389041FDB0E5086C59
                                                  SHA-256:3A2B6BBBAF3F86208DDB6C2E088149454516FE0D6E3A9889E5F2576BE1076B0A
                                                  SHA-512:5EE0A788E0E7CDB2CD42C7DBB6502A52330A764D20D08AD1219EBB6D28829E21B7F4F25155B4282DDE5D7DD96B0E107FBBBF8F5D53D40D2670BB741365DA4680
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739585.11:07:11.8350821</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\rp9bjm6n.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.261674991497972
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnhx86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAB:6YlDc
                                                  MD5:7C10DE4883D5218A301ADE2B6E3E91C1
                                                  SHA1:20EDC3415BAF9FBFE0BBD509491C3F40F5E6C34D
                                                  SHA-256:06DD32CD5290F383EB553A0B828FFC76214B07FC335586C6897067240073BB38
                                                  SHA-512:4DABD23923C09C8ADF5A84DDAA3BE39B40597A6448DC6524DB750D76651BA1C527C69F73CD9FE9ECAD4B11588F9380BDF859E1DC69B2239790FBEFFA4B1B8783
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739636.12:26:54.8860703</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\rql85t5o.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.261634329661608
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnbx86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAB:oYlDc
                                                  MD5:9C92F3CDBE63ACAD5B7304B65592FE5A
                                                  SHA1:9C3A7A3BF0BDB0481F98BB7D8AD7C28CCEC782B0
                                                  SHA-256:49D0AC8BDD750973D791B1BCDC3ED40C4650D588DB4C3146CB84939E5B8607FF
                                                  SHA-512:EA7DE894D0FC6F643ACEB90C3DFC3A129562DAE92CDAD55C278FC3C90BB4451CA3AFE5A23F152089C009C719AE6078F5597B8FB67BC591C16415EC05642B79CD
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739843.16:53:49.2293196</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\rsy8yqsl.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.261256013181574
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAn4x86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAB:zYlDc
                                                  MD5:17D3053FBBC70E407ABE9FA29AE15961
                                                  SHA1:A6A44800620DD076A8088731A5E0724FB71E63C9
                                                  SHA-256:2D6BD03AC360717F7890A9166E3BD55DCEC5AF41878C44B9616F6E985CDE9ED4
                                                  SHA-512:11853083111B7E42CBA7267ACB38007C30AB0693FEBA81E8E0FC21A6593BA4E273485A16D0A548330A315C531D0E95E41112DF9F98E9FE34D81CE86CA9454C19
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739852.17:25:51.6858173</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\ryfds0xe.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.26145179770879
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnYx86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAB:nYlDc
                                                  MD5:CD68B91FDBC932373CD43E8A6369B7B2
                                                  SHA1:75466977C64DB9C20A70EC08C3A356BA91834667
                                                  SHA-256:A5A073D0261FE115209305AC9EDE3CB63D4D59CBA7C8C0F0C2AA8E797D07ED24
                                                  SHA-512:1F246D7668287B80AC35BD3E2CE421FE5F9C73DB233D93EB97FE412461EEAFF40C9C49B781B38CAFFC1FD98E993F11386FB3FC1DD7ECF3EE2DDD531B58650919
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739851.17:25:50.8342083</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\scb7kcdg.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):2893
                                                  Entropy (8bit):4.281121323421998
                                                  Encrypted:false
                                                  SSDEEP:48:cFGnyEAnvQEAnauRMaOgnDEAnYGEAn0EAnGmEAnlTZCEAn7EAn8fEAnYJEAnWLEA:ZnjAnvlAnvT3noAn0AnRAnQAntZTAnwV
                                                  MD5:12EDD6EC9F7086D65CA095FDEFC1722A
                                                  SHA1:205CCD231DEF176AF81B9ACF8ED5D6B7C36C5C35
                                                  SHA-256:23516056C09DE23B95AFB76BC29D31FA9C0D2AE3A64A37C1BA53EE25B8B5FDB2
                                                  SHA-512:0B2DE20604D40023008E00B53074E1942C3FE6287E2D7258706BC560F9F16F76F7311DAE43E4ACAF2900F965827A53802CF2DA42C5A88A721DA97DB32743B7EF
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739174.08:55:41.5920604</value>.. </setting>.. <setting name="WCActiveLogo" serializeAs="String">.. <value>AA_WebCompanionLogo</value>.. </setting>.. <setting name="ProductVersionType" serializeAs="String">.. <value>Free</value>.. </setting>.. <setting name="IsSearchProtectOn" serializeAs="S

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\sm0bb3-d.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.261975802789329
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnVx86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAB:mYlDc
                                                  MD5:B44CBA8AA8EF702BFD614F5BADCA2496
                                                  SHA1:9490FB3C41C731CAA278370E17C2588121DFC56D
                                                  SHA-256:F0BF02BB54B77E201F9969160BA2E91097A3B251B6F7D671C1AE31CB88F081A7
                                                  SHA-512:FD659EBF46F69F64FDAACCCB407A377C9D8AFA83B4089F5FE90B9625CEB8B84423CC443A28E7E5F50AACBF531CAC4267BA4A6B94B3B5975789FA060D315BD954
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739889.18:46:05.7615652</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\stvao_a3.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.261799824163298
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnrx86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAB:oYlDc
                                                  MD5:1EFAA83F9C9F87E34CEFCE3875DA5BC3
                                                  SHA1:7D87ABA101D60E125C04ACA2FE389CAA7430242B
                                                  SHA-256:F32D12DF26184E639554B5D49B47F3C38D23F3A33527B1CD2F54935A3CA93313
                                                  SHA-512:91A0F4AE94EAE375A4381123704694C882E7A575B552C49E34B97CF823DF2CDED7A1D01ADE3CFD01BCB5B3F24D1EDB1829117BF8C24EE77D9C8ABA48F220B0EF
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739845.17:01:49.6969527</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\t0p1kigk.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.261891073336046
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnBnx86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBw:XeYlDc
                                                  MD5:4EAE25FFE5623145912113DD2607F1B4
                                                  SHA1:D1F062DE66A6913CDF4A231F6E25DFF36C2A1D90
                                                  SHA-256:1F755D8F287DD5AEA840A3EBC99248119506DCA9649EFD6720B4DEAFD8A8F775
                                                  SHA-512:B72766201B534080637C8BE71A82281B884ACC3EBEDCA755761019A34AC1ED06BE3F254599173F8120DBF095408567567436AD4E25502709669ACE8F8D28BA14
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>740044.18:28:30.9663195</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\t8oywtrn.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.261592227443464
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAn5x86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAB:GYlDc
                                                  MD5:F14561776C0F38A7BCD5F2C213710457
                                                  SHA1:81EE8B5B66BB06E1C7AAFA4E020D79359DE4C4E3
                                                  SHA-256:610718183D9712D0966BBDB7B501BBABA893E73AFC38D8F24AE3BBF5EEC2E238
                                                  SHA-512:C98BC2069700BF09C59CD92217D5E84E060F3E1BB1709AC05E7C612827D06928B65C43FB6220EE83C20381B39FB8F9EE127959FC9E888F459FAD9126C1B53B12
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739868.18:45:58.3148158</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\td68vx6a.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.261734131167241
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnxx86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAB:+YlDc
                                                  MD5:E882268837689B91809216D053AF5B71
                                                  SHA1:8AD49C7A3B3FE43109D1FB79245D6BFC619AA99B
                                                  SHA-256:52EEC87406741B3955ED1B1D953CA7DF0A32A909DD6D50AEC6990B6FBB92FBBE
                                                  SHA-512:8A02CE9E58325359655602AC9DE013CDACAFAF180C3E5662183D551DB8AEAC4BC6E724EAC70AB5D78201DD327DA2797AF5F43B079589BC57BD0B5D5F1F5E5051
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739626.13:53:55.6284601</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\tjedtipl.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):2893
                                                  Entropy (8bit):4.279342807339133
                                                  Encrypted:false
                                                  SSDEEP:48:cFGnyEAnvQEAna6MaOgnDEAnYGEAn0EAnGmEAnlTZCEAn7EAn8fEAnYJEAnWLEA1:ZnjAnvlAn1T3noAn0AnRAnQAntZTAnwV
                                                  MD5:C45AE64FD6EDA5429C71DCA1F5EBDC4F
                                                  SHA1:5580F34CE0AC6ABD7C9BF79CC5FCDB8BCEBDD4E7
                                                  SHA-256:062AA6A404D5FBFE407E05C2BFBF19698AB66B0F2F18367CFDFBC912DEAC4656
                                                  SHA-512:1DDA6B338B939CD5550B6BC7CA6B9DF47A38774E9E830358B7C10E182DEF21580099AD16372F896855C25AF1C0A4C037E0E2E645B0F0255D8FB1F372047393B6
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739184.10:18:39.2799744</value>.. </setting>.. <setting name="WCActiveLogo" serializeAs="String">.. <value>AA_WebCompanionLogo</value>.. </setting>.. <setting name="ProductVersionType" serializeAs="String">.. <value>Free</value>.. </setting>.. <setting name="IsSearchProtectOn" serializeAs="S

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\tkwmfbus.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.262149816016583
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAn8x86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAB:PYlDc
                                                  MD5:585BB777600F02C877C707115D429866
                                                  SHA1:88A35EB1482BB3BF0EA9712544C4B429793EC34C
                                                  SHA-256:39F2ECD7309C0D6EE44EAA0EAA0FF149C32DCC097C1D5F94FD04C9D03DD6675E
                                                  SHA-512:0130AC5098314E63B6687D8A0DBDAE9E40DE028B0CC26D61CD5F2080F1E3CF54FF7EB952F316EFE4C53B8D1FE80CFA7F76E22735E52BB2EE8BB2D3DBD4E905D4
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739748.16:05:59.7488266</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\tqn6v30s.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.261534528155974
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnux86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAB:xYlDc
                                                  MD5:86B75CB8D629F95425F7A34B78014678
                                                  SHA1:E024C7CF605DA3DDADF9FD12CC0B2D2BAAF63C2C
                                                  SHA-256:71758E82CBF5A225332F05A449B046EC220F516EE16214428F84709C1BB17DE6
                                                  SHA-512:3BF89574A034FAAC18E34BA30E5EFF38F7BC5F1E1AB2790393EFB477D1E59914935D10F4BEB7D0B490BB73E925FAD531841EC43A8D5FD1408EBD5D22DA88CBD9
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739881.18:46:03.3609434</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\tx9tg2_z.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.262016464625693
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnvnx86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBw:NeYlDc
                                                  MD5:8B3C3DE0D933B4C21F73D06C8313681B
                                                  SHA1:EF9398168DA049A924812AEAA09D761A30C364F9
                                                  SHA-256:1EA135A7CCD835BD868F5FAC3EADCA0153CE7B4B6455494039BDB38C5350F455
                                                  SHA-512:EEB72C515FEF1A8EB38643CAC8D4C06714B4AFCC96C2C02848A4B76D2B731C7F4B82A78EEE378C087E5ACCFDD81F853738F805D6E85E9D4C4FBBE8AE8AF9548F
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739837.14:29:48.2395655</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\ty3hv0x5.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.261026120144782
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnox86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAB:/YlDc
                                                  MD5:D15193722253772B8B678FBB78415E2D
                                                  SHA1:F8CBC71355FA4E19B295850E5B27432AEBD6DD24
                                                  SHA-256:F69E62297BECDE3F8FE895EA779B983FCE0B8391589458F2EC80BDD1B5507569
                                                  SHA-512:56E50A13039242425BEF2BF9DF589D6472FB6DB74EBAFDFDBEEB190B8B38C4BB7FC54BE69A7938C0234E4B337C853CF6FD9A59DA7375EC28AB4D8479C95C2238
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739610.13:04:49.0833192</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\u0840nns.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.261070187761701
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnFx86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAB:iYlDc
                                                  MD5:6FDDC01BBC998B17F3ACED876BE1DE17
                                                  SHA1:30BFCA7CE1CC16CC817DB18BA8AF70E3D2FE044E
                                                  SHA-256:5177E8CCE306F384566A6F49B6F4AA9D57A06E76A5228D8AF9435F478E72F438
                                                  SHA-512:EBE424D0DCCE5CDE84EC2EB31278C903CE3C05235D7FAABF18A6F97B42619A5801D34B02C4AC3CEBFA61F8B560D4BEC3C1362A01CC2015453DC6F2C37B397302
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739592.12:11:13.3365814</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\ufzveoqa.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):2893
                                                  Entropy (8bit):4.279032887894875
                                                  Encrypted:false
                                                  SSDEEP:48:cFGnyEAnvQEAnaGMaOgnDEAnYGEAn0EAnGmEAnlTZCEAn7EAn8fEAnYJEAnWLEA1:ZnjAnvlAnxT3noAn0AnRAnQAntZTAnwV
                                                  MD5:01A126F6BAED248E1706EB3E4262BCDB
                                                  SHA1:C621F335FDE2CB87B6868501E23D20B1CBBA169D
                                                  SHA-256:A05175D36ACCB6B0169D00F3396BE394A6F1BAC679AD4C7F39DBC2CA5AA70FE8
                                                  SHA-512:C3B4DE6E89BFCA1A91706917E1D05E945B91876ED1315933EF0ABE73136B78EE86C02A078154B66EB4DA17C803735BB4636CBEA22B94C85D536E99E154A4B811
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739188.10:37:09.0518172</value>.. </setting>.. <setting name="WCActiveLogo" serializeAs="String">.. <value>AA_WebCompanionLogo</value>.. </setting>.. <setting name="ProductVersionType" serializeAs="String">.. <value>Free</value>.. </setting>.. <setting name="IsSearchProtectOn" serializeAs="S

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\user.config (copy)

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):338
                                                  Entropy (8bit):4.593235631150064
                                                  Encrypted:false
                                                  SSDEEP:6:TMVBd1IGnOhrPOYYYAP0RXKRF/+uKpvvvX8PONI3QIT:TMHdGGnOhrOXQEN+uKpvvvXCONI3xT
                                                  MD5:0A35FBAE99F45BC0DCCDB777ECFD0436
                                                  SHA1:65E295FDE91F90D55B107680E060895654FE66E4
                                                  SHA-256:19AF84C48A15820C94367390D58588DDAD8164B0AC4056C258A766C726329550
                                                  SHA-512:DB3A0973A373C039603C750F0F196CBF65553CDDB83739F1942402EAACBE178A775BE87C4B034FEB706830AE69D20158C3E3ECAD8D5D3FEBC45146B487C3C42C
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. </WebCompanion.UI.Properties.Settings>.. </userSettings>..</configuration>

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\uu1mgxhc.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4643
                                                  Entropy (8bit):4.262916723521035
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAndx86MnmNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAnEot:2ilDc
                                                  MD5:16CC23DA6CCB6FA46C73D6EBB47BCDB4
                                                  SHA1:DE838CD1CAEB2498AFED0B0C7B605776C0B32D4F
                                                  SHA-256:4C5E5466F92E0C35FCC55BABEC7EC6C93DF4E4519323CCCFE163B1E0B192FA26
                                                  SHA-512:30F7DB7DDC346DC430D3AF2969036CBA20D018EB40343F14C87636E955FF25716A48AED5E1F70BB71A4004B393869E9DE3E4245FE0F013E03E32F26BB54C7F25
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739224.07:55:38.5443212</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\vmxsqcw4.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):2893
                                                  Entropy (8bit):4.281517191734382
                                                  Encrypted:false
                                                  SSDEEP:48:cFGnyEAnvQEAnauoMaOgnDEAnYGEAn0EAnGmEAnlTZCEAn7EAn8fEAnYJEAnWLEA:ZnjAnvlAneT3noAn0AnRAnQAntZTAnwV
                                                  MD5:4D2985B71DCD4000EFFAD552EDF89D15
                                                  SHA1:2B7D2068EA754C8045EABDFA568535EA5B3A9996
                                                  SHA-256:595382D248996416E4CA49AE44CC510EE720ACC77C8A14D26D0886192EFCADD0
                                                  SHA-512:6586066DBE49F64A2579EC1171718472CD35DCACC69731F216070F0B7912ADB7E04C5C43EB5A5AFDD5DE671AFD93AB7EA15F4007E5AF116AB513AB7C677F9222
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739174.08:55:41.5764432</value>.. </setting>.. <setting name="WCActiveLogo" serializeAs="String">.. <value>AA_WebCompanionLogo</value>.. </setting>.. <setting name="ProductVersionType" serializeAs="String">.. <value>Free</value>.. </setting>.. <setting name="IsSearchProtectOn" serializeAs="S

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\vnfksxph.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.260401019097653
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAntx86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAB:6YlDc
                                                  MD5:5C8EB940FB11B53681A1B2905A0CCC51
                                                  SHA1:3433183316B7BB5B07B5D3D84662EB180FEE58EC
                                                  SHA-256:4266A3D0AF9BFC2EB3BA11B4E903BB162D5EF61B1675470082706F3DFB797118
                                                  SHA-512:5300FBBB0062E6CBF7007250A7FAE7DB2576F075FD585A38A2886111739C1F4244C13ACB3CFB4067BD26CE41FFA58857FC7B8C907E9724CE3149240B6EC9EC24
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739590.12:11:13.0382081</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\voshhos2.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):2893
                                                  Entropy (8bit):4.2808949072339395
                                                  Encrypted:false
                                                  SSDEEP:48:cFGnyEAnvQEAnauyMaOgnDEAnYGEAn0EAnGmEAnlTZCEAn7EAn8fEAnYJEAnWLEA:ZnjAnvlAn8T3noAn0AnRAnQAntZTAnwV
                                                  MD5:E30091AAA7DD43C67B85F5536498DD65
                                                  SHA1:80CD487B2553163DC429B1315044F132B08A1680
                                                  SHA-256:D73A75193DD290362EC8AC701CAC929CBCACD6BA72603876D394BA62B18A2C61
                                                  SHA-512:4868C338F8551B98FA55856C56234279F70E5AC014378982FD5A0536274DA33FA684FAB04EA5CFDD0EDF4013B907293072835BBA4E72D0A8468C16F3FC4EECAA
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739174.08:55:41.5139382</value>.. </setting>.. <setting name="WCActiveLogo" serializeAs="String">.. <value>AA_WebCompanionLogo</value>.. </setting>.. <setting name="ProductVersionType" serializeAs="String">.. <value>Free</value>.. </setting>.. <setting name="IsSearchProtectOn" serializeAs="S

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\vy7fuo0d.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.261558118933888
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnMnx86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBw:eeYlDc
                                                  MD5:2CDAB40B8DEF6E7070091A66AE120FC6
                                                  SHA1:B2C5F5C269786D6EDBEB16C8FC5C1480D809919B
                                                  SHA-256:E5FAF07A162EA8D504080E0BA0BE78FDF42AD1FFCC6FD5A6BF4E9B2DB66DFA9E
                                                  SHA-512:DFF25F2A2C296608DCE30FFA208DA1604A1BCFDDB5049B9021E642B26DA81844E6174286F7782D8CEE3E7579D535F0BD10EF88B545332BDA6BABE8A3E7AF0E11
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>740048.18:36:31.9603125</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\w0gv9jib.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.262041495785386
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnBXx86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBw:6YlDc
                                                  MD5:7C3FF61EE613226BC7805A6A0F815598
                                                  SHA1:E63E3BC66388C7856A4CE6E2BCC8688A1D9B373B
                                                  SHA-256:87345B669335996C4B0EDB3123101244739D1F6A5BFFF8158163CE3232494D0B
                                                  SHA-512:C22527C13950A712227A873DF6D36ABCF2BFA54C313A6BEDA1795F995C8AA9B7C106E49878114E0E2DFB93B487B48BF4508F5AC96F78B50A1A3EF55BF7FBE8E4
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739866.18:45:57.4495733</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\w6z0uvto.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):2893
                                                  Entropy (8bit):4.281677714875312
                                                  Encrypted:false
                                                  SSDEEP:48:cFGnyEAnvQEAnaBcMaOgnDEAnYGEAn0EAnGmEAnlTZCEAn7EAn8fEAnYJEAnWLEA:ZnjAnvlAnhT3noAn0AnRAnQAntZTAnwV
                                                  MD5:EE11E68776AF2F801E38580E6376923B
                                                  SHA1:5B6476F6BEBEC6DDB00CE4770DD75ED60B1AEFE4
                                                  SHA-256:059E0EF7974672726CE91A0B2252E41F19415A7310012C32F69BF3F37810C19C
                                                  SHA-512:E4A4E491D959184754EF98ED8C4CB344C0E3D1B65680D3ABA6BBD70EF4B8AE86147984D1EB22E7095D80DDD6070E18751DBC9B1027AC3D083BF3DA4EA23A6E10
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739176.08:56:11.5264386</value>.. </setting>.. <setting name="WCActiveLogo" serializeAs="String">.. <value>AA_WebCompanionLogo</value>.. </setting>.. <setting name="ProductVersionType" serializeAs="String">.. <value>Free</value>.. </setting>.. <setting name="IsSearchProtectOn" serializeAs="S

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\w8kheiwf.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4643
                                                  Entropy (8bit):4.262968753441386
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnhx86MnmNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAnEot:6ilDc
                                                  MD5:8F36A1E86B56D27C9E01CFEABD128B93
                                                  SHA1:890C8398C11E91B8A4CAB44EDB940E7A6B5961F0
                                                  SHA-256:546507BB28FEDDF6EF82EE6081CF78C80B281F3012EE7E6C54ED808A6F2B0053
                                                  SHA-512:909EBCB1563B228394790C915865498E38BD962656B2932427A3CAB0DA42EE8A30A29C353ED19B5DE6C2D87B13D756CDAEC159A3DDA3994B97FA13A7CA9345A8
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739636.12:26:54.8860703</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\wn0o3jbc.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4236
                                                  Entropy (8bit):4.255926583296658
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnGK86MnmAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZBAnEoAndoKHW:kfD6
                                                  MD5:7346A8FA159D78421ED3ECAF2B3A87C0
                                                  SHA1:1BF99883F3312AD981E49F7AA017D60E130F4D3B
                                                  SHA-256:6F280091B18B5305EC8A79023A793DC009D6F1E029C0A6DCD14461AE736567D0
                                                  SHA-512:89754386C04588D7927BFD29B5D3D54E9833FC72992D4FA0D16021FC349EF687ABE2066677E1E4D49C692A85E08B07357BFC2D0B590F63B67792EC6EFC7B38AC
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739197.07:21:35.7662042</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>00:00:00</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" serializeAs="Str

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\wxugp1--.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):2893
                                                  Entropy (8bit):4.281072339858197
                                                  Encrypted:false
                                                  SSDEEP:48:cFGnyEAnvQEAnaBinMaOgnDEAnYGEAn0EAnGmEAnlTZCEAn7EAn8fEAnYJEAnWL/:ZnjAnvlAnYinT3noAn0AnRAnQAntZTAo
                                                  MD5:D1569F947F5E052C4A90BB8B51EE1DD2
                                                  SHA1:8251CC9B85E36099B5C56D9E28290DD6BBD4ACD4
                                                  SHA-256:0ACD683AE423FCA19FD77DD8FCBA5D579C0E8713E7344170BF5BF2EC2DD915DD
                                                  SHA-512:D9E93C44D34FE01728455093F4D0B9634120202CA831432B7AF624FF2C33D39B878B2AA323CC73FA5DAC5026FBA11F4C71893BF56D773CAC714E0B10EAE02B70
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739181.09:50:40.7736905</value>.. </setting>.. <setting name="WCActiveLogo" serializeAs="String">.. <value>AA_WebCompanionLogo</value>.. </setting>.. <setting name="ProductVersionType" serializeAs="String">.. <value>Free</value>.. </setting>.. <setting name="IsSearchProtectOn" serializeAs="S

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\x-luxv_g.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):2455
                                                  Entropy (8bit):4.2340832537423045
                                                  Encrypted:false
                                                  SSDEEP:48:cFGnvQEAnaMOgnDEAnYGEAn0EAnGmEAnlTZCEAn7EAn8fEAnYJEAnWLEAndocZI4:ZnvlAnl3noAn0AnRAnQAntZTAnwAn3AF
                                                  MD5:336C6EA58A1BAEC689782CD3F9802AB3
                                                  SHA1:00E30D60EEB1DF5C4576CEBBB1ADA54F9D443E59
                                                  SHA-256:B335BBCCE0E801EBE1C0128EF96CF2DAA2B3303561D9D1086083C421C4086B10
                                                  SHA-512:5ED952F9CF1EE4A2E6FCBBFA4B69B4BF8CA841D8F117D63BA7767A2F8E3C38F1AAE27AE5E2E4AD26C9DC341D3070BC1685739D993C7B1D1372A6DD2CC39746AA
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>00:00:00</value>.. </setting>.. <setting name="ProductVersionType" serializeAs="String">.. <value>Free</value>.. </setting>.. <setting name="IsSearchProtectOn" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="EnableWebBar" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="IsMURLOptOut" serializeAs="String">.. <value>False</value

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\x1nlmzci.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.260914540053853
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnAx86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAB:DYlDc
                                                  MD5:7016B1DEDA7ED6ED6116E94E75BE4CF3
                                                  SHA1:44957980585EC2A6B7AB6E7790C2F995FA1C9B33
                                                  SHA-256:5A3112011AB938643D1C02B9040CCF771B150274DFF6650DAB44EE8F14E4909F
                                                  SHA-512:F728B78434358AF16E16D721118E773AE42965B7F941F2E4C82A0906B452683572EB9C76938F832BF490998238CDCDAE67E117B68184670665420496DB943F44
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739675.12:32:01.2675670</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\x53i6pbo.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.261816861614426
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnex86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAB:BYlDc
                                                  MD5:6AD45679BA192B4E71BC25DBE0034EF1
                                                  SHA1:41030CF977CB79D14FDC5F560A50F979BDFDB285
                                                  SHA-256:760E2F853E9655D3D329F9F4D5D300651606361503FF473E8D3EC498E3854E17
                                                  SHA-512:53F57C3F8A32F6740F4B43F7744069F81836F932E2924CA696ADB073D1843685215B3F9335DD82E485CD48DACCA88FD8ABD349A7D8750E32E127568248304DBF
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739686.15:11:44.8639530</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\x7kziw8i.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.261114143065121
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnlx86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAB:2YlDc
                                                  MD5:257B466FCC128EF4E50B5EF2963C537A
                                                  SHA1:94106096627FBB69C670AD34A01BDA19EE35EC28
                                                  SHA-256:A5D8C6258C5906A4075451117734B33ED45F6035D29AECC47A00DF5DD8547B9E
                                                  SHA-512:233CEA6E57C2511092F6D06DE3C92630A75DBEFEA2B5DE62BCD64755327EEFE00C0E81153A15D6EAD76516D0A8D00A3C7F54D778399295E4CE1F604E14E504FC
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739858.18:29:53.5850710</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\xcwwefg0.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.261534528155974
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnYx86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAB:HYlDc
                                                  MD5:2712B09D57EAC75382EAB3F9E40B072F
                                                  SHA1:484F059810AFEFA221BA0A46A9CF9061F973452C
                                                  SHA-256:37120E1418DB003185FEB1B067DC0A6B22666F1FEE61C16AE4E0F3CDA4E56B68
                                                  SHA-512:BE51262D6FDC63605EDFCFBDD564D767D740388AD84880EDFF7B20B77AFBED1DAE3C794CF5B21A34C678E0AAC30469F94D3961C82B9F1A9875B1E4A4B58564B4
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739880.18:46:02.4212024</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\xispzrqh.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):2893
                                                  Entropy (8bit):4.281517191734382
                                                  Encrypted:false
                                                  SSDEEP:48:cFGnyEAnvQEAnaU3MaOgnDEAnYGEAn0EAnGmEAnlTZCEAn7EAn8fEAnYJEAnWLEA:ZnjAnvlAnTT3noAn0AnRAnQAntZTAnwV
                                                  MD5:04DF93DB33D8A61406077C9A10B779DB
                                                  SHA1:37C32D49B3172318D2B63ED3BB3356B236F0BA10
                                                  SHA-256:03512AC196E2AE8C81A39481CA5D00A176A18D90966391B1BC6BE7152F6FCB6D
                                                  SHA-512:06C102CF78C552B198FA010CE6213B6A7E42E61D20A3315E4047338E185028D6EB5630B8F5BFF9355BC1B09889502C50F2BD2745436B31EFA4ACCEC107DF8127
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739185.10:36:08.9736936</value>.. </setting>.. <setting name="WCActiveLogo" serializeAs="String">.. <value>AA_WebCompanionLogo</value>.. </setting>.. <setting name="ProductVersionType" serializeAs="String">.. <value>Free</value>.. </setting>.. <setting name="IsSearchProtectOn" serializeAs="S

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\xltdyq9a.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):2470
                                                  Entropy (8bit):4.276336541171149
                                                  Encrypted:false
                                                  SSDEEP:48:cFGnvQEAna0OgnDEAnYGEAn0EAnGmEAnlTZCEAn7EAn8fEAnYJEAnWLEAndocZI4:ZnvlAnj3noAn0AnRAnQAntZTAnwAn3AF
                                                  MD5:8936509B41833F7D7348BC421FDE6ED7
                                                  SHA1:605CC39C3B09419205A265AD6FF8C8004A805F5C
                                                  SHA-256:D9CBDFDB2571C6EED590D6D823FCA14AC9E30AB42FA1F3ABB9D8AEB1BD252D46
                                                  SHA-512:502951BBFE11FCDEBEE72A75B5549C620E9E1E160B4AE0F84F4415AB70966E64C5F4E605A2AD8FEAD8BD261F4164970549BAA76BB56A15BD8DB24A8498CBB12B
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739164.08:35:07.4731958</value>.. </setting>.. <setting name="ProductVersionType" serializeAs="String">.. <value>Free</value>.. </setting>.. <setting name="IsSearchProtectOn" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="EnableWebBar" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="IsMURLOptOut" serializeAs="String">.. <val

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\xpipd2tc.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):5042
                                                  Entropy (8bit):4.254458436437144
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnMnx86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBn:eeYlD7
                                                  MD5:1F2FE94D951F6F7C1B4FA76491BC0132
                                                  SHA1:045DBF2AF9ADA41CA6D4EBB6422159A8FC88CCE1
                                                  SHA-256:3E71CC34FC1A822B5E8D8508D74F38240D2FF0441C16EA2E448C23BBA6FD22E6
                                                  SHA-512:BC684F28856A64872A5B4B19DF67634B46FAA422EDFACDA52BB3381A443BE6932ED5E43F7742453C0B28BF7449D68942C2BEAFE3CED327A9006661A074DFFDDD
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>740048.18:36:31.9603125</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\y2d81__l.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4251
                                                  Entropy (8bit):4.277069210719011
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAn1x86MnmAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZBAnEoAndoKHW:ifD6
                                                  MD5:A4D7553901E63297F23A2629D90C73D0
                                                  SHA1:8AD8B159EC9B484BF75C633E2F75C4BF94D7CC43
                                                  SHA-256:748434805731BE5BE3067E65723DF198662457B7F0DAA9F07144C8B22FA2C925
                                                  SHA-512:AEBBE1A21AC4CA330DA9F65862FA2A53E2AF0BAF757B6FCB1B410D554AED4313AF82660F18919782037E4EF2530CFA761AB275EBC50BD0F9269FB9DB18CE0A20
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739199.07:21:36.3474519</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\y2hmusgs.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):2893
                                                  Entropy (8bit):4.279032887894875
                                                  Encrypted:false
                                                  SSDEEP:48:cFGnyEAnvQEAnaGMaOgnDEAnYGEAn0EAnGmEAnlTZCEAn7EAn8fEAnYJEAnWLEA1:ZnjAnvlAnxT3noAn0AnRAnQAntZTAnwV
                                                  MD5:01A126F6BAED248E1706EB3E4262BCDB
                                                  SHA1:C621F335FDE2CB87B6868501E23D20B1CBBA169D
                                                  SHA-256:A05175D36ACCB6B0169D00F3396BE394A6F1BAC679AD4C7F39DBC2CA5AA70FE8
                                                  SHA-512:C3B4DE6E89BFCA1A91706917E1D05E945B91876ED1315933EF0ABE73136B78EE86C02A078154B66EB4DA17C803735BB4636CBEA22B94C85D536E99E154A4B811
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739188.10:37:09.0518172</value>.. </setting>.. <setting name="WCActiveLogo" serializeAs="String">.. <value>AA_WebCompanionLogo</value>.. </setting>.. <setting name="ProductVersionType" serializeAs="String">.. <value>Free</value>.. </setting>.. <setting name="IsSearchProtectOn" serializeAs="S

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\y3-d6-by.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.261517490704847
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAn2x86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAB:VYlDc
                                                  MD5:007069C568BF641BF9A9EE28B3B2EFE9
                                                  SHA1:6F5B8ED12CEB9835965CB7B16BC3C08572B89F75
                                                  SHA-256:00931ECB4158B14FAF36F575A843B99955E86623C4D9A860452D0F32D812AAE1
                                                  SHA-512:2AF2B3BFA3EBED37E5E272E6D36BDC3AA86B740FEC9A0B170079DA3FD86FFA7D7AE37733F30D4AF28CC35931D1CAD1E1B006F4D952E4FB0CC7B66612D894C723
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739603.12:44:46.8730761</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\y5xjiuwh.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):2753
                                                  Entropy (8bit):4.274304368726978
                                                  Encrypted:false
                                                  SSDEEP:48:cFGnyEAnvQEAnayOgnDEAnYGEAn0EAnGmEAnlTZCEAn7EAn8fEAnYJEAnWLEAnYj:ZnjAnvlAn13noAn0AnRAnQAntZTAnwAV
                                                  MD5:BEF527081EE2986E1461C7E936A0451E
                                                  SHA1:C45037A41CED9E61D2A8BBE7524BBDAF51AF4CA2
                                                  SHA-256:D6E564D31D66CC3C8573DAC741745AFB4585A9B68256B22098C6BB8BAACEB6A9
                                                  SHA-512:3C07DD3E62AEAD6DA883AAF3AAD13A21B16D4C4430468D4C16A46EF1AC287872DB634304B0CD4A3E9BC8EF4D5A5562D296702EAD1C965E773708D564B9F5F839
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739164.08:40:36.8513169</value>.. </setting>.. <setting name="ProductVersionType" serializeAs="String">.. <value>Free</value>.. </setting>.. <setting name="IsSearchProtectOn" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="EnableWebBar" serializeAs="String">..

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\ym9dvdte.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):5042
                                                  Entropy (8bit):4.254458436437144
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnMnx86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBn:eeYlD7
                                                  MD5:1F2FE94D951F6F7C1B4FA76491BC0132
                                                  SHA1:045DBF2AF9ADA41CA6D4EBB6422159A8FC88CCE1
                                                  SHA-256:3E71CC34FC1A822B5E8D8508D74F38240D2FF0441C16EA2E448C23BBA6FD22E6
                                                  SHA-512:BC684F28856A64872A5B4B19DF67634B46FAA422EDFACDA52BB3381A443BE6932ED5E43F7742453C0B28BF7449D68942C2BEAFE3CED327A9006661A074DFFDDD
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>740048.18:36:31.9603125</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\yp7yaxpc.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):2612
                                                  Entropy (8bit):4.276163671132725
                                                  Encrypted:false
                                                  SSDEEP:48:cFGnvQEAnayOgnDEAnYGEAn0EAnGmEAnlTZCEAn7EAn8fEAnYJEAnWLEAnY/TZdT:ZnvlAn13noAn0AnRAnQAntZTAnwAn3A6
                                                  MD5:1A9E370A244F6F0D1010BEB371BA4412
                                                  SHA1:BC4DF383355CC6E39CA2A22DEF4DAA0CD5239AB6
                                                  SHA-256:563E2A9AAF0AFA2F8FA1F5A4065E32D015EB0C207E578C810C03B8D4EF432916
                                                  SHA-512:0575D4C70AF5A69AA45B09F16A9613FAB45E3A953D4BC32FF9C8D184FAF628863BFEA4B3000342F4BB21F3070D86D201D59F224A99E247F5ED20DC319202D799
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739164.08:40:36.8513169</value>.. </setting>.. <setting name="ProductVersionType" serializeAs="String">.. <value>Free</value>.. </setting>.. <setting name="IsSearchProtectOn" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="EnableWebBar" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="IsMURLOptOut" serializeAs="String">.. <val

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\ypu-baiq.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4251
                                                  Entropy (8bit):4.276026545796709
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnOx86MnmAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZBAnEoAndoKHW:ZfD6
                                                  MD5:BF94755CD426E60AA8E2E91E945A8A04
                                                  SHA1:6A13BF4DF2C6498C2DF965F0ACC17B293293135B
                                                  SHA-256:A0BCA817834FFEA6C25394D71AE89EE9BB541FDE28010AF2338C0EF33CD7F50F
                                                  SHA-512:0F2B533F95E2D3A3661E8ABAAEB02CB0D7A44FD85DCC1C112728BE0A62A30BBA356EC6885C42A3A4AFA54B95EC6CF7D56FC07808D5B76B6814A05C6D63AC0BB1
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739211.07:53:37.1537050</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\yqs5s1le.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):2893
                                                  Entropy (8bit):4.280269476395828
                                                  Encrypted:false
                                                  SSDEEP:48:cFGnyEAnvQEAnaJMaOgnDEAnYGEAn0EAnGmEAnlTZCEAn7EAn8fEAnYJEAnWLEA1:ZnjAnvlAneT3noAn0AnRAnQAntZTAnwV
                                                  MD5:C1D4FD65400DF76FDBED5B6DEB0AAF4F
                                                  SHA1:569C22EBD5D272FB6F63F63BCE0E62ACADFCE7CB
                                                  SHA-256:E0D5A41BD2CFFF33BD98D7044E07EEE2864F6BD24AE46E06445EC01E67253963
                                                  SHA-512:A5A1C901D1BFC82FA9050C195D1BCE93DA61B997CE679B37B2E7DBFDECE35F8DD44534AEE034D951A230ED7C86290BC3FA36655DCB4F279EAE46DD3073E04BC8
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739186.10:37:08.8924498</value>.. </setting>.. <setting name="WCActiveLogo" serializeAs="String">.. <value>AA_WebCompanionLogo</value>.. </setting>.. <setting name="ProductVersionType" serializeAs="String">.. <value>Free</value>.. </setting>.. <setting name="IsSearchProtectOn" serializeAs="S

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\yrtxsjvf.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.2619081443944955
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnKx86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAB:9YlDc
                                                  MD5:D63304C60C7FBC0E6FDB066FE8B336A8
                                                  SHA1:9B0260205EBD5FEA239F3D1AD00005233DA1D0FD
                                                  SHA-256:8BAEE54D0DFEE2FFC32482380576046077F47F594D0AD4D68F6EB29D8B05B857
                                                  SHA-512:7B6D7185E7D0220FF1208B5ECF322E60A23188B5F7E0625CFA289E02B3DCD4A7DF2812B8A49D0E5CFCAB3E7ED5089AE0F51930D19207D4798FA93476A675B780
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739860.18:45:54.5056953</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\ysjb3ao3.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.262041495785386
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnax86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAB:pYlDc
                                                  MD5:4D51C6A47727FDA426347C4F6629B30E
                                                  SHA1:746D2F4212F96E07F0FDE28CB78EE80E9002C19A
                                                  SHA-256:DF084BCA40AB2020A07FCC440A94833FC80ACF2816D4648A49E1242E4D6C2CF6
                                                  SHA-512:FCE86B87C2A44B07D9C4CFEE489B25E776DCC2989AFD0BD49BA9CB046CC5373BA2B4C5D35AD3325CEB8A325D8DFA4A6D2E8296E1B7509D493245EECC356BA835
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739606.12:45:17.4684547</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\zaaz6h_3.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4376
                                                  Entropy (8bit):4.270464178581235
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAndx86MnmAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAnEoAnd6:2FD6
                                                  MD5:EB5B486DE02113000604DBDC6FCCF54B
                                                  SHA1:94126479F3A3F1590889CF19D745DE7BCC3CCA16
                                                  SHA-256:A50A10A02F80471829BFA9D3384C073BC1C44110335A3C0974D544AE026607BD
                                                  SHA-512:B30214CCB6CE18C5DA801845A1C2F038E45EF9AB760EB32D127214ABF5755125E12DC1546B580DF6A0DAC0BC73783526065F11C5B7CD3649A8C5BEF992AEC935
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739224.07:55:38.5443212</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\zje0qe32.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.261825380339989
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnGx86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAB:tYlDc
                                                  MD5:7C678576FBA63970CBA4FC5CE9D7274D
                                                  SHA1:EC7A9BB902D2E2C262BC92E788B63527057611DB
                                                  SHA-256:1E27BC1AE36E537248926B5342FDA9930C888EEC7EB09B306F85628ADD8A870D
                                                  SHA-512:3EBF59EFA3C97190B27E36D8900B4F2E38FD36EB6A0F8BDCEB43A908A7D83B3312F3755A665A356C83A355FC9EDB0CD0D33F374B93EFB3F0BC23E41829423A4C
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739869.18:45:58.5218176</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\zplq8eeu.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.261674991497972
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAnQx86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBAB:zYlDc
                                                  MD5:423971D754DC64577BBC0571EA85F054
                                                  SHA1:51A76D51EF858858AA61AF2894D49F1AB1AB3635
                                                  SHA-256:D11EFF0D74994CF14666B11F57C586CB7BD08F6AA137EA05C1DF69638283A304
                                                  SHA-512:F47910D9EAED781A2FA8E33CD884BD716540DB055F9DB043AAD5659BE85F523958623479EA3E4D69E7A788DF143B94D6CC66718AEAAA313A8F690762D0A9FA52
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739887.18:46:05.0535688</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\zq9grysh.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4912
                                                  Entropy (8bit):4.261455616192841
                                                  Encrypted:false
                                                  SSDEEP:96:ZnjAnvlAn9qx86MnmV5nNKnAT3noAn0AnRAnQAntZTAnwAn3AnfAnWgAnAZ8AnBw:rYlDc
                                                  MD5:6B99DED9E652C7CE56688E967E0BA106
                                                  SHA1:A6E3FA3F1436AFAF917E72B1C4BB1F76F2DBBDD3
                                                  SHA-256:E1E69155F325581AD498CF3C7F068D15273F25780FE1823A704D7F6EB8E4D178
                                                  SHA-512:E80BE9FC865C525FC9175966FB396EE8AEBBE8F54061053B4732FE59303B86BB5F60C346ECDC7AF9354D05374F377C889C306B941165002BCB08388EB7F18903
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739892.18:46:08.1110658</value>.. </setting>.. <setting name="LastCheckForUpdate" serializeAs="String">.. <value>739198.07:21:36.2755697</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" s

                                                  C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\9.1.0.993\zwpztofj.newcfg

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):3014
                                                  Entropy (8bit):4.270340044198938
                                                  Encrypted:false
                                                  SSDEEP:48:cFGnyEAnvQEAnaG8xgMaOgnDEAnYGEAn0EAnGmEAnlTZCEAn7EAn8fEAnYJEAnWb:ZnjAnvlAnx86T3noAn0AnRAnQAntZTAo
                                                  MD5:41206DE52A9B527E7C93327BF779D364
                                                  SHA1:1161E5ADFD2A9A40F1B0F4DB001B7DA3B673C33F
                                                  SHA-256:C8D8ECAFD7ED6BC33D5312065429292AC1CC092B54A75E28897B255973A3985B
                                                  SHA-512:47A4B2F04CE9D6ECA8B9F5437BC4FF0D5C7B77D0E11148F3A02CDCAF13721D05CF2F043B8C3A9D82567D640DA771C5E13ED5F8881201B55CBA58A47F13A1CEE2
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>739188.10:37:09.0518172</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="WCActiveLogo" serializeAs="String">.. <value>AA_WebCompanionLogo</value>.. </setting>.. <setting name="ProductVersionType" serializeAs="String">..

                                                  C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\WebCompanion.exe.log

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):1535
                                                  Entropy (8bit):5.356086363613448
                                                  Encrypted:false
                                                  SSDEEP:24:MLF2CpI3l8bdm26KIKhmhoKm26KTnKoO2+FJ4KO4K2KtV4v4Ku2sB2qb89:MwQqAdB6ZosoW6Ux+FOKlK2OaQK5sAq+
                                                  MD5:9EF3F80197979B4014DB7E69FC08D24E
                                                  SHA1:F06E5CC9CEE94CA3C9123954DBF2416077CB56B9
                                                  SHA-256:23169C225A0F2F2B8E1FE922E310E88B84BFCBD3801BB76C637315450DBD77CA
                                                  SHA-512:84B7C513AE2AE1CFF51D3F79929268AA11BDAB8162F1C37174CAEDCD78C6BA88AF3A5F5D848FE2D78B57CD30064F54974B52EC9DD37B8902CEAC524293EFB8DE
                                                  Malicious:false
                                                  Preview:1,"fusion","GAC",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System\bec14584c93014efbc76285c35d1e891\System.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\953f7919ee8eb01854d0f477eb340f30\WindowsBase.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\53c9f90d7d1962ac81bca35f27f3b5c6\PresentationCore.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\06983816e9e9c8e14e0c69f787b06c62\System.Core.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\f0806a395be5d02c6fb9919cf151da76\PresentationFramework.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\53992d421e2c7ecf6609c62b3510a6f0\System.Configuration.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\74774597e319a738b792e6a6c06d3559\System.Xml.ni.dll",0..2,"System.ServiceModel, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..2,"System.Runtime.Seriali

                                                  C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etl

                                                  Download File
                                                  Process:C:\Windows\System32\runonce.exe
                                                  File Type:data
                                                  Category:dropped
                                                  Size (bytes):24576
                                                  Entropy (8bit):2.0988291958022653
                                                  Encrypted:false
                                                  SSDEEP:384:6n/QoG4K79NyMI5dUkbu0+A9u+x/ySwAisgKjgezpZLuORy8r7UpWiRpxPt98bWE:6npgo
                                                  MD5:C05E597EDD65454EBF6FB5A3E64BF4F3
                                                  SHA1:6A6D104FA6259F4403A638918A29F5CB46D92020
                                                  SHA-256:F02F85F2E47F7AA313404CBEDB9DDDEBD946DF292BF6359344D87024A38576F4
                                                  SHA-512:DA8B6F5D548AE537D2C5F60DDB9C0E94E1D5DCB18556946F36D8C71934FBAD000A6D0A34EE59E20D60F09A48524609AD6FED8FC266359C3EDC8D58B73ADE43C5
                                                  Malicious:false
                                                  Preview:. ..............................................................................h...@...mN............... ......eJ......U).."...Zb..............................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1..........................................................................~.s."...........E.x.p.l.o.r.e.r.S.t.a.r.t.u.p.L.o.g._.R.u.n.O.n.c.e...C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.E.x.p.l.o.r.e.r.\.E.x.p.l.o.r.e.r.S.t.a.r.t.u.p.L.o.g._.R.u.n.O.n.c.e...e.t.l...........P.P.h...@...G,..............................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\WcInstaller[1].exe

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):565920
                                                  Entropy (8bit):7.672199048109324
                                                  Encrypted:false
                                                  SSDEEP:12288:YG5knZfFKeYDbRpFE7T/W2ktHD/ICRrjkBMgOEuPpi:YG50ZfFK5fREfe2yjQCRrjcjuPpi
                                                  MD5:CA94290A5FB89E0AAACBF01585718B17
                                                  SHA1:4FE5E5E9276824158BD9A08BF5A4759EC3C4926B
                                                  SHA-256:0C1EC6BDA6EC65EF4194D0B812B66972B8AF104F46DBA320A46802531D6B2314
                                                  SHA-512:45CC55D77F41BD94472543D23B16C12B4BB777C9F57CB62C5E7E6BE1D0040A0FDE84C219CA504402FB28F03BD57F57CCBA0D2B9E2330D32A59926B4CCC47F535
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s..c}...s..Yy...s..w,...s...r./.s..w....s..Yx...s.......s.......s.Zyu...s.Rich..s.................PE..L.....M........../..................H............@.................................}...........................................d....p...q...........o...2...........................................................................................text............................... ..`.rdata...D.......F..................@..@.data...hZ.......2..................@....sxdata......`......................@....rsrc....q...p...r..................@..@........................................................................................................................................................................................................................................................................................................................

                                                  C:\Users\user\AppData\Local\Temp\7zS8D75AF52\ICSharpCode.SharpZipLib.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\nsnF7E7.tmp\WcInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):213720
                                                  Entropy (8bit):5.759316941956961
                                                  Encrypted:false
                                                  SSDEEP:3072:AK1c/KCOAUXk31Vv91GOtJJKuE1iA5mGPB8qd9OTymIpn+64kRAclDwRNG95ZI4m:Ve9OAQsFtJrGPBnmIRZYp
                                                  MD5:E6BB367B7C30C2A892CD2B9A21727547
                                                  SHA1:4F5983CA5266DAADECEF111EDB15D58582687190
                                                  SHA-256:C451F459F3971F2151578E4BA3080B9F25BA8FC2C0BBAEE2C1BF867A27703741
                                                  SHA-512:91FC13EE9344E67C131011DAD8B9C772476B533FB2388C34D34FBF1D24593B8F785CDAC6846FCF9EC7A84B3664339D0C45669E9EE1EE3EC7643F69D8D550A124
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...........!......... ........... ........@.. .......................@......_.....@.................................d...W........................2... ....................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Users\user\AppData\Local\Temp\7zS8D75AF52\Newtonsoft.Json.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\nsnF7E7.tmp\WcInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):438488
                                                  Entropy (8bit):6.099387465094538
                                                  Encrypted:false
                                                  SSDEEP:6144:jHerwzLkqCG3uKWf4g6tUwoOkErUx5/Rsnaszr0tZDPEaN+YB5+Gon4J:jHerIacuKUtOkESbKQrvB5+CJ
                                                  MD5:2E22312B40CA5093AC2D4C7823BD7F1B
                                                  SHA1:7B29F70F006D40A9F4F387B69D484ACD191DEFC8
                                                  SHA-256:6E5CACEBF3911CDD1B41962C6AA150FFCED3B1D44AE6B64ED18F34005B517ACC
                                                  SHA-512:9F998AD28B9E6F388BAD87C464BEE0718072212AE26C50E0D6D2144ACF9854FC62F833FAC11679A76D52A9DB9F4FF116305F41CB237D9004CF6F1A45A967CE60
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....L.R...........!.....t............... ........... ....................................@.....................................K.......8............~...2..........x................................................ ............... ..H............text....s... ...t.................. ..`.rsrc...8............v..............@..@.reloc...............|..............@..B........................H.......h...................X...P ......................................yK.N...f....i5.#I..xV. ..%BR..^.....t0"..z.%./.G'.j....{...2...k)w...'>.c..P..X.......n...h....E...ex..X/H].R.e.{..;&.-.'....{....*"..}....*V.(x.....(......}....*2.{....oy...*2.{....oz...*B..(....&..(....*...0...........oo........YE....}...............}...n...............n.......I...I...I...I...3...I...X...8D....t......{.....or...o{....ow.....+U..o|.....{.....o....oo...o}.....o....o....t.....o....o..

                                                  C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\nsnF7E7.tmp\WcInstaller.exe
                                                  File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):468184
                                                  Entropy (8bit):6.484237481783134
                                                  Encrypted:false
                                                  SSDEEP:12288:H9FvkzVw/c/gYwx2b619WA1ENpdscZlwH:fgVw/c/gZAscZlwH
                                                  MD5:80619C0E2165AB0C217D4355461DA07D
                                                  SHA1:5EF814D77A9BE69B0D095E0DF3E5D880FDAC0D78
                                                  SHA-256:73184A675024891B66356A2A93FF31BD4D4CDB129274B77B1BA536A35A62D83C
                                                  SHA-512:8E93D44F6604AED638B6A078CC540D5A88526AD2DBEB8141CC316A6E8AE9016493249F2C2BEA4EAA64CBABCF142585F1E7DA6EFB774FC0969E52F433171A5F1F
                                                  Malicious:true
                                                  Yara Hits:
                                                  • Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe, Author: Joe Security
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....}`e.................|...t........... ........@.. .......................@............@.....................................S........q...............2... ......p................................................ ............... ..H............text....z... ...|.................. ..`.rsrc....q.......r...~..............@..@.reloc....... ......................@..B........................H.......h....j...........g................................................~....}.....(......s....}......(....}....*br...p.{....(......(9...*.0..j..........{....rk..po....,.(.....+.(......r}..p(......(......r...p.{....o....o.......(........s.........oP.....z*..........UU......6r...p..(9...*.r...p.....*..{....*"..}....*..{....*"..}....*V.(......(......(....*6r...p..(9...*.0..3........(....( ...,..(.....(.....(!.......s^......oP....z*.........!!......6re..p..(9...*...0..M.......

                                                  C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe.config

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\nsnF7E7.tmp\WcInstaller.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):2720
                                                  Entropy (8bit):4.98742519627159
                                                  Encrypted:false
                                                  SSDEEP:48:c5+qM3DmNwAGDo2cCSIn6la86Vr6R841docr7S36Ek+HEkHQB:jV3gUka8arAN3r7s6Ek+HEkH6
                                                  MD5:1103E1618F5BB75851E0F0C753EC8EC5
                                                  SHA1:CBECB3538CAD8585A4B1962098F1B427DC6984B3
                                                  SHA-256:133F4FCE3A299387263F849250CCEE387B137EE3FF36C6B44B4C02328EDFAAF3
                                                  SHA-512:C005F7873896B8B28C228CFC8CB51BF8A0F9BFEF917A6AF5F0FE32DCC7E818FFB48026FD00A13BF30E82A3383765F2500DD709A25806DAA199829991A9FC9725
                                                  Malicious:true
                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ProdSettings" type="System.Configuration.NameValueSectionHandler"/>.. <section name="StagingSettings" type="System.Configuration.NameValueSectionHandler"/>.. </configSections>.. <ProdSettings>.. <add key="Installer" value="https://wcdownloadercdn.lavasoft.com/9.1.0.993/WebCompanionInstaller-9.1.0.993-prod.exe"/>.. <add key="WebProtectionZip" value="https://rt.webcompanion.com/notifications/download/rt/dci/latest/Webprotection.zip"/>.. <add key="InstallerZip" value="http://wcdownloadercdn.lavasoft.com/9.1.0.993/WebCompanion-9.1.0.993-prod.zip"/>.. </ProdSettings>.. <StagingSettings>.. <add key="Installer" value="https://wcdownloader-qa.lavasoft.com/9.1.0.993/WebCompanionInstaller-9.1.0.993-internal.exe"/>.. <add key="WebProtectionZip" value="https://staging-webcompanion.lavasoft.net/dci/3.0.1.9/Webprotection.zip"/>.. <add key="InstallerZip" value="https://wcdownloader

                                                  C:\Users\user\AppData\Local\Temp\7zS8D75AF52\de-DE\WebCompanionInstaller.resources.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\nsnF7E7.tmp\WcInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):10240
                                                  Entropy (8bit):4.841968989200826
                                                  Encrypted:false
                                                  SSDEEP:192:sV4qrZPdcVt8f2bMpLSpLwvdftwk0d7yF8YplOOoBeRKqBd9uEogll:sV4qrRdcVt8f2wpLS5wvdVCkLpljoBeP
                                                  MD5:CC635544603937E6C0B95528C6174D36
                                                  SHA1:926B8E225E90891BE4353F78E9B6A4F2381599BB
                                                  SHA-256:706A3B4FD8343489EEE470A1E3D1C1065CB5D63B40FD10680286EDEE261D186A
                                                  SHA-512:CBE6140448045393F8A530B62C7F7EF4FACFC4AC4B3961175B9C6C1BF3E3C3E74F2FB2E41F7BF5BAD9555522AA4E19BE16EE3D076CD26170296ECD2A353FC453
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....}`e...........!..... ..........N?... ...@....@.. ....................................@..................................>..S....@.......................`....................................................... ............... ..H............text...T.... ... .................. ..`.rsrc........@......."..............@..@.reloc.......`.......&..............@..B................0?......H........;..d...........P ..C...........................................?..............lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....E.......PADPADPP)6..).......n.....V ..(`5.........]....}........E(/...-.C.... ...#..S.n....xv.|.-.D...................w#(..X:..o.......V...h...................v..-../.x.EZ....1.N...D|-..... ...?.!..v"..v"..v"..v"..."...'vAw(...2c$Q:

                                                  C:\Users\user\AppData\Local\Temp\7zS8D75AF52\en-US\WebCompanionInstaller.resources.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\nsnF7E7.tmp\WcInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):9216
                                                  Entropy (8bit):4.778835051877665
                                                  Encrypted:false
                                                  SSDEEP:192:l4yy+cVgVxrbslCRp5w4F/QTEUM7YP9HrJxsjVPLukogll:l4yy+cVgVxrQlCRLw4FvgVKRTuE
                                                  MD5:A38A454C58268F7D7E515E05B630FD15
                                                  SHA1:5703538D4E9346E8D9053B8A80F45B4E33DA0A02
                                                  SHA-256:7927D35DB9171A88EA7DF1C2F604B4E139F5E34A661ABF5366BB3EA67E3C9035
                                                  SHA-512:E5597A09B32B64CDDB73239D4E4FA0E60C4B12F412B4EBD7FC032717029868882277D6950B0A44C1D5DE4AB411D03F4549192B6A53EC58830226F1ECE3923124
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....}`e...........!.................;... ...@....@.. ....................................@.................................T;..W....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................;......H........7..d...........P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....C.......PADPADPP)6..).......n.....V ..(`5.........]....}........E(/...-.C.... ...#..S.n....xv.|.-.D...................w#(..X:..o.......V...h...............v..-../.x.EZ..N...D|-..... ...?.!..v"..v"..v"..v"..."...'vAw(...2c$Q:#Uv=..C?

                                                  C:\Users\user\AppData\Local\Temp\7zS8D75AF52\es-ES\WebCompanionInstaller.resources.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\nsnF7E7.tmp\WcInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):10240
                                                  Entropy (8bit):4.726455552698344
                                                  Encrypted:false
                                                  SSDEEP:192:1P4qrZPdcVkvZYbu7hKpSwa8R1XUAPLPgWYVyVSAeuzogll:x4qrRdcVkvZYS7hKMwa8XUAzPpY5ux
                                                  MD5:D3DA635F012FB80108EDA2BC7A28A7E6
                                                  SHA1:4115F44018D40FC24A28EF68057BFB3B0490414C
                                                  SHA-256:4B11F05CFED5E4DB094FEBAD3DDAF7A4C869F70AAAF3C1868A45378700030894
                                                  SHA-512:FFE16BB267B11763DD2D1092DF5662DE077DCEE22B18E5C00E2F94E44BB0CB7CB3708590175FCD676155DC7B3D919DDA907D84BA9D25A8E2CE4F1EA39DC74FE8
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....}`e...........!..... ..........>>... ...@....@.. ....................................@..................................=..K....@.......................`....................................................... ............... ..H............text...D.... ... .................. ..`.rsrc........@......."..............@..@.reloc.......`.......&..............@..B................ >......H........:..d...........P ..<...........................................8..............lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....E.......PADPADPP)6..).......n.....V ..(`5.........]....}........E(/...-.C.... ...#..S.n....xv.|.-.D...................w#(..X:..o.......V...h...................v..-../.x.EZ....1.N...D|-..... ...?.!..v"..v"..v"..v"..."...'vAw(...2c$Q:

                                                  C:\Users\user\AppData\Local\Temp\7zS8D75AF52\fr-CA\WebCompanionInstaller.resources.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\nsnF7E7.tmp\WcInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):10240
                                                  Entropy (8bit):4.839585977953346
                                                  Encrypted:false
                                                  SSDEEP:192:+4qrZPdcVRVQBbLQX7pMwUHRvgWRU6ioQho1o4eAZuPogll:+4qrRdcVRVQBHQX7SwUHZg6sj0uV
                                                  MD5:F904CB73495C77A898FF604896C06983
                                                  SHA1:C0752BF08DABD594A89D2E810DA3A57AF2793EF3
                                                  SHA-256:51F3A859166B973C0091C64313AFCBE2ADB2AE1E85A630AFB36D4E7EA4D6697B
                                                  SHA-512:8977AB114E5BF0B3CA8B0F433EC03036447B55235F80FA43247C27E20569A3675A7B9405A72051D45F0D84B508BA18A5D11A31CC31328D937E20C19535AB1B93
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....}`e...........!..... ...........?... ...@....@.. ....................................@..................................>..W....@.......................`....................................................... ............... ..H............text...4.... ... .................. ..`.rsrc........@......."..............@..@.reloc.......`.......&..............@..B.................?......H.......p;..d...........P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....E.......PADPADPP)6..).......n.....V ..(`5.........]....}........E(/...-.C.... ...#..S.n....xv.|.-.D...................w#(..X:..o.......V...h...................v..-../.x.EZ....1.N...D|-..... ...?.!..v"..v"..v"..v"..."...'vAw(...2c$Q:

                                                  C:\Users\user\AppData\Local\Temp\7zS8D75AF52\it-IT\WebCompanionInstaller.resources.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\nsnF7E7.tmp\WcInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):7680
                                                  Entropy (8bit):4.466647098876099
                                                  Encrypted:false
                                                  SSDEEP:96:vCipngp9cqvLcMjJvGWIAvurzPPtK2DhzVYYfNFlRnu/9dqgll:vCipngp9cqT79fePtK2VRfvDuFogll
                                                  MD5:97A2470A5463243ECA160C28BF617607
                                                  SHA1:1916C063D88C4C60AA2E61818244A05FBF26E614
                                                  SHA-256:A03466AF77CD6245AB011128043DED7204E9B4E717DC5BC1A29E7B89A244DE19
                                                  SHA-512:4F8BC9AA8A93E9519D877781EC06CA915639055A70AB791EB61BB3773C2A748FEA282B59C270EC7EECFF590787CF030C22647D814B0E55628148CA3C557AC9E9
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....}`e...........!................^4... ...@....@.. ....................................@..................................4..W....@.......................`....................................................... ............... ..H............text...d.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................@4......H........0..d...........P ..O...........................................K..............lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....+.......PADPADPP)6..).........V ......]....}..........-.C.... ...#..S.n....xv.|.-..X:.....V...h...................v..-....1.D|-.. ...?.!..."vAw(...2..C?.9.W.F.^:1;j...p..cv..~...~[...............7...L...2.......................".......

                                                  C:\Users\user\AppData\Local\Temp\7zS8D75AF52\ja-JP\WebCompanionInstaller.resources.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\nsnF7E7.tmp\WcInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):8192
                                                  Entropy (8bit):4.914052885809483
                                                  Encrypted:false
                                                  SSDEEP:96:TJCi04kp2EvvBykfWWz435MIX7I2YaPegPqDmw430zlRtuJ9dqgll:dCi04kp2EXBnOZ39XBi74kzxuDogll
                                                  MD5:5B9E5F2E9C9F380FC0E6C36A65AE8980
                                                  SHA1:36E93C4D7965BB2D464AD4508080807726BBEA66
                                                  SHA-256:3F2824E50E88B92127A94942F9384E5B843C8E99E621E707A155DC7A5AE9AEB8
                                                  SHA-512:B34441FCC2E4B2CB187E0F1EECE60640C60F6F246BA2D8DFC4D67EF817C51319BEAE53BB0A40FFE990ED75B260B903D3A9ACCF0B53A0500A0E5E1D8F1D5FF1F2
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....}`e...........!.................6... ...@....@.. ....................................@.................................86..S....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................p6......H........2..d...........P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....+.......PADPADPP)6..).........V ......]....}..........-.C.... ...#..S.n....xv.|.-..X:.....V...h...................v..-....1.D|-.. ...?.!..."vAw(...2..C?.9.W.F.^:1;j...p..cv..~...~[...............7...L...2.......................".......

                                                  C:\Users\user\AppData\Local\Temp\7zS8D75AF52\pt-BR\WebCompanionInstaller.resources.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\nsnF7E7.tmp\WcInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):8704
                                                  Entropy (8bit):4.687824884426679
                                                  Encrypted:false
                                                  SSDEEP:192:UlmcDiBsbb8inpYfv4DOh9mE/HMuZogll:UlmcDiBsX8inGf6o8uT
                                                  MD5:D75883F958CC8E6F01BA6CA238B9B062
                                                  SHA1:D21467A9C126A11D0B6935B4E21F4C85483AF577
                                                  SHA-256:A258724DA32D945361CE4FBFD3DFA9D40CC574BB5E19BC8106DBBA9549640BB2
                                                  SHA-512:0BC76713698181BF54036B993E9B0D3B0E7D33B3C048766644F84BDA8D99105B02B1B5C42A7F75561066F20CDE330F68DA76DB8CC070ABB4F93707ADAD62CCB8
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....}`e...........!.................8... ...@....@.. ....................................@..................................8..W....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`....... ..............@..B.................8......H.......05..d...........P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....7.......PADPADPP)6..).......n.....V ..(`5.....]....}........E(/...-.C.... ...#..S.n....xv.|.-..X:..o.....V...h...................v..-../.x...1.D|-..... ...?.!..."...'vAw(...2c$Q:..C?.9.W*..Y`..[.F.^:1;j...pg.Jq..cv...w..~...~u.......

                                                  C:\Users\user\AppData\Local\Temp\7zS8D75AF52\ru-RU\WebCompanionInstaller.resources.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\nsnF7E7.tmp\WcInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):10240
                                                  Entropy (8bit):4.99083138053019
                                                  Encrypted:false
                                                  SSDEEP:192:KlmcDiBGb9+oLp1nNddaxbRFaKvisu1Cj1sJ4evucogll:KlmcDiBGp+oLfntalaIip8j1g48u8
                                                  MD5:0B427E896A2D725C74AA971E95F59ADA
                                                  SHA1:E0CD6B8101115977EFA885C77D8CAFCF42E1F56F
                                                  SHA-256:DCD1A941DA556923D91035EB792128EA6A2C14F3E3D52C7390FDA80BBCC81396
                                                  SHA-512:662B71B8C831628E21D83A2BF643143B69D95D9A4505138065918EF211478C735870BCC552539F4D21205EE5C16A39E52C4E45E775A9E8FB79C4D5D21F7C6FB4
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....}`e...........!..... ...........?... ...@....@.. ....................................@.................................`?..K....@.......................`....................................................... ............... ..H............text........ ... .................. ..`.rsrc........@......."..............@..@.reloc.......`.......&..............@..B.................?......H........;..d...........P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....7.......PADPADPP)6..).......n.....V ..(`5.....]....}........E(/...-.C.... ...#..S.n....xv.|.-..X:..o.....V...h...................v..-../.x...1.D|-..... ...?.!..."...'vAw(...2c$Q:..C?.9.W*..Y`..[.F.^:1;j...pg.Jq..cv...w..~...~u.......

                                                  C:\Users\user\AppData\Local\Temp\7zS8D75AF52\tr-TR\WebCompanionInstaller.resources.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\nsnF7E7.tmp\WcInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):7680
                                                  Entropy (8bit):4.755775398779436
                                                  Encrypted:false
                                                  SSDEEP:96:1bCiAtapiUldvIVaaQo4jvD3WZhWWdurHlR3us9dqgll8:1bCiAtapiUldspl4jvU6juSogll8
                                                  MD5:6E4A42861DBE2BF7933CA69287D0C4B1
                                                  SHA1:CD53A5C33970C37E1ED13B17A7C61D22F7D52AB8
                                                  SHA-256:0D0BB607D963EC6EE3DACAC6947589FD2A2066EDB96F89F0709C32F7120F3AAF
                                                  SHA-512:7A9ACC66D4DBCB774568F4B3F671FE3D072BAAEEF5C091078F5A713F250C297C2FDB7ED0500D04F7076EE6BFBECF49B6886AD924B9F0C200347AD04B47610932
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....}`e...........!................N5... ...@....@.. ....................................@..................................5..K....@.......................`....................................................... ............... ..H............text...T.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................05......H........1..d...........P ..I...........................................E..............lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....+.......PADPADPP)6..).........V ......]....}..........-.C.... ...#..S.n....xv.|.-..X:.....V...h...................v..-....1.D|-.. ...?.!..."vAw(...2..C?.9.W.F.^:1;j...p..cv..~...~[...............7...L...2.......................".......

                                                  C:\Users\user\AppData\Local\Temp\7zS8D75AF52\zh-CHS\WebCompanionInstaller.resources.dll

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\nsnF7E7.tmp\WcInstaller.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):7168
                                                  Entropy (8bit):4.921691415797547
                                                  Encrypted:false
                                                  SSDEEP:192:aCipxlpiUZWp/ipoNK+zlG9CNkpuXogll:Dipxl8UU5qmlG9C6ud
                                                  MD5:1B6691D38C481CF8261405693434990E
                                                  SHA1:7D7BB443A44A52ED8FE22B500872AD7EC1C8C6D9
                                                  SHA-256:34DDFE9488C90EEE14AE4D22585FEACB496A16F268F1ECE876749422311BD93E
                                                  SHA-512:C013CBFF2FFCE611DDA5B3D9F5B1B546D77F8BBDDDE0C5D1BCDB9C92A19B398289429E5EB879C305EDBA0566F3425A8EA61F636701B4F81047E1A422F47117FB
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....}`e...........!.................2... ...@....@.. ....................................@.................................H2..S....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................2......H...........d...........P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....+.......PADPADPP)6..).........V ......]....}..........-.C.... ...#..S.n....xv.|.-..X:.....V...h...................v..-....1.D|-.. ...?.!..."vAw(...2..C?.9.W.F.^:1;j...p..cv..~...~[...............7...L...2.......................".......

                                                  C:\Users\user\AppData\Local\Temp\CSC7165.tmp

                                                  Download File
                                                  Process:C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
                                                  File Type:MSVC .res
                                                  Category:dropped
                                                  Size (bytes):664
                                                  Entropy (8bit):3.2641490490438905
                                                  Encrypted:false
                                                  SSDEEP:12:DXtEki3nmjXAHOa5YAk9aUGiqbiN57Frykak7YnqqUPN5z6lq5zE:SNWD3g0NVtakSUPNdOqdE
                                                  MD5:2DB3204C6F2F736347D0A245BA5CCB5E
                                                  SHA1:C68A60DCA538389DD9BB03B78EB7AC2C9F15A568
                                                  SHA-256:7403C2D0116B9654C64971738D646746F38A305800CD9D0DF4BE91FD9D095A73
                                                  SHA-512:ED7D6D42C45F1146858CB508F7464313AAD93D412B7DAB94432546904CA90A64FF7D9191B494400F3F275757749DB2240782A8D97165F0EA5A90A2D6C64EBB4A
                                                  Malicious:false
                                                  Preview:.... ...........................X...<...............0...........X.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...4.....F.i.l.e.V.e.r.s.i.o.n.....9...1...0...9.9.3...<.....I.n.t.e.r.n.a.l.N.a.m.e...r.s.v.n.d.5.a.7...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...r.s.v.n.d.5.a.7...d.l.l.....8.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...9...1...0...9.9.3...<.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...9...1...0...9.9.3...

                                                  C:\Users\user\AppData\Local\Temp\CSC821F.tmp

                                                  Download File
                                                  Process:C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
                                                  File Type:MSVC .res
                                                  Category:dropped
                                                  Size (bytes):664
                                                  Entropy (8bit):3.2628713463630845
                                                  Encrypted:false
                                                  SSDEEP:12:DXtEki3nmjXAHOa5YAk9aUGiqbiN57Fry7+ak7YnqqGhPN5z6lq5zE:SNWD3g0NVnakSmPNdOqdE
                                                  MD5:FDD915843FC6421E3F0B89C0E8168A5C
                                                  SHA1:383ADD315A4B7DA2083F4DFC30397420128ACB6B
                                                  SHA-256:0780D82C5FB3A7AA70A94AEE17359C703C1E5CD84459BB4423B36DF85DEAAF1C
                                                  SHA-512:AD5DCBB053A6FA49D5BB3473D658DED45EEA868EBA8AB74D7083AF65D086A8B316C0C618EF01E2F8B20717F24A435820D13B3C18C7DCEC368B3CFFB86C7810EC
                                                  Malicious:false
                                                  Preview:.... ...........................X...<...............0...........X.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...4.....F.i.l.e.V.e.r.s.i.o.n.....9...1...0...9.9.3...<.....I.n.t.e.r.n.a.l.N.a.m.e...f.r._.p.x.-.r.0...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...f.r._.p.x.-.r.0...d.l.l.....8.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...9...1...0...9.9.3...<.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...9...1...0...9.9.3...

                                                  C:\Users\user\AppData\Local\Temp\CSC826D.tmp

                                                  Download File
                                                  Process:C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
                                                  File Type:MSVC .res
                                                  Category:dropped
                                                  Size (bytes):664
                                                  Entropy (8bit):3.27785269702316
                                                  Encrypted:false
                                                  SSDEEP:12:DXtEki3nmjXAHOa5YAk9aUGiqbiN57FryUdDak7YnqqHdyPN5z6lq5zE:SNWD3g0NVhakSwPNdOqdE
                                                  MD5:8A75A19F6C61D7A680CCF9677535BA9C
                                                  SHA1:F6DB2D79AA88DA13358BCC111AB60729691EA6A9
                                                  SHA-256:10444655ECD5452BE115058BFB8197BBBEF7744A4F6C5750B495D17BF7B9D511
                                                  SHA-512:BF00FD79AC057F3A2CD4AE96E6781108F123C5FACC4DA3A84371748701C730FFD1FB8672F3FDCD2E58BA52BD703661658F1F31FA8910521C1B70B35F20D44EC7
                                                  Malicious:false
                                                  Preview:.... ...........................X...<...............0...........X.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...4.....F.i.l.e.V.e.r.s.i.o.n.....9...1...0...9.9.3...<.....I.n.t.e.r.n.a.l.N.a.m.e...x.s.c.6.5.p.s.b...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...x.s.c.6.5.p.s.b...d.l.l.....8.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...9...1...0...9.9.3...<.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...9...1...0...9.9.3...

                                                  C:\Users\user\AppData\Local\Temp\RES71F3.tmp

                                                  Download File
                                                  Process:C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                  File Type:Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x40e, 9 symbols, created Mon Jul 22 10:34:30 2024, 1st section name ".debug$S"
                                                  Category:dropped
                                                  Size (bytes):1204
                                                  Entropy (8bit):3.7340498643303492
                                                  Encrypted:false
                                                  SSDEEP:24:HnJ9YG7f6eXDfHZoUnhKDWD3g0NVtakSUPNdOqdet5r:wGL3z5DnhKDdiVta30d7de7r
                                                  MD5:56BADD235BDCB6E0131E246AFF493A32
                                                  SHA1:42C7BCD347C69E5530885BE6A1F53C4286BB2E4C
                                                  SHA-256:5087179F426BE34E4ECA2A19868DEAA9B00D2A8614612CA4AD385518E9E8D182
                                                  SHA-512:ECB93CE3B72EF08E1263ED1CA4828553CC1084B824B75B281F8ABB52E2FB64ADFC4FC33ED7A5BA3F4814CA20F1609F9C7763DF807104A74B940F7E2D700BB661
                                                  Malicious:false
                                                  Preview:L....5.f.............debug$S............................@..B.rsrc$01........X...T...............@..@.rsrc$02........X...................@..@......../....c:\Users\user\AppData\Local\Temp\CSC7165.tmp................-. Lo/scG.E.\.^......c...4.......C:\Users\user\AppData\Local\Temp\RES71F3.tmp.+...................'.Microsoft (R) CVTRES................................................0.......................H.......X...........H.........X.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...4.....F.i.l.e.V.e.r.s.i.o.n.....9...1...0...9.9.3...<.....I.n.t.e.r.n.a.l.N.a.m.e...r.s.v.n.d.5.a.7...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...r.s.v.n.d.5.a.7...d.l.l.....8.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...9...1...0...9.9.3...<.....A.s.s.e.m.b.l.y.

                                                  C:\Users\user\AppData\Local\Temp\RES822F.tmp

                                                  Download File
                                                  Process:C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                  File Type:Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x40e, 9 symbols, created Mon Jul 22 10:34:34 2024, 1st section name ".debug$S"
                                                  Category:dropped
                                                  Size (bytes):1204
                                                  Entropy (8bit):3.747115840710643
                                                  Encrypted:false
                                                  SSDEEP:24:HbJ9YG7fTgE5/XDfHdvUnhKDWD3g0NVnakSmPNdOqdet5r:0GLf/z9MnhKDdiVna3ad7de7r
                                                  MD5:AAE4834F5D4988795DD2CE7E659669D6
                                                  SHA1:5BED1A74AE2973722EBACCE8D91D97B8EF8F1410
                                                  SHA-256:415E1D65E247B1C3B91A608A9E08156E63E6B6D6A2514B02A5122D0C75F6D5D2
                                                  SHA-512:CC361AA9CC9BFB00C1B25D4542627E8F3EBBB3FA442504706652C042CFE81E405F0496A412DC68E9EEB724F982946F5EA62929A0920425A1DB539285227BA664
                                                  Malicious:false
                                                  Preview:L....5.f.............debug$S............................@..B.rsrc$01........X...T...............@..@.rsrc$02........X...................@..@......../....c:\Users\user\AppData\Local\Temp\CSC821F.tmp....................?.B.?......\......c...4.......C:\Users\user\AppData\Local\Temp\RES822F.tmp.+...................'.Microsoft (R) CVTRES................................................0.......................H.......X...........H.........X.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...4.....F.i.l.e.V.e.r.s.i.o.n.....9...1...0...9.9.3...<.....I.n.t.e.r.n.a.l.N.a.m.e...f.r._.p.x.-.r.0...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...f.r._.p.x.-.r.0...d.l.l.....8.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...9...1...0...9.9.3...<.....A.s.s.e.m.b.l.y.

                                                  C:\Users\user\AppData\Local\Temp\RES827D.tmp

                                                  Download File
                                                  Process:C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                  File Type:Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x40e, 9 symbols, created Mon Jul 22 10:34:34 2024, 1st section name ".debug$S"
                                                  Category:dropped
                                                  Size (bytes):1204
                                                  Entropy (8bit):3.7441255554266717
                                                  Encrypted:false
                                                  SSDEEP:24:HbJ9YG7f9nOXDfHduUnhKDWD3g0NVhakSwPNdOqdet5r:0GL9nOz9pnhKDdiVha3od7de7r
                                                  MD5:6D1BA8F44DB25C2E7BBACC30945CF165
                                                  SHA1:675C59C7FEBCDC907B0B0D44121BF5D2567560D1
                                                  SHA-256:9D557FCF0B654FA26B9EED4366C24E30C985593930A4305310DC4CD81275FFFB
                                                  SHA-512:F5AF968F501BEAA5DD90EA093480DCCBCF0E9A57F977B8B77EBF4F3D1BE47EC23F3984A69217CE6BF02C215F7246398FD84CEFAC6869D3F6674225A42A4DBA5D
                                                  Malicious:false
                                                  Preview:L....5.f.............debug$S............................@..B.rsrc$01........X...T...............@..@.rsrc$02........X...................@..@......../....c:\Users\user\AppData\Local\Temp\CSC826D.tmp.................u..la....gu5........c...4.......C:\Users\user\AppData\Local\Temp\RES827D.tmp.+...................'.Microsoft (R) CVTRES................................................0.......................H.......X...........H.........X.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...4.....F.i.l.e.V.e.r.s.i.o.n.....9...1...0...9.9.3...<.....I.n.t.e.r.n.a.l.N.a.m.e...x.s.c.6.5.p.s.b...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...x.s.c.6.5.p.s.b...d.l.l.....8.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...9...1...0...9.9.3...<.....A.s.s.e.m.b.l.y.

                                                  C:\Users\user\AppData\Local\Temp\Recover.txt

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Search.exe
                                                  File Type:very short file (no magic)
                                                  Category:dropped
                                                  Size (bytes):1
                                                  Entropy (8bit):0.0
                                                  Encrypted:false
                                                  SSDEEP:3:V:V
                                                  MD5:CFCD208495D565EF66E7DFF9F98764DA
                                                  SHA1:B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
                                                  SHA-256:5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
                                                  SHA-512:31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
                                                  Malicious:false
                                                  Preview:0

                                                  C:\Users\user\AppData\Local\Temp\WebCompanion.zip

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                  Category:dropped
                                                  Size (bytes):12024981
                                                  Entropy (8bit):7.994643967856248
                                                  Encrypted:true
                                                  SSDEEP:196608:RKBQ0t7sYYxBZmozB8HlucNEgvWCcCkxABoEwsOOSTDq/ifdRvtXKwEtWjVE3FML:8BH6Ykmo94tWXC2AoES2WXfvQFMtV
                                                  MD5:6E7457AE3FBD1C47397EB721A83E7C56
                                                  SHA1:B9BB9DE6DE8BFE126ED008314BF5F33A87F4950B
                                                  SHA-256:7E81DABF1B5EFC7A2390F8C6EB4FF3B1E2BCC086C7CD6D2665B10F237E0E5FAB
                                                  SHA-512:EE50D39A126C759AA156A5FB4A07413C0E0B6A88EB864A33615D62BFAD8CD15F61C3294CF8DF380A3921EB797F96A194EE162CC289F18C43B26B47E30A54F3EA
                                                  Malicious:false
                                                  Preview:PK........'-xW.r,-gF...$......Application/7za.exe.yxTE.8|{I.YH'@CX.V[..%CP.4h_.MnCG@DQ..h..... .`'..\[...u..yg....QGY\........{..d.....S.......~.}y...N.:u..S.NU...`......*.k....~.......e..o.`.......[`._..]U..g.s...?..~..J..:.~.s.t.}..q.>}2l.....u.....#.Y..Mt}.......6z......{.:.:.y^KW.]....ys."..Nu.........C.EB..$..P.k......s.(..zN..K.........~+.L....I....T..o...l.m...Yp=.*..#....g.r...<.wg.....zb......QUw..M.:...L...nHN..r...]#..TA.r...vO..5.'.:B]..p}<.lxU... ...6...........?i...o...g..7H...%E_..B...d.... .f.].&I..Q..G.S..x.o.K......../.~...g.Q_..^(..h^...Dq.J\Y2.....&...........Fo`...........}....98E'..Kne+c........._./..o.o.+g.z..M.6.....D.D.^I9..!..0HJ..?h.7..2"U.;...RY..=b..k.^y....0.l...m*...h..9.........f....J-N..KU....HH."......Y...I)8..=s>.)MPH!.L....e...J..`bc(.:.-M=}...v...=..9.:..u.7.X.O...T..%e.)V...rS..s....o...[1.C... ...x7g)P..:............8. .u...lv-a..MB.TyW..D..p$..0.x>..'..K..l./g..U......b{.!_...,....<.....$#zh.e....+.

                                                  C:\Users\user\AppData\Local\Temp\Webprotection.zip

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                  Category:dropped
                                                  Size (bytes):18692270
                                                  Entropy (8bit):7.997923935037799
                                                  Encrypted:true
                                                  SSDEEP:393216:gSxW/3m6UFVh3BBSAKj0OXQqrI9xSD/FtWz3p/CNsnzrsVmY9:gIWu6evB6wlYDtt8dHpY9
                                                  MD5:3D0AC3A6AD22C725B16B8700311B8684
                                                  SHA1:A2C754712DF826F2EB9340D57827E3D86B59780D
                                                  SHA-256:B6E89DA77AC668A93A2EB877A1ECED7398291AF68B97E2B2B6F841A279A8EDCA
                                                  SHA-512:777CE4490CA45664CF0E81FB0155C0839D8C2C14BDEB1DA3914E7C2D86B111D1A232E4622BFBBB37A739DBEBAB6C60B1DBDAE1D309F934DCE7EB615EE282A135
                                                  Malicious:false
                                                  Preview:PK.........6GX................Win32/PK........@a.FK..a3...`/..(...Win32/api-ms-win-core-console-l1-1-0.dll...TSI.P.@......&.."X...QCQ..B..$.."....x(........<.XP.l.H..!Xh.Sn..w...+.6o.....?;;;;./..... ,..~.:.j.X..Vj.L.rf..#.Z...j..p&...a.qhQ.:..b.....'.E`..v.TB.;.A...k...4V.Q.m...5..t.....a.h.....Lz8..5...!.....*cy...@h...$....2.2..a..yGC..TC ,.@.M...d%"D.^.!....2.d..r...wG.. (Hc..:..B.h!...<P.D.(4~.....H......!cGx..;P........G..Z.........s.w.......my..j|..Q;*..%..v<.T}n{w.#.....(.1.."....x...H.1.L$.aRtH..Et....B...t.q..JHH...C...!.1.....!..{-......x.g.F......c.........9........(.A......P..-.A..|.$.8....~.Z. ....|D...V..............e.]..@?D.4.@XH.,m1H..e+.I......DFB..l.....`pX.Hc.i.u..7.j.6.2.:.8.0.%&!}.u..E..,o...\b........y,.b..`.cz......1.l=...&..-d.2.o.u.2^..M.)>_g....e>..:bt.'....dpFx..<B.;9..>.&.....Gc...K.....J.:(AP.x:..A*......G...T..|g..0&...Q.@.<..<..r..<.t..H9.}.i .".H..P=gP.....it...( ..q &..4&..1.d......a!.......6...H..m.O......R...`..lg ...!..

                                                  C:\Users\user\AppData\Local\Temp\fr_px-r0.0.cs

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):51485
                                                  Entropy (8bit):4.450142408778355
                                                  Encrypted:false
                                                  SSDEEP:384:lyyUbAbPhOLybikYXIrWcZ2ceB8Zqp48yzc8I:lHprY3
                                                  MD5:2C3C7020406F8CC316286450B944E3A1
                                                  SHA1:95BDDE564BA17831E64D3D5FB4F670141074F2EE
                                                  SHA-256:C8DF5FBBBF94C12DAC8CA5811FA6F9D44AF914306E625672A99865307F60E5E9
                                                  SHA-512:95F78FC19B5F3D26F0DD020DDE8DD1E7FB2C081D8F63E82BBDA82F87B1E2F65BFBBE8FA554A646F5E752A9F60339914136E1133D347B544D26D7F09EDE408A85
                                                  Malicious:false
                                                  Preview:.#if _DYNAMIC_XMLSERIALIZER_COMPILATION..[assembly:System.Security.AllowPartiallyTrustedCallers()]..[assembly:System.Security.SecurityTransparent()]..#endif..[assembly:System.Reflection.AssemblyVersionAttribute("9.1.0.993")]..namespace Microsoft.Xml.Serialization.GeneratedAssembly {.... public class XmlSerializationWriterComponentsServiceSoap : System.Xml.Serialization.XmlSerializationWriter {.... public void Write7_GetComponentsInfo(object[] p) {.. WriteStartDocument();.. TopLevelElement();.. int pLength = p.Length;.. WriteStartElement(@"GetComponentsInfo", @"http://tempuri.org/", null, false);.. if (pLength > 0) {.. Write2_ComponentsInfoRequest(@"request", @"http://tempuri.org/", ((global::WebCompanion.UI.NewUpdateService.ComponentsInfoRequest)p[0]), false, false);.. }.. WriteEndElement();.. }.... public void Write8_GetComponentsInfoResponse(object[] p) {..

                                                  C:\Users\user\AppData\Local\Temp\fr_px-r0.cmdline

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:Unicode text, UTF-8 (with BOM) text, with very long lines (502), with no line terminators
                                                  Category:dropped
                                                  Size (bytes):505
                                                  Entropy (8bit):5.545628684311674
                                                  Encrypted:false
                                                  SSDEEP:12:p3rUNvvknoT7fVuOz5Dft+rHc9ow16Prf1:Vkkn8fsOzZfuW1crf1
                                                  MD5:D4BE6BF2B88998DB00A3E1AB8E5A4877
                                                  SHA1:BF6EBB3F54330F335DBEA455FC78723415A84E6F
                                                  SHA-256:C894B1E788827001CBDEFE89D2B49CC1C3B1B03EF234A1F71BA2CE12B362631F
                                                  SHA-512:1A252949A05271E57631E7C6E128CDE53931870A5E352D643727B48D1B8375035F565D601E1E724FE0F9C37E34D0BA7AFB67909787454C3178806941FC52AC39
                                                  Malicious:false
                                                  Preview:./t:library /utf8output /R:"C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll" /R:"C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorlib.dll" /R:"C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe" /R:"C:\Windows\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.Xml.dll" /out:"C:\Users\user\AppData\Local\Temp\fr_px-r0.dll" /debug- /optimize+ /nostdlib /D:_DYNAMIC_XMLSERIALIZER_COMPILATION "C:\Users\user\AppData\Local\Temp\fr_px-r0.0.cs"

                                                  C:\Users\user\AppData\Local\Temp\fr_px-r0.dll

                                                  Download File
                                                  Process:C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):32768
                                                  Entropy (8bit):3.4327794701053977
                                                  Encrypted:false
                                                  SSDEEP:384:E5dcNhNRdeNANtdQN0NudCN3NcMN2dBqNkpqQNjN+eNCFBMNeoekWmQAjwMedKAJ:E3mbunlaoekWmQpMedhLhg6/RpNYNw
                                                  MD5:ED1E0AEBFB91FD48813FD63C302D69A4
                                                  SHA1:83956FCBC4D7762BCE665325B5AEA130C1B46F90
                                                  SHA-256:26657ABA321E6926FB9B7464934E0478D0BCFD18BED915726F2E857BAE7978AC
                                                  SHA-512:E42D761071084EB60811773F32498A74761C70D3E8FBCAAA68DC3537BC04F51C65289129CC86D52D08BDB7A2AFE393CDF39E4E5A3886FF9DC3D75C202D3FE86C
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....5.f...........!.....P... .......e... ........@.. ....................................@..................................e..O.................................................................................... ............... ..H............text....F... ...P.................. ..`.rsrc................`..............@..@.reloc...............p..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Users\user\AppData\Local\Temp\fr_px-r0.out

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:Unicode text, UTF-8 (with BOM) text, with very long lines (617), with CRLF line terminators
                                                  Category:modified
                                                  Size (bytes):1091
                                                  Entropy (8bit):5.545074058787797
                                                  Encrypted:false
                                                  SSDEEP:24:THnzdkkn8fsOzZfuW1crfQKai3SGzKIMl6I5Dv1+fa10fvO1DF1:TH+k8fdzBj1qQKb3xKxl6I5Dwa1wvO1b
                                                  MD5:217E5240C6CB6D7997A747EDA0E025BE
                                                  SHA1:61FA27C19E56F9B1AF35B913872D22ECB2A0C4D9
                                                  SHA-256:C07AEEAA49D9739BE30B42506E03F9CCBE510B1071EFAE99A4EE902E1D301EA4
                                                  SHA-512:1BF3BB9538FD337C47825B23A2803F1742A316159D12F70DF0B3AC356F25ED279E3B7399BACDEABE03E653FED80EE5D73915E0F99B8A074DF1148810BC68BFEF
                                                  Malicious:false
                                                  Preview:.C:\Program Files (x86)\Lavasoft\Web Companion\Application> "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /t:library /utf8output /R:"C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll" /R:"C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorlib.dll" /R:"C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe" /R:"C:\Windows\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.Xml.dll" /out:"C:\Users\user\AppData\Local\Temp\fr_px-r0.dll" /debug- /optimize+ /nostdlib /D:_DYNAMIC_XMLSERIALIZER_COMPILATION "C:\Users\user\AppData\Local\Temp\fr_px-r0.0.cs"......Microsoft (R) Visual C# 2005 Compiler version 8.00.50727.9149..for Microsoft (R) Windows (R) 2005 Framework version 2.0.50727..Copyright (C) Microsoft Corporation 2001-2005. All rights reserved.....c:\Users\user\AppData\Local\Temp\fr_px-r0.0.cs(485,78): warning CS0219: The variable 'a_0' is assigned but its value is never used..c:\Users\user\AppData\Local\Temp\fr_px-r0.

                                                  C:\Users\user\AppData\Local\Temp\nsaCC7.tmp

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:data
                                                  Category:dropped
                                                  Size (bytes):7641
                                                  Entropy (8bit):7.8608874124319845
                                                  Encrypted:false
                                                  SSDEEP:192:rnB9Sx4sZxQVHqUIsg6UVHcyIFl7vTqBLLZR/:8Px8C6UB98dMLLZR/
                                                  MD5:4F0D86B3C8826F9A7337061679996962
                                                  SHA1:E4EE5500CD4F32F6533644386A98867A912B8E11
                                                  SHA-256:6976DB29087733A6A001A189AB9BDA5E3A54480C70E83585226CC652A0C85CFC
                                                  SHA-512:3E74B3CBF057CBAE0893D2C063E41F4315073891167AD67FAAF708A0F2DB74F2341C00AB1FC901647610CDBCD2C925756BDE8DAE3EB0DBD895B2F32672C9909A
                                                  Malicious:false
                                                  Preview:url.https://offers.filezilla-project.org/get.php?offer=2021a.filename.WcInstaller.exe.args.--silent --partner=FZ210427 --searchenbl.skipreg.HKLM.SOFTWARE\Lavasoft\Web Companion.Installed.skipreg.HKCU.SOFTWARE\Lavasoft\Web Companion.Installed.controls.0u.120u.50u.16u.&Accept.0.50u.120u.150u.16u.&Decline.0.label.0u.40u.300u.32u.Adaware Web Companion helps you safely browse the web by blocking malicious sites and phishing scams..0.label.0u.65u.300u.24u.Block malicious threats by installing Adaware Web Companion. Improve my Internet Protection with Adaware Web Companion..0.icon.0u.0u.202.57.6630........7...............PNG........IHDR.......7............IDATx....p.G.......1s......].(.......sl..LgI.0.af>_.3..,...mum...%.l..5..xF.=...M...T..V..X....]..ob.?/...S.....P&..d...m..t.e..6.b..2.Li.z!.....Q.k.+p..e..d../...zm.....q.......7.&.3....2.d.f..Z..W...f..p.l....e..F.../.$...u...&.{....L&.E...i3.8?.....~Q.2[.W...8Y..@MB...}]....`.]w.um(.)...$.G...[~.lq...*ZvM..[..h....:!.k......x

                                                  C:\Users\user\AppData\Local\Temp\nsnF7E7.tmp\INetC.dll

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):25088
                                                  Entropy (8bit):5.442313325278199
                                                  Encrypted:false
                                                  SSDEEP:384:wv1j9e9dEs+rN+qFLAjNXT37vYnOrvFhSL+ZwcSyekzANZBJ:w1AvEs3HBLzYn29vYh
                                                  MD5:640BFF73A5F8E37B202D911E4749B2E9
                                                  SHA1:9588DD7561AB7DE3BCA392B084BEC91F3521C879
                                                  SHA-256:C1E568E25EC111184DEB1B87CFDA4BFEC529B1ABEAB39B66539D998012F33502
                                                  SHA-512:39C6C358E2B480C8CBEBCC1DA683924C8092FB2947F2DA4A8DF1B0DC1FDDA61003D91D12232A436EC88FF4E0995B7F6EE8C6EFBDCA935EAA984001F7A72FEA0A
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'9<.cXR.cXR.cXR.D.).jXR.cXS.6XR.D. .`XR.D.(.bXR.D...bXR.D.*.bXR.RichcXR.........................PE..L....I6V...........!.....>...j......ME.......P.......................................................................M..l....E..d.......(.......................T.......................................................d............................text....=.......>.................. ..`.data....V...P.......B..............@....rsrc...(............P..............@..@.reloc..V............Z..............@..B................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Users\user\AppData\Local\Temp\nsnF7E7.tmp\StartMenu.dll

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):7680
                                                  Entropy (8bit):4.645142610674044
                                                  Encrypted:false
                                                  SSDEEP:96:mIt3J2Gl0eVe0+Cfo0UkXt6+o69UiGdPh5/utta/23lkCTcaqHCI:bhE+A0+sF6piUFkAylncviI
                                                  MD5:A8C86996C4230C2209F5927F21321377
                                                  SHA1:45CE0AB93CB6A3A594E54878CCE05DF724024393
                                                  SHA-256:110545415A59402635E1C9439ACBA15B44BAB268ED02AD2A262CE12604A47855
                                                  SHA-512:69EE73496B916777936B0DDDD2CC4A4F916E393F7D0B167CBA77A4A239EE1E3F645D9B90DEE1627C42A23EB6C3403E4D086546B9F78B3A2E4999C8F92F6A3BC3
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........I...(...(...(...(...(..<'...(.......(..8....(.......(..Rich.(..........................PE..L...S.d...........!.........8............... ............................................@..........................$..e.... ..x....`..(....................p..t.................................................... ...............................text............................... ..`.rdata..U.... ......................@..@.data...t*...0......................@....rsrc...(....`......................@..@.reloc..B....p......................@..B................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Users\user\AppData\Local\Temp\nsnF7E7.tmp\System.dll

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):12288
                                                  Entropy (8bit):5.805604762622714
                                                  Encrypted:false
                                                  SSDEEP:192:VjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZv0QPi:B/Qlt7wiij/lMRv/9V4bvr
                                                  MD5:4ADD245D4BA34B04F213409BFE504C07
                                                  SHA1:EF756D6581D70E87D58CC4982E3F4D18E0EA5B09
                                                  SHA-256:9111099EFE9D5C9B391DC132B2FAF0A3851A760D4106D5368E30AC744EB42706
                                                  SHA-512:1BD260CABE5EA3CEFBBC675162F30092AB157893510F45A1B571489E03EBB2903C55F64F89812754D3FE03C8F10012B8078D1261A7E73AC1F87C82F714BCE03D
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr*.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L...S.d...........!....."...........*.......@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text.... .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.......*..............@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Users\user\AppData\Local\Temp\nsnF7E7.tmp\UAC.dll

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):14848
                                                  Entropy (8bit):5.715583967305762
                                                  Encrypted:false
                                                  SSDEEP:192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
                                                  MD5:ADB29E6B186DAA765DC750128649B63D
                                                  SHA1:160CBDC4CB0AC2C142D361DF138C537AA7E708C9
                                                  SHA-256:2F7F8FC05DC4FD0D5CDA501B47E4433357E887BBFED7292C028D99C73B52DC08
                                                  SHA-512:B28ADCCCF0C33660FECD6F95F28F11F793DC9988582187617B4C113FB4E6FDAD4CF7694CD8C0300A477E63536456894D119741A940DDA09B7DF3FF0087A7EADA
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........#.?NB.lNB.lNB.li..lEB.lNB.l.B.li..lMB.li..lOB.li..lOB.li..lOB.lRichNB.l................PE..L...@.dU...........!.....,...........).......@...............................p.......................................;..<....3..x....P.......................`..........................................................\............................text....+.......,.................. ..`.data...d....@.......0..............@....rsrc........P.......2..............@..@.reloc.......`.......4..............@..B........................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Users\user\AppData\Local\Temp\nsnF7E7.tmp\UserInfo.dll

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):4096
                                                  Entropy (8bit):3.3417962237544945
                                                  Encrypted:false
                                                  SSDEEP:48:qKYHC+J4apHT1wH8l9QcXygHg0ZShMmj3jkRTbGr7X:5piRzuHOXTA0H6jkRnGr7X
                                                  MD5:D458B8251443536E4A334147E0170E95
                                                  SHA1:BA8D4D580F1BC0BB2EAA8B9B02EE9E91B8B50FC3
                                                  SHA-256:4913D4CCCF84CD0534069107CFF3E8E2F427160CAD841547DB9019310AC86CC7
                                                  SHA-512:6FF523A74C3670B8B5CD92F62DCC6EA50B65A5D0D6E67EE1079BDB8A623B27DD10B9036A41AA8EC928200C85323C1A1F3B5C0948B59C0671DE183617B65A96B1
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......K..................[.........Rich..........................PE..L...T.d...........!................~........ ...............................P............@.........................@"......l ..<............................@..p.................................................... ..L............................text............................... ..`.rdata....... ......................@..@.data...h....0......................@....reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Users\user\AppData\Local\Temp\nsnF7E7.tmp\WcInstaller.exe (copy)

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):565920
                                                  Entropy (8bit):7.672199048109324
                                                  Encrypted:false
                                                  SSDEEP:12288:YG5knZfFKeYDbRpFE7T/W2ktHD/ICRrjkBMgOEuPpi:YG50ZfFK5fREfe2yjQCRrjcjuPpi
                                                  MD5:CA94290A5FB89E0AAACBF01585718B17
                                                  SHA1:4FE5E5E9276824158BD9A08BF5A4759EC3C4926B
                                                  SHA-256:0C1EC6BDA6EC65EF4194D0B812B66972B8AF104F46DBA320A46802531D6B2314
                                                  SHA-512:45CC55D77F41BD94472543D23B16C12B4BB777C9F57CB62C5E7E6BE1D0040A0FDE84C219CA504402FB28F03BD57F57CCBA0D2B9E2330D32A59926B4CCC47F535
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s..c}...s..Yy...s..w,...s...r./.s..w....s..Yx...s.......s.......s.Zyu...s.Rich..s.................PE..L.....M........../..................H............@.................................}...........................................d....p...q...........o...2...........................................................................................text............................... ..`.rdata...D.......F..................@..@.data...hZ.......2..................@....sxdata......`......................@....rsrc....q...p...r..................@..@........................................................................................................................................................................................................................................................................................................................

                                                  C:\Users\user\AppData\Local\Temp\nsnF7E7.tmp\modern-wizard.bmp

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PC bitmap, Windows 3.x format, 164 x 314 x 4, image size 26376, resolution 2834 x 2834 px/m, cbSize 26494, bits offset 118
                                                  Category:dropped
                                                  Size (bytes):26494
                                                  Entropy (8bit):1.9568109962493656
                                                  Encrypted:false
                                                  SSDEEP:24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
                                                  MD5:CBE40FD2B1EC96DAEDC65DA172D90022
                                                  SHA1:366C216220AA4329DFF6C485FD0E9B0F4F0A7944
                                                  SHA-256:3AD2DC318056D0A2024AF1804EA741146CFC18CC404649A44610CBF8B2056CF2
                                                  SHA-512:62990CB16E37B6B4EFF6AB03571C3A82DCAA21A1D393C3CB01D81F62287777FB0B4B27F8852B5FA71BC975FEAB5BAA486D33F2C58660210E115DE7E2BD34EA63
                                                  Malicious:false
                                                  Preview:BM~g......v...(.......:............g..................................................................................DDD@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDD@@@@@@..DDD....DDDDDD........................................DDDDDDDDDD....DDDDDDDDD........DD@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDD@@@@DDDDDDDDDD@@@@@@D..DD....DDDDDDD......................................DDDDDDDDDD....DDDDDDDDDD......D..D@@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDDD@@@@@DDD..D.....DDDDDD......................................DDDDDDDDD.....DDDDDDDDD......DDD..@@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDDD@@@@@@DDDD.......DDDDDD.....................................DDDDDDDDDD....DDDDDDDDDD.....DDDDD..@@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDD@@@@@@DDDDDD.......DDDDDD....................................DDDDDDDDD....DDDDDDDDDD......DDDDDD..@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

                                                  C:\Users\user\AppData\Local\Temp\nsnF7E7.tmp\nsDialogs.dll

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):9728
                                                  Entropy (8bit):5.158585441954107
                                                  Encrypted:false
                                                  SSDEEP:96:o4Ev02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YsNqkzfFc:o4EvCu5e81785qHFcU0PuAw0uyGIFc
                                                  MD5:1D8F01A83DDD259BC339902C1D33C8F1
                                                  SHA1:9F7806AF462C94C39E2EC6CC9C7AD05C44EBA04E
                                                  SHA-256:4B7D17DA290F41EBE244827CC295CE7E580DA2F7E9F7CC3EFC1ABC6898E3C9ED
                                                  SHA-512:28BF647374B4B500A0F3DBCED70C2B256F93940E2B39160512E6E486AC31D1D90945ACECEF578F61B0A501F27C7106B6FFC3DEAB2EC3BFB3D9AF24C9449A1567
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......|..c8O`08O`08O`08Oa0.O`0.@=05O`0llP0=O`0.If09O`0.od09O`0Rich8O`0........PE..L...Q.d...........!.........0......g........0............................................@..........................6..k....0.......p...............................................................................0...............................text............................... ..`.rdata..{....0......................@..@.data...h!...@......................@....rsrc........p....... ..............@..@.reloc..~............"..............@..B................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Users\user\AppData\Local\Temp\nsnF7E7.tmp\nsis_appid.dll

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):3072
                                                  Entropy (8bit):3.8348787252570027
                                                  Encrypted:false
                                                  SSDEEP:24:ev1GSvFcvFQhCH6I9/3Y9XUGUw81Jez0c/cfYDrgVj/sjv3aoZCMPgiE/jE:qWQgtsXUGWt6Um0CPXCSC
                                                  MD5:19071761E91C43C115A16B52458869B7
                                                  SHA1:75DDB807157F1AA31A08F87BE0270F60990BCBBC
                                                  SHA-256:E9E1BA410636698D666B328EEA71346B8287248D262E44DA07CE8B5FA24C5E5F
                                                  SHA-512:BC0EAB51CF27F657CD3FD62A47894EE13F3F561FEAA565F16BA15088BE39BE73C9839A3CF35B538219EC83A03D48970B89258C5F20C37BCAF76438998437786C
                                                  Malicious:false
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......;M.~.,p-.,p-.,p-vT.-t,p-.,q-u,p-vT.-~,p-vT.-},p-vT.-~,p-vT.-~,p-Rich.,p-........PE..L...3.K...........!................0........ ...............................`......^<...............................!..K...L ..d....@.......................P..$.................................................... ..(............................text...y........................... ..`.rdata....... ......................@..@.data........0......................@....rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Users\user\AppData\Local\Temp\nsxF7D6.tmp

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:data
                                                  Category:dropped
                                                  Size (bytes):45002843
                                                  Entropy (8bit):6.569136235992309
                                                  Encrypted:false
                                                  SSDEEP:196608:ix3h6vCfcnE474PITB45BLtG9sCkvf2C/2RrHxvZuNw5EstcMqkhYpuFQk86UaD+:dCfcnR4PernRvpNtghzc0TybUyxWD
                                                  MD5:392CE8BA61B36467F899CD9C5B0D4EF8
                                                  SHA1:B123AA6E612CAE6865D6FE19E5B3C7B04B839FE7
                                                  SHA-256:89665B640D76E7F50761E64A77DD681DF2CD610DF6E1C9164DEE25C7417B9A7F
                                                  SHA-512:1CD0483E3E1427A22ABF5F83A0772D7FEE677AC73F4F909C0D2E837409A56F34E16FF567A3DBD09AD869D41D071CECC8F91FAFB4EA5ADA2AB9E009EDC5518DD1
                                                  Malicious:false
                                                  Preview:. ......,...............d,..............0..................................._.......................................g...f...............r...................................................................................................................................................G...J...........3...f.......................................................................m.......................................................................................................................................................................................................(...............................................h...............................................................g...............................................................................................................................j..........."...(.......................................................................................................................J...............................................

                                                  C:\Users\user\AppData\Local\Temp\nsy13FC.tmp

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:MS Windows icon resource - 1 icon, -1x55 with PNG image data, 255 x 55, 8-bit/color RGBA, non-interlaced, 4096 planes
                                                  Category:dropped
                                                  Size (bytes):6630
                                                  Entropy (8bit):7.92313178594869
                                                  Encrypted:false
                                                  SSDEEP:96:kB9Sx4uNZTNLQPdH0BUFTl9W2Vg64/A+V4MfcPtRyB26HwVVl5tZBTwLd:kB9Sx4sZxQVHqUIsg6UVHcyIFl7vTqd
                                                  MD5:387A4D885282D7C89EDF65E76FD490FC
                                                  SHA1:67ED245C8C02E93D6428FD1BB22D26926B2C5CC4
                                                  SHA-256:EAF84352200694DF5DA40FFA71513778A934C0F21ECBDD021776A7E2F5921FF9
                                                  SHA-512:06123EAD2D577E4C2815130CE933D5C267F18A68458B11453B0943340BD0D54C48D652710CE361CDED6FF690141B7C59EBCF20FD30D9DE55EAAFA2D140E38C6B
                                                  Malicious:false
                                                  Preview:.......7...............PNG........IHDR.......7............IDATx....p.G.......1s......].(.......sl..LgI.0.af>_.3..,...mum...%.l..5..xF.=...M...T..V..X....]..ob.?/...S.....P&..d...m..t.e..6.b..2.Li.z!.....Q.k.+p..e..d../...zm.....q.......7.&.3....2.d.f..Z..W...f..p.l....e..F.../.$...u...&.{....L&.E...i3.8?.....~Q.2[.W...8Y..@MB...}]....`.]w.um(.)...$.G...[~.lq...*ZvM..[..h....:!.k......x/..2..."t........O....W6..lnW..JT.f...T.3...u.oI_.`..E.d.?A5G.".....R.d.....&>..-L5.....{.e......g..`:.?..l~......e....ju....D......U.3Y..N..k.,j.dM..W...{..e(Y......~..........h.l.../W.3Y..Uu..5.T3...M.g.....e./#..[...@?hu .....`!..A.!.'1...b|.6..g\.;Y......h..v..;..P..#.\.m........t...{.........a9.._1..V.D..F%.Q..8.2.@....2.Gr..2......(....M6...O.P6.,.Sec........&...../..t`....+n*Ku...Ji.=.........@I.`...<X.#....T..v......g.^....K..n..H-3..6.......&.Q.c...9.l.....1....{.w...8..|....q...(+...]....z.r...D....a..sX7Q..E...n...d....7...p......#.G .. :...mL.e-

                                                  C:\Users\user\AppData\Local\Temp\nsy38DB.tmp

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):565920
                                                  Entropy (8bit):7.672199048109324
                                                  Encrypted:false
                                                  SSDEEP:12288:YG5knZfFKeYDbRpFE7T/W2ktHD/ICRrjkBMgOEuPpi:YG50ZfFK5fREfe2yjQCRrjcjuPpi
                                                  MD5:CA94290A5FB89E0AAACBF01585718B17
                                                  SHA1:4FE5E5E9276824158BD9A08BF5A4759EC3C4926B
                                                  SHA-256:0C1EC6BDA6EC65EF4194D0B812B66972B8AF104F46DBA320A46802531D6B2314
                                                  SHA-512:45CC55D77F41BD94472543D23B16C12B4BB777C9F57CB62C5E7E6BE1D0040A0FDE84C219CA504402FB28F03BD57F57CCBA0D2B9E2330D32A59926B4CCC47F535
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s..c}...s..Yy...s..w,...s...r./.s..w....s..Yx...s.......s.......s.Zyu...s.Rich..s.................PE..L.....M........../..................H............@.................................}...........................................d....p...q...........o...2...........................................................................................text............................... ..`.rdata...D.......F..................@..@.data...hZ.......2..................@....sxdata......`......................@....rsrc....q...p...r..................@..@........................................................................................................................................................................................................................................................................................................................

                                                  C:\Users\user\AppData\Local\Temp\rsvnd5a7.0.cs

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):45228
                                                  Entropy (8bit):4.591796736148075
                                                  Encrypted:false
                                                  SSDEEP:768:l/dyUS7t8CC/3Vzb8snFV6QCDngq+Rz7gVkWBC3J7kvDJs:lasJ
                                                  MD5:B24C97E1EBE751E3E2A3C681E197618E
                                                  SHA1:25710F9E6E1430B74BCDA50FD0BDCC27EE24A65B
                                                  SHA-256:9C52A89B8CF25473E4FA306F27E9C39E8EA1FF48D8461504C37AA08D32DF5ACF
                                                  SHA-512:4DB1B8C4A42A889CB8D73428DB6F5891E98E0A48A3303FD54D6FF74106AE9C7D454707C5F71517A134BEB8D2AA656E7D85659529A8F987168683D772EBC26040
                                                  Malicious:false
                                                  Preview:.#if _DYNAMIC_XMLSERIALIZER_COMPILATION..[assembly:System.Security.AllowPartiallyTrustedCallers()]..[assembly:System.Security.SecurityTransparent()]..#endif..[assembly:System.Reflection.AssemblyVersionAttribute("9.1.0.993")]..namespace Microsoft.Xml.Serialization.GeneratedAssembly {.... public class XmlSerializationWriterGeoIPServiceSoap : System.Xml.Serialization.XmlSerializationWriter {.... public void Write1_GetCountryNameByISO2(object[] p) {.. WriteStartDocument();.. TopLevelElement();.. int pLength = p.Length;.. WriteStartElement(@"GetCountryNameByISO2", @"http://lavasoft.com/", null, false);.. if (pLength > 0) {.. WriteElementString(@"iso2Code", @"http://lavasoft.com/", ((global::System.String)p[0]));.. }.. WriteEndElement();.. }.... public void Write2_GetLocationResponse(object[] p) {.. WriteStartDocument();.. TopLevelElement();..

                                                  C:\Users\user\AppData\Local\Temp\rsvnd5a7.cmdline

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:Unicode text, UTF-8 (with BOM) text, with very long lines (424), with no line terminators
                                                  Category:dropped
                                                  Size (bytes):427
                                                  Entropy (8bit):5.521046807681887
                                                  Encrypted:false
                                                  SSDEEP:6:pAu+HmFpw+o3kLWuoT7R5TLk2dQ2wkn23fmzxscHc9olm14sQPIwkn23f19:p3rz5YknoT7fVuRfOrHc9ow16PrfD
                                                  MD5:42D1E94D456D5B2D69E2B77D6EA829AD
                                                  SHA1:5FD716DA5CF79A637241EF57445D6264949660EE
                                                  SHA-256:C6BBDC79E385A4F530F9696918017C70E6805FD591AE38886C236B1FA68A3924
                                                  SHA-512:D3438EFA9DF980C25EA64EB5E7EB9E20758C1A44355F4E298D45CA875E7DAFB9201C398337B128650B609A91D9935D2721E07AF4C82119256251BDA520A31474
                                                  Malicious:true
                                                  Preview:./t:library /utf8output /R:"C:\Windows\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.Xml.dll" /R:"C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorlib.dll" /R:"C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe" /out:"C:\Users\user\AppData\Local\Temp\rsvnd5a7.dll" /debug- /optimize+ /nostdlib /D:_DYNAMIC_XMLSERIALIZER_COMPILATION "C:\Users\user\AppData\Local\Temp\rsvnd5a7.0.cs"

                                                  C:\Users\user\AppData\Local\Temp\rsvnd5a7.dll

                                                  Download File
                                                  Process:C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):19968
                                                  Entropy (8bit):4.67554145497061
                                                  Encrypted:false
                                                  SSDEEP:192:n/KBHK6DNGgbCB169NIcK01hFDvrpK1EAmopfQGFOtFk2lsM9:SBHK2Q7aIcXbFDvrpK1EQdY
                                                  MD5:9D05A09A1B075BE74AE9293D95BCC9AC
                                                  SHA1:A17C7AA3744C9D03395DF5C304A55ACBF2896C7A
                                                  SHA-256:09E0A227B4E97DFAAEC3964581D4FE556C546C92F0788B054B140B40BCF240FC
                                                  SHA-512:A9616D09924230D0FE51A7C51AFF42F4F53305D84F07709D0010FBA7654C84197FE3DC951D8E41A279C87E36E2C8CF0C21C3BF78D59F0214DE656DA866DBABB8
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....5.f...........!.....F..........Nd... ........@.. ....................................@..................................d..K.................................................................................... ............... ..H............text...TD... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B................0d......H........9...*...........................................................0..E........(.....(......i..r...pr+..p..(......1..rU..pr+..p...t....(.....(....*....0..E........(.....(......i..rg..pr+..p..(......1..r...pr+..p...t....(.....(....*....0..E........(.....(......i..r...pr+..p..(......1..r...pr+..p...t....(.....(....*....0..E........(.....(......i..r...pr+..p..(......1..rQ..pr+..p...t....(.....(....*....0..E........(.....(......i..r...pr+..p..(......1..r...pr+..p...t....(..

                                                  C:\Users\user\AppData\Local\Temp\rsvnd5a7.out

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:Unicode text, UTF-8 (with BOM) text, with very long lines (527), with CRLF line terminators
                                                  Category:modified
                                                  Size (bytes):734
                                                  Entropy (8bit):5.5609909200763274
                                                  Encrypted:false
                                                  SSDEEP:12:KJfHTnzR3rz5YknoT7fVuRfOrHc9ow16PrfiKai3SGzKIMBj6I5BFR5y:KJfHTnzdX2kn8fsRfIW1crfiKai3SGzT
                                                  MD5:DB9968E3DDD7AE09DCBB343B81AC921F
                                                  SHA1:99D43EA63C9D4D8C2ECA37A1207479A29C3C37E8
                                                  SHA-256:76FF0EB6697E5794F2FD9AAF084432DDF414212601181A144AD5C1AD2D7CEA6B
                                                  SHA-512:853F8F857E574D76802789858D3037768E24DECD80182AA8622773274BDAECD028EB872467338366843745D88A1CE0E09879E6D7136D4CED37688AE8BFEF88AD
                                                  Malicious:false
                                                  Preview:.C:\Users\user\AppData\Local\Temp\7zS8D75AF52> "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /t:library /utf8output /R:"C:\Windows\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.Xml.dll" /R:"C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorlib.dll" /R:"C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe" /out:"C:\Users\user\AppData\Local\Temp\rsvnd5a7.dll" /debug- /optimize+ /nostdlib /D:_DYNAMIC_XMLSERIALIZER_COMPILATION "C:\Users\user\AppData\Local\Temp\rsvnd5a7.0.cs"......Microsoft (R) Visual C# 2005 Compiler version 8.00.50727.9149..for Microsoft (R) Windows (R) 2005 Framework version 2.0.50727..Copyright (C) Microsoft Corporation 2001-2005. All rights reserved.....

                                                  C:\Users\user\AppData\Local\Temp\xsc65psb.0.cs

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):45228
                                                  Entropy (8bit):4.591796736148075
                                                  Encrypted:false
                                                  SSDEEP:768:l/dyUS7t8CC/3Vzb8snFV6QCDngq+Rz7gVkWBC3J7kvDJs:lasJ
                                                  MD5:B24C97E1EBE751E3E2A3C681E197618E
                                                  SHA1:25710F9E6E1430B74BCDA50FD0BDCC27EE24A65B
                                                  SHA-256:9C52A89B8CF25473E4FA306F27E9C39E8EA1FF48D8461504C37AA08D32DF5ACF
                                                  SHA-512:4DB1B8C4A42A889CB8D73428DB6F5891E98E0A48A3303FD54D6FF74106AE9C7D454707C5F71517A134BEB8D2AA656E7D85659529A8F987168683D772EBC26040
                                                  Malicious:false
                                                  Preview:.#if _DYNAMIC_XMLSERIALIZER_COMPILATION..[assembly:System.Security.AllowPartiallyTrustedCallers()]..[assembly:System.Security.SecurityTransparent()]..#endif..[assembly:System.Reflection.AssemblyVersionAttribute("9.1.0.993")]..namespace Microsoft.Xml.Serialization.GeneratedAssembly {.... public class XmlSerializationWriterGeoIPServiceSoap : System.Xml.Serialization.XmlSerializationWriter {.... public void Write1_GetCountryNameByISO2(object[] p) {.. WriteStartDocument();.. TopLevelElement();.. int pLength = p.Length;.. WriteStartElement(@"GetCountryNameByISO2", @"http://lavasoft.com/", null, false);.. if (pLength > 0) {.. WriteElementString(@"iso2Code", @"http://lavasoft.com/", ((global::System.String)p[0]));.. }.. WriteEndElement();.. }.... public void Write2_GetLocationResponse(object[] p) {.. WriteStartDocument();.. TopLevelElement();..

                                                  C:\Users\user\AppData\Local\Temp\xsc65psb.cmdline

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:Unicode text, UTF-8 (with BOM) text, with very long lines (424), with no line terminators
                                                  Category:dropped
                                                  Size (bytes):427
                                                  Entropy (8bit):5.523382474165609
                                                  Encrypted:false
                                                  SSDEEP:6:pAu+HmkLWuoT7R5TLk2dQvGFpw+oPwkn23fztUzxscHc9olm14sQPIwkn23fzX:p3rknoT7fVuOz5DfpUrHc9ow16PrfT
                                                  MD5:DBECA4BF73D71961D082CFA0C744379B
                                                  SHA1:988621F99C32C114229C2AD52A80D4E3A04FC8A1
                                                  SHA-256:E207DE424F92083751AF7EF1275654E1D455AE13FE3279FB4134766792188701
                                                  SHA-512:14187CC06460911B5111C157F1E23BB57FEE4DF70BB60CFE2B75B742DC92AA79F37F17AB3B64AD5BD478F2FB70CED3B273395D36630A42FDDDE37FB615D2751D
                                                  Malicious:false
                                                  Preview:./t:library /utf8output /R:"C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorlib.dll" /R:"C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe" /R:"C:\Windows\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.Xml.dll" /out:"C:\Users\user\AppData\Local\Temp\xsc65psb.dll" /debug- /optimize+ /nostdlib /D:_DYNAMIC_XMLSERIALIZER_COMPILATION "C:\Users\user\AppData\Local\Temp\xsc65psb.0.cs"

                                                  C:\Users\user\AppData\Local\Temp\xsc65psb.dll

                                                  Download File
                                                  Process:C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):19968
                                                  Entropy (8bit):4.676297246953763
                                                  Encrypted:false
                                                  SSDEEP:192:D/KBHK6DNGgbCB169NIcK0tbhFDvrpK1EAmIpfQGFOtFk2lsMh:OBHK2Q7aIcXDFDvrpK1Egd0
                                                  MD5:FEA72D83E5F4EE9D078C9BEF5DA39EF9
                                                  SHA1:2ABC3CAB1B45F0A00EF90B13DB1B38B3085A66C4
                                                  SHA-256:233D4D748779291CDA625E3F51F557A21A3BC253C3A90B9DAFF5C6DB6BFEB6C6
                                                  SHA-512:7E52D3A7779EE554B7BBD52BCDB85221F15832C2FA5974824B9343172813DEAFBDF7F37759AC4C48426A417E18CA008AAC21EB2BD8A0A493898E7BBAB0581C51
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....5.f...........!.....F..........Nd... ........@.. ....................................@..................................d..K.................................................................................... ............... ..H............text...TD... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B................0d......H........9...*...........................................................0..E........(.....(......i..r...pr+..p..(......1..rU..pr+..p...t....(.....(....*....0..E........(.....(......i..rg..pr+..p..(......1..r...pr+..p...t....(.....(....*....0..E........(.....(......i..r...pr+..p..(......1..r...pr+..p...t....(.....(....*....0..E........(.....(......i..r...pr+..p..(......1..rQ..pr+..p...t....(.....(....*....0..E........(.....(......i..r...pr+..p..(......1..r...pr+..p...t....(..

                                                  C:\Users\user\AppData\Local\Temp\xsc65psb.out

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:Unicode text, UTF-8 (with BOM) text, with very long lines (539), with CRLF line terminators
                                                  Category:modified
                                                  Size (bytes):746
                                                  Entropy (8bit):5.551360851047967
                                                  Encrypted:false
                                                  SSDEEP:12:vbtRnzR3rknoT7fVuOz5DfpUrHc9ow16PrfyKai3SGzKIMBj6I5BFR5y:THnzdgn8fsOzZfpqW1crfyKai3SGzKI5
                                                  MD5:E6BDCE6C3257F4879545FD67ABE7E56D
                                                  SHA1:82C4B629A4D6CA24E99DC95D25D0D76EE4B9647C
                                                  SHA-256:611E420F1CB418F5C56AB4BC49ED1A5169F5A99E7FCDB97BF5A6796D1AE845EE
                                                  SHA-512:DCEFACCF23CE2417FCB308AAC6C5478535407E1F72E517DBA7202E92A2C6844F7021A4FFD4F0CFB02F00562C81AC7EDC61EBFF726F50E740A2C005283DFB494B
                                                  Malicious:false
                                                  Preview:.C:\Program Files (x86)\Lavasoft\Web Companion\Application> "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /t:library /utf8output /R:"C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorlib.dll" /R:"C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe" /R:"C:\Windows\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.Xml.dll" /out:"C:\Users\user\AppData\Local\Temp\xsc65psb.dll" /debug- /optimize+ /nostdlib /D:_DYNAMIC_XMLSERIALIZER_COMPILATION "C:\Users\user\AppData\Local\Temp\xsc65psb.0.cs"......Microsoft (R) Visual C# 2005 Compiler version 8.00.50727.9149..for Microsoft (R) Windows (R) 2005 Framework version 2.0.50727..Copyright (C) Microsoft Corporation 2001-2005. All rights reserved.....

                                                  C:\Users\user\AppData\Roaming\FileZilla\filezilla.xml

                                                  Download File
                                                  Process:C:\Program Files\FileZilla FTP Client\filezilla.exe
                                                  File Type:XML 1.0 document, ASCII text
                                                  Category:dropped
                                                  Size (bytes):7367
                                                  Entropy (8bit):4.833052717945534
                                                  Encrypted:false
                                                  SSDEEP:96:Ir5AXXa8Yw3Sbpf301EzlK7KXArCfHpC4sE0DM:48YwWW1Eg7pC0rDM
                                                  MD5:8E5E4F150C3AEEBAB8D45A3BD7172D6A
                                                  SHA1:917E2E0ED97201D259C992C5EDD319862DE5AD01
                                                  SHA-256:3D06EC3E94E679AD50333275C4445085FD79AFE9CD710B6070940059F8795341
                                                  SHA-512:7A3284C2EA1FF7198A2E8EB5825324EEBF42E05829334A654BBB460AA4B1DEEB44B8313B297AA97F4C62206DFBAE02C2925F995C44248CD4B4587CBA232A20E9
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="UTF-8"?>.<FileZilla3 version="3.67.1" platform="windows">..<Settings>...<Setting name="Use Pasv mode">1</Setting>...<Setting name="Limit local ports">0</Setting>...<Setting name="Limit ports low">6000</Setting>...<Setting name="Limit ports high">7000</Setting>...<Setting name="Limit ports offset">0</Setting>...<Setting name="External IP mode">0</Setting>...<Setting name="External IP"></Setting>...<Setting name="External address resolver">http://ip.filezilla-project.org/ip.php</Setting>...<Setting name="Last resolved IP"></Setting>...<Setting name="No external ip on local conn">1</Setting>...<Setting name="Pasv reply fallback mode">0</Setting>...<Setting name="Timeout">20</Setting>...<Setting name="Logging Debug Level">0</Setting>...<Setting name="Logging Raw Listing">0</Setting>...<Setting name="Allow transfermode fallback">1</Setting>...<Setting name="Reconnect count">2</Setting>...<Setting name="Reconnect delay">5</Setting>...<Setting name="Enable speed

                                                  C:\Users\user\AppData\Roaming\FileZilla\filezilla.xml~

                                                  Download File
                                                  Process:C:\Program Files\FileZilla FTP Client\filezilla.exe
                                                  File Type:XML 1.0 document, ASCII text
                                                  Category:dropped
                                                  Size (bytes):7342
                                                  Entropy (8bit):4.817138247677335
                                                  Encrypted:false
                                                  SSDEEP:96:Ir5AXXa8Yw3Hbpf301UzlK7KXArCfHpC4sEdzM:48YwrW1Ug7pC0gzM
                                                  MD5:EBC6942CB763E550BB57B53838A49EC9
                                                  SHA1:3EEB50E590A6FBC8FA6C16E14F693A8C09EE979E
                                                  SHA-256:70A1A54D97368A0B46FCB1151F05658A1B3934A8A0615D9F157A4DF4B2E7767F
                                                  SHA-512:7BCE0EDA3025DA2FE77F422F15D617CC1798B772D87D3969AEC68D78A214F7C571226E94D529B23917B801CE0D6CAA928CEA5B914032197BF4EE3A7B4073CBB7
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="UTF-8"?>.<FileZilla3 version="3.67.1" platform="windows">..<Settings>...<Setting name="Use Pasv mode">1</Setting>...<Setting name="Limit local ports">0</Setting>...<Setting name="Limit ports low">6000</Setting>...<Setting name="Limit ports high">7000</Setting>...<Setting name="Limit ports offset">0</Setting>...<Setting name="External IP mode">0</Setting>...<Setting name="External IP"></Setting>...<Setting name="External address resolver">http://ip.filezilla-project.org/ip.php</Setting>...<Setting name="Last resolved IP"></Setting>...<Setting name="No external ip on local conn">1</Setting>...<Setting name="Pasv reply fallback mode">0</Setting>...<Setting name="Timeout">20</Setting>...<Setting name="Logging Debug Level">0</Setting>...<Setting name="Logging Raw Listing">0</Setting>...<Setting name="Allow transfermode fallback">1</Setting>...<Setting name="Reconnect count">2</Setting>...<Setting name="Reconnect delay">5</Setting>...<Setting name="Enable speed

                                                  C:\Users\user\AppData\Roaming\FileZilla\layout.xml

                                                  Download File
                                                  Process:C:\Program Files\FileZilla FTP Client\filezilla.exe
                                                  File Type:XML 1.0 document, ASCII text
                                                  Category:dropped
                                                  Size (bytes):325
                                                  Entropy (8bit):5.325706483254794
                                                  Encrypted:false
                                                  SSDEEP:6:TMVBd//gKXWmdo3KHFBtYuE46mQlsBcMIMU9dhFK/0FwGW0TIKe:TMHd3gWwcxB6nlHMIvFf2GtIh
                                                  MD5:AE53D8A50191A724119C1CD9987A493F
                                                  SHA1:1B652E8A9AABD1C11F366DCC55DE47005492628D
                                                  SHA-256:5AEF44F4E24DABA58E1CE7DBC69091AAE7BC220E67493A38FA20E7F48358B196
                                                  SHA-512:8F6369D8CB013B8A4BF0EBEC6E61AA9FFDF022642BC657AF4AEC8ACD3FE1E73E224B19D3ADF0E73D90DFD061D935A8AFBC046AF01D7751C7D28D9CF29690B81C
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="UTF-8"?>.<FileZilla3 version="3.67.1" platform="windows">..<Layout Builddate="2024-07-10" Buildtime="14:54:21">...<Resources />...<Language id="en_CH" date="1720623328">....<Font font="1;9;-12;0;0;0;400;0;0;0;1;0;0;0;0;Segoe UI" width="669" height="15" />...</Language>..</Layout>.</FileZilla3>.

                                                  C:\Users\user\AppData\Roaming\FileZilla\queue.sqlite3-journal

                                                  Download File
                                                  Process:C:\Program Files\FileZilla FTP Client\filezilla.exe
                                                  File Type:SQLite Rollback Journal
                                                  Category:dropped
                                                  Size (bytes):4616
                                                  Entropy (8bit):2.1021230010697014
                                                  Encrypted:false
                                                  SSDEEP:48:7MMqlfrEabbxBMTL9bPlS7VrWB3IWt5KRY3kgb6Zjdjai10w:75ex8ZdS65IYfiNR
                                                  MD5:4A84DB3319DC3FB7E2BBB7C46E79FAB8
                                                  SHA1:781B4DE3E760F1440B3D17A2D0A5F173168DFD20
                                                  SHA-256:6F516456A1D1082C0E38E0E9BBBB0002B70887EC21F0AE620E6BA5B4F15A2FDD
                                                  SHA-512:002C80DAD0A163D451CE0DB02E2FA6316715B74A41B42C9E18029014539C0251F88B6CDCA156A7510F1025FC8C6F0EE673369F44AAB5CC820AED4050B4357D5C
                                                  Malicious:false
                                                  Preview:.... .c.....l.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................SQLite format 3......@ .........................................................................._.................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Options\CData.txt

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:empty
                                                  Category:dropped
                                                  Size (bytes):0
                                                  Entropy (8bit):0.0
                                                  Encrypted:false
                                                  SSDEEP:3::
                                                  MD5:D41D8CD98F00B204E9800998ECF8427E
                                                  SHA1:DA39A3EE5E6B4B0D3255BFEF95601890AFD80709
                                                  SHA-256:E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
                                                  SHA-512:CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E
                                                  Malicious:false
                                                  Preview:

                                                  C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Options\FData.txt

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:JSON data
                                                  Category:modified
                                                  Size (bytes):855
                                                  Entropy (8bit):4.533252413727434
                                                  Encrypted:false
                                                  SSDEEP:24:PDHZZKxb/DHZJKSuAb/DHZzu8KXb/DHZrKe3:PDHZi/DHZ4e/DHZqV/DHZf
                                                  MD5:3066943D00EF58E49A452A70B00A19D4
                                                  SHA1:91CFF7E365BDEFA6484DA98A166EA0B8369C9A6B
                                                  SHA-256:E1ECD31475DC564D447615AF2347AA57E4D0CF74A1E678B52E7E68208B241526
                                                  SHA-512:229579CDACBA59547384C4C6256125073B45262F10BDBA24415E77DF0CA2B148A1641F8AE7EB43EE02E6684066A3613DD4DFAE3012E7A81613F048299ADCBAC8
                                                  Malicious:false
                                                  Preview:[.. {.. "Search": "Google",.. "Homepage": "about:home",.. "IsOur": false,.. "SetDate": "11/05/2024",.. "Trigger": "User",.. "RemoveDate": "11/12/2024",.. "Age": 7,.. "IsCurrent": false.. },.. {.. "Search": "Google",.. "Homepage": "about:home",.. "IsOur": false,.. "SetDate": "11/12/2024",.. "Trigger": "User",.. "RemoveDate": "08/27/2026",.. "Age": 653,.. "IsCurrent": false.. },.. {.. "Search": "Google",.. "Homepage": "about:home",.. "IsOur": false,.. "SetDate": "08/27/2026",.. "Trigger": "User",.. "RemoveDate": "01/07/2027",.. "Age": 133,.. "IsCurrent": false.. },.. {.. "Search": "Google",.. "Homepage": "about:home",.. "IsOur": false,.. "SetDate": "01/07/2027",.. "Trigger": "User",.. "RemoveDate": null,.. "Age": 75,.. "IsCurrent": true.. }..]

                                                  C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Options\IData.txt

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:JSON data
                                                  Category:dropped
                                                  Size (bytes):754
                                                  Entropy (8bit):4.860077852161113
                                                  Encrypted:false
                                                  SSDEEP:12:N5DHGguDPOOKaGGAUkn1AM7T0TlN/DHGguDPOOKaGGAUdB1AaVAIO0TlN/DHGguj:PDHGRTPsKMnYb/DHGRTPZBKtAb/DHGRj
                                                  MD5:F5AE6F79F78FBD666FC40481D672FCB5
                                                  SHA1:D77EF6EBCFFB7A75B84059B438DC55F69685DA01
                                                  SHA-256:F81C5DE8573D4468F54418F8BB996647B9C270581937D9945A3DB26018AE8BDA
                                                  SHA-512:2E12D6AFD07693CC7522C07FD83503BE49039DF2153C755C98DD4B7238AA36429C6D9313DE82BE9838A993E9E30E01FFF334915771523A5407D772D24E9D69AA
                                                  Malicious:false
                                                  Preview:[.. {.. "Search": "Unknown",.. "Homepage": "http://go.microsoft.com/fwlink/p/?LinkId=255141",.. "IsOur": false,.. "SetDate": "12/07/2024",.. "Trigger": "User",.. "RemoveDate": "12/08/2024",.. "Age": 1,.. "IsCurrent": false.. },.. {.. "Search": "Unknown",.. "Homepage": "http://go.microsoft.com/fwlink/p/?LinkId=255141",.. "IsOur": false,.. "SetDate": "12/08/2024",.. "Trigger": "User",.. "RemoveDate": "12/02/2025",.. "Age": 359,.. "IsCurrent": false.. },.. {.. "Search": "Unknown",.. "Homepage": "http://go.microsoft.com/fwlink/p/?LinkId=255141",.. "IsOur": false,.. "SetDate": "12/02/2025",.. "Trigger": "User",.. "RemoveDate": null,.. "Age": 429,.. "IsCurrent": true.. }..]

                                                  C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Options\Language.txt

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:JSON data
                                                  Category:dropped
                                                  Size (bytes):20
                                                  Entropy (8bit):3.5219280948873624
                                                  Encrypted:false
                                                  SSDEEP:3:GRFf9ur:GZur
                                                  MD5:3E682EB51BAEE9F27B0775287510AC6E
                                                  SHA1:0C62C14B2D05AF414CDC225DB43B60E79EC7B280
                                                  SHA-256:05A960000C74CA2F31FAC1800E5156E2E4D04A78873F005218AEEB8FBACBBFF6
                                                  SHA-512:885FFE4359BF0FD7793B304312C7C6C3E36E767490D0EE542BE5B41A74E8C4A2567C4929BB0C4BF8021A3F07ED97CF05F3FEAC224B79BD76A0AAC9F3B1BD3A06
                                                  Malicious:false
                                                  Preview:{..."lang" : "en"..}

                                                  C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Options\SearchMetadata.txt

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:JSON data
                                                  Category:dropped
                                                  Size (bytes):405
                                                  Entropy (8bit):4.934592557267913
                                                  Encrypted:false
                                                  SSDEEP:6:hJHrHqHN2J1KLKIRmHtkRptr+zTFVHuIvCEOIICr2JG2BVsiirKLKIRmHtyQr:hZKHkJ1fHkRPrYTiIvRICCJG2BVGfHT
                                                  MD5:CD3BBFD3B6F53B094DEAD51F784B5246
                                                  SHA1:E1AA9CA20FF73783A56E4B373D1FDB0D1645C991
                                                  SHA-256:3878249792813448DA6E383C8A71A27C15FE4BFBD3E30D122268A1D9F5083F00
                                                  SHA-512:8F9B32770CE1CAC14F0FD50F9A5A23769308610531F932B380D708567926F7A51EC381495A84B7C50297D6629F41008CC3F77D303A85AC1798A1D988BA4C0E84
                                                  Malicious:false
                                                  Preview:[{"Browser":"Firefox","Search":{"q":"{searchTerms}","domain":"segoonow.com","pId":"FZ210427","iDate":"2018-02-22 12:00:00","bitmask":"9997","bName":"","title":"Search Now","suggestionsUrl":"http://api.bing.com/osjson.aspx?query={searchTerms}","sp":"1"},"HomePage":{"hp":"1","bitmask":"9996","domain":"segoonow.com","pId":"FZ210427","iDate":"2018-02-22 12:00:00","bName":"","homePagePostfix":"/homepage"}}]

                                                  C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\bllist.txt

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:ASCII text, with very long lines (65536), with no line terminators
                                                  Category:dropped
                                                  Size (bytes):179251
                                                  Entropy (8bit):4.664971733668804
                                                  Encrypted:false
                                                  SSDEEP:3072:n/KrPEZjF6WXCfTjtAJD1OD28zmiJn9X/EcZRM/xwbjltvE:3F6WXCNiD1qNzmiv/EcKxwbjXvE
                                                  MD5:57BED415678C5FF6F5730E5BF59410D5
                                                  SHA1:775D61103831CD5F8DDBB6F6C316E4B81A2155E7
                                                  SHA-256:6E5BF9D2E0994C7BE183A854A6D4ECA965FB8BB8FAB81F7BF827DD96AFA59B70
                                                  SHA-512:F3529357D1E99ACE27813F25B4B05C268829A58C95DAD432D370395901DE161F12A02FB3B1EBCC7D89D041B08A77BBF6369B20048A189C047C8892D44E69E8BB
                                                  Malicious:true
                                                  Preview:laizhengslt.cn,mytoolz.net,protect247.online,xxlast.com,worldsanalytics.com,skilltransform.co.in,lelaer.com,jpopsingles.eu,risquegalkx.com,svetvyhod.sk,moviecrumbs.net,phrabu.go.th,onlyindianx.cc,ikiss.online,urewsawani.autos,wearyourbeer.com,app-story.net,movie2k.ch,malfadecor.ru,194.163.176.118,litepick.io,pokemonhacking.com,cake026.ru,mlwbd.rent,barsoocm.com,passionatechick2.com,immensely-admired.live,eleme.cn,jippylong12.xyz,ssoap2day.xyz,israel-or-palestinian.com,sexlist.online,maturenextdoor.com,admindfsga2.xyz,901bargrill.com,bjinr08p88ads2020.com,buff163.fi,shreeganeshapackersmovers.com,tyny.to,uhdmovies.wiki,cinemafirst.ru,indesit-ds.ru,dennibulli.com,heimwerkerhelden.com,voshod41.ru,movielite21.site,gorenamentstore.com,akari46.online,drunkardashamethicket.com,justrakhi.com,yourfreetemplates.com,neccgroup.com,maas.vn,javvietsub.bet,thachangcity.go.th,katmoviehd.mov,bluegaslamp.org,draggedline.org,gh5ys3gry5d532.xyz,kaamuu.org,saoma220.xyz,livetv365.me,pisi.pics,value-life.xyz,

                                                  C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\dcilog.txt

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\DCIService.exe
                                                  File Type:empty
                                                  Category:dropped
                                                  Size (bytes):0
                                                  Entropy (8bit):0.0
                                                  Encrypted:false
                                                  SSDEEP:3::
                                                  MD5:D41D8CD98F00B204E9800998ECF8427E
                                                  SHA1:DA39A3EE5E6B4B0D3255BFEF95601890AFD80709
                                                  SHA-256:E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
                                                  SHA-512:CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E
                                                  Malicious:false
                                                  Preview:

                                                  C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\pwlist.txt

                                                  Download File
                                                  Process:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  File Type:ASCII text, with very long lines (13004), with no line terminators
                                                  Category:dropped
                                                  Size (bytes):13004
                                                  Entropy (8bit):4.401740253805084
                                                  Encrypted:false
                                                  SSDEEP:384:XJQukf0f+Mi+meZZvYRGtXGZ2bgHdA7BMlJPyr8vYQ0:XOPf05mewRoXi2UHitMlR88vYQ0
                                                  MD5:62822E2CD7ACED854A4C89CA69BF8E2D
                                                  SHA1:76A2E7D2BE817C156E224D9F76DB43F805BF19C2
                                                  SHA-256:C8A50DB494FEC9F82C7ECC8C2716F8F0025ECDF6579ABAD0D3EEA848505BA35D
                                                  SHA-512:D65E0170B83566110ECC7BEBDE103B8AAA31921C234E76E80357B5EC5C7D67DC05DC2563C9F0115333F75701245E96569E9DC48ADAC076ED157030431B8BBA8F
                                                  Malicious:false
                                                  Preview:facebook.com,instagram.com,twitter.com,google.com,wordpress.org,youtube.com,linkedin.com,cloudflare.com,pinterest.com,microsoft.com,apple.com,adaware.com,avanquest.com,webcompanion.com,sodapdf.com,inpixio.com,pdfforge.org,discoverygoom.com,defaultsearch.co,explouniverse.com,segoonow.com,ifindit.co,myfiresearch.com,mysearchengine.co,voilasearch.com,ubersearches.com,questhis.com,toptopresults.com,fastestsearch.co,gogosearch.co,simplesearch.co,godaddy.com,wikipedia.org,miit.gov.cn,goo.gl,oculus.com,qq.com,enable-javascript.com,m.me,fbcdn.net,internet.org,youtu.be,internalfb.com,namecheap.com,messenger.com,whatsapp.com,freebasics.com,workplace.com,fb.gg,c5drei.de,lefrenchmelee.fr,amsgaming.in,adobe.com,wordpress.com,sedo.com,gravatar.com,vk.com,wix.com,vimeo.com,europa.eu,baidu.com,github.com,networksolutions.com,amazon.com,shopify.com,dan.com,bit.ly,blogspot.com,filesusr.com,mozilla.org,statcounter.com,tumblr.com,yandex.ru,wa.me,cpanel.net,cpanel.com,jimdo.com,paypal.com,w3.org,bluehost.c

                                                  C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client\FileZilla.lnk

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Wed Jul 10 13:55:42 2024, mtime=Mon Jul 22 09:33:30 2024, atime=Wed Jul 10 13:55:42 2024, length=4237896, window=hide
                                                  Category:dropped
                                                  Size (bytes):978
                                                  Entropy (8bit):4.471828570933783
                                                  Encrypted:false
                                                  SSDEEP:12:8muh40YXMKh9gPKgbdpF4acQwcTS9gQuXhYjA7mJ80BjID6bdpcuwpWbdpcuwctG:8muCKPbdykTSsGA7mJ8nidBddzfBm
                                                  MD5:CB19E624BD005F0BDF61A1AE27CB02D1
                                                  SHA1:34977AB3BEE2F50B2249A294C34CFB016791346C
                                                  SHA-256:7D6B53CFF1EF358B575C4F373003058EDE7FBC6FC8CE429E0658EE77FE8C9960
                                                  SHA-512:3B3772D01E0AAA5433223CB8BB02A90217825FFB92DC021AA0C62B8576F9BEB253E3F430EA64EDB1DCEF9A8BE8A8A5AFA43ECAD63C90FF48B5FB8BC59A09A33B
                                                  Malicious:false
                                                  Preview:L..................F.... ....k*<....|."."....k*<....H.@..........................P.O. .:i.....+00.../C:\.....................1......X/T..PROGRA~1..t......O.I.X/T....B...............J.......".P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....r.1......X2T..FILEZI~1..Z.......X/T.X2T............................-.F.i.l.e.Z.i.l.l.a. .F.T.P. .C.l.i.e.n.t.....h.2.H.@..X.v .FILEZI~1.EXE..L.......X.v.X0T..............................f.i.l.e.z.i.l.l.a...e.x.e.......b...............-.......a.............?K.....C:\Program Files\FileZilla FTP Client\filezilla.exe..K.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.i.l.e.Z.i.l.l.a. .F.T.P. .C.l.i.e.n.t.\.f.i.l.e.z.i.l.l.a...e.x.e.%.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.i.l.e.Z.i.l.l.a. .F.T.P. .C.l.i.e.n.t.`.......X.......818225...........hT..CrF.f4... ..T..b...,.......hT..CrF.f4... ..T..b...,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                                  C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client\FileZilla.lnk~RF6297bf.TMP (copy)

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Wed Jul 10 13:55:42 2024, mtime=Mon Jul 22 09:33:30 2024, atime=Wed Jul 10 13:55:42 2024, length=4237896, window=hide
                                                  Category:dropped
                                                  Size (bytes):978
                                                  Entropy (8bit):4.471828570933783
                                                  Encrypted:false
                                                  SSDEEP:12:8muh40YXMKh9gPKgbdpF4acQwcTS9gQuXhYjA7mJ80BjID6bdpcuwpWbdpcuwctG:8muCKPbdykTSsGA7mJ8nidBddzfBm
                                                  MD5:CB19E624BD005F0BDF61A1AE27CB02D1
                                                  SHA1:34977AB3BEE2F50B2249A294C34CFB016791346C
                                                  SHA-256:7D6B53CFF1EF358B575C4F373003058EDE7FBC6FC8CE429E0658EE77FE8C9960
                                                  SHA-512:3B3772D01E0AAA5433223CB8BB02A90217825FFB92DC021AA0C62B8576F9BEB253E3F430EA64EDB1DCEF9A8BE8A8A5AFA43ECAD63C90FF48B5FB8BC59A09A33B
                                                  Malicious:false
                                                  Preview:L..................F.... ....k*<....|."."....k*<....H.@..........................P.O. .:i.....+00.../C:\.....................1......X/T..PROGRA~1..t......O.I.X/T....B...............J.......".P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....r.1......X2T..FILEZI~1..Z.......X/T.X2T............................-.F.i.l.e.Z.i.l.l.a. .F.T.P. .C.l.i.e.n.t.....h.2.H.@..X.v .FILEZI~1.EXE..L.......X.v.X0T..............................f.i.l.e.z.i.l.l.a...e.x.e.......b...............-.......a.............?K.....C:\Program Files\FileZilla FTP Client\filezilla.exe..K.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.i.l.e.Z.i.l.l.a. .F.T.P. .C.l.i.e.n.t.\.f.i.l.e.z.i.l.l.a...e.x.e.%.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.i.l.e.Z.i.l.l.a. .F.T.P. .C.l.i.e.n.t.`.......X.......818225...........hT..CrF.f4... ..T..b...,.......hT..CrF.f4... ..T..b...,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                                  C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client\Uninstall.lnk

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Mon Jul 22 09:33:34 2024, mtime=Mon Jul 22 09:33:34 2024, atime=Mon Jul 22 09:33:34 2024, length=102358, window=hide
                                                  Category:dropped
                                                  Size (bytes):978
                                                  Entropy (8bit):4.502561846564718
                                                  Encrypted:false
                                                  SSDEEP:12:8mWG40YXMKh9gPKgbdpF4acQwSYJlqGIjA7mJ80BjUD6bdpcuwQGmbdpcuwctzfS:8mWfKPbdyl8RA7mJ8nid9NddzfBm
                                                  MD5:5D1E60BBC1438D1B030AFCC5A514243F
                                                  SHA1:30A70BC30EB66D7BB8FE7C7506FAA7937A1D81A8
                                                  SHA-256:337ED21928DCEBA6A1A5AF5BC3E3C52835B4E678EB655B5BFAB9834CCA8F430A
                                                  SHA-512:F6ACA55DB1A3F9C274AC090312C5E604350A5BA04161A48C028209E3D2F1C07258E22F137EAB663A9CA35EFB9AF74CD783B1F861CDE5A9A75C418C3B20ADEF76
                                                  Malicious:false
                                                  Preview:L..................F.... ...}u.."...%.."...%.."...............................P.O. .:i.....+00.../C:\.....................1......X/T..PROGRA~1..t......O.I.X/T....B...............J.......".P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....r.1......X2T..FILEZI~1..Z.......X/T.X2T............................-.F.i.l.e.Z.i.l.l.a. .F.T.P. .C.l.i.e.n.t.....h.2.....X2T .UNINST~1.EXE..L.......X2T.X2T.....A.....................}..u.n.i.n.s.t.a.l.l...e.x.e.......b...............-.......a.............?K.....C:\Program Files\FileZilla FTP Client\uninstall.exe..K.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.i.l.e.Z.i.l.l.a. .F.T.P. .C.l.i.e.n.t.\.u.n.i.n.s.t.a.l.l...e.x.e.%.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.i.l.e.Z.i.l.l.a. .F.T.P. .C.l.i.e.n.t.`.......X.......818225...........hT..CrF.f4... ..T..b...,.......hT..CrF.f4... ..T..b...,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                                  C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client\~ileZilla.tmp

                                                  Download File
                                                  Process:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Wed Jul 10 13:55:42 2024, mtime=Mon Jul 22 09:33:30 2024, atime=Wed Jul 10 13:55:42 2024, length=4237896, window=hide
                                                  Category:dropped
                                                  Size (bytes):1071
                                                  Entropy (8bit):4.495802143545279
                                                  Encrypted:false
                                                  SSDEEP:12:8muh40YXMKh9gPKgbdpF4acQwcTS9gQuXhYjA7mJ80BjID6bdpcuwpWbdpcuwctj:8muCKPbdykTSsGA7mJ8nidBddzlEm
                                                  MD5:9C04892943AABCB835662BC4E12E30F6
                                                  SHA1:F64ECD17A1D171597C859088C56FF14C86C7F258
                                                  SHA-256:FCA3F1C0AEF5C48A8AF4F51964BAC6D759DD64BCF31809AFA15B541C37145D11
                                                  SHA-512:155374A7D08617B743A41C3570F705FF65E51AD90CF0A3862E02FADC9178E2B10E6114D36CA77E31389F7B7AC3622A470FF5780E6C38349E0A30B7CC0205B75C
                                                  Malicious:false
                                                  Preview:L..................F.... ....k*<....|."."....k*<....H.@..........................P.O. .:i.....+00.../C:\.....................1......X/T..PROGRA~1..t......O.I.X/T....B...............J.......".P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....r.1......X2T..FILEZI~1..Z.......X/T.X2T............................-.F.i.l.e.Z.i.l.l.a. .F.T.P. .C.l.i.e.n.t.....h.2.H.@..X.v .FILEZI~1.EXE..L.......X.v.X0T..............................f.i.l.e.z.i.l.l.a...e.x.e.......b...............-.......a.............?K.....C:\Program Files\FileZilla FTP Client\filezilla.exe..K.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.i.l.e.Z.i.l.l.a. .F.T.P. .C.l.i.e.n.t.\.f.i.l.e.z.i.l.l.a...e.x.e.%.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.i.l.e.Z.i.l.l.a. .F.T.P. .C.l.i.e.n.t.`.......X.......818225...........hT..CrF.f4... ..T..b...,.......hT..CrF.f4... ..T..b...,..............]...1SPSU(L.y.9K....-...A................F.i.l.e.Z.i.l.l.a...C.l.i.e.n.t...A.p.p.I.D...

                                                  C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:ASCII text, with very long lines (1809)
                                                  Category:dropped
                                                  Size (bytes):11046
                                                  Entropy (8bit):5.444165618753222
                                                  Encrypted:false
                                                  SSDEEP:192:9nDupuKhepyAej4qyqaXKNh5xfGgKp8sr7SLaXhD+ueMXofEPS2Cf:dLrq/9spD7W
                                                  MD5:87E927EDF77FD3E27D6D3B6096E9BE85
                                                  SHA1:5563424DCF556D6AF5996467DC382BFA7865F900
                                                  SHA-256:C9E8A72999CA9EA81862BB94ECC9E1A83497DA61DE5D873F60E409399F4141C8
                                                  SHA-512:322B9830712AD1AE13A477E79F1613EC97622414FED21CE89D0E9D3B608BABE35F1B0BD761DAA29F6EE84EC2306CE199D3198B632893B45B0A22B76F7E6A6C4E
                                                  Malicious:true
                                                  Preview:// Mozilla User Preferences..// DO NOT EDIT THIS FILE..//.// If you make changes to this file while the application is running,.// the changes will be overwritten when the application exits..//.// To change a preference value, you can either:.// - modify it via the UI (e.g. via about:config in the browser); or.// - set it within a user.js file in your profile...user_pref("app.normandy.first_run", false);.user_pref("app.normandy.migrationsApplied", 12);.user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");.user_pref("app.update.auto.migrated", true);.user_pref("app.update.background.rolledout", true);.user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);.user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);.user_pref("app.update.lastUpdateTime.region-update-timer", 0);.user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);.user_pref("app.update.lastUpdateTime.xpi-signature-verification", 0);.user_pref("ap

                                                  C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\prefs.js

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:CSV text
                                                  Category:dropped
                                                  Size (bytes):1633
                                                  Entropy (8bit):4.66866152913298
                                                  Encrypted:false
                                                  SSDEEP:48:f85hSmWUvQwYoSvZvUSvP+vLSvtIjvwhUuUtUuxEPS2Cf:EaXhD+u4MUuUtUeEPS2Cf
                                                  MD5:63AD80648692A6A0B24825C1017DFF1B
                                                  SHA1:60EDBE078C2044E09442BA4091A817AB8D4B9F4C
                                                  SHA-256:36F0050C2C4B10C0EBE2F5E781979B285123B1825D1130D9B8F60292163E2868
                                                  SHA-512:E740AD7B457DD60412CEDC91866D671F9DB01B75D6C760C87A13ECC89E0588DB1251B5D143FAAA8761CB9DDE3D1CC62212EE1BD499AA2EDA40B026F0F1895B87
                                                  Malicious:true
                                                  Preview:user_pref("devtools.onboarding.telemetry.logged", false);.user_pref("toolkit.telemetry.updatePing.enabled", false);.user_pref("browser.newtabpage.activity-stream.feeds.telemetry", false);.user_pref("browser.newtabpage.activity-stream.telemetry", false);.user_pref("browser.ping-centre.telemetry", false);.user_pref("toolkit.telemetry.bhrPing.enabled", false);.user_pref("toolkit.telemetry.enabled", false);.user_pref("toolkit.telemetry.firstShutdownPing.enabled", false);.user_pref("toolkit.telemetry.hybridContent.enabled", false);.user_pref("toolkit.telemetry.newProfilePing.enabled", false);.user_pref("toolkit.telemetry.reportingpolicy.firstRun", false);.user_pref("toolkit.telemetry.shutdownPingSender.enabled", false);.user_pref("toolkit.telemetry.unified", false);.user_pref("toolkit.telemetry.archive.enabled", false);.user_pref("datareporting.healthreport.uploadEnabled", false);.user_pref("datareporting.policy.dataSubmissionEnabled", false);.user_pref("datareporting.sessions.current.clean

                                                  C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\026A86A161D256DBB33076EDF20C0E5E_86AB612B21DEDF3B8CD155ED2E4114FF

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe
                                                  File Type:data
                                                  Category:dropped
                                                  Size (bytes):812
                                                  Entropy (8bit):7.47604375171871
                                                  Encrypted:false
                                                  SSDEEP:24:5FtKGBz4jRsYPkJrY4zFS02It7S0p+vT5:/tKzRBPktxn2I1SOU
                                                  MD5:C930736F83FB0CD4C01787BB61D2A04B
                                                  SHA1:D27C3FF1A3AA66E33FEC1CE6FA4F67F58946637C
                                                  SHA-256:643EDA261DB1C399EB61F8B90246037604AB319118EE648D06BE862BE2677859
                                                  SHA-512:12C640E68D15BF49924454FA147876D41500AABBBC4AB02F975B8F521C637AD2212C07263D9048F7D38BAE3468865A485015F09921293A424AA9902208FA7ABF
                                                  Malicious:false
                                                  Preview:0..(......!0.....+.....0......0...0..k0i1.0...U....US1.0...U....Entrust, Inc.1B0@..U...9Entrust Code Signing Root Certification Authority - CSBR1..20240626144300Z0s0q0I0...+........k..E<L.L.j.Q..9@XZ......=...q.7....i5W...5..{.4.j...F.15+....20240626140000Z....20250626135959Z0...*.H...............t..uF.I7..<.a..iC...eC....%..#...$XW.W...B.7.w..2.....MT4UU..$..^g..(.E.....x...o.0......l.L...6....3.pU.......].-/.~...7..%.>~.kJ....-Us.t........K|.W..0o.j.K.P.:.....?+4...4{/.72Nk...>.)....T6.\...k.V...ry....i5.6dE..J.-'.:G.A.:....4V....>...x..#..xu.._...>.....}.D@..Rk..1.0.....2.=.."r........,.5.i....s......U..m..6K.x...B.....b.........L5U..4oH.......p...^..U.a..3iLA...s>aL..3. %tQ..+T.F.wR... .A..m.>..4.].5.L"Zu(.m.1..8.......$0.s.P...yo.i..`o`..\....HG.h(e).P..fZ.o6

                                                  C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A37B8BA80004D3266CB4D93B2052DC10_EBDB5A7037F08CDFB408DBFC0D44B43D

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe
                                                  File Type:data
                                                  Category:dropped
                                                  Size (bytes):1580
                                                  Entropy (8bit):7.468877161931592
                                                  Encrypted:false
                                                  SSDEEP:24:DjCwVnjCEnfSICjSHu7lvOuTuylcU8hsf52QnjCEB7/Iajl6E0YDRW/KrtFgEj0:CAnj6uHu7ZOuRlcU8hsFnjx/bP7tS5
                                                  MD5:1C8B5AD615068F2434E1706EB3F2897B
                                                  SHA1:0F72E1A2FE2487E26979C28629FE5001DFDB0A35
                                                  SHA-256:F1796499AB5E1C22460C608C6E2DCFA3F0DE654D4B1EFE4D868880A74FCAB180
                                                  SHA-512:A08B10F5A6BD5BA7C62ED31EA8048603C4FB07DC95762BEB65E4CB775A87D808A9C36937639EC60F8E8A4F113AC0DEDE9973AAD3DBB52D8D96A5372C7736C1BD
                                                  Malicious:false
                                                  Preview:0..(......!0.....+.....0......0...0..H0F1.0...U....US1.0...U....Entrust1%0#..U....Entrust Validation Authority..20240721232200Z0s0q0I0...+.........\...a......A[B'...jr&z...}.;iQ.l....f...N@.7T......Q......20240721230000Z....20240728225959Z0...*.H.............X..W...&-\..P..7?...`.P.6..s..-.a7.*)V[..(.;N......].lb........4..BZ...#......!....G..[U..|!...C....dl"...Rw.'+.2p3.#...j..MK.....:...S.Z.P4.R.}....{...I..(.[h>.EE...6....9K.xd...{.+.`..d.|.}..M..?m.;.f....y.EN..^..'......-){:r..&K...<^aj....0...0...0...........;.h....,..N..0...*.H........0..1.0...U....US1.0...U....Entrust, Inc.1(0&..U....See www.entrust.net/legal-terms1907..U...0(c) 2009 Entrust, Inc. - for authorized use only1200..U...)Entrust Root Certification Authority - G20...240626145745Z..250626145744Z0F1.0...U....US1.0...U....Entrust1%0#..U....Entrust Validation Authority0.."0...*.H.............0..............3x.F.'.B..$..-..P@.M....]e..4.B.K..6..p.dk#m'.I.0}X.|...'...8.h..=.....;......<-...n....

                                                  C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AF360AACB1570042DEFBC833317997D0_684EE07DA693FF51901FCCD35B88A7C0

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe
                                                  File Type:data
                                                  Category:dropped
                                                  Size (bytes):806
                                                  Entropy (8bit):7.535894266951264
                                                  Encrypted:false
                                                  SSDEEP:24:UpwUZImCamv8OR/WTqX5ve4zPNlkYyJMUCN63:7UZTCF/ZleCN+YgMUCA3
                                                  MD5:521BE6FC1141C170A0583713CA76158A
                                                  SHA1:FBA1C45078A7FE19BA25FC156CABC4E6EF5E350D
                                                  SHA-256:C30DCE2EB8AADF6ECFE15F7641D0784024B1EB4C460DC4C5CDD147FF0D179C1C
                                                  SHA-512:BA1CE054E99DF7B70175B88B8BB67A43844EEAA944C48565D17DC42CED2186E2128CFCA5DEDD3B4CE9D0952857581425F7FCF7BC2B3017E62EE728479B5AB78C
                                                  Malicious:false
                                                  Preview:0..".......0.....+.....0......0...0..e0c1.0...U....US1.0...U....Entrust, Inc.1<0:..U...3Entrust Extended Validation Code Signing CA - EVCS2..20240722073400Z0s0q0I0...+........i.d.)...r ..'d{....*...O.Q....b.1#a.a...x..t.J4.e)'~..9*.....20240722070000Z....20240729065959Z0...*.H.....................A...Y.U7.7....Z.u.w.{l.(.=!w..G)..[.#....'.T.F..B...5 {.~.}_....wL.+q..N.4.I...v.....a....{..?...........R...re...|...-.j.Z(..Z'..4$G....`.k.z.U.Ar.OI".X..k.......`s...$..../:kJ.n%......8B...O .....rc..-. D ..........}..kd....#.u...J..j..mT..o.A..x..Muz./.5....@..9]3...P......!....'}"W...I...v.. .-.....Hd.NFDc...<.......~)...........u.~..............v..... ..C....&..i....YG.....|.H....i.y.;..L..Z .U..I.\m.......XS....7......._..H..Fv.9..k\LFc.7.~..<.i....c'}...$..k!.V...X...%

                                                  C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F599B66E34645915D6CE3B9990A2673F

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe
                                                  File Type:data
                                                  Category:dropped
                                                  Size (bytes):14088
                                                  Entropy (8bit):6.593890359602793
                                                  Encrypted:false
                                                  SSDEEP:384:TWum4htXZRSovyNJVLqfRZdMBe4Xz1FmS:T5JZxoJVL+RZd0kS
                                                  MD5:88A68485AAA30C2DB8B1CE385113B061
                                                  SHA1:24EFDC5A7BC1F675806F81FE452B5FDE44BCB6D6
                                                  SHA-256:7895944133C165EE0228018CA6546C0B19691FF9E774F3BACFC73D6E94264785
                                                  SHA-512:C3B84879332FFA0D8F73A522B5128D0C7554515DFD5B0813C8783258513351EA3B581A5F54B06E2FDDEA56172306F80E9A5B64DC1D8A3A9A44002A41D9D65E8F
                                                  Malicious:false
                                                  Preview:0.7.0.4....0...*.H........0c1.0...U....US1.0...U....Entrust, Inc.1<0:..U...3Entrust Extended Validation Code Signing CA - EVCS2..240722035134Z..240729035133Z0.4.0/........j&z..9T..P..210721155414Z0.0...U.......0!..q..... ....w.z.i..231031182638Z0!....M..6Pr.....0..221208193337Z0/..[....;.'..........220622130907Z0.0...U.......0/....=.+.q.gVH.......210601111522Z0.0...U.......0!..).l...&6....q"...240305005952Z0!..tXb2``2..=.-<h%..240515114754Z0/.....c..k..'..>..P..220715102749Z0.0...U.......0!..c.e../'.....lD.G..240108233256Z0/..u.._....|...*.MX..210910202325Z0.0...U.......0!..[.7......"i...{..231108122354Z0!..B!....V..$.>%Z....240513071418Z0!..e.<v..5.7y8.A(...231020184158Z0!..KJ.R.f.._.[d.e...221128172354Z0/.....f...Pe....Ph..210910195533Z0.0...U.......0!..........b7......220905163358Z0/....bt.x2.h.........240123150823Z0.0...U.......0I..5n=.^.C[..........220823121242Z0&0...U.......0...U......20220823114521Z0!...r...E?-.l#.h:Tm..230208202900Z0/..|^.&....."....Z..220606102232Z0

                                                  C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\026A86A161D256DBB33076EDF20C0E5E_86AB612B21DEDF3B8CD155ED2E4114FF

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe
                                                  File Type:data
                                                  Category:dropped
                                                  Size (bytes):540
                                                  Entropy (8bit):3.9412826689950005
                                                  Encrypted:false
                                                  SSDEEP:12:u/B7/HXiv8sFz06VKMaG7uUyHuYlFDoR/cS6gEZ:eBDHYvZvdEIUaO
                                                  MD5:56B8C391754010E7FEE4481CD574A506
                                                  SHA1:592FA2E6BC6A8BBE695D3C09B43F793035E4E30F
                                                  SHA-256:5B8FFA4C7987C38B343F649B55B3E2CC29906970F869C764C372287E9043BAAB
                                                  SHA-512:F2B20FB6B8EFF782C67A62515244B4D43E86FCEBC93EC1223D935EA93FFAC12D1872E1F53097E3A52F373E4A09489DDD4A7534D71F4AD6CDA3BFC33E83AA921A
                                                  Malicious:false
                                                  Preview:p...... ...."....t.."...(................0e".....Y.......................Y...... ........0e"....=...............,...h.t.t.p.:././.o.c.s.p...e.n.t.r.u.s.t...n.e.t./.M.F.E.w.T.z.B.N.M.E.s.w.S.T.A.J.B.g.U.r.D.g.M.C.G.g.U.A.B.B.R.r.2.b.w.A.R.T.x.M.t.E.y.9.a.s.p.R.A.Z.g.5.Q.F.h.a.g.Q.Q.U.g.r.r.W.P.Z.f.O.n.8.9.x.6.J.I.3.r.%.2.F.2.z.t.W.k.1.V.8.8.C.E.D.W.v.t.3.u.d.N.B.9.q.%.2.F.I.%.2.B.E.R.q.s.x.N.S.s.%.3.D...".6.4.3.E.D.A.2.6.1.D.B.1.C.3.9.9.E.B.6.1.F.8.B.9.0.2.4.6.0.3.7.6.0.4.A.B.3.1.9.1.1.8.E.E.6.4.8.D.0.6.B.E.8.6.2.B.E.2.6.7.7.8.5.9."...

                                                  C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A37B8BA80004D3266CB4D93B2052DC10_EBDB5A7037F08CDFB408DBFC0D44B43D

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe
                                                  File Type:data
                                                  Category:dropped
                                                  Size (bytes):528
                                                  Entropy (8bit):3.9458464677190603
                                                  Encrypted:false
                                                  SSDEEP:12:HpnMHXiv8sFLTr38VQlkNbfH51y3wxT5uzAxq:HpMHYvNrgbBvV5uzAI
                                                  MD5:B88D16D7F3ACF76A0BC27837FD864F68
                                                  SHA1:BAE17FC2EE4AA41324A29FF8C558D20AAEFE13B9
                                                  SHA-256:BF71CB3ECBA4E8D2F31D384D9C9CCE62AA3DEFBF5ABCC7C9A6D3A139EFAD07F2
                                                  SHA-512:3CBA4FB0E488D09E101D5E4B5328A2CAAD576AFF87DFB07956BA9AF102B5C3D84AD5E30A465D9D52C9CEE185C95C36237C90B9E9091DE1916E63FA7E5C802F3F
                                                  Malicious:false
                                                  Preview:p...... .........P.."...(........................A..A....................A..A... ...............I...............,...h.t.t.p.:././.o.c.s.p...e.n.t.r.u.s.t...n.e.t./.M.F.E.w.T.z.B.N.M.E.s.w.S.T.A.J.B.g.U.r.D.g.M.C.G.g.U.A.B.B.T.L.X.N.C.z.D.v.B.h.H.e.c.W.j.g.7.0.i.J.h.B.W.0.I.n.y.w.Q.U.a.n.I.m.e.t.A.e.7.3.3.n.O.2.l.R.1.G.y.N.n.5.A.S.Z.q.s.C.E.E.5.A.5.D.d.U.7.e.a.M.A.A.A.A.A.F.H.T.l.H.8.%.3.D...".F.1.7.9.6.4.9.9.A.B.5.E.1.C.2.2.4.6.0.C.6.0.8.C.6.E.2.D.C.F.A.3.F.0.D.E.6.5.4.D.4.B.1.E.F.E.4.D.8.6.8.8.8.0.A.7.4.F.C.A.B.1.8.0."...

                                                  C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AF360AACB1570042DEFBC833317997D0_684EE07DA693FF51901FCCD35B88A7C0

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe
                                                  File Type:data
                                                  Category:dropped
                                                  Size (bytes):540
                                                  Entropy (8bit):3.9683023766796164
                                                  Encrypted:false
                                                  SSDEEP:12:MfY9HXiv8sFkOmTP4ws/WyX2iZ2iy5MVJzQlv:cY9HYvuOmT2WLiZ28VJslv
                                                  MD5:275A3625D74B03DA678CBCE192D16B33
                                                  SHA1:4CD659D4759210A218FD9C3A9841F9563F932FD0
                                                  SHA-256:C83911215A94129B903CF069EE69F8D3297B6CE7F4BCEDDC51AF46C3F15AB84D
                                                  SHA-512:D315E09C8ABA0DD0926AF2348A883159A276E2729736EC172D73C19387A2919FEAFF728580D77A7CBD768AA6EDF64FC802EFB74106E0DD779FCD5AE6741BCE4F
                                                  Malicious:false
                                                  Preview:p...... ...."...g6.."...(..................................................... ...............~...............&...h.t.t.p.:././.o.c.s.p...e.n.t.r.u.s.t...n.e.t./.M.F.E.w.T.z.B.N.M.E.s.w.S.T.A.J.B.g.U.r.D.g.M.C.G.g.U.A.B.B.R.p.%.2.B.m.Q.D.K.a.u.E.4.n.I.g.%.2.F.g.k.n.Z.H.u.B.l.L.k.f.K.g.Q.U.z.o.l.P.g.l.G.q.F.a.K.E.Y.s.o.x.I.2.H.S.Y.f.v.4.%.2.F.n.g.C.E.H.T.v.S.j.T.p.o.G.U.p.J.3.7.O.B.z.k.q.8.u.U.%.3.D...".C.3.0.D.C.E.2.E.B.8.A.A.D.F.6.E.C.F.E.1.5.F.7.6.4.1.D.0.7.8.4.0.2.4.B.1.E.B.4.C.4.6.0.D.C.4.C.5.C.D.D.1.4.7.F.F.0.D.1.7.9.C.1.C."...

                                                  C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F599B66E34645915D6CE3B9990A2673F

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe
                                                  File Type:data
                                                  Category:dropped
                                                  Size (bytes):288
                                                  Entropy (8bit):3.037123972953581
                                                  Encrypted:false
                                                  SSDEEP:6:kKOZMGuXLYpi18nce6ELKlWloWPBf17DId:9b8d6WKMloWPr7DId
                                                  MD5:98EE5D2F5AB4B76463591B01A3BD2E25
                                                  SHA1:7F6A0F10A3F17B8F0340F3F201D71402F1A4DC1A
                                                  SHA-256:CC8531BE0ECD22C8CCCE79F358F372051EBFC8BF7A8F02D9ABA902D7C23B4B6D
                                                  SHA-512:5138DF2558D20527CB6D6BE589ECE33C8DEDA04B9E46DF34A8C8176C9BF25A9BEA83C27933920B40341635B2B2C7156EA6DBA008800B85B48FB95B436B379A92
                                                  Malicious:false
                                                  Preview:p...... ....B...\..."...(....................................................... ...................j............7..h.t.t.p.:././.c.r.l...e.n.t.r.u.s.t...n.e.t./.e.v.c.s.2...c.r.l...".8.8.a.6.8.4.8.5.a.a.a.3.0.c.2.d.b.8.b.1.c.e.3.8.5.1.1.3.b.0.6.1.:.1.7.2.1.6.2.0.3.2.7...0.8.5.5.7.2."...

                                                  C:\Windows\System32\drivers\SETF07D.tmp

                                                  Download File
                                                  Process:C:\Windows\System32\rundll32.exe
                                                  File Type:PE32+ executable (native) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):800672
                                                  Entropy (8bit):6.427490885202283
                                                  Encrypted:false
                                                  SSDEEP:24576:TW3je01Io/rAYd/cg3NuRoB4Qn5ZTQuzfSuKRDSqLP6z5BLM5:a3jp1Io/rn/cgduRoB4Q5ZTQuzfShDSs
                                                  MD5:2A241AF18D9F0466AFF6CD77C1561F9B
                                                  SHA1:2C6BFC8E583ED026FDF9EC01265D99E22D39305A
                                                  SHA-256:528804013487CDB1DA617E512D1DE68060602887BCC8A7822BDB1346A2995FFD
                                                  SHA-512:6779667BB57C87FDBF4DEE57682E7851B5AD5BEA39DEB09FCB596AE48EB571317749FF59E825F91BD57527DAB7477DEAC5B24BDBD86471844FAD36876C08DD28
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........."?.Ll.Ll.Ll..Jm.Ll...l.Ll...l.Ll..Mm.Ll.Mlq.Ll..Om.Ll..Hm.Ll;.Im..Ll;.l.Ll;.Nm.LlRich.Ll................PE..d...#$&a.........."..........:......p..........@.............................p.............A....................................................d....P..`........i.......!...`.......D..T...........................0E..................h............................text............................... ..`PAGE....6".......$.................. ..`.rdata..............................@..@.data... ...........................@....pdata...i.......j..................@..@INIT....b....@...................... ..b.rsrc...`....P......................@..B.reloc.......`......................@..B........................................................................................................................................................................

                                                  C:\Windows\assembly\Desktop.ini

                                                  Download File
                                                  Process:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  File Type:Windows desktop.ini
                                                  Category:dropped
                                                  Size (bytes):227
                                                  Entropy (8bit):5.2735028737400205
                                                  Encrypted:false
                                                  SSDEEP:6:a1eZBXVNYTF0NwoScUbtSgyAXIWv7v5PMKq:UeZBFNYTswUq1r5zq
                                                  MD5:F7F759A5CD40BC52172E83486B6DE404
                                                  SHA1:D74930F354A56CFD03DC91AA96D8AE9657B1EE54
                                                  SHA-256:A709C2551B8818D7849D31A65446DC2F8C4CCA2DCBBC5385604286F49CFDAF1C
                                                  SHA-512:A50B7826BFE72506019E4B1148A214C71C6F4743C09E809EF15CD0E0223F3078B683D203200910B07B5E1E34B94F0FE516AC53527311E2943654BFCEADE53298
                                                  Malicious:false
                                                  Preview:; ==++==..; ..; Copyright (c) Microsoft Corporation. All rights reserved...; ..; ==--==..[.ShellClassInfo]..CLSID={1D2680C9-0E2A-469d-B787-065558BC7D43}..ConfirmFileOp=1..InfoTip=Contains application stability information...

                                                  C:\Windows\system32\DRIVERS\bddci.sys (copy)

                                                  Download File
                                                  Process:C:\Windows\System32\rundll32.exe
                                                  File Type:PE32+ executable (native) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):800672
                                                  Entropy (8bit):6.427490885202283
                                                  Encrypted:false
                                                  SSDEEP:24576:TW3je01Io/rAYd/cg3NuRoB4Qn5ZTQuzfSuKRDSqLP6z5BLM5:a3jp1Io/rn/cgduRoB4Q5ZTQuzfShDSs
                                                  MD5:2A241AF18D9F0466AFF6CD77C1561F9B
                                                  SHA1:2C6BFC8E583ED026FDF9EC01265D99E22D39305A
                                                  SHA-256:528804013487CDB1DA617E512D1DE68060602887BCC8A7822BDB1346A2995FFD
                                                  SHA-512:6779667BB57C87FDBF4DEE57682E7851B5AD5BEA39DEB09FCB596AE48EB571317749FF59E825F91BD57527DAB7477DEAC5B24BDBD86471844FAD36876C08DD28
                                                  Malicious:true
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........."?.Ll.Ll.Ll..Jm.Ll...l.Ll...l.Ll..Mm.Ll.Mlq.Ll..Om.Ll..Hm.Ll;.Im..Ll;.l.Ll;.Nm.LlRich.Ll................PE..d...#$&a.........."..........:......p..........@.............................p.............A....................................................d....P..`........i.......!...`.......D..T...........................0E..................h............................text............................... ..`PAGE....6".......$.................. ..`.rdata..............................@..@.data... ...........................@....pdata...i.......j..................@..@INIT....b....@...................... ..b.rsrc...`....P......................@..B.reloc.......`......................@..B........................................................................................................................................................................

                                                  \Device\ConDrv

                                                  Download File
                                                  Process:C:\Windows\System32\netsh.exe
                                                  File Type:ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):99
                                                  Entropy (8bit):4.325646299814427
                                                  Encrypted:false
                                                  SSDEEP:3:j7DsRKMSSKdidXHvMOF/d459FgXAEBQWpwa:jTdsHU8G592QdWea
                                                  MD5:488F6C94D5E6F3515F1380447E912B18
                                                  SHA1:98AC04AAC92510BACDA68078FE85E6D0FAFAA9B3
                                                  SHA-256:D533F870C250189D9F6A5F8BE86CAEF46C3C7CF3E0197ED9FE4C6E5418D0BE8C
                                                  SHA-512:09B968112E9D8EF4E0E7D1F57D6D55A147CA9542BCADC8BD75E84EF35E5498D47C55ECA0DB5D40AA01E382E662C5E76889924EBFCA5D8CC52B13F5360F452924
                                                  Malicious:false
                                                  Preview:..Url reservation add failed, Error: 183..Cannot create a file when that file already exists.......

                                                  Static File Info

                                                  General

                                                  File type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                  Entropy (8bit):7.999661029957062
                                                  TrID:
                                                  • Win32 Executable (generic) a (10002005/4) 99.96%
                                                  • Generic Win/DOS Executable (2004/3) 0.02%
                                                  • DOS Executable Generic (2002/1) 0.02%
                                                  • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                  File name:FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  File size:12'417'936 bytes
                                                  MD5:ac97e64c3e2e865c50155dfdffe5428a
                                                  SHA1:d473e2d49e908e6d1abfa614c55bdae485508153
                                                  SHA256:6113a3f7c9469fcd9b53ea3ecb16bbefb71318af2864ae0a74a8fb633a05f24a
                                                  SHA512:fd43745695ad835e06bad9341b1a1149996a67ee3e15bacf29ac537ddd5857e7551331acfe4fd40679f892da8012d79cd4ce446854503e77086cd4b7893fa6f9
                                                  SSDEEP:196608:L/+plSWtW9Ee+owH4x1FqZ4OpcTKIgBe/cOkeoNF/xQXS8+waJDPRdF+yF:L/elbwx+PE1ocTKI4eklNkXS8xaN5d3
                                                  TLSH:59C633D85BC8C37AE42C47B90B2F1162DBA69E5154EF4356CCC5BC437A0A297FE13A18
                                                  File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1 ..PN..PN..PN.*_...PN..PO.JPN.*_...PN..s~..PN..VH..PN.Rich.PN.........................PE..L...g..d.................h...".....

                                                  File Icon

                                                  Icon Hash:c769eccc64f6e2bb

                                                  Static PE Info

                                                  General

                                                  Entrypoint:0x403645
                                                  Entrypoint Section:.text
                                                  Digitally signed:true
                                                  Imagebase:0x400000
                                                  Subsystem:windows gui
                                                  Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
                                                  DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                                                  Time Stamp:0x64A0DC67 [Sun Jul 2 02:09:43 2023 UTC]
                                                  TLS Callbacks:
                                                  CLR (.Net) Version:
                                                  OS Version Major:4
                                                  OS Version Minor:0
                                                  File Version Major:4
                                                  File Version Minor:0
                                                  Subsystem Version Major:4
                                                  Subsystem Version Minor:0
                                                  Import Hash:9dda1a1d1f8a1d13ae0297b47046b26e

                                                  Authenticode Signature

                                                  Signature Valid:true
                                                  Signature Issuer:CN=Sectigo Public Code Signing CA R36, O=Sectigo Limited, C=GB
                                                  Signature Validation Error:The operation completed successfully
                                                  Error Number:0
                                                  Not Before, Not After
                                                  • 18/02/2022 00:00:00 17/02/2025 23:59:59
                                                  Subject Chain
                                                  • CN=Tim Kosse, O=Tim Kosse, S=Nordrhein-Westfalen, C=DE
                                                  Version:3
                                                  Thumbprint MD5:D2F88AEA5C53DD7092E3CD7246907BE2
                                                  Thumbprint SHA-1:E57CE01F6A5E1D4C522BC68488AF53D9BAD13AB7
                                                  Thumbprint SHA-256:ED619A9A79713E12FFB757CF8A51BBA89FBB967EC6223C653F1F8932B0E2A25A
                                                  Serial:31830C370AD7E497633B6EB3A02D69E6

                                                  Entrypoint Preview

                                                  Instruction
                                                  sub esp, 000003F8h
                                                  push ebp
                                                  push esi
                                                  push edi
                                                  push 00000020h
                                                  pop edi
                                                  xor ebp, ebp
                                                  push 00008001h
                                                  mov dword ptr [esp+20h], ebp
                                                  mov dword ptr [esp+18h], 0040A230h
                                                  mov dword ptr [esp+14h], ebp
                                                  call dword ptr [004080A0h]
                                                  mov esi, dword ptr [004080A4h]
                                                  lea eax, dword ptr [esp+34h]
                                                  push eax
                                                  mov dword ptr [esp+4Ch], ebp
                                                  mov dword ptr [esp+0000014Ch], ebp
                                                  mov dword ptr [esp+00000150h], ebp
                                                  mov dword ptr [esp+38h], 0000011Ch
                                                  call esi
                                                  test eax, eax
                                                  jne 00007FA2F87BDAAAh
                                                  lea eax, dword ptr [esp+34h]
                                                  mov dword ptr [esp+34h], 00000114h
                                                  push eax
                                                  call esi
                                                  mov ax, word ptr [esp+48h]
                                                  mov ecx, dword ptr [esp+62h]
                                                  sub ax, 00000053h
                                                  add ecx, FFFFFFD0h
                                                  neg ax
                                                  sbb eax, eax
                                                  mov byte ptr [esp+0000014Eh], 00000004h
                                                  not eax
                                                  and eax, ecx
                                                  mov word ptr [esp+00000148h], ax
                                                  cmp dword ptr [esp+38h], 0Ah
                                                  jnc 00007FA2F87BDA78h
                                                  and word ptr [esp+42h], 0000h
                                                  mov eax, dword ptr [esp+40h]
                                                  movzx ecx, byte ptr [esp+3Ch]
                                                  mov dword ptr [00429B18h], eax
                                                  xor eax, eax
                                                  mov ah, byte ptr [esp+38h]
                                                  movzx eax, ax
                                                  or eax, ecx
                                                  xor ecx, ecx
                                                  mov ch, byte ptr [esp+00000148h]
                                                  movzx ecx, cx
                                                  shl eax, 10h
                                                  or eax, ecx
                                                  movzx ecx, byte ptr [esp+0000004Eh]

                                                  Rich Headers

                                                  Programming Language:
                                                  • [EXP] VC++ 6.0 SP5 build 8804

                                                  Data Directories

                                                  NameVirtual AddressVirtual Size Is in Section
                                                  IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                  IMAGE_DIRECTORY_ENTRY_IMPORT0x84fc0xa0.rdata
                                                  IMAGE_DIRECTORY_ENTRY_RESOURCE0x6a0000xa3a0.rsrc
                                                  IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                  IMAGE_DIRECTORY_ENTRY_SECURITY0xbd4b480x3048
                                                  IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                  IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                  IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                  IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                  IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                  IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                  IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                  IMAGE_DIRECTORY_ENTRY_IAT0x80000x2a8.rdata
                                                  IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                  IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                  IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                  Sections

                                                  NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                  .text0x10000x66b70x6800e65344ac983813901119e185754ec24eFalse0.6607196514423077data6.4378696011937135IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                  .rdata0x80000x13580x1400bd82d08a08da8783923a22b467699302False0.4431640625data5.103358601944578IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                  .data0xa0000x1fb780x600caa377d001cfc3215a3edff6d7702132False0.5091145833333334data4.126209888385862IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                  .ndata0x2a0000x400000x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                  .rsrc0x6a0000xa3a00xa40019461ce50ea1a1c3b9135c6e656e070fFalse0.6042301829268293data6.5733049598238456IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                                  Resources

                                                  NameRVASizeTypeLanguageCountryZLIB Complexity
                                                  RT_BITMAP0x6a3a00x666Device independent bitmap graphic, 96 x 16 x 8, image size 1538, resolution 2868 x 2868 px/m, 15 important colorsEnglishUnited States0.18192918192918192
                                                  RT_ICON0x6aa080x485dPNG image data, 256 x 256, 8-bit/color RGBA, non-interlacedEnglishUnited States1.000863697705803
                                                  RT_ICON0x6f2680x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9216EnglishUnited States0.1892116182572614
                                                  RT_ICON0x718100xea8Device independent bitmap graphic, 48 x 96 x 8, image size 2304EnglishUnited States0.34808102345415776
                                                  RT_ICON0x726b80x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 1024EnglishUnited States0.3993682310469314
                                                  RT_ICON0x72f600x568Device independent bitmap graphic, 16 x 32 x 8, image size 256EnglishUnited States0.3432080924855491
                                                  RT_DIALOG0x734c80xb4dataEnglishUnited States0.6111111111111112
                                                  RT_DIALOG0x735800x120dataEnglishUnited States0.5138888888888888
                                                  RT_DIALOG0x736a00x158dataEnglishUnited States0.5261627906976745
                                                  RT_DIALOG0x737f80x202dataEnglishUnited States0.4085603112840467
                                                  RT_DIALOG0x73a000xf8dataEnglishUnited States0.6290322580645161
                                                  RT_DIALOG0x73af80xa0dataEnglishUnited States0.60625
                                                  RT_DIALOG0x73b980xeedataEnglishUnited States0.6302521008403361
                                                  RT_GROUP_ICON0x73c880x4cdataEnglishUnited States0.7763157894736842
                                                  RT_VERSION0x73cd80x2a0dataEnglishUnited States0.47470238095238093
                                                  RT_MANIFEST0x73f780x423XML 1.0 document, ASCII text, with very long lines (1059), with no line terminatorsEnglishUnited States0.5127478753541076

                                                  Imports

                                                  DLLImport
                                                  ADVAPI32.dllRegEnumValueW, RegEnumKeyW, RegQueryValueExW, RegSetValueExW, RegCloseKey, RegDeleteValueW, RegDeleteKeyW, AdjustTokenPrivileges, LookupPrivilegeValueW, OpenProcessToken, RegOpenKeyExW, RegCreateKeyExW
                                                  SHELL32.dllSHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, SHFileOperationW, ShellExecuteExW
                                                  ole32.dllCoCreateInstance, OleUninitialize, OleInitialize, IIDFromString, CoTaskMemFree
                                                  COMCTL32.dllImageList_Destroy, ImageList_AddMasked, ImageList_Create
                                                  USER32.dllMessageBoxIndirectW, GetDlgItemTextW, SetDlgItemTextW, CreatePopupMenu, AppendMenuW, TrackPopupMenu, OpenClipboard, EmptyClipboard, SetClipboardData, CloseClipboard, IsWindowVisible, CallWindowProcW, GetMessagePos, CheckDlgButton, LoadCursorW, SetCursor, GetSysColor, SetWindowPos, GetWindowLongW, IsWindowEnabled, SetClassLongW, GetSystemMenu, EnableMenuItem, GetWindowRect, ScreenToClient, EndDialog, RegisterClassW, SystemParametersInfoW, CharPrevW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, FindWindowExW, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndPaint, CharNextA, wsprintfA, DispatchMessageW, CreateWindowExW, PeekMessageW, GetSystemMetrics
                                                  GDI32.dllGetDeviceCaps, SetBkColor, SelectObject, DeleteObject, CreateBrushIndirect, CreateFontIndirectW, SetBkMode, SetTextColor
                                                  KERNEL32.dllRemoveDirectoryW, lstrcmpiA, GetTempFileNameW, CreateProcessW, CreateDirectoryW, GetLastError, CreateThread, GlobalLock, GlobalUnlock, GetDiskFreeSpaceW, WideCharToMultiByte, lstrcpynW, lstrlenW, SetErrorMode, GetVersionExW, GetCommandLineW, GetTempPathW, GetWindowsDirectoryW, SetEnvironmentVariableW, WriteFile, ExitProcess, GetCurrentProcess, GetModuleFileNameW, GetFileSize, CreateFileW, GetTickCount, Sleep, SetFileAttributesW, GetFileAttributesW, SetCurrentDirectoryW, MoveFileW, GetFullPathNameW, GetShortPathNameW, SearchPathW, CompareFileTime, SetFileTime, CloseHandle, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalFree, GlobalAlloc, GetModuleHandleW, LoadLibraryExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, lstrlenA, MultiByteToWideChar, ReadFile, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW, MulDiv, lstrcpyA, MoveFileExW, lstrcatW, GetSystemDirectoryW, GetProcAddress, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, CopyFileW

                                                  Possible Origin

                                                  Language of compilation systemCountry where language is spokenMap
                                                  EnglishUnited States

                                                  Network Behavior

                                                  DNS Queries

                                                  TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                  Jul 22, 2024 12:33:00.843005896 CEST192.168.2.41.1.1.10xd276Standard query (0)offers.filezilla-project.orgA (IP address)IN (0x0001)false
                                                  Jul 22, 2024 12:33:12.398741007 CEST192.168.2.41.1.1.10x1981Standard query (0)webcompanion.comA (IP address)IN (0x0001)false
                                                  Jul 22, 2024 12:33:17.595628977 CEST192.168.2.41.1.1.10x44f9Standard query (0)flow.lavasoft.comA (IP address)IN (0x0001)false
                                                  Jul 22, 2024 12:33:20.868606091 CEST192.168.2.41.1.1.10x151fStandard query (0)wc-update-service.lavasoft.comA (IP address)IN (0x0001)false
                                                  Jul 22, 2024 12:33:21.548180103 CEST192.168.2.41.1.1.10x4834Standard query (0)wcdownloadercdn.lavasoft.comA (IP address)IN (0x0001)false
                                                  Jul 22, 2024 12:33:38.152719021 CEST192.168.2.41.1.1.10x5b87Standard query (0)rt.webcompanion.comA (IP address)IN (0x0001)false
                                                  Jul 22, 2024 12:33:50.350842953 CEST192.168.2.41.1.1.10x839aStandard query (0)update.filezilla-project.orgA (IP address)IN (0x0001)false
                                                  Jul 22, 2024 12:33:59.564387083 CEST192.168.2.41.1.1.10x94b0Standard query (0)acs.lavasoft.comA (IP address)IN (0x0001)false
                                                  Jul 22, 2024 12:34:01.039350033 CEST192.168.2.41.1.1.10x75c2Standard query (0)acscdn.lavasoft.comA (IP address)IN (0x0001)false
                                                  Jul 22, 2024 12:34:11.688996077 CEST192.168.2.41.1.1.10xbcfcStandard query (0)wc-partners.lavasoft.comA (IP address)IN (0x0001)false
                                                  Jul 22, 2024 12:34:15.242460012 CEST192.168.2.41.1.1.10x327bStandard query (0)ocsp.entrust.netA (IP address)IN (0x0001)false
                                                  Jul 22, 2024 12:34:16.170972109 CEST192.168.2.41.1.1.10x164dStandard query (0)crl.entrust.netA (IP address)IN (0x0001)false
                                                  Jul 22, 2024 12:34:32.408094883 CEST192.168.2.41.1.1.10xf4e6Standard query (0)wsgeoip.lavasoft.comA (IP address)IN (0x0001)false
                                                  Jul 22, 2024 12:34:42.493833065 CEST192.168.2.41.1.1.10xee51Standard query (0)webcompanion.comA (IP address)IN (0x0001)false
                                                  Jul 22, 2024 12:34:53.411659002 CEST192.168.2.41.1.1.10xaa7eStandard query (0)www.google.comA (IP address)IN (0x0001)false
                                                  Jul 22, 2024 12:35:21.695260048 CEST192.168.2.41.1.1.10xcaf1Standard query (0)acs.lavasoft.comA (IP address)IN (0x0001)false
                                                  Jul 22, 2024 12:35:43.427253008 CEST192.168.2.41.1.1.10xadb8Standard query (0)acs.lavasoft.comA (IP address)IN (0x0001)false

                                                  DNS Answers

                                                  TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                  Jul 22, 2024 12:33:00.857325077 CEST1.1.1.1192.168.2.40xd276No error (0)offers.filezilla-project.orgfilezilla-project.orgCNAME (Canonical name)IN (0x0001)false
                                                  Jul 22, 2024 12:33:00.857325077 CEST1.1.1.1192.168.2.40xd276No error (0)filezilla-project.org49.12.121.47A (IP address)IN (0x0001)false
                                                  Jul 22, 2024 12:33:12.406481028 CEST1.1.1.1192.168.2.40x1981No error (0)webcompanion.com104.19.159.224A (IP address)IN (0x0001)false
                                                  Jul 22, 2024 12:33:12.406481028 CEST1.1.1.1192.168.2.40x1981No error (0)webcompanion.com104.19.208.152A (IP address)IN (0x0001)false
                                                  Jul 22, 2024 12:33:17.603950977 CEST1.1.1.1192.168.2.40x44f9No error (0)flow.lavasoft.com104.16.149.130A (IP address)IN (0x0001)false
                                                  Jul 22, 2024 12:33:17.603950977 CEST1.1.1.1192.168.2.40x44f9No error (0)flow.lavasoft.com104.16.148.130A (IP address)IN (0x0001)false
                                                  Jul 22, 2024 12:33:20.878667116 CEST1.1.1.1192.168.2.40x151fNo error (0)wc-update-service.lavasoft.com64.18.87.81A (IP address)IN (0x0001)false
                                                  Jul 22, 2024 12:33:20.878667116 CEST1.1.1.1192.168.2.40x151fNo error (0)wc-update-service.lavasoft.com64.18.87.82A (IP address)IN (0x0001)false
                                                  Jul 22, 2024 12:33:21.558743954 CEST1.1.1.1192.168.2.40x4834No error (0)wcdownloadercdn.lavasoft.com104.16.148.130A (IP address)IN (0x0001)false
                                                  Jul 22, 2024 12:33:21.558743954 CEST1.1.1.1192.168.2.40x4834No error (0)wcdownloadercdn.lavasoft.com104.16.149.130A (IP address)IN (0x0001)false
                                                  Jul 22, 2024 12:33:38.160770893 CEST1.1.1.1192.168.2.40x5b87No error (0)rt.webcompanion.com104.19.208.152A (IP address)IN (0x0001)false
                                                  Jul 22, 2024 12:33:38.160770893 CEST1.1.1.1192.168.2.40x5b87No error (0)rt.webcompanion.com104.19.159.224A (IP address)IN (0x0001)false
                                                  Jul 22, 2024 12:33:50.359113932 CEST1.1.1.1192.168.2.40x839aNo error (0)update.filezilla-project.org49.12.121.47A (IP address)IN (0x0001)false
                                                  Jul 22, 2024 12:33:59.577045918 CEST1.1.1.1192.168.2.40x94b0No error (0)acs.lavasoft.com104.16.148.130A (IP address)IN (0x0001)false
                                                  Jul 22, 2024 12:33:59.577045918 CEST1.1.1.1192.168.2.40x94b0No error (0)acs.lavasoft.com104.16.149.130A (IP address)IN (0x0001)false
                                                  Jul 22, 2024 12:34:01.049159050 CEST1.1.1.1192.168.2.40x75c2No error (0)acscdn.lavasoft.com104.16.149.130A (IP address)IN (0x0001)false
                                                  Jul 22, 2024 12:34:01.049159050 CEST1.1.1.1192.168.2.40x75c2No error (0)acscdn.lavasoft.com104.16.148.130A (IP address)IN (0x0001)false
                                                  Jul 22, 2024 12:34:11.700606108 CEST1.1.1.1192.168.2.40xbcfcNo error (0)wc-partners.lavasoft.com64.18.87.82A (IP address)IN (0x0001)false
                                                  Jul 22, 2024 12:34:11.700606108 CEST1.1.1.1192.168.2.40xbcfcNo error (0)wc-partners.lavasoft.com64.18.87.81A (IP address)IN (0x0001)false
                                                  Jul 22, 2024 12:34:15.251044989 CEST1.1.1.1192.168.2.40x327bNo error (0)ocsp.entrust.netocsp.entrust.net.edgekey.netCNAME (Canonical name)IN (0x0001)false
                                                  Jul 22, 2024 12:34:16.179024935 CEST1.1.1.1192.168.2.40x164dNo error (0)crl.entrust.netcrl.entrust.net.edgesuite.netCNAME (Canonical name)IN (0x0001)false
                                                  Jul 22, 2024 12:34:32.417979002 CEST1.1.1.1192.168.2.40xf4e6No error (0)wsgeoip.lavasoft.com64.18.87.4A (IP address)IN (0x0001)false
                                                  Jul 22, 2024 12:34:42.501640081 CEST1.1.1.1192.168.2.40xee51No error (0)webcompanion.com104.19.159.224A (IP address)IN (0x0001)false
                                                  Jul 22, 2024 12:34:42.501640081 CEST1.1.1.1192.168.2.40xee51No error (0)webcompanion.com104.19.208.152A (IP address)IN (0x0001)false
                                                  Jul 22, 2024 12:34:53.620440960 CEST1.1.1.1192.168.2.40xaa7eNo error (0)www.google.com142.250.186.164A (IP address)IN (0x0001)false
                                                  Jul 22, 2024 12:35:21.704071999 CEST1.1.1.1192.168.2.40xcaf1No error (0)acs.lavasoft.com104.16.148.130A (IP address)IN (0x0001)false
                                                  Jul 22, 2024 12:35:21.704071999 CEST1.1.1.1192.168.2.40xcaf1No error (0)acs.lavasoft.com104.16.149.130A (IP address)IN (0x0001)false
                                                  Jul 22, 2024 12:35:43.438241005 CEST1.1.1.1192.168.2.40xadb8No error (0)acs.lavasoft.com104.16.149.130A (IP address)IN (0x0001)false
                                                  Jul 22, 2024 12:35:43.438241005 CEST1.1.1.1192.168.2.40xadb8No error (0)acs.lavasoft.com104.16.148.130A (IP address)IN (0x0001)false

                                                  HTTP Packets

                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  0192.168.2.449742104.16.149.130805436C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:33:17.612778902 CEST186OUTPOST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 538
                                                  Connection: Keep-Alive
                                                  Jul 22, 2024 12:33:17.618792057 CEST538OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","OsVersion":"Microsoft Windows 10 Pro","OsBit":"64","PartnerID":"FZ210427","CampaignID":null,"LanguageIso2":n
                                                  Jul 22, 2024 12:33:18.155584097 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:33:18 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c58fa90a4363-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0
                                                  Jul 22, 2024 12:33:18.176448107 CEST162OUTPOST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 413
                                                  Jul 22, 2024 12:33:18.181858063 CEST413OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","OsVersion":"Microsoft Windows 10 Pro","OsBit":"64","PartnerID":"FZ210427","CampaignID":null,"LanguageIso2":n
                                                  Jul 22, 2024 12:33:18.308681011 CEST519INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:33:18 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c590e9ea4363-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}
                                                  Jul 22, 2024 12:33:18.436813116 CEST5INData Raw: 30 0d 0a 0d 0a
                                                  Data Ascii: 0
                                                  Jul 22, 2024 12:33:18.451278925 CEST162OUTPOST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 419
                                                  Jul 22, 2024 12:33:18.456593990 CEST419OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","OsVersion":"Microsoft Windows 10 Pro","OsBit":"64","PartnerID":"FZ210427","CampaignID":null,"LanguageIso2":n
                                                  Jul 22, 2024 12:33:18.609338999 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:33:18 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c592ab6b4363-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0
                                                  Jul 22, 2024 12:33:18.631242990 CEST162OUTPOST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 397
                                                  Jul 22, 2024 12:33:18.636210918 CEST397OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","OsVersion":"Microsoft Windows 10 Pro","OsBit":"64","PartnerID":"FZ210427","CampaignID":null,"LanguageIso2":n
                                                  Jul 22, 2024 12:33:18.913641930 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:33:18 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c593ccc54363-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0
                                                  Jul 22, 2024 12:33:19.015260935 CEST162OUTPOST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 389
                                                  Jul 22, 2024 12:33:19.021373034 CEST389OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","OsVersion":"Microsoft Windows 10 Pro","OsBit":"64","PartnerID":"FZ210427","CampaignID":null,"LanguageIso2":n
                                                  Jul 22, 2024 12:33:19.157308102 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:33:19 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c5962ec44363-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0
                                                  Jul 22, 2024 12:33:19.583167076 CEST162OUTPOST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 391
                                                  Jul 22, 2024 12:33:19.792849064 CEST391OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","OsVersion":"Microsoft Windows 10 Pro","OsBit":"64","PartnerID":"FZ210427","CampaignID":null,"LanguageIso2":n
                                                  Jul 22, 2024 12:33:19.953315020 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:33:19 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c59b0a1c4363-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0
                                                  Jul 22, 2024 12:33:20.032021046 CEST162OUTPOST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 406
                                                  Jul 22, 2024 12:33:20.037000895 CEST406OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","OsVersion":"Microsoft Windows 10 Pro","OsBit":"64","PartnerID":"FZ210427","CampaignID":null,"LanguageIso2":n
                                                  Jul 22, 2024 12:33:20.247838974 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:33:20 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c59c8b3f4363-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0
                                                  Jul 22, 2024 12:33:20.255604982 CEST162OUTPOST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 422
                                                  Jul 22, 2024 12:33:20.260675907 CEST422OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","OsVersion":"Microsoft Windows 10 Pro","OsBit":"64","PartnerID":"FZ210427","CampaignID":null,"LanguageIso2":n
                                                  Jul 22, 2024 12:33:20.380913973 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:33:20 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c59dec584363-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0
                                                  Jul 22, 2024 12:33:31.728076935 CEST162OUTPOST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 448
                                                  Jul 22, 2024 12:33:31.733458996 CEST448OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","OsVersion":"Microsoft Windows 10 Pro","OsBit":"64","PartnerID":"FZ210427","CampaignID":null,"LanguageIso2":n
                                                  Jul 22, 2024 12:33:31.909085989 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:33:31 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c5e598d04363-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0
                                                  Jul 22, 2024 12:33:36.123647928 CEST162OUTPOST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 422
                                                  Jul 22, 2024 12:33:36.251560926 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:33:36 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c6011dbe4363-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0
                                                  Jul 22, 2024 12:33:37.800609112 CEST162OUTPOST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 427
                                                  Jul 22, 2024 12:33:38.146940947 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:33:38 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c60cae034363-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0
                                                  Jul 22, 2024 12:33:53.920425892 CEST162OUTPOST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 438
                                                  Jul 22, 2024 12:33:54.108247995 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:33:54 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c6705cbd4363-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0
                                                  Jul 22, 2024 12:33:58.068526030 CEST162OUTPOST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 422
                                                  Jul 22, 2024 12:33:58.206697941 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:33:58 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c68a3eed4363-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0
                                                  Jul 22, 2024 12:33:59.206070900 CEST162OUTPOST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 425
                                                  Jul 22, 2024 12:33:59.366377115 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:33:59 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c6915c144363-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0
                                                  Jul 22, 2024 12:33:59.388915062 CEST162OUTPOST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 420
                                                  Jul 22, 2024 12:33:59.553874969 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:33:59 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c6927d4c4363-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0
                                                  Jul 22, 2024 12:34:03.514003038 CEST162OUTPOST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 397
                                                  Jul 22, 2024 12:34:03.684120893 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:03 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c6ac4fb74363-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0
                                                  Jul 22, 2024 12:34:04.085316896 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:03 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c6ac4fb74363-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0
                                                  Jul 22, 2024 12:34:05.467479944 CEST162OUTPOST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 397
                                                  Jul 22, 2024 12:34:05.630645037 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:05 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c6b8796a4363-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0
                                                  Jul 22, 2024 12:34:05.640099049 CEST162OUTPOST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 418
                                                  Jul 22, 2024 12:34:05.801008940 CEST519INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:05 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c6b99a224363-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}
                                                  Jul 22, 2024 12:34:05.946425915 CEST162OUTPOST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 414
                                                  Jul 22, 2024 12:34:06.106637955 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:06 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c6bb7ba14363-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0
                                                  Jul 22, 2024 12:34:06.119225025 CEST162OUTPOST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 457
                                                  Jul 22, 2024 12:34:06.281383991 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:06 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c6bc8c6b4363-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0
                                                  Jul 22, 2024 12:34:06.296403885 CEST162OUTPOST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 470
                                                  Jul 22, 2024 12:34:06.459506035 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:06 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c6bdad384363-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0
                                                  Jul 22, 2024 12:34:06.477564096 CEST162OUTPOST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 464
                                                  Jul 22, 2024 12:34:06.636698961 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:06 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c6bece3a4363-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0
                                                  Jul 22, 2024 12:34:06.771789074 CEST162OUTPOST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 434
                                                  Jul 22, 2024 12:34:06.949795008 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:06 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c6c0afcc4363-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0
                                                  Jul 22, 2024 12:34:06.960120916 CEST162OUTPOST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 458
                                                  Jul 22, 2024 12:34:07.222434998 CEST519INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:07 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c6c1d8e04363-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}
                                                  Jul 22, 2024 12:34:07.361412048 CEST162OUTPOST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 459
                                                  Jul 22, 2024 12:34:07.495117903 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:07 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c6c45b194363-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0
                                                  Jul 22, 2024 12:34:07.503909111 CEST162OUTPOST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 442
                                                  Jul 22, 2024 12:34:07.785144091 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:07 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c6c53bd74363-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0
                                                  Jul 22, 2024 12:34:07.801392078 CEST162OUTPOST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 453
                                                  Jul 22, 2024 12:34:08.304311037 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:08 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c6c71d334363-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0
                                                  Jul 22, 2024 12:34:08.313302994 CEST162OUTPOST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 452
                                                  Jul 22, 2024 12:34:08.785836935 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:08 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c6ca4fc64363-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0
                                                  Jul 22, 2024 12:34:08.786730051 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:08 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c6ca4fc64363-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0
                                                  Jul 22, 2024 12:34:08.795913935 CEST162OUTPOST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 452
                                                  Jul 22, 2024 12:34:08.971489906 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:08 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c6cd4a584363-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  1192.168.2.44974364.18.87.81805436C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:33:20.892627954 CEST211OUTPOST /update.asmx HTTP/1.1
                                                  Content-Type: text/xml; charset=utf-8
                                                  SOAPAction: "http://tempuri.org/GetComponentsVersionInfo"
                                                  Host: wc-update-service.lavasoft.com
                                                  Content-Length: 280
                                                  Connection: Keep-Alive
                                                  Jul 22, 2024 12:33:20.892694950 CEST280OUTData Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 47 65 74 43 6f 6d 70 6f 6e
                                                  Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><GetComponentsVersionInfo xmlns="http://tempuri.org/" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"><platform>prod</platform><version>9.1.0.993</version></GetCompone
                                                  Jul 22, 2024 12:33:21.355338097 CEST1236INHTTP/1.1 200 OK
                                                  Server: nginx
                                                  Date: Mon, 22 Jul 2024 10:33:21 GMT
                                                  Content-Type: text/xml; charset=utf-8
                                                  Content-Length: 1449
                                                  Connection: keep-alive
                                                  Cache-Control: private, max-age=0
                                                  X-AspNet-Version: 4.0.30319
                                                  X-Powered-By: ASP.NET
                                                  Access-Control-Allow-Origin: http://webcompanion.com
                                                  Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 47 65 74 43 6f 6d 70 6f 6e 65 6e 74 73 56 65 72 73 69 6f 6e 49 6e 66 6f 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 47 65 74 43 6f 6d 70 6f 6e 65 6e 74 73 56 65 72 73 69 6f 6e 49 6e 66 6f 52 65 73 75 6c 74 3e 3c 43 6f 6d 70 6f 6e 65 6e 74 73 3e 3c 43 6f 6d 70 6f 6e 65 6e 74 56 65 72 73 [TRUNCATED]
                                                  Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"><soap:Body><GetComponentsVersionInfoResponse xmlns="http://tempuri.org/"><GetComponentsVersionInfoResult><Components><ComponentVersionInfo><Name>installer</Name><Version>9.1.0.993</Version><DownloadUrl>http://wcdownloadercdn.lavasoft.com/9.1.0.993/Installer.exe</DownloadUrl></ComponentVersionInfo><ComponentVersionInfo><Name>application</Name><Version>2.1.1117.2317</Version><DownloadUrl>http://wcdownloadercdn.lavasoft.com/9.1.0.993/Installer.msi</DownloadUrl></ComponentVersionInfo><ComponentVersionInfo><Name>tcpservice</Name><Version>2.3.4.7</Version><DownloadUrl>http://wcdownloadercdn.lavasoft.com/9.1.0.993/TcpService.msi</DownloadUrl></ComponentVersionInfo><ComponentVersionInfo><Name>42f00399-529e-4915-83ce-5b4c18049fc8</
                                                  Jul 22, 2024 12:33:21.355655909 CEST510INData Raw: 4e 61 6d 65 3e 3c 56 65 72 73 69 6f 6e 3e 39 2e 31 2e 30 2e 39 39 33 3c 2f 56 65 72 73 69 6f 6e 3e 3c 44 6f 77 6e 6c 6f 61 64 55 72 6c 3e 68 74 74 70 3a 2f 2f 77 63 64 6f 77 6e 6c 6f 61 64 65 72 63 64 6e 2e 6c 61 76 61 73 6f 66 74 2e 63 6f 6d 2f
                                                  Data Ascii: Name><Version>9.1.0.993</Version><DownloadUrl>http://wcdownloadercdn.lavasoft.com/9.1.0.993/WcInstaller.exe</DownloadUrl></ComponentVersionInfo><ComponentVersionInfo><Name>webcompanion</Name><Version>9.1.0.993</Version><DownloadUrl>http://wcdo


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  2192.168.2.449744104.16.148.130805436C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:33:21.565977097 CEST119OUTGET /9.1.0.993/WebCompanion-9.1.0.993-prod.zip HTTP/1.1
                                                  Host: wcdownloadercdn.lavasoft.com
                                                  Connection: Keep-Alive
                                                  Jul 22, 2024 12:33:22.095140934 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:33:22 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 12024981
                                                  Connection: keep-alive
                                                  ETag: "1474771251"
                                                  Last-Modified: Fri, 24 Nov 2023 19:05:15 GMT
                                                  CF-Cache-Status: REVALIDATED
                                                  Expires: Mon, 22 Jul 2024 14:33:22 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c5a85e7743af-EWR
                                                  Data Raw: 50 4b 03 04 14 00 00 00 08 00 27 2d 78 57 0a 72 2c 2d 67 46 03 00 d8 24 07 00 13 00 00 00 41 70 70 6c 69 63 61 74 69 6f 6e 2f 37 7a 61 2e 65 78 65 ec bd 79 78 54 45 d6 38 7c 7b 49 d2 59 48 27 40 43 58 c4 56 5b 8d 84 25 43 50 93 34 68 5f d2 4d 6e 43 47 40 44 51 a3 a0 68 0b ae 18 fa 86 20 8b 60 27 be e9 5c 5b 1d c5 19 75 1c c7 79 67 9c cf 19 97 51 47 59 5c bb 13 c8 c2 be b8 b0 8c 8a 7b 85 16 64 91 10 b6 dc ef 9c 53 b7 b7 10 a2 cf f7 fc 7e ff 7d 79 9e f4 dd aa 4e 9d 3a 75 ea d4 a9 53 a7 4e 55 dc f4 a4 60 10 04 c1 08 ff aa 2a 08 6b 04 fe e7 10 7e fd 8f c1 7f f6 f9 ef 65 0b ef a4 6f be 60 8d ce b3 f9 82 eb e6 ce 5b 60 9d 5f f5 c0 5d 55 b7 dd 67 9d 73 db fd f7 3f e0 b3 de 7e a7 b5 4a be df 3a ef 7e ab 73 ca 74 eb 7d 0f dc 71 e7 a8 3e 7d 32 6c 1a 8c f3 87 dd dd 75 f3 c3 c6 d7 a3 ff 23 bf 59 f4 fa 4d 74 7d f8 f5 a9 f4 2e e5 f5 36 7a be fb f5 1c ba ce 7b fd 3a b8 3a be 79 5e 4b 57 a3 5d 97 d0 f5 da 79 73 e6 22 9c ee b8 4e 75 09 c2 1d 8f a6 08 f3 bf bf ef a6 e8 bb 43 c2 45 42 a6 de 24 08 cd 50 fb 6b f4 f4 2e [TRUNCATED]
                                                  Data Ascii: PK'-xWr,-gF$Application/7za.exeyxTE8|{IYH'@CXV[%CP4h_MnCG@DQh `'\[uygQGY\{dS~}yN:uSNU`*k~eo`[`_]Ugs?~J:~st}q>}2lu#YMt}.6z{::y^KW]ys"NuCEB$Pk.s(zNK~+LITolmYp=*#gr<wgzbQUwM:LnHNr]#TArvO5':B]p}<lxU 6?iog7H%E_Bd f]&IQGSxoK./~gQ_^(h^DqJ\Y2&Fo`}98E'Kne+c_/oo+gzM6DD^I9!0HJ?h72"U;RY=bk^y0lm*h9fJ-NKUHH"YI)8=s>)MPH!LeJ`bc(:-M=}v=9:u.7XO
                                                  Jul 22, 2024 12:33:22.095232010 CEST1236INData Raw: 54 e9 cf 25 65 8a 29 56 eb d5 f0 72 53 9c 96 73 13 aa 08 e5 6f 97 82 1e 5b 31 db 43 d5 a0 db d5 20 bd f9 dd 8d 78 37 67 29 50 fe ab 3a 15 c9 fe ad c1 df 02 d5 88 c0 1b 17 14 38 d6 20 d5 75 f8 00 c9 6c 76 2d 61 b0 85 4d 42 0c 54 79 57 8b cb 44 0c
                                                  Data Ascii: T%e)VrSso[1C x7g)P:8 ulv-aMBTyWDp$0x>'Kl/gUb{!_,<.$#zhe+P$8h,lVbomTig,%%QmMgqBb'=23/8k
                                                  Jul 22, 2024 12:33:22.095360994 CEST1236INData Raw: 1d 09 f0 f1 28 1b 16 6c c2 57 ee 39 8d ae 7a 13 e1 b3 03 f1 f1 18 ad 09 08 39 0d 3b e5 43 1a 3e 8e 9b 9b a0 da e2 5a 10 cb 82 12 8e 18 a0 d6 61 66 94 3b 45 25 5c 31 67 77 b3 31 47 f0 18 f6 b8 d5 8d 2e a5 51 0c ef 37 8a fe 7d 66 10 7d 19 62 d0 71
                                                  Data Ascii: (lW9z9;C>Zaf;E%\1gw1G.Q7}f}bqZh^j^h3O6y$!n86O00\tEIgAm\~j`+yZWb@?yE7GJjt|w{M4=[&{tIVq
                                                  Jul 22, 2024 12:33:22.095558882 CEST1236INData Raw: c0 50 ce 87 cf 03 25 37 5b cb ba 95 4d cd 8b cd f5 b7 43 99 0d 68 85 91 66 dd dc 74 f6 9c e6 a6 70 dc be 82 ef 97 2f 32 01 52 bb 7d 43 89 8a f7 86 8c 02 a8 d2 46 a8 47 1f a9 05 8d 93 42 73 99 49 e0 15 04 70 dc 74 06 09 87 40 c2 a2 36 7b 58 23 74
                                                  Data Ascii: P%7[MChftp/2R}CFGBsIpt@6{X#t9w6Z;LM HjV]i8.TRTH'F0n8//v S:tgsvGS-sH;>N+%{c3`.Pq?@
                                                  Jul 22, 2024 12:33:22.095596075 CEST896INData Raw: b7 c9 3e 0f e1 56 e8 d8 4b 71 b8 e1 63 1c ee 03 04 f7 01 64 2a 42 3d 0a f9 48 22 e4 18 5c 10 2a 45 b8 2e e4 ad 03 fe 3b ec 1b 28 29 1b bc e3 97 0b 0b ae 47 79 a2 b6 78 15 1d 7c 91 7f b2 2f c3 02 a7 e8 d8 68 2a 30 1b 0b 9c 7a 2c c6 32 ca 80 a2 b6
                                                  Data Ascii: >VKqcd*B=H"\*E.;()Gyx|/h*0z,2:5QNe+V6`1WHZg4Q\#_Ozh!!URcrH~(iUl@$b$VM2-{GF6iVN4Y}q>t9,r`o0N:bz7OFY
                                                  Jul 22, 2024 12:33:22.095630884 CEST1236INData Raw: a3 0c 3b f6 54 94 8a da 68 d2 c3 38 59 a2 8d 93 43 61 9c 44 c8 f2 c1 58 25 fe 70 f0 ac a1 12 79 1b 49 f2 a7 a7 e2 24 49 ec 33 24 60 ec 20 5d 94 4e 5e 91 18 c6 e7 c5 31 be 2a 86 71 9d 8a 4b 52 d9 1e 80 44 48 b3 32 82 9b ea 6d 31 d6 40 37 58 66 ea
                                                  Data Ascii: ;Th8YCaDX%pyI$I3$` ]N^1*qKRDH2m1@7Xfqe^|Qg)Yu 4gpb0. (ED8Gx=Z;*RU$,"KR/*n4Y0bSt[.KO25h3~S@Tf $gHmO^
                                                  Jul 22, 2024 12:33:22.095666885 CEST1236INData Raw: 0a 2c 60 80 dc 56 b8 df a7 5a 26 00 5e a2 bd 59 39 24 8f 56 2d 17 f3 07 73 ed 2e 5a f2 b1 04 a7 20 a6 8f 51 29 2d b5 74 21 7c f7 02 7b 6d e2 8b 1d ce c0 3b fc 7d e6 0a 95 c1 b3 d8 70 50 36 38 de d5 25 d0 e5 52 d2 48 fa b9 94 0a 98 4d b8 04 b1 f4
                                                  Data Ascii: ,`VZ&^Y9$V-s.Z Q)-t!|{m;}pP68%RHM`SnkA17+[j1lv,+p\s\Gq$Y?D)b6S|k5kSY{6:t!>.js49I*#a&t
                                                  Jul 22, 2024 12:33:22.095704079 CEST1236INData Raw: 70 d7 6f 2f 2e ab 7b 71 57 1e e4 36 d6 e9 49 56 8a 3d b1 8e fe e3 61 cc b0 d5 19 74 c0 3c c7 30 29 d8 df c1 fe 8b c6 f3 84 05 16 65 9a a9 08 cd b2 30 9f 49 f7 fa 4b 86 fb fa c1 ef d5 be 3e 2a ad 5b da 1b ab f6 f3 15 59 18 10 8a 76 78 ed 8d be 7c
                                                  Data Ascii: po/.{qW6IV=at<0)e0IK>*[Yvx|T[2(MJHi&|Lu9EpoE}LRr'Eb[#EE{bSd"yhmBp}mm l_MJT[\hO+-Kq*S]\HP<=W=r
                                                  Jul 22, 2024 12:33:22.096313953 CEST1236INData Raw: 6c b6 7c 8f fd 5b 5f 2e 36 10 b3 7f 8a 8b 87 9b 58 11 5c ed a7 e4 5d a0 3c 8a ca 52 93 fd 94 b9 f6 d3 98 3b e8 b5 df a9 ea 93 4a 93 12 b1 9f aa be 97 76 1e 57 08 5e d1 3f 2e ab d2 67 a2 eb 68 79 b2 53 59 af 99 38 79 9e 6a d0 1d 39 5b bc f6 09 d2
                                                  Data Ascii: l|[_.6X\]<R;JvW^?.ghySY8yj9[q79.P6=79.nV\\Nens=|3 _r|kJyQN'~+;\UidU>[9,60Pk]h(WTa3|op*{:
                                                  Jul 22, 2024 12:33:22.096353054 CEST1236INData Raw: c5 fc 8d 83 5f 9c 1c 5a c2 9e a0 c2 e4 3d 41 27 78 a3 ed 6d 4b 96 e7 0e 9c e3 22 bb 5f 6f 22 76 1f bd 87 1a e3 fa 3c 62 f7 f0 19 fe 94 4f ec 7e f5 51 fe 54 4c ec fe 3b 7c 8a 09 fa ad 51 41 bf ff 50 4c d0 f7 d8 1e 8f b6 f5 46 6f be 4f 3e e3 b1 de
                                                  Data Ascii: _Z=A'xmK"_o"v<bO~QTL;|QAPLFoO>O>}1e~$."MCBzFBg~.AnaFtO7/]$"*&U"pIgs8G>NSn.+]V^YE6}9]1ek\mtZD
                                                  Jul 22, 2024 12:33:22.100353003 CEST1236INData Raw: ae ba ef 7c a3 d1 58 22 fa d7 c5 ac 25 8e 24 6b c9 94 30 27 4d 39 5c 21 b9 fc 29 ad de b3 e2 70 4c 66 8e a4 db de 09 9c ae 41 d1 85 39 81 91 65 8f 85 e0 dd 8a 75 28 d1 ce 1d a8 28 51 56 5a 59 e3 bf 7b 93 a5 85 6c 92 bf b7 7d ca f3 d9 f0 5f f9 fe
                                                  Data Ascii: |X"%$k0'M9\!)pLfA9eu((QVZY{l}_tlBca~p}leAWlTNU[<%3M2OV@RO3K+j0 +1C'wjW@&SJs^5}bpk~


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  3192.168.2.449753104.19.208.15280940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:10.206234932 CEST113OUTGET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Connection: Keep-Alive
                                                  Jul 22, 2024 12:34:10.680619955 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:10 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 17770
                                                  Connection: keep-alive
                                                  ETag: "770472110"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 380
                                                  Expires: Mon, 22 Jul 2024 14:34:10 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c6d85a9f0f75-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 [TRUNCATED]
                                                  Data Ascii: PK:=AX7\0DrActiveFeatures.txt+@sjp#K1;/-[[ABexq)7 7:^gK !ibUVsO$v7|e\W'ZdveU*oR>%w$-;Q4Tf$+T$&Q?9#"6>0o@j(*i)H"B1`=&0I8CR"ycM7g\@8xE4S|Iyy7~%W?7!JhrfdB^OQ"IDG!o+^6VY6<wNNPP2\?EY^j>i[p`L_sXq>#~nY>LO9rsAS+g5FBiqgUf{*vBUBqTpKF;/[&WIAPuS-&v3!Y'bMl{[:5sVL3om7'O4'(V#:\#VOO&<s}Yd|<P@jM%O5lHs^SYfaCDDwVcE8~cETL0YIEd@._PQ~w\fAT7Kiywq|+#]N">(A0bU-lDM#ETYa-h}ep<),
                                                  Jul 22, 2024 12:34:10.680680037 CEST1236INData Raw: c3 e9 0b b5 94 79 f6 cd ab db ef 95 d6 d1 32 bc 03 27 b0 a7 67 bb 67 5c 5f 47 4a 97 f1 f7 fc 80 a5 3d 5e cb d2 21 fd 16 4d f6 ed 94 f2 d0 41 ec b6 8d 9b cb af 44 4b 5e 3f 92 fc ae 08 db 64 a5 1d 86 78 29 a2 a9 c5 2d c1 7a 36 38 e0 81 84 1a 34 f5
                                                  Data Ascii: y2'gg\_GJ=^!MADK^?dx)-z684R|YSgynUf1qbEFO?'[a`bF\rsZL0q\vgrP:ZbPw^l^|Vov^'D0\mJh*I{X14
                                                  Jul 22, 2024 12:34:10.680716038 CEST1236INData Raw: e3 09 b7 93 e7 ef 55 87 a5 e2 4a 0e 55 3c 50 4f 28 65 ca 9a de 34 88 d5 59 ab cd 64 54 2a 94 93 b6 b8 c7 f1 34 a6 fe 9a 9e 58 e1 5b 68 04 08 88 1d 07 7a 22 8c f4 8b 1a 37 f4 2d 18 02 f7 c9 7a e3 8d 30 e6 e5 c6 72 4a b5 33 12 97 f2 9b 9f 3d 2b 49
                                                  Data Ascii: UJU<PO(e4YdT*4X[hz"7-z0rJ3=+I:QrVjeAU|0e r.-nFs%U@_G~W}E^ns]W6.Jg4)Kk~9"4{i#W}_&L'HNOp
                                                  Jul 22, 2024 12:34:10.680752039 CEST1236INData Raw: a2 40 45 ad 3e 10 cc d4 22 b8 18 aa b5 83 15 5b 5f 79 62 da f6 64 de 89 40 91 c6 e3 e6 3c 48 f6 f2 37 d0 b4 a2 87 ed 8b 72 11 f9 fa 1d 84 ca dd 63 7c e6 56 65 74 e8 c3 ce 0a 52 78 3d f5 2c 69 ad 82 46 5f 21 19 b5 ed d3 bf 7e 98 76 8d 6a 94 b7 ed
                                                  Data Ascii: @E>"[_ybd@<H7rc|VetRx=,iF_!~vj5s,yL/[g{QosVz%{A|PSeC)PYzSZ/]E?kINr|Pg!\2-;@&Lb<maS
                                                  Jul 22, 2024 12:34:10.680788040 CEST1236INData Raw: ef ec e3 a3 78 02 50 1e 6e 18 3a c8 ef 40 01 47 df 2f 67 75 81 ee e7 ed 5c 86 a7 cd ff 50 b9 61 08 00 fa a5 b9 0e 2f 50 8f 87 fd 80 44 ec bf 7d 28 a2 50 86 c4 d0 81 34 04 f9 9d 19 90 5d 6c c8 6f a3 82 62 5f 8a 77 97 ae e6 15 32 ec 5b 3c d5 d1 50
                                                  Data Ascii: xPn:@G/gu\Pa/PD}(P4]lob_w2[<Pz|<gzX],af!:$uMs)m74Tf8Q0Ee@>i~p#D'uma{4q-x.{W)x,0Fm'*wTn
                                                  Jul 22, 2024 12:34:10.680823088 CEST1236INData Raw: ea fe e8 9b 44 1e 62 80 9f 85 5d b4 ed 54 9a 62 26 5d f9 5f e9 66 31 79 1a ec 5d eb 3b 42 de 2a 12 2f 99 5a 51 ad 2c 4e fc b2 cd 25 8a df 0b d7 07 24 1e 16 60 15 f2 23 fe 84 ec 28 ca cb ea 25 a1 6f 30 22 39 cc 4f eb 80 ec b0 87 73 03 c9 e2 6f cb
                                                  Data Ascii: Db]Tb&]_f1y];B*/ZQ,N%$`#(%o0"9OsosUN^m9N)&8))QK}b9"@T~yu?V7j7y)vJ_EEW58X+:CP~T,{/s" a*=_lJ
                                                  Jul 22, 2024 12:34:10.680855989 CEST1236INData Raw: c6 ac fb 85 2b c7 a3 2f 2f d9 73 66 a6 d5 b3 dc bc 4c 89 64 2f f9 a1 b7 40 bf dd 84 b3 f4 0d 92 fa d2 49 45 fc 27 f8 14 9d 3f bd 02 3a c4 6a 3c 68 f4 ec 55 d8 20 1b ea 58 1f 15 63 0c 4e fc 76 39 e9 cc 71 40 69 5b b9 5b c5 4e 6d 50 82 e3 2b 3d 15
                                                  Data Ascii: +//sfLd/@IE'?:j<hU XcNv9q@i[[NmP+=127ZS$rHxh7[m15'1Z91 #%|^s\obPTPUO:$9pgLNTKqmc_xE]uUW\&6Ijo
                                                  Jul 22, 2024 12:34:10.680891037 CEST1236INData Raw: e7 41 3d ce 7d 33 4d 0f 6d da 2d 57 cd 6d 7c 72 20 41 5f e2 85 cb 48 2a 2c 1b 25 2d ea 0b 8c 30 58 68 ec 5b 67 54 17 0b 09 36 f0 a1 5f 55 d0 81 77 eb 76 58 90 be 59 9e ba 3f be 84 2b 42 29 6f 5c df c6 42 5f 49 8a 9f 97 26 07 55 9d da 50 6a e6 dc
                                                  Data Ascii: A=}3Mm-Wm|r A_H*,%-0Xh[gT6_UwvXY?+B)o\B_I&UPj?n,\_%N&gFx!7^"*w/:=\-?2$(<9#oPa7Z+iIU1B($k!XdI<#7s(,\~1~@SfHTn
                                                  Jul 22, 2024 12:34:10.680924892 CEST1236INData Raw: 20 19 6a 5f 78 89 c4 93 e5 38 5a 6e de 37 da e2 c6 06 b0 e8 f5 8e ec 2a 4d 52 53 7c c0 ce f1 b1 9d 84 d3 91 ba fc 29 13 39 6d 22 59 ca f4 90 ba 24 c3 b5 86 27 17 f3 8a b2 8c 0f d9 b9 6d 97 6d 9b 96 f5 eb e7 ae 0b 71 31 03 84 41 72 7d a7 8d f4 99
                                                  Data Ascii: j_x8Zn7*MRS|)9m"Y$'mmq1Ar}sWC@T^n2I%j+r|kpjq%<OjYSO)o+`qK18oLXG#F?sTds%>qWY2qf[n XR`
                                                  Jul 22, 2024 12:34:10.680960894 CEST1236INData Raw: d1 d2 9b 08 03 2c 5a d5 0d b5 24 ba 57 06 e9 82 13 06 b8 76 cd 11 85 df 30 60 c7 4a 68 fc 62 33 d3 a3 33 4a 36 3d a8 67 bb a3 56 33 7d 3d 9a 83 2c 2e ab 79 ba 0d fb 01 11 b8 6d 84 ce cd 88 2e 7d f5 4f 3e 3e d1 e4 3c 13 83 fa 27 77 82 c7 e2 d9 4b
                                                  Data Ascii: ,Z$Wv0`Jhb33J6=gV3}=,.ym.}O>><'wK\U}&El?<tl%}v%HSA*gH(vqd00Dan~Jlax_K9#+Rfl?uhLO{.FLRS
                                                  Jul 22, 2024 12:34:10.685985088 CEST1236INData Raw: 12 42 b8 dd e5 1f 9e 6b 33 d0 27 64 66 67 09 75 13 4e 4f e9 2f 56 c0 a1 26 a6 e7 0f 48 59 99 5e 9a 7b ee 13 0a e1 b2 7e 95 bf 06 41 45 43 c3 c5 43 45 37 b4 fd 4d f1 ee 9a 9c 98 53 15 42 01 8c fa ef a5 44 d0 97 33 99 81 2a 36 6b 2c 46 c1 0c 71 2f
                                                  Data Ascii: Bk3'dfguNO/V&HY^{~AECCE7MSBD3*6k,Fq/D:-E|OylOR-BS)2,o(P.Ibk@1F] 9X&;/<MZ5 `CLg`h*EH=|EZpoC/j{1,u;


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  4192.168.2.449754104.19.208.15280940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:11.045258999 CEST113OUTGET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Connection: Keep-Alive
                                                  Jul 22, 2024 12:34:11.526524067 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:11 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 17770
                                                  Connection: keep-alive
                                                  ETag: "770472110"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 381
                                                  Expires: Mon, 22 Jul 2024 14:34:11 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c6ddae1c1760-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 [TRUNCATED]
                                                  Data Ascii: PK:=AX7\0DrActiveFeatures.txt+@sjp#K1;/-[[ABexq)7 7:^gK !ibUVsO$v7|e\W'ZdveU*oR>%w$-;Q4Tf$+T$&Q?9#"6>0o@j(*i)H"B1`=&0I8CR"ycM7g\@8xE4S|Iyy7~%W?7!JhrfdB^OQ"IDG!o+^6VY6<wNNPP2\?EY^j>i[p`L_sXq>#~nY>LO9rsAS+g5FBiqgUf{*vBUBqTpKF;/[&WIAPuS-&v3!Y'bMl{[:5sVL3om7'O4'(V#:\#VOO&<s}Yd|<P@jM%O5lHs^SYfaCDDwVcE8~cETL0YIEd@._PQ~w\fAT7Kiywq|+#]N">(A0bU-lDM#ETYa-h}ep<),
                                                  Jul 22, 2024 12:34:11.526599884 CEST1236INData Raw: c3 e9 0b b5 94 79 f6 cd ab db ef 95 d6 d1 32 bc 03 27 b0 a7 67 bb 67 5c 5f 47 4a 97 f1 f7 fc 80 a5 3d 5e cb d2 21 fd 16 4d f6 ed 94 f2 d0 41 ec b6 8d 9b cb af 44 4b 5e 3f 92 fc ae 08 db 64 a5 1d 86 78 29 a2 a9 c5 2d c1 7a 36 38 e0 81 84 1a 34 f5
                                                  Data Ascii: y2'gg\_GJ=^!MADK^?dx)-z684R|YSgynUf1qbEFO?'[a`bF\rsZL0q\vgrP:ZbPw^l^|Vov^'D0\mJh*I{X14
                                                  Jul 22, 2024 12:34:11.526649952 CEST1236INData Raw: e3 09 b7 93 e7 ef 55 87 a5 e2 4a 0e 55 3c 50 4f 28 65 ca 9a de 34 88 d5 59 ab cd 64 54 2a 94 93 b6 b8 c7 f1 34 a6 fe 9a 9e 58 e1 5b 68 04 08 88 1d 07 7a 22 8c f4 8b 1a 37 f4 2d 18 02 f7 c9 7a e3 8d 30 e6 e5 c6 72 4a b5 33 12 97 f2 9b 9f 3d 2b 49
                                                  Data Ascii: UJU<PO(e4YdT*4X[hz"7-z0rJ3=+I:QrVjeAU|0e r.-nFs%U@_G~W}E^ns]W6.Jg4)Kk~9"4{i#W}_&L'HNOp
                                                  Jul 22, 2024 12:34:11.526683092 CEST1236INData Raw: a2 40 45 ad 3e 10 cc d4 22 b8 18 aa b5 83 15 5b 5f 79 62 da f6 64 de 89 40 91 c6 e3 e6 3c 48 f6 f2 37 d0 b4 a2 87 ed 8b 72 11 f9 fa 1d 84 ca dd 63 7c e6 56 65 74 e8 c3 ce 0a 52 78 3d f5 2c 69 ad 82 46 5f 21 19 b5 ed d3 bf 7e 98 76 8d 6a 94 b7 ed
                                                  Data Ascii: @E>"[_ybd@<H7rc|VetRx=,iF_!~vj5s,yL/[g{QosVz%{A|PSeC)PYzSZ/]E?kINr|Pg!\2-;@&Lb<maS
                                                  Jul 22, 2024 12:34:11.526716948 CEST1236INData Raw: ef ec e3 a3 78 02 50 1e 6e 18 3a c8 ef 40 01 47 df 2f 67 75 81 ee e7 ed 5c 86 a7 cd ff 50 b9 61 08 00 fa a5 b9 0e 2f 50 8f 87 fd 80 44 ec bf 7d 28 a2 50 86 c4 d0 81 34 04 f9 9d 19 90 5d 6c c8 6f a3 82 62 5f 8a 77 97 ae e6 15 32 ec 5b 3c d5 d1 50
                                                  Data Ascii: xPn:@G/gu\Pa/PD}(P4]lob_w2[<Pz|<gzX],af!:$uMs)m74Tf8Q0Ee@>i~p#D'uma{4q-x.{W)x,0Fm'*wTn
                                                  Jul 22, 2024 12:34:11.526748896 CEST1236INData Raw: ea fe e8 9b 44 1e 62 80 9f 85 5d b4 ed 54 9a 62 26 5d f9 5f e9 66 31 79 1a ec 5d eb 3b 42 de 2a 12 2f 99 5a 51 ad 2c 4e fc b2 cd 25 8a df 0b d7 07 24 1e 16 60 15 f2 23 fe 84 ec 28 ca cb ea 25 a1 6f 30 22 39 cc 4f eb 80 ec b0 87 73 03 c9 e2 6f cb
                                                  Data Ascii: Db]Tb&]_f1y];B*/ZQ,N%$`#(%o0"9OsosUN^m9N)&8))QK}b9"@T~yu?V7j7y)vJ_EEW58X+:CP~T,{/s" a*=_lJ
                                                  Jul 22, 2024 12:34:11.526779890 CEST1236INData Raw: c6 ac fb 85 2b c7 a3 2f 2f d9 73 66 a6 d5 b3 dc bc 4c 89 64 2f f9 a1 b7 40 bf dd 84 b3 f4 0d 92 fa d2 49 45 fc 27 f8 14 9d 3f bd 02 3a c4 6a 3c 68 f4 ec 55 d8 20 1b ea 58 1f 15 63 0c 4e fc 76 39 e9 cc 71 40 69 5b b9 5b c5 4e 6d 50 82 e3 2b 3d 15
                                                  Data Ascii: +//sfLd/@IE'?:j<hU XcNv9q@i[[NmP+=127ZS$rHxh7[m15'1Z91 #%|^s\obPTPUO:$9pgLNTKqmc_xE]uUW\&6Ijo
                                                  Jul 22, 2024 12:34:11.526812077 CEST1236INData Raw: e7 41 3d ce 7d 33 4d 0f 6d da 2d 57 cd 6d 7c 72 20 41 5f e2 85 cb 48 2a 2c 1b 25 2d ea 0b 8c 30 58 68 ec 5b 67 54 17 0b 09 36 f0 a1 5f 55 d0 81 77 eb 76 58 90 be 59 9e ba 3f be 84 2b 42 29 6f 5c df c6 42 5f 49 8a 9f 97 26 07 55 9d da 50 6a e6 dc
                                                  Data Ascii: A=}3Mm-Wm|r A_H*,%-0Xh[gT6_UwvXY?+B)o\B_I&UPj?n,\_%N&gFx!7^"*w/:=\-?2$(<9#oPa7Z+iIU1B($k!XdI<#7s(,\~1~@SfHTn
                                                  Jul 22, 2024 12:34:11.526845932 CEST1236INData Raw: 20 19 6a 5f 78 89 c4 93 e5 38 5a 6e de 37 da e2 c6 06 b0 e8 f5 8e ec 2a 4d 52 53 7c c0 ce f1 b1 9d 84 d3 91 ba fc 29 13 39 6d 22 59 ca f4 90 ba 24 c3 b5 86 27 17 f3 8a b2 8c 0f d9 b9 6d 97 6d 9b 96 f5 eb e7 ae 0b 71 31 03 84 41 72 7d a7 8d f4 99
                                                  Data Ascii: j_x8Zn7*MRS|)9m"Y$'mmq1Ar}sWC@T^n2I%j+r|kpjq%<OjYSO)o+`qK18oLXG#F?sTds%>qWY2qf[n XR`
                                                  Jul 22, 2024 12:34:11.526884079 CEST1236INData Raw: d1 d2 9b 08 03 2c 5a d5 0d b5 24 ba 57 06 e9 82 13 06 b8 76 cd 11 85 df 30 60 c7 4a 68 fc 62 33 d3 a3 33 4a 36 3d a8 67 bb a3 56 33 7d 3d 9a 83 2c 2e ab 79 ba 0d fb 01 11 b8 6d 84 ce cd 88 2e 7d f5 4f 3e 3e d1 e4 3c 13 83 fa 27 77 82 c7 e2 d9 4b
                                                  Data Ascii: ,Z$Wv0`Jhb33J6=gV3}=,.ym.}O>><'wK\U}&El?<tl%}v%HSA*gH(vqd00Dan~Jlax_K9#+Rfl?uhLO{.FLRS
                                                  Jul 22, 2024 12:34:11.531816959 CEST1236INData Raw: 12 42 b8 dd e5 1f 9e 6b 33 d0 27 64 66 67 09 75 13 4e 4f e9 2f 56 c0 a1 26 a6 e7 0f 48 59 99 5e 9a 7b ee 13 0a e1 b2 7e 95 bf 06 41 45 43 c3 c5 43 45 37 b4 fd 4d f1 ee 9a 9c 98 53 15 42 01 8c fa ef a5 44 d0 97 33 99 81 2a 36 6b 2c 46 c1 0c 71 2f
                                                  Data Ascii: Bk3'dfguNO/V&HY^{~AECCE7MSBD3*6k,Fq/D:-E|OylOR-BS)2,o(P.Ibk@1F] 9X&;/<MZ5 `CLg`h*EH=|EZpoC/j{1,u;


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  5192.168.2.44975664.18.87.8280940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:11.706355095 CEST117OUTGET /Partner.svc/GetPartnerInfo?partner=FZ210427 HTTP/1.1
                                                  Host: wc-partners.lavasoft.com
                                                  Connection: Keep-Alive
                                                  Jul 22, 2024 12:34:12.473962069 CEST383INHTTP/1.1 200 OK
                                                  Server: nginx
                                                  Date: Mon, 22 Jul 2024 10:34:12 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Content-Length: 197
                                                  Connection: keep-alive
                                                  X-Powered-By: ASP.NET
                                                  Data Raw: 7b 22 47 65 74 50 61 72 74 6e 65 72 49 6e 66 6f 52 65 73 75 6c 74 22 3a 7b 22 43 4c 49 44 44 53 22 3a 31 30 30 30 38 37 31 2c 22 43 4c 49 44 48 50 22 3a 32 31 37 33 33 31 32 2c 22 43 54 49 44 22 3a 22 43 54 33 33 33 34 34 36 36 22 2c 22 44 65 66 61 75 6c 74 22 3a 66 61 6c 73 65 2c 22 49 6e 73 74 61 6c 6c 44 61 74 65 55 74 63 22 3a 22 37 5c 2f 32 32 5c 2f 32 30 32 34 20 31 30 3a 33 34 3a 31 32 20 41 4d 22 2c 22 50 54 41 47 22 3a 22 41 46 33 30 46 41 45 33 38 44 33 22 2c 22 50 55 52 4c 22 3a 22 64 65 66 61 75 6c 74 22 2c 22 57 43 59 49 44 22 3a 22 57 43 59 49 44 31 30 31 35 30 22 7d 7d
                                                  Data Ascii: {"GetPartnerInfoResult":{"CLIDDS":1000871,"CLIDHP":2173312,"CTID":"CT3334466","Default":false,"InstallDateUtc":"7\/22\/2024 10:34:12 AM","PTAG":"AF30FAE38D3","PURL":"default","WCYID":"WCYID10150"}}
                                                  Jul 22, 2024 12:34:12.475333929 CEST383INHTTP/1.1 200 OK
                                                  Server: nginx
                                                  Date: Mon, 22 Jul 2024 10:34:12 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Content-Length: 197
                                                  Connection: keep-alive
                                                  X-Powered-By: ASP.NET
                                                  Data Raw: 7b 22 47 65 74 50 61 72 74 6e 65 72 49 6e 66 6f 52 65 73 75 6c 74 22 3a 7b 22 43 4c 49 44 44 53 22 3a 31 30 30 30 38 37 31 2c 22 43 4c 49 44 48 50 22 3a 32 31 37 33 33 31 32 2c 22 43 54 49 44 22 3a 22 43 54 33 33 33 34 34 36 36 22 2c 22 44 65 66 61 75 6c 74 22 3a 66 61 6c 73 65 2c 22 49 6e 73 74 61 6c 6c 44 61 74 65 55 74 63 22 3a 22 37 5c 2f 32 32 5c 2f 32 30 32 34 20 31 30 3a 33 34 3a 31 32 20 41 4d 22 2c 22 50 54 41 47 22 3a 22 41 46 33 30 46 41 45 33 38 44 33 22 2c 22 50 55 52 4c 22 3a 22 64 65 66 61 75 6c 74 22 2c 22 57 43 59 49 44 22 3a 22 57 43 59 49 44 31 30 31 35 30 22 7d 7d
                                                  Data Ascii: {"GetPartnerInfoResult":{"CLIDDS":1000871,"CLIDHP":2173312,"CTID":"CT3334466","Default":false,"InstallDateUtc":"7\/22\/2024 10:34:12 AM","PTAG":"AF30FAE38D3","PURL":"default","WCYID":"WCYID10150"}}


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  6192.168.2.449758104.19.208.15280940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:11.933459997 CEST89OUTGET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Jul 22, 2024 12:34:12.475397110 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:12 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 17770
                                                  Connection: keep-alive
                                                  ETag: "770472110"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 382
                                                  Expires: Mon, 22 Jul 2024 14:34:12 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c6e32edf0f80-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 [TRUNCATED]
                                                  Data Ascii: PK:=AX7\0DrActiveFeatures.txt+@sjp#K1;/-[[ABexq)7 7:^gK !ibUVsO$v7|e\W'ZdveU*oR>%w$-;Q4Tf$+T$&Q?9#"6>0o@j(*i)H"B1`=&0I8CR"ycM7g\@8xE4S|Iyy7~%W?7!JhrfdB^OQ"IDG!o+^6VY6<wNNPP2\?EY^j>i[p`L_sXq>#~nY>LO9rsAS+g5FBiqgUf{*vBUBqTpKF;/[&WIAPuS-&v3!Y'bMl{[:5sVL3om7'O4'(V#:\#VOO&<s}Yd|<P@jM%O5lHs^SYfaCDDwVcE8~cETL0YIEd@._PQ~w\fAT7Kiywq|+#]N">(A0bU-lDM#ETYa-h}ep<),
                                                  Jul 22, 2024 12:34:12.475451946 CEST1236INData Raw: c3 e9 0b b5 94 79 f6 cd ab db ef 95 d6 d1 32 bc 03 27 b0 a7 67 bb 67 5c 5f 47 4a 97 f1 f7 fc 80 a5 3d 5e cb d2 21 fd 16 4d f6 ed 94 f2 d0 41 ec b6 8d 9b cb af 44 4b 5e 3f 92 fc ae 08 db 64 a5 1d 86 78 29 a2 a9 c5 2d c1 7a 36 38 e0 81 84 1a 34 f5
                                                  Data Ascii: y2'gg\_GJ=^!MADK^?dx)-z684R|YSgynUf1qbEFO?'[a`bF\rsZL0q\vgrP:ZbPw^l^|Vov^'D0\mJh*I{X14
                                                  Jul 22, 2024 12:34:12.475492001 CEST1236INData Raw: e3 09 b7 93 e7 ef 55 87 a5 e2 4a 0e 55 3c 50 4f 28 65 ca 9a de 34 88 d5 59 ab cd 64 54 2a 94 93 b6 b8 c7 f1 34 a6 fe 9a 9e 58 e1 5b 68 04 08 88 1d 07 7a 22 8c f4 8b 1a 37 f4 2d 18 02 f7 c9 7a e3 8d 30 e6 e5 c6 72 4a b5 33 12 97 f2 9b 9f 3d 2b 49
                                                  Data Ascii: UJU<PO(e4YdT*4X[hz"7-z0rJ3=+I:QrVjeAU|0e r.-nFs%U@_G~W}E^ns]W6.Jg4)Kk~9"4{i#W}_&L'HNOp
                                                  Jul 22, 2024 12:34:12.475527048 CEST1236INData Raw: a2 40 45 ad 3e 10 cc d4 22 b8 18 aa b5 83 15 5b 5f 79 62 da f6 64 de 89 40 91 c6 e3 e6 3c 48 f6 f2 37 d0 b4 a2 87 ed 8b 72 11 f9 fa 1d 84 ca dd 63 7c e6 56 65 74 e8 c3 ce 0a 52 78 3d f5 2c 69 ad 82 46 5f 21 19 b5 ed d3 bf 7e 98 76 8d 6a 94 b7 ed
                                                  Data Ascii: @E>"[_ybd@<H7rc|VetRx=,iF_!~vj5s,yL/[g{QosVz%{A|PSeC)PYzSZ/]E?kINr|Pg!\2-;@&Lb<maS
                                                  Jul 22, 2024 12:34:12.475580931 CEST1236INData Raw: ef ec e3 a3 78 02 50 1e 6e 18 3a c8 ef 40 01 47 df 2f 67 75 81 ee e7 ed 5c 86 a7 cd ff 50 b9 61 08 00 fa a5 b9 0e 2f 50 8f 87 fd 80 44 ec bf 7d 28 a2 50 86 c4 d0 81 34 04 f9 9d 19 90 5d 6c c8 6f a3 82 62 5f 8a 77 97 ae e6 15 32 ec 5b 3c d5 d1 50
                                                  Data Ascii: xPn:@G/gu\Pa/PD}(P4]lob_w2[<Pz|<gzX],af!:$uMs)m74Tf8Q0Ee@>i~p#D'uma{4q-x.{W)x,0Fm'*wTn
                                                  Jul 22, 2024 12:34:12.475615025 CEST1236INData Raw: ea fe e8 9b 44 1e 62 80 9f 85 5d b4 ed 54 9a 62 26 5d f9 5f e9 66 31 79 1a ec 5d eb 3b 42 de 2a 12 2f 99 5a 51 ad 2c 4e fc b2 cd 25 8a df 0b d7 07 24 1e 16 60 15 f2 23 fe 84 ec 28 ca cb ea 25 a1 6f 30 22 39 cc 4f eb 80 ec b0 87 73 03 c9 e2 6f cb
                                                  Data Ascii: Db]Tb&]_f1y];B*/ZQ,N%$`#(%o0"9OsosUN^m9N)&8))QK}b9"@T~yu?V7j7y)vJ_EEW58X+:CP~T,{/s" a*=_lJ
                                                  Jul 22, 2024 12:34:12.475667953 CEST1236INData Raw: c6 ac fb 85 2b c7 a3 2f 2f d9 73 66 a6 d5 b3 dc bc 4c 89 64 2f f9 a1 b7 40 bf dd 84 b3 f4 0d 92 fa d2 49 45 fc 27 f8 14 9d 3f bd 02 3a c4 6a 3c 68 f4 ec 55 d8 20 1b ea 58 1f 15 63 0c 4e fc 76 39 e9 cc 71 40 69 5b b9 5b c5 4e 6d 50 82 e3 2b 3d 15
                                                  Data Ascii: +//sfLd/@IE'?:j<hU XcNv9q@i[[NmP+=127ZS$rHxh7[m15'1Z91 #%|^s\obPTPUO:$9pgLNTKqmc_xE]uUW\&6Ijo
                                                  Jul 22, 2024 12:34:12.475702047 CEST1236INData Raw: e7 41 3d ce 7d 33 4d 0f 6d da 2d 57 cd 6d 7c 72 20 41 5f e2 85 cb 48 2a 2c 1b 25 2d ea 0b 8c 30 58 68 ec 5b 67 54 17 0b 09 36 f0 a1 5f 55 d0 81 77 eb 76 58 90 be 59 9e ba 3f be 84 2b 42 29 6f 5c df c6 42 5f 49 8a 9f 97 26 07 55 9d da 50 6a e6 dc
                                                  Data Ascii: A=}3Mm-Wm|r A_H*,%-0Xh[gT6_UwvXY?+B)o\B_I&UPj?n,\_%N&gFx!7^"*w/:=\-?2$(<9#oPa7Z+iIU1B($k!XdI<#7s(,\~1~@SfHTn
                                                  Jul 22, 2024 12:34:12.475738049 CEST1236INData Raw: 20 19 6a 5f 78 89 c4 93 e5 38 5a 6e de 37 da e2 c6 06 b0 e8 f5 8e ec 2a 4d 52 53 7c c0 ce f1 b1 9d 84 d3 91 ba fc 29 13 39 6d 22 59 ca f4 90 ba 24 c3 b5 86 27 17 f3 8a b2 8c 0f d9 b9 6d 97 6d 9b 96 f5 eb e7 ae 0b 71 31 03 84 41 72 7d a7 8d f4 99
                                                  Data Ascii: j_x8Zn7*MRS|)9m"Y$'mmq1Ar}sWC@T^n2I%j+r|kpjq%<OjYSO)o+`qK18oLXG#F?sTds%>qWY2qf[n XR`
                                                  Jul 22, 2024 12:34:12.475776911 CEST1236INData Raw: d1 d2 9b 08 03 2c 5a d5 0d b5 24 ba 57 06 e9 82 13 06 b8 76 cd 11 85 df 30 60 c7 4a 68 fc 62 33 d3 a3 33 4a 36 3d a8 67 bb a3 56 33 7d 3d 9a 83 2c 2e ab 79 ba 0d fb 01 11 b8 6d 84 ce cd 88 2e 7d f5 4f 3e 3e d1 e4 3c 13 83 fa 27 77 82 c7 e2 d9 4b
                                                  Data Ascii: ,Z$Wv0`Jhb33J6=gV3}=,.ym.}O>><'wK\U}&El?<tl%}v%HSA*gH(vqd00Dan~Jlax_K9#+Rfl?uhLO{.FLRS
                                                  Jul 22, 2024 12:34:12.475832939 CEST1236INData Raw: 12 42 b8 dd e5 1f 9e 6b 33 d0 27 64 66 67 09 75 13 4e 4f e9 2f 56 c0 a1 26 a6 e7 0f 48 59 99 5e 9a 7b ee 13 0a e1 b2 7e 95 bf 06 41 45 43 c3 c5 43 45 37 b4 fd 4d f1 ee 9a 9c 98 53 15 42 01 8c fa ef a5 44 d0 97 33 99 81 2a 36 6b 2c 46 c1 0c 71 2f
                                                  Data Ascii: Bk3'dfguNO/V&HY^{~AECCE7MSBD3*6k,Fq/D:-E|OylOR-BS)2,o(P.Ibk@1F] 9X&;/<MZ5 `CLg`h*EH=|EZpoC/j{1,u;


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  7192.168.2.449763104.19.208.15280940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:12.477332115 CEST89OUTGET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Jul 22, 2024 12:34:12.945079088 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:12 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 17770
                                                  Connection: keep-alive
                                                  ETag: "770472110"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 382
                                                  Expires: Mon, 22 Jul 2024 14:34:12 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c6e68eac0cb5-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 [TRUNCATED]
                                                  Data Ascii: PK:=AX7\0DrActiveFeatures.txt+@sjp#K1;/-[[ABexq)7 7:^gK !ibUVsO$v7|e\W'ZdveU*oR>%w$-;Q4Tf$+T$&Q?9#"6>0o@j(*i)H"B1`=&0I8CR"ycM7g\@8xE4S|Iyy7~%W?7!JhrfdB^OQ"IDG!o+^6VY6<wNNPP2\?EY^j>i[p`L_sXq>#~nY>LO9rsAS+g5FBiqgUf{*vBUBqTpKF;/[&WIAPuS-&v3!Y'bMl{[:5sVL3om7'O4'(V#:\#VOO&<s}Yd|<P@jM%O5lHs^SYfaCDDwVcE8~cETL0YIEd@._PQ~w\fAT7Kiywq|+#]N">(A0bU-lDM#ETYa-h}ep<),
                                                  Jul 22, 2024 12:34:12.945137024 CEST1236INData Raw: c3 e9 0b b5 94 79 f6 cd ab db ef 95 d6 d1 32 bc 03 27 b0 a7 67 bb 67 5c 5f 47 4a 97 f1 f7 fc 80 a5 3d 5e cb d2 21 fd 16 4d f6 ed 94 f2 d0 41 ec b6 8d 9b cb af 44 4b 5e 3f 92 fc ae 08 db 64 a5 1d 86 78 29 a2 a9 c5 2d c1 7a 36 38 e0 81 84 1a 34 f5
                                                  Data Ascii: y2'gg\_GJ=^!MADK^?dx)-z684R|YSgynUf1qbEFO?'[a`bF\rsZL0q\vgrP:ZbPw^l^|Vov^'D0\mJh*I{X14
                                                  Jul 22, 2024 12:34:12.945189953 CEST1236INData Raw: e3 09 b7 93 e7 ef 55 87 a5 e2 4a 0e 55 3c 50 4f 28 65 ca 9a de 34 88 d5 59 ab cd 64 54 2a 94 93 b6 b8 c7 f1 34 a6 fe 9a 9e 58 e1 5b 68 04 08 88 1d 07 7a 22 8c f4 8b 1a 37 f4 2d 18 02 f7 c9 7a e3 8d 30 e6 e5 c6 72 4a b5 33 12 97 f2 9b 9f 3d 2b 49
                                                  Data Ascii: UJU<PO(e4YdT*4X[hz"7-z0rJ3=+I:QrVjeAU|0e r.-nFs%U@_G~W}E^ns]W6.Jg4)Kk~9"4{i#W}_&L'HNOp
                                                  Jul 22, 2024 12:34:12.945223093 CEST1236INData Raw: a2 40 45 ad 3e 10 cc d4 22 b8 18 aa b5 83 15 5b 5f 79 62 da f6 64 de 89 40 91 c6 e3 e6 3c 48 f6 f2 37 d0 b4 a2 87 ed 8b 72 11 f9 fa 1d 84 ca dd 63 7c e6 56 65 74 e8 c3 ce 0a 52 78 3d f5 2c 69 ad 82 46 5f 21 19 b5 ed d3 bf 7e 98 76 8d 6a 94 b7 ed
                                                  Data Ascii: @E>"[_ybd@<H7rc|VetRx=,iF_!~vj5s,yL/[g{QosVz%{A|PSeC)PYzSZ/]E?kINr|Pg!\2-;@&Lb<maS
                                                  Jul 22, 2024 12:34:12.945274115 CEST1236INData Raw: ef ec e3 a3 78 02 50 1e 6e 18 3a c8 ef 40 01 47 df 2f 67 75 81 ee e7 ed 5c 86 a7 cd ff 50 b9 61 08 00 fa a5 b9 0e 2f 50 8f 87 fd 80 44 ec bf 7d 28 a2 50 86 c4 d0 81 34 04 f9 9d 19 90 5d 6c c8 6f a3 82 62 5f 8a 77 97 ae e6 15 32 ec 5b 3c d5 d1 50
                                                  Data Ascii: xPn:@G/gu\Pa/PD}(P4]lob_w2[<Pz|<gzX],af!:$uMs)m74Tf8Q0Ee@>i~p#D'uma{4q-x.{W)x,0Fm'*wTn
                                                  Jul 22, 2024 12:34:12.945308924 CEST1236INData Raw: ea fe e8 9b 44 1e 62 80 9f 85 5d b4 ed 54 9a 62 26 5d f9 5f e9 66 31 79 1a ec 5d eb 3b 42 de 2a 12 2f 99 5a 51 ad 2c 4e fc b2 cd 25 8a df 0b d7 07 24 1e 16 60 15 f2 23 fe 84 ec 28 ca cb ea 25 a1 6f 30 22 39 cc 4f eb 80 ec b0 87 73 03 c9 e2 6f cb
                                                  Data Ascii: Db]Tb&]_f1y];B*/ZQ,N%$`#(%o0"9OsosUN^m9N)&8))QK}b9"@T~yu?V7j7y)vJ_EEW58X+:CP~T,{/s" a*=_lJ
                                                  Jul 22, 2024 12:34:12.945342064 CEST1236INData Raw: c6 ac fb 85 2b c7 a3 2f 2f d9 73 66 a6 d5 b3 dc bc 4c 89 64 2f f9 a1 b7 40 bf dd 84 b3 f4 0d 92 fa d2 49 45 fc 27 f8 14 9d 3f bd 02 3a c4 6a 3c 68 f4 ec 55 d8 20 1b ea 58 1f 15 63 0c 4e fc 76 39 e9 cc 71 40 69 5b b9 5b c5 4e 6d 50 82 e3 2b 3d 15
                                                  Data Ascii: +//sfLd/@IE'?:j<hU XcNv9q@i[[NmP+=127ZS$rHxh7[m15'1Z91 #%|^s\obPTPUO:$9pgLNTKqmc_xE]uUW\&6Ijo
                                                  Jul 22, 2024 12:34:12.945359945 CEST1236INData Raw: e7 41 3d ce 7d 33 4d 0f 6d da 2d 57 cd 6d 7c 72 20 41 5f e2 85 cb 48 2a 2c 1b 25 2d ea 0b 8c 30 58 68 ec 5b 67 54 17 0b 09 36 f0 a1 5f 55 d0 81 77 eb 76 58 90 be 59 9e ba 3f be 84 2b 42 29 6f 5c df c6 42 5f 49 8a 9f 97 26 07 55 9d da 50 6a e6 dc
                                                  Data Ascii: A=}3Mm-Wm|r A_H*,%-0Xh[gT6_UwvXY?+B)o\B_I&UPj?n,\_%N&gFx!7^"*w/:=\-?2$(<9#oPa7Z+iIU1B($k!XdI<#7s(,\~1~@SfHTn
                                                  Jul 22, 2024 12:34:12.945390940 CEST1236INData Raw: 20 19 6a 5f 78 89 c4 93 e5 38 5a 6e de 37 da e2 c6 06 b0 e8 f5 8e ec 2a 4d 52 53 7c c0 ce f1 b1 9d 84 d3 91 ba fc 29 13 39 6d 22 59 ca f4 90 ba 24 c3 b5 86 27 17 f3 8a b2 8c 0f d9 b9 6d 97 6d 9b 96 f5 eb e7 ae 0b 71 31 03 84 41 72 7d a7 8d f4 99
                                                  Data Ascii: j_x8Zn7*MRS|)9m"Y$'mmq1Ar}sWC@T^n2I%j+r|kpjq%<OjYSO)o+`qK18oLXG#F?sTds%>qWY2qf[n XR`
                                                  Jul 22, 2024 12:34:12.945409060 CEST1236INData Raw: d1 d2 9b 08 03 2c 5a d5 0d b5 24 ba 57 06 e9 82 13 06 b8 76 cd 11 85 df 30 60 c7 4a 68 fc 62 33 d3 a3 33 4a 36 3d a8 67 bb a3 56 33 7d 3d 9a 83 2c 2e ab 79 ba 0d fb 01 11 b8 6d 84 ce cd 88 2e 7d f5 4f 3e 3e d1 e4 3c 13 83 fa 27 77 82 c7 e2 d9 4b
                                                  Data Ascii: ,Z$Wv0`Jhb33J6=gV3}=,.ym.}O>><'wK\U}&El?<tl%}v%HSA*gH(vqd00Dan~Jlax_K9#+Rfl?uhLO{.FLRS
                                                  Jul 22, 2024 12:34:12.952837944 CEST1236INData Raw: 12 42 b8 dd e5 1f 9e 6b 33 d0 27 64 66 67 09 75 13 4e 4f e9 2f 56 c0 a1 26 a6 e7 0f 48 59 99 5e 9a 7b ee 13 0a e1 b2 7e 95 bf 06 41 45 43 c3 c5 43 45 37 b4 fd 4d f1 ee 9a 9c 98 53 15 42 01 8c fa ef a5 44 d0 97 33 99 81 2a 36 6b 2c 46 c1 0c 71 2f
                                                  Data Ascii: Bk3'dfguNO/V&HY^{~AECCE7MSBD3*6k,Fq/D:-E|OylOR-BS)2,o(P.Ibk@1F] 9X&;/<MZ5 `CLg`h*EH=|EZpoC/j{1,u;


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  8192.168.2.44977164.18.87.8280940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:13.554692984 CEST120OUTGET /Partner.svc/GetPartnerInfo?partner=FZ210427_wb HTTP/1.1
                                                  Host: wc-partners.lavasoft.com
                                                  Connection: Keep-Alive
                                                  Jul 22, 2024 12:34:14.057245970 CEST391INHTTP/1.1 200 OK
                                                  Server: nginx
                                                  Date: Mon, 22 Jul 2024 10:34:13 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Content-Length: 205
                                                  Connection: keep-alive
                                                  X-Powered-By: ASP.NET
                                                  Data Raw: 7b 22 47 65 74 50 61 72 74 6e 65 72 49 6e 66 6f 52 65 73 75 6c 74 22 3a 7b 22 43 4c 49 44 44 53 22 3a 31 30 30 30 38 37 31 2c 22 43 4c 49 44 48 50 22 3a 32 31 37 33 33 31 32 2c 22 43 54 49 44 22 3a 22 43 54 33 33 32 39 33 38 30 22 2c 22 44 65 66 61 75 6c 74 22 3a 74 72 75 65 2c 22 49 6e 73 74 61 6c 6c 44 61 74 65 55 74 63 22 3a 22 37 5c 2f 32 32 5c 2f 32 30 32 34 20 31 30 3a 33 34 3a 31 33 20 41 4d 22 2c 22 50 54 41 47 22 3a 22 41 30 33 31 45 44 39 34 32 36 37 33 46 34 38 36 34 42 39 46 22 2c 22 50 55 52 4c 22 3a 22 64 65 66 61 75 6c 74 22 2c 22 57 43 59 49 44 22 3a 22 57 43 59 49 44 31 30 30 30 30 22 7d 7d
                                                  Data Ascii: {"GetPartnerInfoResult":{"CLIDDS":1000871,"CLIDHP":2173312,"CTID":"CT3329380","Default":true,"InstallDateUtc":"7\/22\/2024 10:34:13 AM","PTAG":"A031ED942673F4864B9F","PURL":"default","WCYID":"WCYID10000"}}
                                                  Jul 22, 2024 12:34:14.064043999 CEST96OUTGET /Partner.svc/GetPartnerInfo?partner=FZ210427_ab HTTP/1.1
                                                  Host: wc-partners.lavasoft.com
                                                  Jul 22, 2024 12:34:14.177954912 CEST391INHTTP/1.1 200 OK
                                                  Server: nginx
                                                  Date: Mon, 22 Jul 2024 10:34:14 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Content-Length: 205
                                                  Connection: keep-alive
                                                  X-Powered-By: ASP.NET
                                                  Data Raw: 7b 22 47 65 74 50 61 72 74 6e 65 72 49 6e 66 6f 52 65 73 75 6c 74 22 3a 7b 22 43 4c 49 44 44 53 22 3a 31 30 30 30 38 37 31 2c 22 43 4c 49 44 48 50 22 3a 32 31 37 33 33 31 32 2c 22 43 54 49 44 22 3a 22 43 54 33 33 32 39 33 38 30 22 2c 22 44 65 66 61 75 6c 74 22 3a 74 72 75 65 2c 22 49 6e 73 74 61 6c 6c 44 61 74 65 55 74 63 22 3a 22 37 5c 2f 32 32 5c 2f 32 30 32 34 20 31 30 3a 33 34 3a 31 34 20 41 4d 22 2c 22 50 54 41 47 22 3a 22 41 30 33 31 45 44 39 34 32 36 37 33 46 34 38 36 34 42 39 46 22 2c 22 50 55 52 4c 22 3a 22 64 65 66 61 75 6c 74 22 2c 22 57 43 59 49 44 22 3a 22 57 43 59 49 44 31 30 30 30 30 22 7d 7d
                                                  Data Ascii: {"GetPartnerInfoResult":{"CLIDDS":1000871,"CLIDHP":2173312,"CTID":"CT3329380","Default":true,"InstallDateUtc":"7\/22\/2024 10:34:14 AM","PTAG":"A031ED942673F4864B9F","PURL":"default","WCYID":"WCYID10000"}}
                                                  Jul 22, 2024 12:34:14.178457975 CEST96OUTGET /Partner.svc/GetPartnerInfo?partner=FZ210427_ac HTTP/1.1
                                                  Host: wc-partners.lavasoft.com
                                                  Jul 22, 2024 12:34:14.295538902 CEST391INHTTP/1.1 200 OK
                                                  Server: nginx
                                                  Date: Mon, 22 Jul 2024 10:34:14 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Content-Length: 205
                                                  Connection: keep-alive
                                                  X-Powered-By: ASP.NET
                                                  Data Raw: 7b 22 47 65 74 50 61 72 74 6e 65 72 49 6e 66 6f 52 65 73 75 6c 74 22 3a 7b 22 43 4c 49 44 44 53 22 3a 31 30 30 30 38 37 31 2c 22 43 4c 49 44 48 50 22 3a 32 31 37 33 33 31 32 2c 22 43 54 49 44 22 3a 22 43 54 33 33 32 39 33 38 30 22 2c 22 44 65 66 61 75 6c 74 22 3a 74 72 75 65 2c 22 49 6e 73 74 61 6c 6c 44 61 74 65 55 74 63 22 3a 22 37 5c 2f 32 32 5c 2f 32 30 32 34 20 31 30 3a 33 34 3a 31 34 20 41 4d 22 2c 22 50 54 41 47 22 3a 22 41 30 33 31 45 44 39 34 32 36 37 33 46 34 38 36 34 42 39 46 22 2c 22 50 55 52 4c 22 3a 22 64 65 66 61 75 6c 74 22 2c 22 57 43 59 49 44 22 3a 22 57 43 59 49 44 31 30 30 30 30 22 7d 7d
                                                  Data Ascii: {"GetPartnerInfoResult":{"CLIDDS":1000871,"CLIDHP":2173312,"CTID":"CT3329380","Default":true,"InstallDateUtc":"7\/22\/2024 10:34:14 AM","PTAG":"A031ED942673F4864B9F","PURL":"default","WCYID":"WCYID10000"}}


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  9192.168.2.449772104.19.208.15280940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:13.715979099 CEST89OUTGET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Jul 22, 2024 12:34:14.174273968 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:14 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 17770
                                                  Connection: keep-alive
                                                  ETag: "770472110"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 384
                                                  Expires: Mon, 22 Jul 2024 14:34:14 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c6ee3aa40fa7-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 [TRUNCATED]
                                                  Data Ascii: PK:=AX7\0DrActiveFeatures.txt+@sjp#K1;/-[[ABexq)7 7:^gK !ibUVsO$v7|e\W'ZdveU*oR>%w$-;Q4Tf$+T$&Q?9#"6>0o@j(*i)H"B1`=&0I8CR"ycM7g\@8xE4S|Iyy7~%W?7!JhrfdB^OQ"IDG!o+^6VY6<wNNPP2\?EY^j>i[p`L_sXq>#~nY>LO9rsAS+g5FBiqgUf{*vBUBqTpKF;/[&WIAPuS-&v3!Y'bMl{[:5sVL3om7'O4'(V#:\#VOO&<s}Yd|<P@jM%O5lHs^SYfaCDDwVcE8~cETL0YIEd@._PQ~w\fAT7Kiywq|+#]N">(A0bU-lDM#ETYa-h}ep<),
                                                  Jul 22, 2024 12:34:14.174303055 CEST1236INData Raw: c3 e9 0b b5 94 79 f6 cd ab db ef 95 d6 d1 32 bc 03 27 b0 a7 67 bb 67 5c 5f 47 4a 97 f1 f7 fc 80 a5 3d 5e cb d2 21 fd 16 4d f6 ed 94 f2 d0 41 ec b6 8d 9b cb af 44 4b 5e 3f 92 fc ae 08 db 64 a5 1d 86 78 29 a2 a9 c5 2d c1 7a 36 38 e0 81 84 1a 34 f5
                                                  Data Ascii: y2'gg\_GJ=^!MADK^?dx)-z684R|YSgynUf1qbEFO?'[a`bF\rsZL0q\vgrP:ZbPw^l^|Vov^'D0\mJh*I{X14
                                                  Jul 22, 2024 12:34:14.174314976 CEST1236INData Raw: e3 09 b7 93 e7 ef 55 87 a5 e2 4a 0e 55 3c 50 4f 28 65 ca 9a de 34 88 d5 59 ab cd 64 54 2a 94 93 b6 b8 c7 f1 34 a6 fe 9a 9e 58 e1 5b 68 04 08 88 1d 07 7a 22 8c f4 8b 1a 37 f4 2d 18 02 f7 c9 7a e3 8d 30 e6 e5 c6 72 4a b5 33 12 97 f2 9b 9f 3d 2b 49
                                                  Data Ascii: UJU<PO(e4YdT*4X[hz"7-z0rJ3=+I:QrVjeAU|0e r.-nFs%U@_G~W}E^ns]W6.Jg4)Kk~9"4{i#W}_&L'HNOp
                                                  Jul 22, 2024 12:34:14.174326897 CEST1236INData Raw: a2 40 45 ad 3e 10 cc d4 22 b8 18 aa b5 83 15 5b 5f 79 62 da f6 64 de 89 40 91 c6 e3 e6 3c 48 f6 f2 37 d0 b4 a2 87 ed 8b 72 11 f9 fa 1d 84 ca dd 63 7c e6 56 65 74 e8 c3 ce 0a 52 78 3d f5 2c 69 ad 82 46 5f 21 19 b5 ed d3 bf 7e 98 76 8d 6a 94 b7 ed
                                                  Data Ascii: @E>"[_ybd@<H7rc|VetRx=,iF_!~vj5s,yL/[g{QosVz%{A|PSeC)PYzSZ/]E?kINr|Pg!\2-;@&Lb<maS
                                                  Jul 22, 2024 12:34:14.174339056 CEST1236INData Raw: ef ec e3 a3 78 02 50 1e 6e 18 3a c8 ef 40 01 47 df 2f 67 75 81 ee e7 ed 5c 86 a7 cd ff 50 b9 61 08 00 fa a5 b9 0e 2f 50 8f 87 fd 80 44 ec bf 7d 28 a2 50 86 c4 d0 81 34 04 f9 9d 19 90 5d 6c c8 6f a3 82 62 5f 8a 77 97 ae e6 15 32 ec 5b 3c d5 d1 50
                                                  Data Ascii: xPn:@G/gu\Pa/PD}(P4]lob_w2[<Pz|<gzX],af!:$uMs)m74Tf8Q0Ee@>i~p#D'uma{4q-x.{W)x,0Fm'*wTn
                                                  Jul 22, 2024 12:34:14.174350023 CEST1120INData Raw: ea fe e8 9b 44 1e 62 80 9f 85 5d b4 ed 54 9a 62 26 5d f9 5f e9 66 31 79 1a ec 5d eb 3b 42 de 2a 12 2f 99 5a 51 ad 2c 4e fc b2 cd 25 8a df 0b d7 07 24 1e 16 60 15 f2 23 fe 84 ec 28 ca cb ea 25 a1 6f 30 22 39 cc 4f eb 80 ec b0 87 73 03 c9 e2 6f cb
                                                  Data Ascii: Db]Tb&]_f1y];B*/ZQ,N%$`#(%o0"9OsosUN^m9N)&8))QK}b9"@T~yu?V7j7y)vJ_EEW58X+:CP~T,{/s" a*=_lJ
                                                  Jul 22, 2024 12:34:14.174362898 CEST1236INData Raw: 2f cf 68 1d 39 85 f4 e4 07 46 72 78 75 75 d2 cb 04 48 3f 6c d1 2a 40 d6 12 13 d2 5d 70 a5 40 36 d4 2b 04 e5 5d 94 ab d5 dc 0d 0c 1d a7 16 8c b3 61 ff 48 aa 28 42 89 d3 8d 07 b3 4b 9c 4d 9c 08 ad 31 33 66 c0 64 38 c2 34 af d9 db 1f 71 ad 5a 2f 14
                                                  Data Ascii: /h9FrxuuH?l*@]p@6+]aH(BKM13fd84qZ/<SYsb#&&xB+//sfLd/@IE'?:j<hU XcNv9q@i[[NmP+=127ZS$rHxh7[m15'
                                                  Jul 22, 2024 12:34:14.174379110 CEST1236INData Raw: b4 f1 0c ad 92 9f 06 d4 93 14 51 8d 3e db 45 e9 f7 89 d8 98 c6 99 51 3d 6d d6 35 c2 83 bc a8 76 69 e9 01 9a 6a 89 d9 d1 1c be 3a 4c 24 9d 83 9c 0d 14 c1 3c 09 60 d3 28 f7 db d3 d2 07 e3 22 19 5e 98 ef ec 2c a1 1b 39 83 48 6e 0d b7 7a bb 46 83 f3
                                                  Data Ascii: Q>EQ=m5vij:L$<`("^,9HnzF*Ci":<DKa@ife(A=}3Mm-Wm|r A_H*,%-0Xh[gT6_UwvXY?+B)o\B_I&UPj?n,\_%N&gFx!7^"*w/
                                                  Jul 22, 2024 12:34:14.174391031 CEST1236INData Raw: 72 1e a8 a1 9e 93 3f fa f1 61 84 c8 0a 61 ed 5f db c2 55 ca 02 49 63 ab 41 0c cd b1 f0 dc f6 16 85 94 79 d1 3b b2 28 17 69 40 2f 88 db e2 13 f9 8a b9 ad 95 ef 00 30 1f 5c db f1 fe 55 3c 0a ee 24 55 d8 40 90 c3 e1 72 a4 2d 34 f4 e0 f6 19 be a7 85
                                                  Data Ascii: r?aa_UIcAy;(i@/0\U<$U@r-43y15A-fS!7 j_x8Zn7*MRS|)9m"Y$'mmq1Ar}sWC@T^n2I%j+r|kpjq%
                                                  Jul 22, 2024 12:34:14.174451113 CEST1236INData Raw: a8 f8 45 73 b2 03 b5 6f c0 c6 6e b2 0b 85 13 74 f6 12 69 3c 09 02 83 18 59 c2 af af a3 9a d0 63 39 fe ef 55 4e 27 54 9a 85 41 85 7a 53 ef b7 5b cc cc d3 fb 1a b6 9e 39 f3 39 3b 91 9b 83 b3 bf 3a 40 bd e0 12 79 1e c9 dd f6 81 c4 d1 ac f2 58 32 c3
                                                  Data Ascii: Esonti<Yc9UN'TAzS[99;:@yX2aHVC0(%'6k^"p,Z$Wv0`Jhb33J6=gV3}=,.ym.}O>><'wK\U}&El?<t
                                                  Jul 22, 2024 12:34:14.179399967 CEST1236INData Raw: 48 71 ff 5c c2 3d ff f3 bd 2a 2c f9 c3 4c 48 fd d8 e0 2b 7c c5 34 b4 b8 da 2c 05 6e 4b 22 3b 2e d0 b7 d0 40 7e 07 df b3 e2 4d 1c 2c 28 06 79 fc 19 66 59 f9 47 4f a8 38 7e fd 14 d7 23 80 c7 d6 9e 17 38 01 6b d0 a7 25 27 0e fd 88 df b9 72 d2 ce dc
                                                  Data Ascii: Hq\=*,LH+|4,nK";.@~M,(yfYGO8~#8k%'r$UGDB_s/Z#GrBk3'dfguNO/V&HY^{~AECCE7MSBD3*6k,Fq/D:-E|OylOR-BS)2,


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  10192.168.2.449773104.19.208.15280940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:13.824152946 CEST105OUTGET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Jul 22, 2024 12:34:14.300221920 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:14 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 9891
                                                  Connection: keep-alive
                                                  ETag: "3914547665"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 81
                                                  Expires: Mon, 22 Jul 2024 14:34:14 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c6eefffe43c8-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d [TRUNCATED]
                                                  Data Ascii: PKIX6%FeatureActions.txtBPZ&KE9(0p<a}9g<D)9k@4y'!=~Zk`1J2[)_,{FF?q;fL*=1ZI->m%>`ml,sWITPu*;Pxxhgl$M]I}ogZL5?BZLxukU1P4mW-Ntf?I-/!w90/^%X-.0(mVPn]=cr_A$<BWye2bK{jOdxZv@[NLDU|_1Sp~Paq>})$qH7,hm)Ias<TWu$?Ey@Xu@5*UJLja0v^Q (O}k+fwvfzbhFE<plLWZI*.4#,X`=beVW)W*;Q,'x>Jq _T<ea&wo/RM2`rXFEc:A97A4FT0@wuJIBd5Bhw}oE@N=Z$)6@sXru%eIg5ruA:81&"e_'Be
                                                  Jul 22, 2024 12:34:14.300256968 CEST1236INData Raw: 27 91 1f 4b c3 11 60 77 a1 43 f9 f7 10 07 63 36 80 1a 86 ad 48 a7 d3 8f 6f 01 ae 9e 9c 3f a2 79 6e 3b 81 f2 7e 33 72 dc 17 7b 3c b2 f2 80 9b 26 a0 a9 76 69 9d e2 6e 9e 4d 47 96 36 9b c5 b5 27 68 b5 b4 84 34 1c 56 23 a3 50 e1 9f 24 02 89 9a 6e b0
                                                  Data Ascii: 'K`wCc6Ho?yn;~3r{<&vinMG6'h4V#P$n/Kt'<4oOa"xGTVBfE<eG#Bw{#@mc]os}uE6@e`^](9A,NjbNYnOF\8p"CLFk
                                                  Jul 22, 2024 12:34:14.300292015 CEST1236INData Raw: ac 50 d8 52 44 ee 8b 8f d4 d8 b2 84 d1 cb d6 f7 f8 05 a5 aa 41 48 05 36 3c 93 56 87 e3 e6 2f 47 40 72 47 91 28 bd 1e de c7 43 06 15 aa c9 07 7f 4b 86 10 6b 1f 41 44 6f 91 db 30 a2 f9 46 11 1a 4b 58 16 a1 31 d1 5e b4 59 ca fc 47 fc bc 25 05 70 a5
                                                  Data Ascii: PRDAH6<V/G@rG(CKkADo0FKX1^YG%p8P*rH|idu{"PBv`DWG&O*rD:V4#{>51Zy4U-&SSIgFkZpYN~L-6Fed~ex>3
                                                  Jul 22, 2024 12:34:14.300410032 CEST1236INData Raw: a8 b4 43 f7 18 27 39 99 b5 09 5b b0 21 e4 89 cd dc d8 80 8f ba 2c 76 5f 49 78 e0 a0 e6 a4 e8 61 8a 0a 7d 07 ae 7f 5b db 69 5b ab 4d 22 92 db 0e dc 5e ef db 36 83 5e 63 58 81 45 75 40 0c 8a 74 59 c3 e4 31 78 2a c9 f9 39 82 db c7 d7 e1 67 09 f5 da
                                                  Data Ascii: C'9[!,v_Ixa}[i[M"^6^cXEu@tY1x*9g&LIY+5kR@v<a.{G`#|<rPgAn><AhcF1NG_d~JFS}=l-z%Q\)Zm?)^afu
                                                  Jul 22, 2024 12:34:14.300442934 CEST1236INData Raw: a2 95 4e ba 4b 5c 16 c5 a5 51 be 5a 39 45 dd 17 61 63 b5 65 bb 34 9f 6d 7c 76 0b e7 cf 8a 28 b1 32 a3 4c 94 f3 9c 2d 3a d8 05 c3 70 d8 b9 9e ea 5e e2 8b aa 76 16 1e 66 9d 5b 09 8d b4 bd 0c df a4 f1 57 38 11 41 42 5a 8f 27 30 7a 45 dd 2c af 7e 69
                                                  Data Ascii: NK\QZ9Eace4m|v(2L-:p^vf[W8ABZ'0zE,~iY~^UiH-E`79_ue_f!t,f-X9^y0jgsotF8rUFX3\"T5p3WJBORFv
                                                  Jul 22, 2024 12:34:14.300477028 CEST1236INData Raw: 53 b8 3f 1e d4 8d 8b fb 22 dd 51 13 da db 37 c1 6d 8a c5 7d 9b 47 42 3f 8e c9 f0 52 59 f2 14 2a 9e 75 2e 6a 2e 7b 93 ce 8d 7f 03 7e d5 5c fc 25 45 10 44 72 a8 87 1c d2 e8 6e 79 f4 3a 12 2f 87 97 f4 7d 88 08 2a 70 f8 25 43 fc 4b 2d f3 25 a3 5d 46
                                                  Data Ascii: S?"Q7m}GB?RY*u.j.{~\%EDrny:/}*p%CK-%]F?TSkSG-^Bgv[1K+k9v&plE0P8t}BnUJXhBDBlfbG7Fsq3BI{?3>n
                                                  Jul 22, 2024 12:34:14.300530910 CEST1236INData Raw: 44 c0 9d 35 87 31 5c f2 45 f9 c7 ef 27 c4 f0 44 cb 1d 0f 1c d1 37 2a fd 7f 20 4f 38 65 99 02 a1 9a ea fd 15 94 74 5c 15 e4 8a 30 a5 11 66 30 df 52 31 9c c6 28 24 8c 3e 6f 18 50 ce cd 5b 40 65 9a 59 06 f5 bf 1e 38 1f 30 99 1f 31 4f 2a 69 da 0b 94
                                                  Data Ascii: D51\E'D7* O8et\0f0R1($>oP[@eY801O*iT2@#l0*z<F4a/dUF5iAzDScUSK:;{qQ.29h}w$/SZ24d2%h@"IT*w;W<-f.7p=ei ^C\aP`RyHaC!
                                                  Jul 22, 2024 12:34:14.300746918 CEST1236INData Raw: ba ca 62 79 64 b1 96 fc a3 e4 33 18 bf f2 b3 53 33 28 3d 94 63 da fc df 9a ab 61 96 4f fd 8f 75 23 dd b5 d3 bd b5 31 ab e5 e1 6d de 8b 88 11 1d 05 ed 75 9d 2f 58 00 23 9c b7 5e 9c be d2 46 a0 2b 67 71 a6 f8 75 c0 5f 80 c9 c6 7f 3b c9 9d 1b 53 08
                                                  Data Ascii: byd3S3(=caOu#1mu/X#^F+gqu_;Sv_HO=[Ipy`9|;!&uEv@~q+"`T].@ON/,V]Bn`;LGQNL0j*\x8j8cpo;Y|1x[
                                                  Jul 22, 2024 12:34:14.300894022 CEST383INData Raw: b8 35 15 54 a9 22 01 ba 8d 73 41 22 2d 5f 1c e5 c1 6a 64 1c 3a 02 da 84 ef c5 74 bd 9f 23 d9 32 44 34 28 27 d7 07 95 69 6b 95 3f 18 37 32 d0 a9 81 eb a5 e0 47 f9 bd 0e ce d3 e3 4e d2 40 77 fe 00 a1 df bb a6 9f 2e ba ee eb a2 f0 8c 0d bc fe f1 95
                                                  Data Ascii: 5T"sA"-_jd:t#2D4('ik?72GN@w.o[C4PcJ3 [mrE&r8U,%,uzs(q7r%Hr1]>D!M#C7xJW/5oZ~Wr4gB6SE^C8LT_4'8rC&:<uMz#


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  11192.168.2.449775104.19.208.15280940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:14.525501013 CEST89OUTGET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Jul 22, 2024 12:34:14.993526936 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:14 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 17770
                                                  Connection: keep-alive
                                                  ETag: "770472110"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 384
                                                  Expires: Mon, 22 Jul 2024 14:34:14 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c6f358d272c2-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 [TRUNCATED]
                                                  Data Ascii: PK:=AX7\0DrActiveFeatures.txt+@sjp#K1;/-[[ABexq)7 7:^gK !ibUVsO$v7|e\W'ZdveU*oR>%w$-;Q4Tf$+T$&Q?9#"6>0o@j(*i)H"B1`=&0I8CR"ycM7g\@8xE4S|Iyy7~%W?7!JhrfdB^OQ"IDG!o+^6VY6<wNNPP2\?EY^j>i[p`L_sXq>#~nY>LO9rsAS+g5FBiqgUf{*vBUBqTpKF;/[&WIAPuS-&v3!Y'bMl{[:5sVL3om7'O4'(V#:\#VOO&<s}Yd|<P@jM%O5lHs^SYfaCDDwVcE8~cETL0YIEd@._PQ~w\fAT7Kiywq|+#]N">(A0bU-lDM#ETYa-h}ep<),
                                                  Jul 22, 2024 12:34:14.993554115 CEST1236INData Raw: c3 e9 0b b5 94 79 f6 cd ab db ef 95 d6 d1 32 bc 03 27 b0 a7 67 bb 67 5c 5f 47 4a 97 f1 f7 fc 80 a5 3d 5e cb d2 21 fd 16 4d f6 ed 94 f2 d0 41 ec b6 8d 9b cb af 44 4b 5e 3f 92 fc ae 08 db 64 a5 1d 86 78 29 a2 a9 c5 2d c1 7a 36 38 e0 81 84 1a 34 f5
                                                  Data Ascii: y2'gg\_GJ=^!MADK^?dx)-z684R|YSgynUf1qbEFO?'[a`bF\rsZL0q\vgrP:ZbPw^l^|Vov^'D0\mJh*I{X14
                                                  Jul 22, 2024 12:34:14.993566990 CEST1236INData Raw: e3 09 b7 93 e7 ef 55 87 a5 e2 4a 0e 55 3c 50 4f 28 65 ca 9a de 34 88 d5 59 ab cd 64 54 2a 94 93 b6 b8 c7 f1 34 a6 fe 9a 9e 58 e1 5b 68 04 08 88 1d 07 7a 22 8c f4 8b 1a 37 f4 2d 18 02 f7 c9 7a e3 8d 30 e6 e5 c6 72 4a b5 33 12 97 f2 9b 9f 3d 2b 49
                                                  Data Ascii: UJU<PO(e4YdT*4X[hz"7-z0rJ3=+I:QrVjeAU|0e r.-nFs%U@_G~W}E^ns]W6.Jg4)Kk~9"4{i#W}_&L'HNOp
                                                  Jul 22, 2024 12:34:14.993577957 CEST1236INData Raw: a2 40 45 ad 3e 10 cc d4 22 b8 18 aa b5 83 15 5b 5f 79 62 da f6 64 de 89 40 91 c6 e3 e6 3c 48 f6 f2 37 d0 b4 a2 87 ed 8b 72 11 f9 fa 1d 84 ca dd 63 7c e6 56 65 74 e8 c3 ce 0a 52 78 3d f5 2c 69 ad 82 46 5f 21 19 b5 ed d3 bf 7e 98 76 8d 6a 94 b7 ed
                                                  Data Ascii: @E>"[_ybd@<H7rc|VetRx=,iF_!~vj5s,yL/[g{QosVz%{A|PSeC)PYzSZ/]E?kINr|Pg!\2-;@&Lb<maS
                                                  Jul 22, 2024 12:34:14.993591070 CEST1236INData Raw: ef ec e3 a3 78 02 50 1e 6e 18 3a c8 ef 40 01 47 df 2f 67 75 81 ee e7 ed 5c 86 a7 cd ff 50 b9 61 08 00 fa a5 b9 0e 2f 50 8f 87 fd 80 44 ec bf 7d 28 a2 50 86 c4 d0 81 34 04 f9 9d 19 90 5d 6c c8 6f a3 82 62 5f 8a 77 97 ae e6 15 32 ec 5b 3c d5 d1 50
                                                  Data Ascii: xPn:@G/gu\Pa/PD}(P4]lob_w2[<Pz|<gzX],af!:$uMs)m74Tf8Q0Ee@>i~p#D'uma{4q-x.{W)x,0Fm'*wTn
                                                  Jul 22, 2024 12:34:14.993601084 CEST1236INData Raw: ea fe e8 9b 44 1e 62 80 9f 85 5d b4 ed 54 9a 62 26 5d f9 5f e9 66 31 79 1a ec 5d eb 3b 42 de 2a 12 2f 99 5a 51 ad 2c 4e fc b2 cd 25 8a df 0b d7 07 24 1e 16 60 15 f2 23 fe 84 ec 28 ca cb ea 25 a1 6f 30 22 39 cc 4f eb 80 ec b0 87 73 03 c9 e2 6f cb
                                                  Data Ascii: Db]Tb&]_f1y];B*/ZQ,N%$`#(%o0"9OsosUN^m9N)&8))QK}b9"@T~yu?V7j7y)vJ_EEW58X+:CP~T,{/s" a*=_lJ
                                                  Jul 22, 2024 12:34:14.993613005 CEST1236INData Raw: c6 ac fb 85 2b c7 a3 2f 2f d9 73 66 a6 d5 b3 dc bc 4c 89 64 2f f9 a1 b7 40 bf dd 84 b3 f4 0d 92 fa d2 49 45 fc 27 f8 14 9d 3f bd 02 3a c4 6a 3c 68 f4 ec 55 d8 20 1b ea 58 1f 15 63 0c 4e fc 76 39 e9 cc 71 40 69 5b b9 5b c5 4e 6d 50 82 e3 2b 3d 15
                                                  Data Ascii: +//sfLd/@IE'?:j<hU XcNv9q@i[[NmP+=127ZS$rHxh7[m15'1Z91 #%|^s\obPTPUO:$9pgLNTKqmc_xE]uUW\&6Ijo
                                                  Jul 22, 2024 12:34:14.993623018 CEST1236INData Raw: e7 41 3d ce 7d 33 4d 0f 6d da 2d 57 cd 6d 7c 72 20 41 5f e2 85 cb 48 2a 2c 1b 25 2d ea 0b 8c 30 58 68 ec 5b 67 54 17 0b 09 36 f0 a1 5f 55 d0 81 77 eb 76 58 90 be 59 9e ba 3f be 84 2b 42 29 6f 5c df c6 42 5f 49 8a 9f 97 26 07 55 9d da 50 6a e6 dc
                                                  Data Ascii: A=}3Mm-Wm|r A_H*,%-0Xh[gT6_UwvXY?+B)o\B_I&UPj?n,\_%N&gFx!7^"*w/:=\-?2$(<9#oPa7Z+iIU1B($k!XdI<#7s(,\~1~@SfHTn
                                                  Jul 22, 2024 12:34:14.993634939 CEST1236INData Raw: 20 19 6a 5f 78 89 c4 93 e5 38 5a 6e de 37 da e2 c6 06 b0 e8 f5 8e ec 2a 4d 52 53 7c c0 ce f1 b1 9d 84 d3 91 ba fc 29 13 39 6d 22 59 ca f4 90 ba 24 c3 b5 86 27 17 f3 8a b2 8c 0f d9 b9 6d 97 6d 9b 96 f5 eb e7 ae 0b 71 31 03 84 41 72 7d a7 8d f4 99
                                                  Data Ascii: j_x8Zn7*MRS|)9m"Y$'mmq1Ar}sWC@T^n2I%j+r|kpjq%<OjYSO)o+`qK18oLXG#F?sTds%>qWY2qf[n XR`
                                                  Jul 22, 2024 12:34:14.993648052 CEST1236INData Raw: d1 d2 9b 08 03 2c 5a d5 0d b5 24 ba 57 06 e9 82 13 06 b8 76 cd 11 85 df 30 60 c7 4a 68 fc 62 33 d3 a3 33 4a 36 3d a8 67 bb a3 56 33 7d 3d 9a 83 2c 2e ab 79 ba 0d fb 01 11 b8 6d 84 ce cd 88 2e 7d f5 4f 3e 3e d1 e4 3c 13 83 fa 27 77 82 c7 e2 d9 4b
                                                  Data Ascii: ,Z$Wv0`Jhb33J6=gV3}=,.ym.}O>><'wK\U}&El?<tl%}v%HSA*gH(vqd00Dan~Jlax_K9#+Rfl?uhLO{.FLRS
                                                  Jul 22, 2024 12:34:14.998599052 CEST1236INData Raw: 12 42 b8 dd e5 1f 9e 6b 33 d0 27 64 66 67 09 75 13 4e 4f e9 2f 56 c0 a1 26 a6 e7 0f 48 59 99 5e 9a 7b ee 13 0a e1 b2 7e 95 bf 06 41 45 43 c3 c5 43 45 37 b4 fd 4d f1 ee 9a 9c 98 53 15 42 01 8c fa ef a5 44 d0 97 33 99 81 2a 36 6b 2c 46 c1 0c 71 2f
                                                  Data Ascii: Bk3'dfguNO/V&HY^{~AECCE7MSBD3*6k,Fq/D:-E|OylOR-BS)2,o(P.Ibk@1F] 9X&;/<MZ5 `CLg`h*EH=|EZpoC/j{1,u;


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  12192.168.2.449777104.19.208.15280940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:15.071358919 CEST105OUTGET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Jul 22, 2024 12:34:15.557657003 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:15 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 9891
                                                  Connection: keep-alive
                                                  ETag: "3914547665"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 82
                                                  Expires: Mon, 22 Jul 2024 14:34:15 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c6f6d88c4219-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d [TRUNCATED]
                                                  Data Ascii: PKIX6%FeatureActions.txtBPZ&KE9(0p<a}9g<D)9k@4y'!=~Zk`1J2[)_,{FF?q;fL*=1ZI->m%>`ml,sWITPu*;Pxxhgl$M]I}ogZL5?BZLxukU1P4mW-Ntf?I-/!w90/^%X-.0(mVPn]=cr_A$<BWye2bK{jOdxZv@[NLDU|_1Sp~Paq>})$qH7,hm)Ias<TWu$?Ey@Xu@5*UJLja0v^Q (O}k+fwvfzbhFE<plLWZI*.4#,X`=beVW)W*;Q,'x>Jq _T<ea&wo/RM2`rXFEc:A97A4FT0@wuJIBd5Bhw}oE@N=Z$)6@sXru%eIg5ruA:81&"e_'Be
                                                  Jul 22, 2024 12:34:15.557712078 CEST224INData Raw: 27 91 1f 4b c3 11 60 77 a1 43 f9 f7 10 07 63 36 80 1a 86 ad 48 a7 d3 8f 6f 01 ae 9e 9c 3f a2 79 6e 3b 81 f2 7e 33 72 dc 17 7b 3c b2 f2 80 9b 26 a0 a9 76 69 9d e2 6e 9e 4d 47 96 36 9b c5 b5 27 68 b5 b4 84 34 1c 56 23 a3 50 e1 9f 24 02 89 9a 6e b0
                                                  Data Ascii: 'K`wCc6Ho?yn;~3r{<&vinMG6'h4V#P$n/Kt'<4oOa"xGTVBfE<eG#Bw{#@mc]os}uE6@e`^](9A,NjbNYnOF
                                                  Jul 22, 2024 12:34:15.557724953 CEST1236INData Raw: 5c fb af 91 38 c0 70 fa 22 c9 e3 87 43 4c c7 46 87 6b 8a af 86 ca e5 38 84 51 e2 31 67 c1 63 b9 d7 47 9f 37 4f 2d 71 fd 69 57 47 d4 dc 26 8a 76 f3 93 e9 a6 7a 0e fb 36 64 28 35 ec 55 52 8c dc eb 55 ce 6e 46 75 24 4b 11 8f 9f 87 f7 53 d0 a7 ec e1
                                                  Data Ascii: \8p"CLFk8Q1gcG7O-qiWG&vz6d(5URUnFu$KS08Y8D CO^;Ag"B^%/M13%)fC0$vDoC(sr\ae!bm[4?d11DAPs-m]_/qb*bO8zZIPy5w
                                                  Jul 22, 2024 12:34:15.557779074 CEST1236INData Raw: 2d 36 46 65 93 ba 93 64 db 09 87 7e 65 78 e4 dc 3e 33 1f b1 dd 66 48 cc 13 93 85 c9 ef bd 59 3c 20 70 0c 0b cf 02 66 b8 56 3e 43 d8 5c 2a c4 7c bb 8e e2 35 e6 c7 ba 8e 6b 14 2c 73 38 6b 98 97 16 6c 2e 7c 78 82 9b 23 2c a9 f4 bf 83 30 91 68 4a 89
                                                  Data Ascii: -6Fed~ex>3fHY< pfV>C\*|5k,s8kl.|x#,0hJc^Tz|:,1Y| BUH`@2GBFz2xwP`/g}[%IuXG9(&q#&;2+.[FtxO=tWsF
                                                  Jul 22, 2024 12:34:15.557795048 CEST1236INData Raw: 29 5e ad 61 d9 d6 14 eb 66 fb 03 02 ac 75 86 07 1d f5 a5 bd e4 b3 0f 0f a6 93 7a f7 70 c7 19 35 81 53 89 6a 4b cd 9c 15 52 78 01 66 6c c6 ce 5d f9 49 cc e2 8b 10 1f 26 e8 18 85 14 d6 67 04 ab 7f 00 94 71 7c 1c 67 c5 b5 6e 26 36 fc 3c ec 82 c3 99
                                                  Data Ascii: )^afuzp5SjKRxfl]I&gq|gn&6<%<$3<3Mb_-H}3XH7~GV^f%B5\~unuF_+.8U<$gd2`-d=CWiHoQeA,_D
                                                  Jul 22, 2024 12:34:15.557811022 CEST1236INData Raw: 4f 88 f3 92 8c 01 0d 52 d3 46 80 91 04 76 c4 15 bd d0 ed c2 d7 2d 51 8d 74 1f 7e c5 35 9c 7d 9f 86 4d de 32 65 21 76 54 ef 35 1f 1c d2 cf c3 84 95 98 de 7a 90 92 34 bc 0a 6f 5d 9f f9 c8 74 ea 46 b3 4d 92 e6 0f 72 f2 4e f6 f0 50 20 2b a8 5a 48 c8
                                                  Data Ascii: ORFv-Qt~5}M2e!vT5z4o]tFMrNP +ZHZKjD[%m4p@g:XCRcu~t<3/57e.A.<3`jP:R]BR7P'xtatn'nCasex^X@"k:L`
                                                  Jul 22, 2024 12:34:15.557845116 CEST1236INData Raw: f8 e9 ba e3 97 ff 9e d9 df f1 42 49 7b 3f 33 3e 6e 9f d9 53 de 65 73 ef c9 35 4e bf f0 5b 41 43 95 76 2b 53 c8 ab 74 39 dc 5e 4c 3b b4 77 03 73 13 55 c4 86 2c f6 c6 af 64 eb 4b 9d 68 e0 b3 2a 0e 69 17 9c ed 38 31 56 48 05 d5 1d e3 f2 8e b0 7d 7c
                                                  Data Ascii: BI{?3>nSes5N[ACv+St9^L;wsU,dKh*i81VH}|>s"x=b-rBl`'0]L"{+.C]vCyCYdWw(JuOpfWvTiuvLD"E#k0Y_W+hp;f}J
                                                  Jul 22, 2024 12:34:15.557862043 CEST1236INData Raw: dc be 50 92 09 e4 d6 c8 15 60 52 79 48 61 d3 d8 43 21 11 a0 dc e1 35 d2 35 a6 54 9c 19 22 0a 30 b2 e1 91 a7 bc 9e 22 a6 8b d1 7e 10 15 ea 2d 11 bb 3a 56 ed a0 3c df ae a6 db 24 c4 2f 88 c2 87 b5 43 8a 1a 50 d4 08 7e 02 3e ff 5d 4d 68 e9 97 de 4c
                                                  Data Ascii: P`RyHaC!55T"0"~-:V<$/CP~>]MhLkQbm5-4MGM,0V6 I)nSr8i?2TUVucdgd2h{@t)am_xt6.748uX}:Xd
                                                  Jul 22, 2024 12:34:15.557876110 CEST1236INData Raw: 63 ee 70 6f 0b 89 3b 9f a1 ca cc 1e 59 7c 31 78 a2 5b f9 9b bb f0 7b 28 85 19 23 d1 5c d7 71 36 5c 97 fb 87 e6 cc 83 4f 5a 6b c8 11 01 85 88 c4 7b 3e 88 1d 24 b5 c7 12 41 a2 3b ea 10 41 1f 02 da 12 80 75 fc 65 da 5d 11 e4 cf 15 ea 56 d2 49 05 cf
                                                  Data Ascii: cpo;Y|1x[{(#\q6\OZk{>$A;Aue]VI3j3log)|f| U!qYtq/+08i`0z]Mb;zoKIA3\nk^xuLzgD8oi&k_#$!.h/)3!75F413^'
                                                  Jul 22, 2024 12:34:15.557889938 CEST159INData Raw: db 0b ff fc 38 dd 8d 72 89 43 26 3a 85 8c 3c 75 4d 7a 23 19 3a 13 5f 47 6d de 62 d7 14 67 0e 08 e6 e2 ee 49 81 50 4b 01 02 3f 00 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 24 00 00 00 00 00 00 00 20 00 08 00 00 00 00
                                                  Data Ascii: 8rC&:<uMz#:_GmbgIPK?IX6%$ FeatureActions.txt p8PKd)&


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  13192.168.2.449780104.19.208.15280940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:15.470751047 CEST89OUTGET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Jul 22, 2024 12:34:15.949115992 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:15 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 17770
                                                  Connection: keep-alive
                                                  ETag: "770472110"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 385
                                                  Expires: Mon, 22 Jul 2024 14:34:15 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c6f94e584381-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 [TRUNCATED]
                                                  Data Ascii: PK:=AX7\0DrActiveFeatures.txt+@sjp#K1;/-[[ABexq)7 7:^gK !ibUVsO$v7|e\W'ZdveU*oR>%w$-;Q4Tf$+T$&Q?9#"6>0o@j(*i)H"B1`=&0I8CR"ycM7g\@8xE4S|Iyy7~%W?7!JhrfdB^OQ"IDG!o+^6VY6<wNNPP2\?EY^j>i[p`L_sXq>#~nY>LO9rsAS+g5FBiqgUf{*vBUBqTpKF;/[&WIAPuS-&v3!Y'bMl{[:5sVL3om7'O4'(V#:\#VOO&<s}Yd|<P@jM%O5lHs^SYfaCDDwVcE8~cETL0YIEd@._PQ~w\fAT7Kiywq|+#]N">(A0bU-lDM#ETYa-h}ep<),
                                                  Jul 22, 2024 12:34:15.949152946 CEST1236INData Raw: c3 e9 0b b5 94 79 f6 cd ab db ef 95 d6 d1 32 bc 03 27 b0 a7 67 bb 67 5c 5f 47 4a 97 f1 f7 fc 80 a5 3d 5e cb d2 21 fd 16 4d f6 ed 94 f2 d0 41 ec b6 8d 9b cb af 44 4b 5e 3f 92 fc ae 08 db 64 a5 1d 86 78 29 a2 a9 c5 2d c1 7a 36 38 e0 81 84 1a 34 f5
                                                  Data Ascii: y2'gg\_GJ=^!MADK^?dx)-z684R|YSgynUf1qbEFO?'[a`bF\rsZL0q\vgrP:ZbPw^l^|Vov^'D0\mJh*I{X14
                                                  Jul 22, 2024 12:34:15.949168921 CEST1236INData Raw: e3 09 b7 93 e7 ef 55 87 a5 e2 4a 0e 55 3c 50 4f 28 65 ca 9a de 34 88 d5 59 ab cd 64 54 2a 94 93 b6 b8 c7 f1 34 a6 fe 9a 9e 58 e1 5b 68 04 08 88 1d 07 7a 22 8c f4 8b 1a 37 f4 2d 18 02 f7 c9 7a e3 8d 30 e6 e5 c6 72 4a b5 33 12 97 f2 9b 9f 3d 2b 49
                                                  Data Ascii: UJU<PO(e4YdT*4X[hz"7-z0rJ3=+I:QrVjeAU|0e r.-nFs%U@_G~W}E^ns]W6.Jg4)Kk~9"4{i#W}_&L'HNOp
                                                  Jul 22, 2024 12:34:15.949187994 CEST1236INData Raw: a2 40 45 ad 3e 10 cc d4 22 b8 18 aa b5 83 15 5b 5f 79 62 da f6 64 de 89 40 91 c6 e3 e6 3c 48 f6 f2 37 d0 b4 a2 87 ed 8b 72 11 f9 fa 1d 84 ca dd 63 7c e6 56 65 74 e8 c3 ce 0a 52 78 3d f5 2c 69 ad 82 46 5f 21 19 b5 ed d3 bf 7e 98 76 8d 6a 94 b7 ed
                                                  Data Ascii: @E>"[_ybd@<H7rc|VetRx=,iF_!~vj5s,yL/[g{QosVz%{A|PSeC)PYzSZ/]E?kINr|Pg!\2-;@&Lb<maS
                                                  Jul 22, 2024 12:34:15.949222088 CEST896INData Raw: ef ec e3 a3 78 02 50 1e 6e 18 3a c8 ef 40 01 47 df 2f 67 75 81 ee e7 ed 5c 86 a7 cd ff 50 b9 61 08 00 fa a5 b9 0e 2f 50 8f 87 fd 80 44 ec bf 7d 28 a2 50 86 c4 d0 81 34 04 f9 9d 19 90 5d 6c c8 6f a3 82 62 5f 8a 77 97 ae e6 15 32 ec 5b 3c d5 d1 50
                                                  Data Ascii: xPn:@G/gu\Pa/PD}(P4]lob_w2[<Pz|<gzX],af!:$uMs)m74Tf8Q0Ee@>i~p#D'uma{4q-x.{W)x,0Fm'*wTn
                                                  Jul 22, 2024 12:34:15.949237108 CEST1236INData Raw: 34 7a 37 eb 41 78 0e 69 ee 11 1c f5 8d 29 8d ef b3 38 72 f5 f7 cc fb 36 a3 c2 33 d4 82 c1 58 75 70 0c 5f 55 99 f6 e2 74 8f d1 5e 0b e5 76 62 a3 7a f8 a5 65 a6 ea 05 07 b9 eb 1e 5f bd 75 b6 c2 cc 94 6a a2 22 b3 d0 66 95 e4 94 13 d8 c8 ec e4 19 65
                                                  Data Ascii: 4z7Axi)8r63Xup_Ut^vbze_uj"feJ\<2FU[eLEcRkpa:wczZ;Q,T8[e?9`zhz&T*yQ4#'f+qT^Kk2}3cbN*B128SiC'wA0S
                                                  Jul 22, 2024 12:34:15.949253082 CEST1236INData Raw: 34 25 2c e5 9d 5d ed b5 e1 2c a7 3e 41 d6 a0 33 a8 93 ff c5 15 81 3d ce 94 01 98 a4 ff 99 54 e9 36 32 86 38 39 e8 14 27 87 a9 a8 9f f0 c1 3b 3a a6 4c fd 4a cf 51 44 77 61 5c 29 51 4a 98 3b 05 86 8d 76 04 df a6 3d d8 93 02 c0 90 00 e2 f0 b2 d1 83
                                                  Data Ascii: 4%,],>A3=T6289';:LJQDwa\)QJ;v=5i6we/YIa]ge:8J9a-HFpRD:}]8@4FG`t3b3Aci,JJ<G!:c`u,,g/h9FrxuuH?
                                                  Jul 22, 2024 12:34:15.949268103 CEST1236INData Raw: d0 f6 cb d1 b3 61 55 fa a4 43 33 57 d3 0e 45 b7 ed 34 65 50 30 eb db fd 21 57 25 e2 b9 5d 8b 01 56 d6 0f a7 e6 e8 ca 4b 1d 77 ed 37 d5 75 0f 3a 55 77 60 b3 3d 6e 16 26 b9 f0 de 11 f8 a3 6c 90 d4 5c dc 72 5c 30 6b 99 58 be 4c 30 6e 29 14 76 6e e0
                                                  Data Ascii: aUC3WE4eP0!W%]VKw7u:Uw`=n&l\r\0kXL0n)vneEw6h,{>VoJ[,"W2F##bl'h~T1&Cs_e-VYo[*r/zrC3{|Bt93CQ>E
                                                  Jul 22, 2024 12:34:15.949282885 CEST1236INData Raw: cb 2a 77 20 e5 30 06 0d 12 0f ce a0 a1 e4 a2 73 cb 42 3d 7a 87 cf 2b 4b a6 8c ef a7 33 77 c3 87 56 b0 a8 7d 61 53 08 eb 29 e8 42 6c 83 f3 55 44 60 61 ad b4 90 25 b4 10 8c 7a 04 31 2d f5 10 2f 61 7b 61 5a 40 a5 05 22 ef f9 09 3b 41 f7 73 57 a0 b1
                                                  Data Ascii: *w 0sB=z+K3wV}aS)BlUD`a%z1-/a{aZ@";AsW_DL[hArN~+;6]._#idF B;}+DIKv={k5G7>UPg-`N(w4!*@1?3@$Ji._r?aa_U
                                                  Jul 22, 2024 12:34:15.949299097 CEST1236INData Raw: b9 f2 d3 4c dc 58 95 5a 62 64 42 4e ba 0c 03 cb 52 79 d5 8d a2 fc 69 62 5b a7 46 45 a4 a7 8c 82 b3 e4 ed 76 ff b0 2e 3d 4b 87 33 1d 13 36 41 23 3a ef 4f 7f 83 bc 01 18 d8 ce ac 1b 15 fa ca d4 3b df c7 93 23 1b 4d 6a c4 4a 8a 3f fa 4e 10 f1 37 1a
                                                  Data Ascii: LXZbdBNRyib[FEv.=K36A#:O;#MjJ?N7k]^0huT [^o}r{498Q`JN<,R*je7Ij+{bZwziN}jN\qEcC\Esonti
                                                  Jul 22, 2024 12:34:15.954145908 CEST1236INData Raw: a4 07 67 23 06 91 b8 3a ff 7a c9 ec ef ba 9a 45 66 97 b6 21 25 5a 77 c7 6b a3 ff 3d c6 36 5e f1 64 1e 03 a2 d8 24 fa 3f 2e 85 88 e2 83 61 22 d8 68 dc ea fc f5 5a 9b 1a 4c 91 e3 d0 a5 6a 88 4d 6c 1c ed e6 b0 3a 61 f8 b0 5d e4 8b 4a cb 21 60 77 f2
                                                  Data Ascii: g#:zEf!%Zwk=6^d$?.a"hZLjMl:a]J!`wVRDwa*|bM#lx8aE%~~xLx)o_*[8lY)z(x~z-$Tg:$BD@uEHq\=*,LH+


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  14192.168.2.449788104.19.208.15280940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:16.341032028 CEST105OUTGET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Jul 22, 2024 12:34:16.801449060 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:16 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 9891
                                                  Connection: keep-alive
                                                  ETag: "3914547665"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 83
                                                  Expires: Mon, 22 Jul 2024 14:34:16 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c6fea85e1839-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d [TRUNCATED]
                                                  Data Ascii: PKIX6%FeatureActions.txtBPZ&KE9(0p<a}9g<D)9k@4y'!=~Zk`1J2[)_,{FF?q;fL*=1ZI->m%>`ml,sWITPu*;Pxxhgl$M]I}ogZL5?BZLxukU1P4mW-Ntf?I-/!w90/^%X-.0(mVPn]=cr_A$<BWye2bK{jOdxZv@[NLDU|_1Sp~Paq>})$qH7,hm)Ias<TWu$?Ey@Xu@5*UJLja0v^Q (O}k+fwvfzbhFE<plLWZI*.4#,X`=beVW)W*;Q,'x>Jq _T<ea&wo/RM2`rXFEc:A97A4FT0@wuJIBd5Bhw}oE@N=Z$)6@sXru%eIg5ruA:81&"e_'Be
                                                  Jul 22, 2024 12:34:16.801469088 CEST1236INData Raw: 27 91 1f 4b c3 11 60 77 a1 43 f9 f7 10 07 63 36 80 1a 86 ad 48 a7 d3 8f 6f 01 ae 9e 9c 3f a2 79 6e 3b 81 f2 7e 33 72 dc 17 7b 3c b2 f2 80 9b 26 a0 a9 76 69 9d e2 6e 9e 4d 47 96 36 9b c5 b5 27 68 b5 b4 84 34 1c 56 23 a3 50 e1 9f 24 02 89 9a 6e b0
                                                  Data Ascii: 'K`wCc6Ho?yn;~3r{<&vinMG6'h4V#P$n/Kt'<4oOa"xGTVBfE<eG#Bw{#@mc]os}uE6@e`^](9A,NjbNYnOF\8p"CLFk
                                                  Jul 22, 2024 12:34:16.801506996 CEST1236INData Raw: ac 50 d8 52 44 ee 8b 8f d4 d8 b2 84 d1 cb d6 f7 f8 05 a5 aa 41 48 05 36 3c 93 56 87 e3 e6 2f 47 40 72 47 91 28 bd 1e de c7 43 06 15 aa c9 07 7f 4b 86 10 6b 1f 41 44 6f 91 db 30 a2 f9 46 11 1a 4b 58 16 a1 31 d1 5e b4 59 ca fc 47 fc bc 25 05 70 a5
                                                  Data Ascii: PRDAH6<V/G@rG(CKkADo0FKX1^YG%p8P*rH|idu{"PBv`DWG&O*rD:V4#{>51Zy4U-&SSIgFkZpYN~L-6Fed~ex>3
                                                  Jul 22, 2024 12:34:16.801522017 CEST1236INData Raw: a8 b4 43 f7 18 27 39 99 b5 09 5b b0 21 e4 89 cd dc d8 80 8f ba 2c 76 5f 49 78 e0 a0 e6 a4 e8 61 8a 0a 7d 07 ae 7f 5b db 69 5b ab 4d 22 92 db 0e dc 5e ef db 36 83 5e 63 58 81 45 75 40 0c 8a 74 59 c3 e4 31 78 2a c9 f9 39 82 db c7 d7 e1 67 09 f5 da
                                                  Data Ascii: C'9[!,v_Ixa}[i[M"^6^cXEu@tY1x*9g&LIY+5kR@v<a.{G`#|<rPgAn><AhcF1NG_d~JFS}=l-z%Q\)Zm?)^afu
                                                  Jul 22, 2024 12:34:16.801537037 CEST1236INData Raw: a2 95 4e ba 4b 5c 16 c5 a5 51 be 5a 39 45 dd 17 61 63 b5 65 bb 34 9f 6d 7c 76 0b e7 cf 8a 28 b1 32 a3 4c 94 f3 9c 2d 3a d8 05 c3 70 d8 b9 9e ea 5e e2 8b aa 76 16 1e 66 9d 5b 09 8d b4 bd 0c df a4 f1 57 38 11 41 42 5a 8f 27 30 7a 45 dd 2c af 7e 69
                                                  Data Ascii: NK\QZ9Eace4m|v(2L-:p^vf[W8ABZ'0zE,~iY~^UiH-E`79_ue_f!t,f-X9^y0jgsotF8rUFX3\"T5p3WJBORFv
                                                  Jul 22, 2024 12:34:16.801552057 CEST1236INData Raw: 53 b8 3f 1e d4 8d 8b fb 22 dd 51 13 da db 37 c1 6d 8a c5 7d 9b 47 42 3f 8e c9 f0 52 59 f2 14 2a 9e 75 2e 6a 2e 7b 93 ce 8d 7f 03 7e d5 5c fc 25 45 10 44 72 a8 87 1c d2 e8 6e 79 f4 3a 12 2f 87 97 f4 7d 88 08 2a 70 f8 25 43 fc 4b 2d f3 25 a3 5d 46
                                                  Data Ascii: S?"Q7m}GB?RY*u.j.{~\%EDrny:/}*p%CK-%]F?TSkSG-^Bgv[1K+k9v&plE0P8t}BnUJXhBDBlfbG7Fsq3BI{?3>n
                                                  Jul 22, 2024 12:34:16.801585913 CEST1236INData Raw: 44 c0 9d 35 87 31 5c f2 45 f9 c7 ef 27 c4 f0 44 cb 1d 0f 1c d1 37 2a fd 7f 20 4f 38 65 99 02 a1 9a ea fd 15 94 74 5c 15 e4 8a 30 a5 11 66 30 df 52 31 9c c6 28 24 8c 3e 6f 18 50 ce cd 5b 40 65 9a 59 06 f5 bf 1e 38 1f 30 99 1f 31 4f 2a 69 da 0b 94
                                                  Data Ascii: D51\E'D7* O8et\0f0R1($>oP[@eY801O*iT2@#l0*z<F4a/dUF5iAzDScUSK:;{qQ.29h}w$/SZ24d2%h@"IT*w;W<-f.7p=ei ^C\aP`RyHaC!
                                                  Jul 22, 2024 12:34:16.801601887 CEST1236INData Raw: ba ca 62 79 64 b1 96 fc a3 e4 33 18 bf f2 b3 53 33 28 3d 94 63 da fc df 9a ab 61 96 4f fd 8f 75 23 dd b5 d3 bd b5 31 ab e5 e1 6d de 8b 88 11 1d 05 ed 75 9d 2f 58 00 23 9c b7 5e 9c be d2 46 a0 2b 67 71 a6 f8 75 c0 5f 80 c9 c6 7f 3b c9 9d 1b 53 08
                                                  Data Ascii: byd3S3(=caOu#1mu/X#^F+gqu_;Sv_HO=[Ipy`9|;!&uEv@~q+"`T].@ON/,V]Bn`;LGQNL0j*\x8j8cpo;Y|1x[
                                                  Jul 22, 2024 12:34:16.801615000 CEST383INData Raw: b8 35 15 54 a9 22 01 ba 8d 73 41 22 2d 5f 1c e5 c1 6a 64 1c 3a 02 da 84 ef c5 74 bd 9f 23 d9 32 44 34 28 27 d7 07 95 69 6b 95 3f 18 37 32 d0 a9 81 eb a5 e0 47 f9 bd 0e ce d3 e3 4e d2 40 77 fe 00 a1 df bb a6 9f 2e ba ee eb a2 f0 8c 0d bc fe f1 95
                                                  Data Ascii: 5T"sA"-_jd:t#2D4('ik?72GN@w.o[C4PcJ3 [mrE&r8U,%,uzs(q7r%Hr1]>D!M#C7xJW/5oZ~Wr4gB6SE^C8LT_4'8rC&:<uMz#


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  15192.168.2.449792104.19.208.15280940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:16.949222088 CEST89OUTGET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Jul 22, 2024 12:34:17.446337938 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:17 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 17770
                                                  Connection: keep-alive
                                                  ETag: "770472110"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 387
                                                  Expires: Mon, 22 Jul 2024 14:34:17 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c702ada9439f-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 [TRUNCATED]
                                                  Data Ascii: PK:=AX7\0DrActiveFeatures.txt+@sjp#K1;/-[[ABexq)7 7:^gK !ibUVsO$v7|e\W'ZdveU*oR>%w$-;Q4Tf$+T$&Q?9#"6>0o@j(*i)H"B1`=&0I8CR"ycM7g\@8xE4S|Iyy7~%W?7!JhrfdB^OQ"IDG!o+^6VY6<wNNPP2\?EY^j>i[p`L_sXq>#~nY>LO9rsAS+g5FBiqgUf{*vBUBqTpKF;/[&WIAPuS-&v3!Y'bMl{[:5sVL3om7'O4'(V#:\#VOO&<s}Yd|<P@jM%O5lHs^SYfaCDDwVcE8~cETL0YIEd@._PQ~w\fAT7Kiywq|+#]N">(A0bU-lDM#ETYa-h}ep<),
                                                  Jul 22, 2024 12:34:17.446355104 CEST224INData Raw: c3 e9 0b b5 94 79 f6 cd ab db ef 95 d6 d1 32 bc 03 27 b0 a7 67 bb 67 5c 5f 47 4a 97 f1 f7 fc 80 a5 3d 5e cb d2 21 fd 16 4d f6 ed 94 f2 d0 41 ec b6 8d 9b cb af 44 4b 5e 3f 92 fc ae 08 db 64 a5 1d 86 78 29 a2 a9 c5 2d c1 7a 36 38 e0 81 84 1a 34 f5
                                                  Data Ascii: y2'gg\_GJ=^!MADK^?dx)-z684R|YSgynUf1qbEFO?'[a`bF\rsZL0q\vgrP:ZbPw^l^|Vov^'D0\mJ
                                                  Jul 22, 2024 12:34:17.446459055 CEST1236INData Raw: f5 d4 68 16 04 e9 da da 2a be b7 49 7b 58 31 f7 34 85 b1 a4 07 cc 22 41 cf 29 fe ef b6 ed 73 9e 33 db f2 de 67 08 80 87 c0 59 70 b7 3a a9 89 30 db 90 f2 7a ac d0 f9 13 06 39 ba ad 08 8e 8c 3d 34 b6 f7 51 cc 64 50 0a 4c cb 1c 11 70 9b bc dc e4 c7
                                                  Data Ascii: h*I{X14"A)s3gYp:0z9=4QdPLplngh'G|6t4U .Q|Hz^6HeLg1|BK@IO[EU4+(+B31l!c*c-:O6^-#9/Exk#
                                                  Jul 22, 2024 12:34:17.446474075 CEST1236INData Raw: 57 7d 88 bf 5f ac 0a 26 4c db d8 27 e5 c6 48 c7 4e 4f 70 d7 40 39 1e 4c 3d e5 95 51 3c 84 56 4a 31 88 69 36 00 05 b7 67 c2 0e e1 9f 28 42 4b 4c 42 c8 00 f9 cb 15 30 90 ff 8f fd 64 a2 fa 91 4f 39 90 d0 52 32 2c 3f d8 ef ab 3f c7 3e bf 20 2a e2 60
                                                  Data Ascii: W}_&L'HNOp@9L=Q<VJ1i6g(BKLB0dO9R2,??> *`H^VfknSSOX9m3y<*Imx/nbIMY<9a<1t3KV6\JqnJ6l8}FwF8q;2.
                                                  Jul 22, 2024 12:34:17.446501970 CEST1236INData Raw: 3b 40 26 c1 4c 94 62 06 3c 6d 86 61 1e 10 c4 b7 a3 f4 53 63 fc a5 99 7a 1f f5 f5 32 0e 04 59 da ed 79 80 52 10 ac 7f 78 79 f2 b8 79 4d 82 f3 7e d8 db a6 19 9f dd 60 d6 e2 23 fb fa 3b 3a 21 03 a4 03 5a e0 f4 6f b0 49 e3 59 10 46 c9 bb 91 d9 44 7f
                                                  Data Ascii: ;@&Lb<maScz2YyRxyyM~`#;:!ZoIYFDVW\n3Vij @*$W|fb3eUTaW1vmL{b24So)[N/qoCM:$+AYBwMnp:(6
                                                  Jul 22, 2024 12:34:17.446526051 CEST1236INData Raw: a1 46 99 6d 1f 27 8c f1 da 2a 00 ee 77 d7 f7 bc 0a 54 6e a1 6c ae 9d ec 99 3e 1c 4b 6f 6f 00 36 68 48 54 f6 c3 cb af 59 c7 84 5b b4 a7 27 60 9e 25 de 8d 4b 6b 7e db ca 98 e7 ac e8 2d 89 23 e6 56 7d 19 76 4d 3f 64 75 4c 29 e0 04 de 36 55 4c 1b ba
                                                  Data Ascii: Fm'*wTnl>Koo6hHTY['`%Kk~-#V}vM?duL)6ULIvUm9GAu#7&~@X%%[I*pw y{B/J=(y7<zQ.+km} Q}guHZ1$Bw-!xOsb
                                                  Jul 22, 2024 12:34:17.446542025 CEST1236INData Raw: 73 de 22 ab 20 cc 61 2a 3d 5f 8b 6c d8 b6 dd b5 ab f4 4a 86 63 0c 73 8c 15 e2 87 bb 54 5f 60 54 01 08 9e 33 b3 ad 38 3c 0d 94 fb 2a 66 af 06 83 e7 5b aa 49 c8 1f 1c c1 c4 7f 53 9d ba 82 f2 d4 21 64 46 fa 09 32 7c 69 f3 12 9c 6d 4c cb 53 ad 70 b9
                                                  Data Ascii: s" a*=_lJcsT_`T38<*f[IS!dF2|imLSpQu{8/P}/08OfVK^? Dt0.<8ElzqGs5mPM{1&q[&nV^Ic
                                                  Jul 22, 2024 12:34:17.446568012 CEST1236INData Raw: f1 7f 57 88 f3 5c 26 36 49 6a 6f 89 06 a3 b0 a8 9c 15 c1 c9 f1 6d b6 7c e6 e5 b2 76 86 e1 65 d5 06 1a 26 99 9b e7 46 d8 5c ba fc 05 82 66 3d cb 34 7b 41 05 76 ea 3d 7c b0 09 21 d6 ac a6 7a e1 37 56 91 bc 44 8d 55 cd ca ae 53 c7 ae 5d 17 86 78 59
                                                  Data Ascii: W\&6Ijom|ve&F\f=4{Av=|!z7VDUS]xYC~D{E/%$n/.!/W6n$!+#Ctvi(kRU;1PRbbHGSBS8__3h!FZ6%aZ8cp/](y
                                                  Jul 22, 2024 12:34:17.446583986 CEST1236INData Raw: 2c 5c 7e 31 7e 9c 06 40 a5 99 53 66 8a cf 48 54 b2 e3 6e ab 82 1a 0f a1 02 1e 47 b6 e3 ea 1a 70 19 12 1f 13 2e a2 e4 a9 32 1f 97 86 0d 51 8e 49 60 52 84 22 03 db 7a 6d 5d f1 8d fe e7 55 dd 46 8b 81 f6 6c 86 fb bd 0f 16 99 18 a1 78 7f 9f 39 f8 93
                                                  Data Ascii: ,\~1~@SfHTnGp.2QI`R"zm]UFlx9!I!6}l<"?&TH]VEICxR[?_9egyCS`uj5Qh>Tr),b2]:jb)u NkKL+!/,V ~rhtp67
                                                  Jul 22, 2024 12:34:17.446599960 CEST1236INData Raw: 84 07 c1 f3 5b 18 6e 20 58 ca d2 99 52 1c 99 12 0c 18 60 11 e6 42 28 fc c6 00 29 c3 f6 c2 9b a0 62 02 64 08 bf 3c f4 30 69 a7 02 1d 59 ce 2a bd ff 89 4e 7f ca d6 d7 11 39 00 67 46 7f e7 94 4f 02 99 e7 45 e5 f6 26 19 40 1b 4a 8f 33 71 7a dd 61 46
                                                  Data Ascii: [n XR`B()bd<0iY*N9gFOE&@J3qzaF7?c?*Fz.n4!o\^SB{Khe4YI;m!4!E7|DYxG-p^Ex|-7`W+eNyo)>B{M}d7+!b
                                                  Jul 22, 2024 12:34:17.451661110 CEST1236INData Raw: d9 f1 0d f2 cd 8b 7f f7 b6 98 c7 c1 2e 46 4c 04 e1 52 53 e8 31 ab f3 fd 1e 50 ae ac e4 a8 8c 7d 9f c2 dc 2c 9b 36 53 33 93 96 4b a3 f9 25 dc 96 6a 20 3c 9f 19 2e 65 dc 6d 56 82 93 8b 90 02 e9 05 20 b3 a1 bb aa 82 24 88 80 b4 43 4a 75 4a ab 0a 5e
                                                  Data Ascii: .FLRS1P},6S3K%j <.emV $CJuJ^G82;is9fF/jvr<`U+WGSgw3(ur}F]}dXJ4frDt]{^IE6!GSa$owdu~JB<|=j^o


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  16192.168.2.449798104.19.208.15280940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:17.882508993 CEST113OUTGET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Connection: Keep-Alive
                                                  Jul 22, 2024 12:34:18.351967096 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:18 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 17770
                                                  Connection: keep-alive
                                                  ETag: "770472110"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 388
                                                  Expires: Mon, 22 Jul 2024 14:34:18 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c708599443a7-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 [TRUNCATED]
                                                  Data Ascii: PK:=AX7\0DrActiveFeatures.txt+@sjp#K1;/-[[ABexq)7 7:^gK !ibUVsO$v7|e\W'ZdveU*oR>%w$-;Q4Tf$+T$&Q?9#"6>0o@j(*i)H"B1`=&0I8CR"ycM7g\@8xE4S|Iyy7~%W?7!JhrfdB^OQ"IDG!o+^6VY6<wNNPP2\?EY^j>i[p`L_sXq>#~nY>LO9rsAS+g5FBiqgUf{*vBUBqTpKF;/[&WIAPuS-&v3!Y'bMl{[:5sVL3om7'O4'(V#:\#VOO&<s}Yd|<P@jM%O5lHs^SYfaCDDwVcE8~cETL0YIEd@._PQ~w\fAT7Kiywq|+#]N">(A0bU-lDM#ETYa-h}ep<),
                                                  Jul 22, 2024 12:34:18.351980925 CEST1236INData Raw: c3 e9 0b b5 94 79 f6 cd ab db ef 95 d6 d1 32 bc 03 27 b0 a7 67 bb 67 5c 5f 47 4a 97 f1 f7 fc 80 a5 3d 5e cb d2 21 fd 16 4d f6 ed 94 f2 d0 41 ec b6 8d 9b cb af 44 4b 5e 3f 92 fc ae 08 db 64 a5 1d 86 78 29 a2 a9 c5 2d c1 7a 36 38 e0 81 84 1a 34 f5
                                                  Data Ascii: y2'gg\_GJ=^!MADK^?dx)-z684R|YSgynUf1qbEFO?'[a`bF\rsZL0q\vgrP:ZbPw^l^|Vov^'D0\mJh*I{X14
                                                  Jul 22, 2024 12:34:18.351993084 CEST1236INData Raw: e3 09 b7 93 e7 ef 55 87 a5 e2 4a 0e 55 3c 50 4f 28 65 ca 9a de 34 88 d5 59 ab cd 64 54 2a 94 93 b6 b8 c7 f1 34 a6 fe 9a 9e 58 e1 5b 68 04 08 88 1d 07 7a 22 8c f4 8b 1a 37 f4 2d 18 02 f7 c9 7a e3 8d 30 e6 e5 c6 72 4a b5 33 12 97 f2 9b 9f 3d 2b 49
                                                  Data Ascii: UJU<PO(e4YdT*4X[hz"7-z0rJ3=+I:QrVjeAU|0e r.-nFs%U@_G~W}E^ns]W6.Jg4)Kk~9"4{i#W}_&L'HNOp
                                                  Jul 22, 2024 12:34:18.352045059 CEST1236INData Raw: a2 40 45 ad 3e 10 cc d4 22 b8 18 aa b5 83 15 5b 5f 79 62 da f6 64 de 89 40 91 c6 e3 e6 3c 48 f6 f2 37 d0 b4 a2 87 ed 8b 72 11 f9 fa 1d 84 ca dd 63 7c e6 56 65 74 e8 c3 ce 0a 52 78 3d f5 2c 69 ad 82 46 5f 21 19 b5 ed d3 bf 7e 98 76 8d 6a 94 b7 ed
                                                  Data Ascii: @E>"[_ybd@<H7rc|VetRx=,iF_!~vj5s,yL/[g{QosVz%{A|PSeC)PYzSZ/]E?kINr|Pg!\2-;@&Lb<maS
                                                  Jul 22, 2024 12:34:18.352056980 CEST1236INData Raw: ef ec e3 a3 78 02 50 1e 6e 18 3a c8 ef 40 01 47 df 2f 67 75 81 ee e7 ed 5c 86 a7 cd ff 50 b9 61 08 00 fa a5 b9 0e 2f 50 8f 87 fd 80 44 ec bf 7d 28 a2 50 86 c4 d0 81 34 04 f9 9d 19 90 5d 6c c8 6f a3 82 62 5f 8a 77 97 ae e6 15 32 ec 5b 3c d5 d1 50
                                                  Data Ascii: xPn:@G/gu\Pa/PD}(P4]lob_w2[<Pz|<gzX],af!:$uMs)m74Tf8Q0Ee@>i~p#D'uma{4q-x.{W)x,0Fm'*wTn
                                                  Jul 22, 2024 12:34:18.352067947 CEST1236INData Raw: ea fe e8 9b 44 1e 62 80 9f 85 5d b4 ed 54 9a 62 26 5d f9 5f e9 66 31 79 1a ec 5d eb 3b 42 de 2a 12 2f 99 5a 51 ad 2c 4e fc b2 cd 25 8a df 0b d7 07 24 1e 16 60 15 f2 23 fe 84 ec 28 ca cb ea 25 a1 6f 30 22 39 cc 4f eb 80 ec b0 87 73 03 c9 e2 6f cb
                                                  Data Ascii: Db]Tb&]_f1y];B*/ZQ,N%$`#(%o0"9OsosUN^m9N)&8))QK}b9"@T~yu?V7j7y)vJ_EEW58X+:CP~T,{/s" a*=_lJ
                                                  Jul 22, 2024 12:34:18.352078915 CEST1236INData Raw: c6 ac fb 85 2b c7 a3 2f 2f d9 73 66 a6 d5 b3 dc bc 4c 89 64 2f f9 a1 b7 40 bf dd 84 b3 f4 0d 92 fa d2 49 45 fc 27 f8 14 9d 3f bd 02 3a c4 6a 3c 68 f4 ec 55 d8 20 1b ea 58 1f 15 63 0c 4e fc 76 39 e9 cc 71 40 69 5b b9 5b c5 4e 6d 50 82 e3 2b 3d 15
                                                  Data Ascii: +//sfLd/@IE'?:j<hU XcNv9q@i[[NmP+=127ZS$rHxh7[m15'1Z91 #%|^s\obPTPUO:$9pgLNTKqmc_xE]uUW\&6Ijo
                                                  Jul 22, 2024 12:34:18.352103949 CEST1236INData Raw: e7 41 3d ce 7d 33 4d 0f 6d da 2d 57 cd 6d 7c 72 20 41 5f e2 85 cb 48 2a 2c 1b 25 2d ea 0b 8c 30 58 68 ec 5b 67 54 17 0b 09 36 f0 a1 5f 55 d0 81 77 eb 76 58 90 be 59 9e ba 3f be 84 2b 42 29 6f 5c df c6 42 5f 49 8a 9f 97 26 07 55 9d da 50 6a e6 dc
                                                  Data Ascii: A=}3Mm-Wm|r A_H*,%-0Xh[gT6_UwvXY?+B)o\B_I&UPj?n,\_%N&gFx!7^"*w/:=\-?2$(<9#oPa7Z+iIU1B($k!XdI<#7s(,\~1~@SfHTn
                                                  Jul 22, 2024 12:34:18.352113962 CEST1236INData Raw: 20 19 6a 5f 78 89 c4 93 e5 38 5a 6e de 37 da e2 c6 06 b0 e8 f5 8e ec 2a 4d 52 53 7c c0 ce f1 b1 9d 84 d3 91 ba fc 29 13 39 6d 22 59 ca f4 90 ba 24 c3 b5 86 27 17 f3 8a b2 8c 0f d9 b9 6d 97 6d 9b 96 f5 eb e7 ae 0b 71 31 03 84 41 72 7d a7 8d f4 99
                                                  Data Ascii: j_x8Zn7*MRS|)9m"Y$'mmq1Ar}sWC@T^n2I%j+r|kpjq%<OjYSO)o+`qK18oLXG#F?sTds%>qWY2qf[n XR`
                                                  Jul 22, 2024 12:34:18.352123022 CEST1236INData Raw: d1 d2 9b 08 03 2c 5a d5 0d b5 24 ba 57 06 e9 82 13 06 b8 76 cd 11 85 df 30 60 c7 4a 68 fc 62 33 d3 a3 33 4a 36 3d a8 67 bb a3 56 33 7d 3d 9a 83 2c 2e ab 79 ba 0d fb 01 11 b8 6d 84 ce cd 88 2e 7d f5 4f 3e 3e d1 e4 3c 13 83 fa 27 77 82 c7 e2 d9 4b
                                                  Data Ascii: ,Z$Wv0`Jhb33J6=gV3}=,.ym.}O>><'wK\U}&El?<tl%}v%HSA*gH(vqd00Dan~Jlax_K9#+Rfl?uhLO{.FLRS
                                                  Jul 22, 2024 12:34:18.357012033 CEST1236INData Raw: 12 42 b8 dd e5 1f 9e 6b 33 d0 27 64 66 67 09 75 13 4e 4f e9 2f 56 c0 a1 26 a6 e7 0f 48 59 99 5e 9a 7b ee 13 0a e1 b2 7e 95 bf 06 41 45 43 c3 c5 43 45 37 b4 fd 4d f1 ee 9a 9c 98 53 15 42 01 8c fa ef a5 44 d0 97 33 99 81 2a 36 6b 2c 46 c1 0c 71 2f
                                                  Data Ascii: Bk3'dfguNO/V&HY^{~AECCE7MSBD3*6k,Fq/D:-E|OylOR-BS)2,o(P.Ibk@1F] 9X&;/<MZ5 `CLg`h*EH=|EZpoC/j{1,u;


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  17192.168.2.449800104.19.208.15280940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:19.216921091 CEST113OUTGET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Connection: Keep-Alive
                                                  Jul 22, 2024 12:34:19.649636030 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:19 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 17770
                                                  Connection: keep-alive
                                                  ETag: "770472110"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 389
                                                  Expires: Mon, 22 Jul 2024 14:34:19 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7107edf8ca7-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 [TRUNCATED]
                                                  Data Ascii: PK:=AX7\0DrActiveFeatures.txt+@sjp#K1;/-[[ABexq)7 7:^gK !ibUVsO$v7|e\W'ZdveU*oR>%w$-;Q4Tf$+T$&Q?9#"6>0o@j(*i)H"B1`=&0I8CR"ycM7g\@8xE4S|Iyy7~%W?7!JhrfdB^OQ"IDG!o+^6VY6<wNNPP2\?EY^j>i[p`L_sXq>#~nY>LO9rsAS+g5FBiqgUf{*vBUBqTpKF;/[&WIAPuS-&v3!Y'bMl{[:5sVL3om7'O4'(V#:\#VOO&<s}Yd|<P@jM%O5lHs^SYfaCDDwVcE8~cETL0YIEd@._PQ~w\fAT7Kiywq|+#]N">(A0bU-lDM#ETYa-h}ep<),
                                                  Jul 22, 2024 12:34:19.649655104 CEST1236INData Raw: c3 e9 0b b5 94 79 f6 cd ab db ef 95 d6 d1 32 bc 03 27 b0 a7 67 bb 67 5c 5f 47 4a 97 f1 f7 fc 80 a5 3d 5e cb d2 21 fd 16 4d f6 ed 94 f2 d0 41 ec b6 8d 9b cb af 44 4b 5e 3f 92 fc ae 08 db 64 a5 1d 86 78 29 a2 a9 c5 2d c1 7a 36 38 e0 81 84 1a 34 f5
                                                  Data Ascii: y2'gg\_GJ=^!MADK^?dx)-z684R|YSgynUf1qbEFO?'[a`bF\rsZL0q\vgrP:ZbPw^l^|Vov^'D0\mJh*I{X14
                                                  Jul 22, 2024 12:34:19.649667025 CEST1236INData Raw: e3 09 b7 93 e7 ef 55 87 a5 e2 4a 0e 55 3c 50 4f 28 65 ca 9a de 34 88 d5 59 ab cd 64 54 2a 94 93 b6 b8 c7 f1 34 a6 fe 9a 9e 58 e1 5b 68 04 08 88 1d 07 7a 22 8c f4 8b 1a 37 f4 2d 18 02 f7 c9 7a e3 8d 30 e6 e5 c6 72 4a b5 33 12 97 f2 9b 9f 3d 2b 49
                                                  Data Ascii: UJU<PO(e4YdT*4X[hz"7-z0rJ3=+I:QrVjeAU|0e r.-nFs%U@_G~W}E^ns]W6.Jg4)Kk~9"4{i#W}_&L'HNOp
                                                  Jul 22, 2024 12:34:19.649677038 CEST1236INData Raw: a2 40 45 ad 3e 10 cc d4 22 b8 18 aa b5 83 15 5b 5f 79 62 da f6 64 de 89 40 91 c6 e3 e6 3c 48 f6 f2 37 d0 b4 a2 87 ed 8b 72 11 f9 fa 1d 84 ca dd 63 7c e6 56 65 74 e8 c3 ce 0a 52 78 3d f5 2c 69 ad 82 46 5f 21 19 b5 ed d3 bf 7e 98 76 8d 6a 94 b7 ed
                                                  Data Ascii: @E>"[_ybd@<H7rc|VetRx=,iF_!~vj5s,yL/[g{QosVz%{A|PSeC)PYzSZ/]E?kINr|Pg!\2-;@&Lb<maS
                                                  Jul 22, 2024 12:34:19.649686098 CEST1236INData Raw: ef ec e3 a3 78 02 50 1e 6e 18 3a c8 ef 40 01 47 df 2f 67 75 81 ee e7 ed 5c 86 a7 cd ff 50 b9 61 08 00 fa a5 b9 0e 2f 50 8f 87 fd 80 44 ec bf 7d 28 a2 50 86 c4 d0 81 34 04 f9 9d 19 90 5d 6c c8 6f a3 82 62 5f 8a 77 97 ae e6 15 32 ec 5b 3c d5 d1 50
                                                  Data Ascii: xPn:@G/gu\Pa/PD}(P4]lob_w2[<Pz|<gzX],af!:$uMs)m74Tf8Q0Ee@>i~p#D'uma{4q-x.{W)x,0Fm'*wTn
                                                  Jul 22, 2024 12:34:19.649697065 CEST1236INData Raw: ea fe e8 9b 44 1e 62 80 9f 85 5d b4 ed 54 9a 62 26 5d f9 5f e9 66 31 79 1a ec 5d eb 3b 42 de 2a 12 2f 99 5a 51 ad 2c 4e fc b2 cd 25 8a df 0b d7 07 24 1e 16 60 15 f2 23 fe 84 ec 28 ca cb ea 25 a1 6f 30 22 39 cc 4f eb 80 ec b0 87 73 03 c9 e2 6f cb
                                                  Data Ascii: Db]Tb&]_f1y];B*/ZQ,N%$`#(%o0"9OsosUN^m9N)&8))QK}b9"@T~yu?V7j7y)vJ_EEW58X+:CP~T,{/s" a*=_lJ
                                                  Jul 22, 2024 12:34:19.649705887 CEST1236INData Raw: c6 ac fb 85 2b c7 a3 2f 2f d9 73 66 a6 d5 b3 dc bc 4c 89 64 2f f9 a1 b7 40 bf dd 84 b3 f4 0d 92 fa d2 49 45 fc 27 f8 14 9d 3f bd 02 3a c4 6a 3c 68 f4 ec 55 d8 20 1b ea 58 1f 15 63 0c 4e fc 76 39 e9 cc 71 40 69 5b b9 5b c5 4e 6d 50 82 e3 2b 3d 15
                                                  Data Ascii: +//sfLd/@IE'?:j<hU XcNv9q@i[[NmP+=127ZS$rHxh7[m15'1Z91 #%|^s\obPTPUO:$9pgLNTKqmc_xE]uUW\&6Ijo
                                                  Jul 22, 2024 12:34:19.649718046 CEST1236INData Raw: e7 41 3d ce 7d 33 4d 0f 6d da 2d 57 cd 6d 7c 72 20 41 5f e2 85 cb 48 2a 2c 1b 25 2d ea 0b 8c 30 58 68 ec 5b 67 54 17 0b 09 36 f0 a1 5f 55 d0 81 77 eb 76 58 90 be 59 9e ba 3f be 84 2b 42 29 6f 5c df c6 42 5f 49 8a 9f 97 26 07 55 9d da 50 6a e6 dc
                                                  Data Ascii: A=}3Mm-Wm|r A_H*,%-0Xh[gT6_UwvXY?+B)o\B_I&UPj?n,\_%N&gFx!7^"*w/:=\-?2$(<9#oPa7Z+iIU1B($k!XdI<#7s(,\~1~@SfHTn
                                                  Jul 22, 2024 12:34:19.649727106 CEST1236INData Raw: 20 19 6a 5f 78 89 c4 93 e5 38 5a 6e de 37 da e2 c6 06 b0 e8 f5 8e ec 2a 4d 52 53 7c c0 ce f1 b1 9d 84 d3 91 ba fc 29 13 39 6d 22 59 ca f4 90 ba 24 c3 b5 86 27 17 f3 8a b2 8c 0f d9 b9 6d 97 6d 9b 96 f5 eb e7 ae 0b 71 31 03 84 41 72 7d a7 8d f4 99
                                                  Data Ascii: j_x8Zn7*MRS|)9m"Y$'mmq1Ar}sWC@T^n2I%j+r|kpjq%<OjYSO)o+`qK18oLXG#F?sTds%>qWY2qf[n XR`
                                                  Jul 22, 2024 12:34:19.649733067 CEST1236INData Raw: d1 d2 9b 08 03 2c 5a d5 0d b5 24 ba 57 06 e9 82 13 06 b8 76 cd 11 85 df 30 60 c7 4a 68 fc 62 33 d3 a3 33 4a 36 3d a8 67 bb a3 56 33 7d 3d 9a 83 2c 2e ab 79 ba 0d fb 01 11 b8 6d 84 ce cd 88 2e 7d f5 4f 3e 3e d1 e4 3c 13 83 fa 27 77 82 c7 e2 d9 4b
                                                  Data Ascii: ,Z$Wv0`Jhb33J6=gV3}=,.ym.}O>><'wK\U}&El?<tl%}v%HSA*gH(vqd00Dan~Jlax_K9#+Rfl?uhLO{.FLRS
                                                  Jul 22, 2024 12:34:19.654697895 CEST1236INData Raw: 12 42 b8 dd e5 1f 9e 6b 33 d0 27 64 66 67 09 75 13 4e 4f e9 2f 56 c0 a1 26 a6 e7 0f 48 59 99 5e 9a 7b ee 13 0a e1 b2 7e 95 bf 06 41 45 43 c3 c5 43 45 37 b4 fd 4d f1 ee 9a 9c 98 53 15 42 01 8c fa ef a5 44 d0 97 33 99 81 2a 36 6b 2c 46 c1 0c 71 2f
                                                  Data Ascii: Bk3'dfguNO/V&HY^{~AECCE7MSBD3*6k,Fq/D:-E|OylOR-BS)2,o(P.Ibk@1F] 9X&;/<MZ5 `CLg`h*EH=|EZpoC/j{1,u;


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  18192.168.2.449805104.19.208.15280940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:21.949476004 CEST129OUTGET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Connection: Keep-Alive
                                                  Jul 22, 2024 12:34:22.426744938 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:22 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 9891
                                                  Connection: keep-alive
                                                  ETag: "3914547665"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 89
                                                  Expires: Mon, 22 Jul 2024 14:34:22 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c721cd5c4308-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d [TRUNCATED]
                                                  Data Ascii: PKIX6%FeatureActions.txtBPZ&KE9(0p<a}9g<D)9k@4y'!=~Zk`1J2[)_,{FF?q;fL*=1ZI->m%>`ml,sWITPu*;Pxxhgl$M]I}ogZL5?BZLxukU1P4mW-Ntf?I-/!w90/^%X-.0(mVPn]=cr_A$<BWye2bK{jOdxZv@[NLDU|_1Sp~Paq>})$qH7,hm)Ias<TWu$?Ey@Xu@5*UJLja0v^Q (O}k+fwvfzbhFE<plLWZI*.4#,X`=beVW)W*;Q,'x>Jq _T<ea&wo/RM2`rXFEc:A97A4FT0@wuJIBd5Bhw}oE@N=Z$)6@sXru%eIg5ruA:81&"e_'Be
                                                  Jul 22, 2024 12:34:22.426769972 CEST1236INData Raw: 27 91 1f 4b c3 11 60 77 a1 43 f9 f7 10 07 63 36 80 1a 86 ad 48 a7 d3 8f 6f 01 ae 9e 9c 3f a2 79 6e 3b 81 f2 7e 33 72 dc 17 7b 3c b2 f2 80 9b 26 a0 a9 76 69 9d e2 6e 9e 4d 47 96 36 9b c5 b5 27 68 b5 b4 84 34 1c 56 23 a3 50 e1 9f 24 02 89 9a 6e b0
                                                  Data Ascii: 'K`wCc6Ho?yn;~3r{<&vinMG6'h4V#P$n/Kt'<4oOa"xGTVBfE<eG#Bw{#@mc]os}uE6@e`^](9A,NjbNYnOF\8p"CLFk
                                                  Jul 22, 2024 12:34:22.426790953 CEST448INData Raw: ac 50 d8 52 44 ee 8b 8f d4 d8 b2 84 d1 cb d6 f7 f8 05 a5 aa 41 48 05 36 3c 93 56 87 e3 e6 2f 47 40 72 47 91 28 bd 1e de c7 43 06 15 aa c9 07 7f 4b 86 10 6b 1f 41 44 6f 91 db 30 a2 f9 46 11 1a 4b 58 16 a1 31 d1 5e b4 59 ca fc 47 fc bc 25 05 70 a5
                                                  Data Ascii: PRDAH6<V/G@rG(CKkADo0FKX1^YG%p8P*rH|idu{"PBv`DWG&O*rD:V4#{>51Zy4U-&SSIgFkZpYN~L-6Fed~ex>3
                                                  Jul 22, 2024 12:34:22.426801920 CEST1236INData Raw: 74 78 bf d1 4f e7 e2 3d a6 1b 87 fe 74 57 73 46 8d ae 81 4e b5 95 90 a6 0a 32 29 67 d8 c7 21 47 50 3f 92 00 6e 58 3b 68 5c 39 a5 27 c3 8f c6 c3 8b c1 8c d3 eb 6c 55 ca 97 c2 12 dc 83 bc 08 95 eb a8 4f e9 a1 3f bb dc 6a d0 fc 87 68 26 35 4f 63 0d
                                                  Data Ascii: txO=tWsFN2)g!GP?nX;h\9'lUO?jh&5OcRM;BY={yMNSVJLSl-\yBNM*T0X8o'm#ZIfHr,-^D[GWan]k0:t)Q^smAJ)
                                                  Jul 22, 2024 12:34:22.426812887 CEST1236INData Raw: b0 ea 69 48 6f 97 04 cc 88 51 65 16 41 0f a1 ce 2c 5f 44 27 b4 16 c6 86 90 c5 74 9d 98 5d 14 f8 08 95 7f e2 c9 8d df e0 61 32 78 a6 c0 e5 93 d3 34 b3 91 b6 26 79 c9 cd 07 9a 62 a6 cf 86 1f ee 30 1e 7a 04 9f ef 39 86 3c 67 7f 09 77 56 ca 33 18 43
                                                  Data Ascii: iHoQeA,_D't]a2x4&yb0z9<gwV3CvY8]N{cF4y<o8.P"w(t[%c{,KC`m[EPi<YfugDJbQec4!RA$y>TJ,r9aN 9Ql3
                                                  Jul 22, 2024 12:34:22.426822901 CEST1236INData Raw: 85 11 40 a7 22 b6 de 95 b0 8a 6b 3a 12 0f 9c 4c b5 60 f3 af 2d 30 08 fe 13 b2 b5 10 9a 51 94 73 ac 93 15 e2 75 a0 26 8b c7 60 6a e3 be a2 46 fd 5f ba 02 5c d6 7e ff 8e 35 8a 0e 01 1d 8d 4a c0 74 ac 56 39 45 fd 19 a0 ee a5 44 1c 37 f5 33 92 44 33
                                                  Data Ascii: @"k:L`-0Qsu&`jF_\~5JtV9ED73D32.>DA;.+}X:JFRlO%kqys|w- 7/Sw7XD<M7v-98L:"Dx.Z]Di0\*XE2
                                                  Jul 22, 2024 12:34:22.426835060 CEST1236INData Raw: dc 3b 12 c6 14 12 66 b4 19 fc ce 11 d8 0d 7d f3 c3 4a d1 1a 02 97 bc b8 14 8b 96 9d 56 5a 73 2e 85 85 d7 cf 3d 64 8c 69 c0 30 fb 5e 7d e7 20 2d 5e 5a e0 42 46 09 48 cc a1 dc fc 6b 7c 2a 51 62 6e fe cf 57 d5 fc 84 cb 4b 2b ef d0 7b 39 ea 6d 7a 5d
                                                  Data Ascii: ;f}JVZs.=di0^} -^ZBFHk|*QbnWK+{9mz]1.D8s@ 7i: %}?^!5xjfr<ANSYmJgZA}a_p(']JY+;j,k"DPm -SR|Em{!q
                                                  Jul 22, 2024 12:34:22.426845074 CEST1236INData Raw: 99 a9 82 0e 0f a3 58 f4 7d 18 81 e6 a0 dd 09 3a b4 58 64 5c c9 4a 5b 3c ee c2 4a ba 20 31 25 b6 c4 02 8d 36 f7 08 58 08 92 21 54 cc 0f 1f b4 85 c1 26 3a 05 db 9b c7 7e 35 0f cb ba 03 be 24 56 88 8f bc 33 ea ac 9c b5 7c a9 46 95 3b 6b be 19 3d 79
                                                  Data Ascii: X}:Xd\J[<J 1%6X!T&:~5$V3|F;k=yL6Q;*DA-. +cR7FzrxHg]w;rIOgPBVsFCSb0Y!7hy*iWFW:/,`fv2NuK(91{-3~>ou}[C.m,$*CbD]3rd
                                                  Jul 22, 2024 12:34:22.426857948 CEST1171INData Raw: 68 2f 29 33 c0 21 37 b1 35 86 46 34 86 31 ee 33 5e b0 27 38 88 08 ad 39 0d ed ff 58 9e a8 66 31 2f 5d 2b 9a 7f c6 51 6f 84 4b e4 da a0 4b 15 f4 48 14 b1 8e e8 ef f0 5d b8 b0 bf a2 fa aa 75 58 74 0d ae 47 26 7c ef 9b f0 93 81 cc 83 9b 21 8a 68 4f
                                                  Data Ascii: h/)3!75F413^'89Xf1/]+QoKKH]uXtG&|!hO|TTaz-@Qlm=(\IN7m12m+tvFob4}"S%na,KyAw{iPhz,Sk:34m,\YBq{]nffv5%"(


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  19192.168.2.449806104.16.149.13080940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:21.968192101 CEST179OUTPOST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 239
                                                  Connection: Keep-Alive
                                                  Jul 22, 2024 12:34:21.974940062 CEST239OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","CurrentSearch":"Google","CurrentHomepage":"about:home","LanguageIso2":"en-GB","IP":null,"CreateDate":0}}
                                                  Jul 22, 2024 12:34:22.476571083 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:22 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c721dbdcc3fa-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0
                                                  Jul 22, 2024 12:34:22.478579998 CEST155OUTPOST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 239
                                                  Jul 22, 2024 12:34:22.483409882 CEST239OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","CurrentSearch":"Google","CurrentHomepage":"about:home","LanguageIso2":"en-GB","IP":null,"CreateDate":0}}
                                                  Jul 22, 2024 12:34:22.670320988 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:22 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c722cc9cc3fa-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0
                                                  Jul 22, 2024 12:34:22.670833111 CEST155OUTPOST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 239
                                                  Jul 22, 2024 12:34:22.676438093 CEST239OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","CurrentSearch":"Google","CurrentHomepage":"about:home","LanguageIso2":"en-GB","IP":null,"CreateDate":0}}
                                                  Jul 22, 2024 12:34:23.788120985 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:22 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7240d6dc3fa-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0
                                                  Jul 22, 2024 12:34:23.788527966 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:22 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7240d6dc3fa-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0
                                                  Jul 22, 2024 12:34:23.789006948 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:22 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7240d6dc3fa-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0
                                                  Jul 22, 2024 12:34:23.789300919 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:22 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7240d6dc3fa-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  20192.168.2.449807104.16.149.13080940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:21.970333099 CEST179OUTPOST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 239
                                                  Connection: Keep-Alive
                                                  Jul 22, 2024 12:34:21.975558043 CEST239OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","CurrentSearch":"Google","CurrentHomepage":"about:home","LanguageIso2":"en-GB","IP":null,"CreateDate":0}}
                                                  Jul 22, 2024 12:34:22.480249882 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:22 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c721f8974286-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0
                                                  Jul 22, 2024 12:34:22.482927084 CEST155OUTPOST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 239
                                                  Jul 22, 2024 12:34:22.488192081 CEST239OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","CurrentSearch":"Google","CurrentHomepage":"about:home","LanguageIso2":"en-GB","IP":null,"CreateDate":0}}
                                                  Jul 22, 2024 12:34:22.646857977 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:22 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c722d9304286-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0
                                                  Jul 22, 2024 12:34:22.649346113 CEST155OUTPOST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 239
                                                  Jul 22, 2024 12:34:22.654366016 CEST239OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","CurrentSearch":"Google","CurrentHomepage":"about:home","LanguageIso2":"en-GB","IP":null,"CreateDate":0}}
                                                  Jul 22, 2024 12:34:23.788137913 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:22 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c723da264286-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0
                                                  Jul 22, 2024 12:34:23.788578033 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:22 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c723da264286-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0
                                                  Jul 22, 2024 12:34:23.789017916 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:22 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c723da264286-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0
                                                  Jul 22, 2024 12:34:23.789288998 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:22 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c723da264286-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0
                                                  Jul 22, 2024 12:34:28.411617041 CEST155OUTPOST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 239
                                                  Jul 22, 2024 12:34:28.417606115 CEST239OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","CurrentSearch":"Google","CurrentHomepage":"about:home","LanguageIso2":"en-GB","IP":null,"CreateDate":0}}
                                                  Jul 22, 2024 12:34:28.554989100 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:28 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c747eb984286-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0
                                                  Jul 22, 2024 12:34:28.555227041 CEST155OUTPOST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 239
                                                  Jul 22, 2024 12:34:28.560359001 CEST239OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","CurrentSearch":"Google","CurrentHomepage":"about:home","LanguageIso2":"en-GB","IP":null,"CreateDate":0}}
                                                  Jul 22, 2024 12:34:28.723798990 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:28 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c748cc154286-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0
                                                  Jul 22, 2024 12:34:28.818041086 CEST155OUTPOST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 239
                                                  Jul 22, 2024 12:34:28.823057890 CEST239OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","CurrentSearch":"Google","CurrentHomepage":"about:home","LanguageIso2":"en-GB","IP":null,"CreateDate":0}}
                                                  Jul 22, 2024 12:34:29.059879065 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:29 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c74a6d104286-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0
                                                  Jul 22, 2024 12:34:29.060559988 CEST155OUTPOST /v1/event-stat-wc?Type=FirstRun&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 265
                                                  Jul 22, 2024 12:34:29.065463066 CEST265OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","DefaultBrowser":"Google Chrome117.0.5938.132","OriginalSearch":"Google","OriginalHomepage":"about:home","IP"
                                                  Jul 22, 2024 12:34:29.190814018 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:29 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c74bfdf34286-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0
                                                  Jul 22, 2024 12:34:29.203854084 CEST155OUTPOST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 239
                                                  Jul 22, 2024 12:34:29.208734035 CEST239OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","CurrentSearch":"Google","CurrentHomepage":"about:home","LanguageIso2":"en-GB","IP":null,"CreateDate":0}}
                                                  Jul 22, 2024 12:34:29.369689941 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:29 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c74cde954286-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  21192.168.2.449808104.19.208.15280940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:21.977502108 CEST113OUTGET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Connection: Keep-Alive
                                                  Jul 22, 2024 12:34:22.464520931 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:22 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 17770
                                                  Connection: keep-alive
                                                  ETag: "770472110"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 392
                                                  Expires: Mon, 22 Jul 2024 14:34:22 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7220f1d5e76-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 [TRUNCATED]
                                                  Data Ascii: PK:=AX7\0DrActiveFeatures.txt+@sjp#K1;/-[[ABexq)7 7:^gK !ibUVsO$v7|e\W'ZdveU*oR>%w$-;Q4Tf$+T$&Q?9#"6>0o@j(*i)H"B1`=&0I8CR"ycM7g\@8xE4S|Iyy7~%W?7!JhrfdB^OQ"IDG!o+^6VY6<wNNPP2\?EY^j>i[p`L_sXq>#~nY>LO9rsAS+g5FBiqgUf{*vBUBqTpKF;/[&WIAPuS-&v3!Y'bMl{[:5sVL3om7'O4'(V#:\#VOO&<s}Yd|<P@jM%O5lHs^SYfaCDDwVcE8~cETL0YIEd@._PQ~w\fAT7Kiywq|+#]N">(A0bU-lDM#ETYa-h}ep<),
                                                  Jul 22, 2024 12:34:22.464535952 CEST224INData Raw: c3 e9 0b b5 94 79 f6 cd ab db ef 95 d6 d1 32 bc 03 27 b0 a7 67 bb 67 5c 5f 47 4a 97 f1 f7 fc 80 a5 3d 5e cb d2 21 fd 16 4d f6 ed 94 f2 d0 41 ec b6 8d 9b cb af 44 4b 5e 3f 92 fc ae 08 db 64 a5 1d 86 78 29 a2 a9 c5 2d c1 7a 36 38 e0 81 84 1a 34 f5
                                                  Data Ascii: y2'gg\_GJ=^!MADK^?dx)-z684R|YSgynUf1qbEFO?'[a`bF\rsZL0q\vgrP:ZbPw^l^|Vov^'D0\mJ
                                                  Jul 22, 2024 12:34:22.464598894 CEST1236INData Raw: f5 d4 68 16 04 e9 da da 2a be b7 49 7b 58 31 f7 34 85 b1 a4 07 cc 22 41 cf 29 fe ef b6 ed 73 9e 33 db f2 de 67 08 80 87 c0 59 70 b7 3a a9 89 30 db 90 f2 7a ac d0 f9 13 06 39 ba ad 08 8e 8c 3d 34 b6 f7 51 cc 64 50 0a 4c cb 1c 11 70 9b bc dc e4 c7
                                                  Data Ascii: h*I{X14"A)s3gYp:0z9=4QdPLplngh'G|6t4U .Q|Hz^6HeLg1|BK@IO[EU4+(+B31l!c*c-:O6^-#9/Exk#
                                                  Jul 22, 2024 12:34:22.464612961 CEST1236INData Raw: 57 7d 88 bf 5f ac 0a 26 4c db d8 27 e5 c6 48 c7 4e 4f 70 d7 40 39 1e 4c 3d e5 95 51 3c 84 56 4a 31 88 69 36 00 05 b7 67 c2 0e e1 9f 28 42 4b 4c 42 c8 00 f9 cb 15 30 90 ff 8f fd 64 a2 fa 91 4f 39 90 d0 52 32 2c 3f d8 ef ab 3f c7 3e bf 20 2a e2 60
                                                  Data Ascii: W}_&L'HNOp@9L=Q<VJ1i6g(BKLB0dO9R2,??> *`H^VfknSSOX9m3y<*Imx/nbIMY<9a<1t3KV6\JqnJ6l8}FwF8q;2.
                                                  Jul 22, 2024 12:34:22.464627981 CEST1236INData Raw: 3b 40 26 c1 4c 94 62 06 3c 6d 86 61 1e 10 c4 b7 a3 f4 53 63 fc a5 99 7a 1f f5 f5 32 0e 04 59 da ed 79 80 52 10 ac 7f 78 79 f2 b8 79 4d 82 f3 7e d8 db a6 19 9f dd 60 d6 e2 23 fb fa 3b 3a 21 03 a4 03 5a e0 f4 6f b0 49 e3 59 10 46 c9 bb 91 d9 44 7f
                                                  Data Ascii: ;@&Lb<maScz2YyRxyyM~`#;:!ZoIYFDVW\n3Vij @*$W|fb3eUTaW1vmL{b24So)[N/qoCM:$+AYBwMnp:(6
                                                  Jul 22, 2024 12:34:22.464652061 CEST1236INData Raw: a1 46 99 6d 1f 27 8c f1 da 2a 00 ee 77 d7 f7 bc 0a 54 6e a1 6c ae 9d ec 99 3e 1c 4b 6f 6f 00 36 68 48 54 f6 c3 cb af 59 c7 84 5b b4 a7 27 60 9e 25 de 8d 4b 6b 7e db ca 98 e7 ac e8 2d 89 23 e6 56 7d 19 76 4d 3f 64 75 4c 29 e0 04 de 36 55 4c 1b ba
                                                  Data Ascii: Fm'*wTnl>Koo6hHTY['`%Kk~-#V}vM?duL)6ULIvUm9GAu#7&~@X%%[I*pw y{B/J=(y7<zQ.+km} Q}guHZ1$Bw-!xOsb
                                                  Jul 22, 2024 12:34:22.464663982 CEST1236INData Raw: 73 de 22 ab 20 cc 61 2a 3d 5f 8b 6c d8 b6 dd b5 ab f4 4a 86 63 0c 73 8c 15 e2 87 bb 54 5f 60 54 01 08 9e 33 b3 ad 38 3c 0d 94 fb 2a 66 af 06 83 e7 5b aa 49 c8 1f 1c c1 c4 7f 53 9d ba 82 f2 d4 21 64 46 fa 09 32 7c 69 f3 12 9c 6d 4c cb 53 ad 70 b9
                                                  Data Ascii: s" a*=_lJcsT_`T38<*f[IS!dF2|imLSpQu{8/P}/08OfVK^? Dt0.<8ElzqGs5mPM{1&q[&nV^Ic
                                                  Jul 22, 2024 12:34:22.464669943 CEST1236INData Raw: f1 7f 57 88 f3 5c 26 36 49 6a 6f 89 06 a3 b0 a8 9c 15 c1 c9 f1 6d b6 7c e6 e5 b2 76 86 e1 65 d5 06 1a 26 99 9b e7 46 d8 5c ba fc 05 82 66 3d cb 34 7b 41 05 76 ea 3d 7c b0 09 21 d6 ac a6 7a e1 37 56 91 bc 44 8d 55 cd ca ae 53 c7 ae 5d 17 86 78 59
                                                  Data Ascii: W\&6Ijom|ve&F\f=4{Av=|!z7VDUS]xYC~D{E/%$n/.!/W6n$!+#Ctvi(kRU;1PRbbHGSBS8__3h!FZ6%aZ8cp/](y
                                                  Jul 22, 2024 12:34:22.464683056 CEST1236INData Raw: 2c 5c 7e 31 7e 9c 06 40 a5 99 53 66 8a cf 48 54 b2 e3 6e ab 82 1a 0f a1 02 1e 47 b6 e3 ea 1a 70 19 12 1f 13 2e a2 e4 a9 32 1f 97 86 0d 51 8e 49 60 52 84 22 03 db 7a 6d 5d f1 8d fe e7 55 dd 46 8b 81 f6 6c 86 fb bd 0f 16 99 18 a1 78 7f 9f 39 f8 93
                                                  Data Ascii: ,\~1~@SfHTnGp.2QI`R"zm]UFlx9!I!6}l<"?&TH]VEICxR[?_9egyCS`uj5Qh>Tr),b2]:jb)u NkKL+!/,V ~rhtp67
                                                  Jul 22, 2024 12:34:22.464696884 CEST1236INData Raw: 84 07 c1 f3 5b 18 6e 20 58 ca d2 99 52 1c 99 12 0c 18 60 11 e6 42 28 fc c6 00 29 c3 f6 c2 9b a0 62 02 64 08 bf 3c f4 30 69 a7 02 1d 59 ce 2a bd ff 89 4e 7f ca d6 d7 11 39 00 67 46 7f e7 94 4f 02 99 e7 45 e5 f6 26 19 40 1b 4a 8f 33 71 7a dd 61 46
                                                  Data Ascii: [n XR`B()bd<0iY*N9gFOE&@J3qzaF7?c?*Fz.n4!o\^SB{Khe4YI;m!4!E7|DYxG-p^Ex|-7`W+eNyo)>B{M}d7+!b
                                                  Jul 22, 2024 12:34:22.469711065 CEST1236INData Raw: d9 f1 0d f2 cd 8b 7f f7 b6 98 c7 c1 2e 46 4c 04 e1 52 53 e8 31 ab f3 fd 1e 50 ae ac e4 a8 8c 7d 9f c2 dc 2c 9b 36 53 33 93 96 4b a3 f9 25 dc 96 6a 20 3c 9f 19 2e 65 dc 6d 56 82 93 8b 90 02 e9 05 20 b3 a1 bb aa 82 24 88 80 b4 43 4a 75 4a ab 0a 5e
                                                  Data Ascii: .FLRS1P},6S3K%j <.emV $CJuJ^G82;is9fF/jvr<`U+WGSgw3(ur}F]}dXJ4frDt]{^IE6!GSa$owdu~JB<|=j^o


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  22192.168.2.449810104.19.208.15280940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:22.709925890 CEST89OUTGET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Jul 22, 2024 12:34:23.788774014 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:23 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 17770
                                                  Connection: keep-alive
                                                  ETag: "770472110"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 393
                                                  Expires: Mon, 22 Jul 2024 14:34:23 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7269ac842a7-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 [TRUNCATED]
                                                  Data Ascii: PK:=AX7\0DrActiveFeatures.txt+@sjp#K1;/-[[ABexq)7 7:^gK !ibUVsO$v7|e\W'ZdveU*oR>%w$-;Q4Tf$+T$&Q?9#"6>0o@j(*i)H"B1`=&0I8CR"ycM7g\@8xE4S|Iyy7~%W?7!JhrfdB^OQ"IDG!o+^6VY6<wNNPP2\?EY^j>i[p`L_sXq>#~nY>LO9rsAS+g5FBiqgUf{*vBUBqTpKF;/[&WIAPuS-&v3!Y'bMl{[:5sVL3om7'O4'(V#:\#VOO&<s}Yd|<P@jM%O5lHs^SYfaCDDwVcE8~cETL0YIEd@._PQ~w\fAT7Kiywq|+#]N">(A0bU-lDM#ETYa-h}ep<),
                                                  Jul 22, 2024 12:34:23.788794041 CEST1236INData Raw: c3 e9 0b b5 94 79 f6 cd ab db ef 95 d6 d1 32 bc 03 27 b0 a7 67 bb 67 5c 5f 47 4a 97 f1 f7 fc 80 a5 3d 5e cb d2 21 fd 16 4d f6 ed 94 f2 d0 41 ec b6 8d 9b cb af 44 4b 5e 3f 92 fc ae 08 db 64 a5 1d 86 78 29 a2 a9 c5 2d c1 7a 36 38 e0 81 84 1a 34 f5
                                                  Data Ascii: y2'gg\_GJ=^!MADK^?dx)-z684R|YSgynUf1qbEFO?'[a`bF\rsZL0q\vgrP:ZbPw^l^|Vov^'D0\mJh*I{X14
                                                  Jul 22, 2024 12:34:23.788810015 CEST1236INData Raw: e3 09 b7 93 e7 ef 55 87 a5 e2 4a 0e 55 3c 50 4f 28 65 ca 9a de 34 88 d5 59 ab cd 64 54 2a 94 93 b6 b8 c7 f1 34 a6 fe 9a 9e 58 e1 5b 68 04 08 88 1d 07 7a 22 8c f4 8b 1a 37 f4 2d 18 02 f7 c9 7a e3 8d 30 e6 e5 c6 72 4a b5 33 12 97 f2 9b 9f 3d 2b 49
                                                  Data Ascii: UJU<PO(e4YdT*4X[hz"7-z0rJ3=+I:QrVjeAU|0e r.-nFs%U@_G~W}E^ns]W6.Jg4)Kk~9"4{i#W}_&L'HNOp
                                                  Jul 22, 2024 12:34:23.788820982 CEST1236INData Raw: a2 40 45 ad 3e 10 cc d4 22 b8 18 aa b5 83 15 5b 5f 79 62 da f6 64 de 89 40 91 c6 e3 e6 3c 48 f6 f2 37 d0 b4 a2 87 ed 8b 72 11 f9 fa 1d 84 ca dd 63 7c e6 56 65 74 e8 c3 ce 0a 52 78 3d f5 2c 69 ad 82 46 5f 21 19 b5 ed d3 bf 7e 98 76 8d 6a 94 b7 ed
                                                  Data Ascii: @E>"[_ybd@<H7rc|VetRx=,iF_!~vj5s,yL/[g{QosVz%{A|PSeC)PYzSZ/]E?kINr|Pg!\2-;@&Lb<maS
                                                  Jul 22, 2024 12:34:23.788832903 CEST1236INData Raw: ef ec e3 a3 78 02 50 1e 6e 18 3a c8 ef 40 01 47 df 2f 67 75 81 ee e7 ed 5c 86 a7 cd ff 50 b9 61 08 00 fa a5 b9 0e 2f 50 8f 87 fd 80 44 ec bf 7d 28 a2 50 86 c4 d0 81 34 04 f9 9d 19 90 5d 6c c8 6f a3 82 62 5f 8a 77 97 ae e6 15 32 ec 5b 3c d5 d1 50
                                                  Data Ascii: xPn:@G/gu\Pa/PD}(P4]lob_w2[<Pz|<gzX],af!:$uMs)m74Tf8Q0Ee@>i~p#D'uma{4q-x.{W)x,0Fm'*wTn
                                                  Jul 22, 2024 12:34:23.788935900 CEST1236INData Raw: ea fe e8 9b 44 1e 62 80 9f 85 5d b4 ed 54 9a 62 26 5d f9 5f e9 66 31 79 1a ec 5d eb 3b 42 de 2a 12 2f 99 5a 51 ad 2c 4e fc b2 cd 25 8a df 0b d7 07 24 1e 16 60 15 f2 23 fe 84 ec 28 ca cb ea 25 a1 6f 30 22 39 cc 4f eb 80 ec b0 87 73 03 c9 e2 6f cb
                                                  Data Ascii: Db]Tb&]_f1y];B*/ZQ,N%$`#(%o0"9OsosUN^m9N)&8))QK}b9"@T~yu?V7j7y)vJ_EEW58X+:CP~T,{/s" a*=_lJ
                                                  Jul 22, 2024 12:34:23.788947105 CEST1236INData Raw: c6 ac fb 85 2b c7 a3 2f 2f d9 73 66 a6 d5 b3 dc bc 4c 89 64 2f f9 a1 b7 40 bf dd 84 b3 f4 0d 92 fa d2 49 45 fc 27 f8 14 9d 3f bd 02 3a c4 6a 3c 68 f4 ec 55 d8 20 1b ea 58 1f 15 63 0c 4e fc 76 39 e9 cc 71 40 69 5b b9 5b c5 4e 6d 50 82 e3 2b 3d 15
                                                  Data Ascii: +//sfLd/@IE'?:j<hU XcNv9q@i[[NmP+=127ZS$rHxh7[m15'1Z91 #%|^s\obPTPUO:$9pgLNTKqmc_xE]uUW\&6Ijo
                                                  Jul 22, 2024 12:34:23.788959026 CEST1236INData Raw: e7 41 3d ce 7d 33 4d 0f 6d da 2d 57 cd 6d 7c 72 20 41 5f e2 85 cb 48 2a 2c 1b 25 2d ea 0b 8c 30 58 68 ec 5b 67 54 17 0b 09 36 f0 a1 5f 55 d0 81 77 eb 76 58 90 be 59 9e ba 3f be 84 2b 42 29 6f 5c df c6 42 5f 49 8a 9f 97 26 07 55 9d da 50 6a e6 dc
                                                  Data Ascii: A=}3Mm-Wm|r A_H*,%-0Xh[gT6_UwvXY?+B)o\B_I&UPj?n,\_%N&gFx!7^"*w/:=\-?2$(<9#oPa7Z+iIU1B($k!XdI<#7s(,\~1~@SfHTn
                                                  Jul 22, 2024 12:34:23.788969994 CEST1236INData Raw: 20 19 6a 5f 78 89 c4 93 e5 38 5a 6e de 37 da e2 c6 06 b0 e8 f5 8e ec 2a 4d 52 53 7c c0 ce f1 b1 9d 84 d3 91 ba fc 29 13 39 6d 22 59 ca f4 90 ba 24 c3 b5 86 27 17 f3 8a b2 8c 0f d9 b9 6d 97 6d 9b 96 f5 eb e7 ae 0b 71 31 03 84 41 72 7d a7 8d f4 99
                                                  Data Ascii: j_x8Zn7*MRS|)9m"Y$'mmq1Ar}sWC@T^n2I%j+r|kpjq%<OjYSO)o+`qK18oLXG#F?sTds%>qWY2qf[n XR`
                                                  Jul 22, 2024 12:34:23.788981915 CEST1236INData Raw: d1 d2 9b 08 03 2c 5a d5 0d b5 24 ba 57 06 e9 82 13 06 b8 76 cd 11 85 df 30 60 c7 4a 68 fc 62 33 d3 a3 33 4a 36 3d a8 67 bb a3 56 33 7d 3d 9a 83 2c 2e ab 79 ba 0d fb 01 11 b8 6d 84 ce cd 88 2e 7d f5 4f 3e 3e d1 e4 3c 13 83 fa 27 77 82 c7 e2 d9 4b
                                                  Data Ascii: ,Z$Wv0`Jhb33J6=gV3}=,.ym.}O>><'wK\U}&El?<tl%}v%HSA*gH(vqd00Dan~Jlax_K9#+Rfl?uhLO{.FLRS
                                                  Jul 22, 2024 12:34:23.788995028 CEST1236INData Raw: 12 42 b8 dd e5 1f 9e 6b 33 d0 27 64 66 67 09 75 13 4e 4f e9 2f 56 c0 a1 26 a6 e7 0f 48 59 99 5e 9a 7b ee 13 0a e1 b2 7e 95 bf 06 41 45 43 c3 c5 43 45 37 b4 fd 4d f1 ee 9a 9c 98 53 15 42 01 8c fa ef a5 44 d0 97 33 99 81 2a 36 6b 2c 46 c1 0c 71 2f
                                                  Data Ascii: Bk3'dfguNO/V&HY^{~AECCE7MSBD3*6k,Fq/D:-E|OylOR-BS)2,o(P.Ibk@1F] 9X&;/<MZ5 `CLg`h*EH=|EZpoC/j{1,u;
                                                  Jul 22, 2024 12:34:23.789113998 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:23 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 17770
                                                  Connection: keep-alive
                                                  ETag: "770472110"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 393
                                                  Expires: Mon, 22 Jul 2024 14:34:23 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7269ac842a7-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 [TRUNCATED]
                                                  Data Ascii: PK:=AX7\0DrActiveFeatures.txt+@sjp#K1;/-[[ABexq)7 7:^gK !ibUVsO$v7|e\W'ZdveU*oR>%w$-;Q4Tf$+T$&Q?9#"6>0o@j(*i)H"B1`=&0I8CR"ycM7g\@8xE4S|Iyy7~%W?7!JhrfdB^OQ"IDG!o+^6VY6<wNNPP2\?EY^j>i[p`L_sXq>#~nY>LO9rsAS+g5FBiqgUf{*vBUBqTpKF;/[&WIAPuS-&v3!Y'bMl{[:5sVL3om7'O4'(V#:\#VOO&<s}Yd|<P@jM%O5lHs^SYfaCDDwVcE8~cETL0YIEd@._PQ~w\fAT7Kiywq|+#]N">(A0bU-lDM#ETYa-h}ep<),


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  23192.168.2.449813104.16.149.13080940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:28.419928074 CEST155OUTPOST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 239
                                                  Jul 22, 2024 12:34:28.428163052 CEST239OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","CurrentSearch":"Google","CurrentHomepage":"about:home","LanguageIso2":"en-GB","IP":null,"CreateDate":0}}


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  24192.168.2.449818104.16.149.13080940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:28.708619118 CEST155OUTPOST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 239
                                                  Jul 22, 2024 12:34:28.713506937 CEST239OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","CurrentSearch":"Google","CurrentHomepage":"about:home","LanguageIso2":"en-GB","IP":null,"CreateDate":0}}


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  25192.168.2.449819104.19.208.15280940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:28.840260983 CEST129OUTGET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Connection: Keep-Alive
                                                  Jul 22, 2024 12:34:29.321407080 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:29 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 9891
                                                  Connection: keep-alive
                                                  ETag: "3914547665"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 96
                                                  Expires: Mon, 22 Jul 2024 14:34:29 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c74cdc91c32a-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d [TRUNCATED]
                                                  Data Ascii: PKIX6%FeatureActions.txtBPZ&KE9(0p<a}9g<D)9k@4y'!=~Zk`1J2[)_,{FF?q;fL*=1ZI->m%>`ml,sWITPu*;Pxxhgl$M]I}ogZL5?BZLxukU1P4mW-Ntf?I-/!w90/^%X-.0(mVPn]=cr_A$<BWye2bK{jOdxZv@[NLDU|_1Sp~Paq>})$qH7,hm)Ias<TWu$?Ey@Xu@5*UJLja0v^Q (O}k+fwvfzbhFE<plLWZI*.4#,X`=beVW)W*;Q,'x>Jq _T<ea&wo/RM2`rXFEc:A97A4FT0@wuJIBd5Bhw}oE@N=Z$)6@sXru%eIg5ruA:81&"e_'Be
                                                  Jul 22, 2024 12:34:29.321419001 CEST1236INData Raw: 27 91 1f 4b c3 11 60 77 a1 43 f9 f7 10 07 63 36 80 1a 86 ad 48 a7 d3 8f 6f 01 ae 9e 9c 3f a2 79 6e 3b 81 f2 7e 33 72 dc 17 7b 3c b2 f2 80 9b 26 a0 a9 76 69 9d e2 6e 9e 4d 47 96 36 9b c5 b5 27 68 b5 b4 84 34 1c 56 23 a3 50 e1 9f 24 02 89 9a 6e b0
                                                  Data Ascii: 'K`wCc6Ho?yn;~3r{<&vinMG6'h4V#P$n/Kt'<4oOa"xGTVBfE<eG#Bw{#@mc]os}uE6@e`^](9A,NjbNYnOF\8p"CLFk
                                                  Jul 22, 2024 12:34:29.321429014 CEST1236INData Raw: ac 50 d8 52 44 ee 8b 8f d4 d8 b2 84 d1 cb d6 f7 f8 05 a5 aa 41 48 05 36 3c 93 56 87 e3 e6 2f 47 40 72 47 91 28 bd 1e de c7 43 06 15 aa c9 07 7f 4b 86 10 6b 1f 41 44 6f 91 db 30 a2 f9 46 11 1a 4b 58 16 a1 31 d1 5e b4 59 ca fc 47 fc bc 25 05 70 a5
                                                  Data Ascii: PRDAH6<V/G@rG(CKkADo0FKX1^YG%p8P*rH|idu{"PBv`DWG&O*rD:V4#{>51Zy4U-&SSIgFkZpYN~L-6Fed~ex>3
                                                  Jul 22, 2024 12:34:29.321535110 CEST1236INData Raw: a8 b4 43 f7 18 27 39 99 b5 09 5b b0 21 e4 89 cd dc d8 80 8f ba 2c 76 5f 49 78 e0 a0 e6 a4 e8 61 8a 0a 7d 07 ae 7f 5b db 69 5b ab 4d 22 92 db 0e dc 5e ef db 36 83 5e 63 58 81 45 75 40 0c 8a 74 59 c3 e4 31 78 2a c9 f9 39 82 db c7 d7 e1 67 09 f5 da
                                                  Data Ascii: C'9[!,v_Ixa}[i[M"^6^cXEu@tY1x*9g&LIY+5kR@v<a.{G`#|<rPgAn><AhcF1NG_d~JFS}=l-z%Q\)Zm?)^afu
                                                  Jul 22, 2024 12:34:29.321549892 CEST1236INData Raw: a2 95 4e ba 4b 5c 16 c5 a5 51 be 5a 39 45 dd 17 61 63 b5 65 bb 34 9f 6d 7c 76 0b e7 cf 8a 28 b1 32 a3 4c 94 f3 9c 2d 3a d8 05 c3 70 d8 b9 9e ea 5e e2 8b aa 76 16 1e 66 9d 5b 09 8d b4 bd 0c df a4 f1 57 38 11 41 42 5a 8f 27 30 7a 45 dd 2c af 7e 69
                                                  Data Ascii: NK\QZ9Eace4m|v(2L-:p^vf[W8ABZ'0zE,~iY~^UiH-E`79_ue_f!t,f-X9^y0jgsotF8rUFX3\"T5p3WJBORFv
                                                  Jul 22, 2024 12:34:29.321559906 CEST1236INData Raw: 53 b8 3f 1e d4 8d 8b fb 22 dd 51 13 da db 37 c1 6d 8a c5 7d 9b 47 42 3f 8e c9 f0 52 59 f2 14 2a 9e 75 2e 6a 2e 7b 93 ce 8d 7f 03 7e d5 5c fc 25 45 10 44 72 a8 87 1c d2 e8 6e 79 f4 3a 12 2f 87 97 f4 7d 88 08 2a 70 f8 25 43 fc 4b 2d f3 25 a3 5d 46
                                                  Data Ascii: S?"Q7m}GB?RY*u.j.{~\%EDrny:/}*p%CK-%]F?TSkSG-^Bgv[1K+k9v&plE0P8t}BnUJXhBDBlfbG7Fsq3BI{?3>n
                                                  Jul 22, 2024 12:34:29.321569920 CEST776INData Raw: 44 c0 9d 35 87 31 5c f2 45 f9 c7 ef 27 c4 f0 44 cb 1d 0f 1c d1 37 2a fd 7f 20 4f 38 65 99 02 a1 9a ea fd 15 94 74 5c 15 e4 8a 30 a5 11 66 30 df 52 31 9c c6 28 24 8c 3e 6f 18 50 ce cd 5b 40 65 9a 59 06 f5 bf 1e 38 1f 30 99 1f 31 4f 2a 69 da 0b 94
                                                  Data Ascii: D51\E'D7* O8et\0f0R1($>oP[@eY801O*iT2@#l0*z<F4a/dUF5iAzDScUSK:;{qQ.29h}w$/SZ24d2%h@"IT*w;W<-f.7p=ei ^C\aP`RyHaC!
                                                  Jul 22, 2024 12:34:29.321582079 CEST1236INData Raw: 8e 72 29 8a c0 1d 3f 7c b1 47 79 69 06 1b 3b 20 2d d3 80 fd 5e 0a 7f 7f e8 ac f4 e0 91 49 12 b0 45 b9 40 ab 32 8c 4a 2c dd e0 c4 f6 c7 5b a6 da 77 23 f9 11 08 27 df 00 b7 d1 0d 68 61 65 ca f5 94 2c 49 3c 23 b4 dd 71 44 19 8b 85 07 c3 c3 a6 5d fb
                                                  Data Ascii: r)?|Gyi; -^IE@2J,[w#'hae,I<#qD]qHo;p,jU_lMhL)BBJLrKgUCb`oRg#{u$KG*0[F1#>#>!kH|$1YfA
                                                  Jul 22, 2024 12:34:29.321590900 CEST843INData Raw: a7 f3 80 a8 8b 39 a9 af ac 8e 4d da 0c 3c 6c 36 b0 93 fa 50 57 5d e6 d6 54 d3 bb 51 f7 01 1d 87 fa 6c b7 82 35 42 59 dd 7f d6 79 6b 59 93 d4 fb e9 e3 20 7b d7 09 a6 58 da ea fc 4e 90 3d 02 ef 8f ea cd 54 72 61 9d c2 bb 32 3c b4 4d 8e a9 d3 78 89
                                                  Data Ascii: 9M<l6PW]TQl5BYykY {XN=Tra2<MxC)Z}-&%djyiwm^G<s 1u%pv#"SQd$S$!kUnf^RnG\vb&%65VXV@ha;aOiM3+EtU{o$o
                                                  Jul 22, 2024 12:34:29.516951084 CEST105OUTGET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Jul 22, 2024 12:34:29.626930952 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:29 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 9891
                                                  Connection: keep-alive
                                                  ETag: "3914547665"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 96
                                                  Expires: Mon, 22 Jul 2024 14:34:29 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c74ecd76c32a-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d [TRUNCATED]
                                                  Data Ascii: PKIX6%FeatureActions.txtBPZ&KE9(0p<a}9g<D)9k@4y'!=~Zk`1J2[)_,{FF?q;fL*=1ZI->m%>`ml,sWITPu*;Pxxhgl$M]I}ogZL5?BZLxukU1P4mW-Ntf?I-/!w90/^%X-.0(mVPn]=cr_A$<BWye2bK{jOdxZv@[NLDU|_1Sp~Paq>})$qH7,hm)Ias<TWu$?Ey@Xu@5*UJLja0v^Q (O}k+fwvfzbhFE<plLWZI*.4#,X`=beVW)W*;Q,'x>Jq _T<ea&wo/RM2`rXFEc:A97A4FT0@wuJIBd5Bhw}oE@N=Z$)6@sXru%eIg5ruA:81&"e_'Be
                                                  Jul 22, 2024 12:34:29.626948118 CEST1236INData Raw: 27 91 1f 4b c3 11 60 77 a1 43 f9 f7 10 07 63 36 80 1a 86 ad 48 a7 d3 8f 6f 01 ae 9e 9c 3f a2 79 6e 3b 81 f2 7e 33 72 dc 17 7b 3c b2 f2 80 9b 26 a0 a9 76 69 9d e2 6e 9e 4d 47 96 36 9b c5 b5 27 68 b5 b4 84 34 1c 56 23 a3 50 e1 9f 24 02 89 9a 6e b0
                                                  Data Ascii: 'K`wCc6Ho?yn;~3r{<&vinMG6'h4V#P$n/Kt'<4oOa"xGTVBfE<eG#Bw{#@mc]os}uE6@e`^](9A,NjbNYnOF\8p"CLFk
                                                  Jul 22, 2024 12:34:29.626956940 CEST1236INData Raw: ac 50 d8 52 44 ee 8b 8f d4 d8 b2 84 d1 cb d6 f7 f8 05 a5 aa 41 48 05 36 3c 93 56 87 e3 e6 2f 47 40 72 47 91 28 bd 1e de c7 43 06 15 aa c9 07 7f 4b 86 10 6b 1f 41 44 6f 91 db 30 a2 f9 46 11 1a 4b 58 16 a1 31 d1 5e b4 59 ca fc 47 fc bc 25 05 70 a5
                                                  Data Ascii: PRDAH6<V/G@rG(CKkADo0FKX1^YG%p8P*rH|idu{"PBv`DWG&O*rD:V4#{>51Zy4U-&SSIgFkZpYN~L-6Fed~ex>3


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  26192.168.2.449820104.16.149.13080940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:28.888401031 CEST155OUTPOST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 239
                                                  Jul 22, 2024 12:34:28.893280983 CEST239OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","CurrentSearch":"Google","CurrentHomepage":"about:home","LanguageIso2":"en-GB","IP":null,"CreateDate":0}}


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  27192.168.2.449821104.19.208.15280940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:29.005491018 CEST113OUTGET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Connection: Keep-Alive
                                                  Jul 22, 2024 12:34:29.494584084 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:29 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 17770
                                                  Connection: keep-alive
                                                  ETag: "770472110"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 399
                                                  Expires: Mon, 22 Jul 2024 14:34:29 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c74dfe1a198e-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 [TRUNCATED]
                                                  Data Ascii: PK:=AX7\0DrActiveFeatures.txt+@sjp#K1;/-[[ABexq)7 7:^gK !ibUVsO$v7|e\W'ZdveU*oR>%w$-;Q4Tf$+T$&Q?9#"6>0o@j(*i)H"B1`=&0I8CR"ycM7g\@8xE4S|Iyy7~%W?7!JhrfdB^OQ"IDG!o+^6VY6<wNNPP2\?EY^j>i[p`L_sXq>#~nY>LO9rsAS+g5FBiqgUf{*vBUBqTpKF;/[&WIAPuS-&v3!Y'bMl{[:5sVL3om7'O4'(V#:\#VOO&<s}Yd|<P@jM%O5lHs^SYfaCDDwVcE8~cETL0YIEd@._PQ~w\fAT7Kiywq|+#]N">(A0bU-lDM#ETYa-h}ep<),
                                                  Jul 22, 2024 12:34:29.494761944 CEST1236INData Raw: c3 e9 0b b5 94 79 f6 cd ab db ef 95 d6 d1 32 bc 03 27 b0 a7 67 bb 67 5c 5f 47 4a 97 f1 f7 fc 80 a5 3d 5e cb d2 21 fd 16 4d f6 ed 94 f2 d0 41 ec b6 8d 9b cb af 44 4b 5e 3f 92 fc ae 08 db 64 a5 1d 86 78 29 a2 a9 c5 2d c1 7a 36 38 e0 81 84 1a 34 f5
                                                  Data Ascii: y2'gg\_GJ=^!MADK^?dx)-z684R|YSgynUf1qbEFO?'[a`bF\rsZL0q\vgrP:ZbPw^l^|Vov^'D0\mJh*I{X14
                                                  Jul 22, 2024 12:34:29.494772911 CEST1236INData Raw: e3 09 b7 93 e7 ef 55 87 a5 e2 4a 0e 55 3c 50 4f 28 65 ca 9a de 34 88 d5 59 ab cd 64 54 2a 94 93 b6 b8 c7 f1 34 a6 fe 9a 9e 58 e1 5b 68 04 08 88 1d 07 7a 22 8c f4 8b 1a 37 f4 2d 18 02 f7 c9 7a e3 8d 30 e6 e5 c6 72 4a b5 33 12 97 f2 9b 9f 3d 2b 49
                                                  Data Ascii: UJU<PO(e4YdT*4X[hz"7-z0rJ3=+I:QrVjeAU|0e r.-nFs%U@_G~W}E^ns]W6.Jg4)Kk~9"4{i#W}_&L'HNOp
                                                  Jul 22, 2024 12:34:29.494785070 CEST1236INData Raw: a2 40 45 ad 3e 10 cc d4 22 b8 18 aa b5 83 15 5b 5f 79 62 da f6 64 de 89 40 91 c6 e3 e6 3c 48 f6 f2 37 d0 b4 a2 87 ed 8b 72 11 f9 fa 1d 84 ca dd 63 7c e6 56 65 74 e8 c3 ce 0a 52 78 3d f5 2c 69 ad 82 46 5f 21 19 b5 ed d3 bf 7e 98 76 8d 6a 94 b7 ed
                                                  Data Ascii: @E>"[_ybd@<H7rc|VetRx=,iF_!~vj5s,yL/[g{QosVz%{A|PSeC)PYzSZ/]E?kINr|Pg!\2-;@&Lb<maS
                                                  Jul 22, 2024 12:34:29.494795084 CEST1236INData Raw: ef ec e3 a3 78 02 50 1e 6e 18 3a c8 ef 40 01 47 df 2f 67 75 81 ee e7 ed 5c 86 a7 cd ff 50 b9 61 08 00 fa a5 b9 0e 2f 50 8f 87 fd 80 44 ec bf 7d 28 a2 50 86 c4 d0 81 34 04 f9 9d 19 90 5d 6c c8 6f a3 82 62 5f 8a 77 97 ae e6 15 32 ec 5b 3c d5 d1 50
                                                  Data Ascii: xPn:@G/gu\Pa/PD}(P4]lob_w2[<Pz|<gzX],af!:$uMs)m74Tf8Q0Ee@>i~p#D'uma{4q-x.{W)x,0Fm'*wTn
                                                  Jul 22, 2024 12:34:29.494805098 CEST1236INData Raw: ea fe e8 9b 44 1e 62 80 9f 85 5d b4 ed 54 9a 62 26 5d f9 5f e9 66 31 79 1a ec 5d eb 3b 42 de 2a 12 2f 99 5a 51 ad 2c 4e fc b2 cd 25 8a df 0b d7 07 24 1e 16 60 15 f2 23 fe 84 ec 28 ca cb ea 25 a1 6f 30 22 39 cc 4f eb 80 ec b0 87 73 03 c9 e2 6f cb
                                                  Data Ascii: Db]Tb&]_f1y];B*/ZQ,N%$`#(%o0"9OsosUN^m9N)&8))QK}b9"@T~yu?V7j7y)vJ_EEW58X+:CP~T,{/s" a*=_lJ
                                                  Jul 22, 2024 12:34:29.494951010 CEST776INData Raw: c6 ac fb 85 2b c7 a3 2f 2f d9 73 66 a6 d5 b3 dc bc 4c 89 64 2f f9 a1 b7 40 bf dd 84 b3 f4 0d 92 fa d2 49 45 fc 27 f8 14 9d 3f bd 02 3a c4 6a 3c 68 f4 ec 55 d8 20 1b ea 58 1f 15 63 0c 4e fc 76 39 e9 cc 71 40 69 5b b9 5b c5 4e 6d 50 82 e3 2b 3d 15
                                                  Data Ascii: +//sfLd/@IE'?:j<hU XcNv9q@i[[NmP+=127ZS$rHxh7[m15'1Z91 #%|^s\obPTPUO:$9pgLNTKqmc_xE]uUW\&6Ijo
                                                  Jul 22, 2024 12:34:29.494963884 CEST1236INData Raw: d8 55 39 07 81 24 01 07 44 95 57 e7 60 2b d2 a5 bd 52 20 06 5d 6d 80 a3 f0 2d 04 be f6 c4 36 f1 38 a7 eb 6a 35 61 be 2e 7c 73 13 4f 8d 09 88 42 b0 bd 85 7e 1c 31 f2 7a d1 7f a9 63 dd 5b 75 a3 67 d4 de b1 93 51 3e b1 c5 0d 54 c8 76 fd 9b 11 7e 11
                                                  Data Ascii: U9$DW`+R ]m-68j5a.|sOB~1zc[ugQ>Tv~Fa&<pX caENsE0aUC3WE4eP0!W%]VKw7u:Uw`=n&l\r\0kXL0n)vneEw6h,{>Vo
                                                  Jul 22, 2024 12:34:29.494973898 CEST1236INData Raw: e7 b7 5b 52 84 a3 65 20 65 10 bf a4 cf 1e 23 cf 87 ab 48 1a 64 35 a1 c4 c9 49 17 07 2e 2a b5 70 13 92 00 da b1 7b 6f cb 09 2e 48 8a 27 c7 e5 2a 7c 61 32 06 ef 8d ef 69 86 b1 a5 5a cf 14 e3 2e be 59 f3 70 3f 58 1f f9 19 c3 e4 d6 3d d0 5b 49 5c 56
                                                  Data Ascii: [Re e#Hd5I.*p{o.H'*|a2iZ.Yp?X=[I\V~^{z7F: G5C*w 0sB=z+K3wV}aS)BlUD`a%z1-/a{aZ@";AsW_DL[hArN~+;6]._
                                                  Jul 22, 2024 12:34:29.494985104 CEST1236INData Raw: 18 76 dd 0b 34 ab e4 4a 6f f1 34 d1 63 c7 18 e9 2b a2 3b 4a 7c 23 0f 05 ff 30 bf 2c 4e b5 39 8b 92 8a 8a b6 4d 75 f8 02 27 6c 5e b0 df 44 bd 46 0b 0d 9a 2b 69 4c cf 34 03 5c 57 42 3e a3 89 54 04 6f 2a 2b 68 02 69 ad c5 d9 c8 9b 5a 61 a1 3b 90 0a
                                                  Data Ascii: v4Jo4c+;J|#0,N9Mu'l^DF+iL4\WB>To*+hiZa;;-c.T12=ZLXZbdBNRyib[FEv.=K36A#:O;#MjJ?N7k]^0huT [^o}
                                                  Jul 22, 2024 12:34:29.500010014 CEST1236INData Raw: b8 b3 f7 91 1f 9d 29 cb f6 de b0 17 73 f0 26 f7 4b 69 cd 63 ec 41 5d 59 62 41 b8 60 3e 59 3c dd 80 84 98 78 c8 c6 f1 43 62 44 9e 73 2d ca 48 10 af 3a 9a 06 4a ab 30 bb 10 e4 53 db 19 2b 39 c0 86 cd 79 20 1a 1e 93 96 68 8b 8b 89 11 98 38 0e cc 2e
                                                  Data Ascii: )s&KicA]YbA`>Y<xCbDs-H:J0S+9y h8.7BmJPl/T5(^,Ke}g#:zEf!%Zwk=6^d$?.a"hZLjMl:a]J!`wVRDwa*|bM#lx


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  28192.168.2.449824104.16.149.13080940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:29.136393070 CEST155OUTPOST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 239
                                                  Jul 22, 2024 12:34:29.136847019 CEST239OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","CurrentSearch":"Google","CurrentHomepage":"about:home","LanguageIso2":"en-GB","IP":null,"CreateDate":0}}


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  29192.168.2.449825104.16.149.13080940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:29.149046898 CEST155OUTPOST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 239
                                                  Jul 22, 2024 12:34:29.153959036 CEST239OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","CurrentSearch":"Google","CurrentHomepage":"about:home","LanguageIso2":"en-GB","IP":null,"CreateDate":0}}


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  30192.168.2.449836104.19.208.15280940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:29.538484097 CEST89OUTGET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1
                                                  Host: rt.webcompanion.com


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  31192.168.2.449837104.16.149.13080940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:29.938364029 CEST179OUTPOST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 239
                                                  Connection: Keep-Alive
                                                  Jul 22, 2024 12:34:29.946142912 CEST239OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","CurrentSearch":"Google","CurrentHomepage":"about:home","LanguageIso2":"en-GB","IP":null,"CreateDate":0}}


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  32192.168.2.449838104.16.149.13080940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:29.963999033 CEST179OUTPOST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 239
                                                  Connection: Keep-Alive
                                                  Jul 22, 2024 12:34:29.968826056 CEST239OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","CurrentSearch":"Google","CurrentHomepage":"about:home","LanguageIso2":"en-GB","IP":null,"CreateDate":0}}


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  33192.168.2.449843104.19.208.15280940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:30.165419102 CEST113OUTGET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Connection: Keep-Alive
                                                  Jul 22, 2024 12:34:30.699486017 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:30 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 17770
                                                  Connection: keep-alive
                                                  ETag: "770472110"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 400
                                                  Expires: Mon, 22 Jul 2024 14:34:30 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7550ab041f8-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 [TRUNCATED]
                                                  Data Ascii: PK:=AX7\0DrActiveFeatures.txt+@sjp#K1;/-[[ABexq)7 7:^gK !ibUVsO$v7|e\W'ZdveU*oR>%w$-;Q4Tf$+T$&Q?9#"6>0o@j(*i)H"B1`=&0I8CR"ycM7g\@8xE4S|Iyy7~%W?7!JhrfdB^OQ"IDG!o+^6VY6<wNNPP2\?EY^j>i[p`L_sXq>#~nY>LO9rsAS+g5FBiqgUf{*vBUBqTpKF;/[&WIAPuS-&v3!Y'bMl{[:5sVL3om7'O4'(V#:\#VOO&<s}Yd|<P@jM%O5lHs^SYfaCDDwVcE8~cETL0YIEd@._PQ~w\fAT7Kiywq|+#]N">(A0bU-lDM#ETYa-h}ep<),
                                                  Jul 22, 2024 12:34:30.699507952 CEST1236INData Raw: c3 e9 0b b5 94 79 f6 cd ab db ef 95 d6 d1 32 bc 03 27 b0 a7 67 bb 67 5c 5f 47 4a 97 f1 f7 fc 80 a5 3d 5e cb d2 21 fd 16 4d f6 ed 94 f2 d0 41 ec b6 8d 9b cb af 44 4b 5e 3f 92 fc ae 08 db 64 a5 1d 86 78 29 a2 a9 c5 2d c1 7a 36 38 e0 81 84 1a 34 f5
                                                  Data Ascii: y2'gg\_GJ=^!MADK^?dx)-z684R|YSgynUf1qbEFO?'[a`bF\rsZL0q\vgrP:ZbPw^l^|Vov^'D0\mJh*I{X14
                                                  Jul 22, 2024 12:34:30.699520111 CEST1236INData Raw: e3 09 b7 93 e7 ef 55 87 a5 e2 4a 0e 55 3c 50 4f 28 65 ca 9a de 34 88 d5 59 ab cd 64 54 2a 94 93 b6 b8 c7 f1 34 a6 fe 9a 9e 58 e1 5b 68 04 08 88 1d 07 7a 22 8c f4 8b 1a 37 f4 2d 18 02 f7 c9 7a e3 8d 30 e6 e5 c6 72 4a b5 33 12 97 f2 9b 9f 3d 2b 49
                                                  Data Ascii: UJU<PO(e4YdT*4X[hz"7-z0rJ3=+I:QrVjeAU|0e r.-nFs%U@_G~W}E^ns]W6.Jg4)Kk~9"4{i#W}_&L'HNOp
                                                  Jul 22, 2024 12:34:30.699590921 CEST1236INData Raw: a2 40 45 ad 3e 10 cc d4 22 b8 18 aa b5 83 15 5b 5f 79 62 da f6 64 de 89 40 91 c6 e3 e6 3c 48 f6 f2 37 d0 b4 a2 87 ed 8b 72 11 f9 fa 1d 84 ca dd 63 7c e6 56 65 74 e8 c3 ce 0a 52 78 3d f5 2c 69 ad 82 46 5f 21 19 b5 ed d3 bf 7e 98 76 8d 6a 94 b7 ed
                                                  Data Ascii: @E>"[_ybd@<H7rc|VetRx=,iF_!~vj5s,yL/[g{QosVz%{A|PSeC)PYzSZ/]E?kINr|Pg!\2-;@&Lb<maS
                                                  Jul 22, 2024 12:34:30.699604988 CEST1236INData Raw: ef ec e3 a3 78 02 50 1e 6e 18 3a c8 ef 40 01 47 df 2f 67 75 81 ee e7 ed 5c 86 a7 cd ff 50 b9 61 08 00 fa a5 b9 0e 2f 50 8f 87 fd 80 44 ec bf 7d 28 a2 50 86 c4 d0 81 34 04 f9 9d 19 90 5d 6c c8 6f a3 82 62 5f 8a 77 97 ae e6 15 32 ec 5b 3c d5 d1 50
                                                  Data Ascii: xPn:@G/gu\Pa/PD}(P4]lob_w2[<Pz|<gzX],af!:$uMs)m74Tf8Q0Ee@>i~p#D'uma{4q-x.{W)x,0Fm'*wTn
                                                  Jul 22, 2024 12:34:30.699615002 CEST1236INData Raw: ea fe e8 9b 44 1e 62 80 9f 85 5d b4 ed 54 9a 62 26 5d f9 5f e9 66 31 79 1a ec 5d eb 3b 42 de 2a 12 2f 99 5a 51 ad 2c 4e fc b2 cd 25 8a df 0b d7 07 24 1e 16 60 15 f2 23 fe 84 ec 28 ca cb ea 25 a1 6f 30 22 39 cc 4f eb 80 ec b0 87 73 03 c9 e2 6f cb
                                                  Data Ascii: Db]Tb&]_f1y];B*/ZQ,N%$`#(%o0"9OsosUN^m9N)&8))QK}b9"@T~yu?V7j7y)vJ_EEW58X+:CP~T,{/s" a*=_lJ
                                                  Jul 22, 2024 12:34:30.699625015 CEST776INData Raw: c6 ac fb 85 2b c7 a3 2f 2f d9 73 66 a6 d5 b3 dc bc 4c 89 64 2f f9 a1 b7 40 bf dd 84 b3 f4 0d 92 fa d2 49 45 fc 27 f8 14 9d 3f bd 02 3a c4 6a 3c 68 f4 ec 55 d8 20 1b ea 58 1f 15 63 0c 4e fc 76 39 e9 cc 71 40 69 5b b9 5b c5 4e 6d 50 82 e3 2b 3d 15
                                                  Data Ascii: +//sfLd/@IE'?:j<hU XcNv9q@i[[NmP+=127ZS$rHxh7[m15'1Z91 #%|^s\obPTPUO:$9pgLNTKqmc_xE]uUW\&6Ijo
                                                  Jul 22, 2024 12:34:30.699644089 CEST1236INData Raw: d8 55 39 07 81 24 01 07 44 95 57 e7 60 2b d2 a5 bd 52 20 06 5d 6d 80 a3 f0 2d 04 be f6 c4 36 f1 38 a7 eb 6a 35 61 be 2e 7c 73 13 4f 8d 09 88 42 b0 bd 85 7e 1c 31 f2 7a d1 7f a9 63 dd 5b 75 a3 67 d4 de b1 93 51 3e b1 c5 0d 54 c8 76 fd 9b 11 7e 11
                                                  Data Ascii: U9$DW`+R ]m-68j5a.|sOB~1zc[ugQ>Tv~Fa&<pX caENsE0aUC3WE4eP0!W%]VKw7u:Uw`=n&l\r\0kXL0n)vneEw6h,{>Vo
                                                  Jul 22, 2024 12:34:30.699657917 CEST1236INData Raw: e7 b7 5b 52 84 a3 65 20 65 10 bf a4 cf 1e 23 cf 87 ab 48 1a 64 35 a1 c4 c9 49 17 07 2e 2a b5 70 13 92 00 da b1 7b 6f cb 09 2e 48 8a 27 c7 e5 2a 7c 61 32 06 ef 8d ef 69 86 b1 a5 5a cf 14 e3 2e be 59 f3 70 3f 58 1f f9 19 c3 e4 d6 3d d0 5b 49 5c 56
                                                  Data Ascii: [Re e#Hd5I.*p{o.H'*|a2iZ.Yp?X=[I\V~^{z7F: G5C*w 0sB=z+K3wV}aS)BlUD`a%z1-/a{aZ@";AsW_DL[hArN~+;6]._
                                                  Jul 22, 2024 12:34:30.699667931 CEST1236INData Raw: 18 76 dd 0b 34 ab e4 4a 6f f1 34 d1 63 c7 18 e9 2b a2 3b 4a 7c 23 0f 05 ff 30 bf 2c 4e b5 39 8b 92 8a 8a b6 4d 75 f8 02 27 6c 5e b0 df 44 bd 46 0b 0d 9a 2b 69 4c cf 34 03 5c 57 42 3e a3 89 54 04 6f 2a 2b 68 02 69 ad c5 d9 c8 9b 5a 61 a1 3b 90 0a
                                                  Data Ascii: v4Jo4c+;J|#0,N9Mu'l^DF+iL4\WB>To*+hiZa;;-c.T12=ZLXZbdBNRyib[FEv.=K36A#:O;#MjJ?N7k]^0huT [^o}
                                                  Jul 22, 2024 12:34:30.699700117 CEST1236INData Raw: b8 b3 f7 91 1f 9d 29 cb f6 de b0 17 73 f0 26 f7 4b 69 cd 63 ec 41 5d 59 62 41 b8 60 3e 59 3c dd 80 84 98 78 c8 c6 f1 43 62 44 9e 73 2d ca 48 10 af 3a 9a 06 4a ab 30 bb 10 e4 53 db 19 2b 39 c0 86 cd 79 20 1a 1e 93 96 68 8b 8b 89 11 98 38 0e cc 2e
                                                  Data Ascii: )s&KicA]YbA`>Y<xCbDs-H:J0S+9y h8.7BmJPl/T5(^,Ke}g#:zEf!%Zwk=6^d$?.a"hZLjMl:a]J!`wVRDwa*|bM#lx


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  34192.168.2.449844104.19.208.15280940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:30.202756882 CEST129OUTGET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Connection: Keep-Alive
                                                  Jul 22, 2024 12:34:30.699846029 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:30 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 9891
                                                  Connection: keep-alive
                                                  ETag: "3914547665"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 97
                                                  Expires: Mon, 22 Jul 2024 14:34:30 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7556f4432f4-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d [TRUNCATED]
                                                  Data Ascii: PKIX6%FeatureActions.txtBPZ&KE9(0p<a}9g<D)9k@4y'!=~Zk`1J2[)_,{FF?q;fL*=1ZI->m%>`ml,sWITPu*;Pxxhgl$M]I}ogZL5?BZLxukU1P4mW-Ntf?I-/!w90/^%X-.0(mVPn]=cr_A$<BWye2bK{jOdxZv@[NLDU|_1Sp~Paq>})$qH7,hm)Ias<TWu$?Ey@Xu@5*UJLja0v^Q (O}k+fwvfzbhFE<plLWZI*.4#,X`=beVW)W*;Q,'x>Jq _T<ea&wo/RM2`rXFEc:A97A4FT0@wuJIBd5Bhw}oE@N=Z$)6@sXru%eIg5ruA:81&"e_'Be
                                                  Jul 22, 2024 12:34:30.699857950 CEST1236INData Raw: 27 91 1f 4b c3 11 60 77 a1 43 f9 f7 10 07 63 36 80 1a 86 ad 48 a7 d3 8f 6f 01 ae 9e 9c 3f a2 79 6e 3b 81 f2 7e 33 72 dc 17 7b 3c b2 f2 80 9b 26 a0 a9 76 69 9d e2 6e 9e 4d 47 96 36 9b c5 b5 27 68 b5 b4 84 34 1c 56 23 a3 50 e1 9f 24 02 89 9a 6e b0
                                                  Data Ascii: 'K`wCc6Ho?yn;~3r{<&vinMG6'h4V#P$n/Kt'<4oOa"xGTVBfE<eG#Bw{#@mc]os}uE6@e`^](9A,NjbNYnOF\8p"CLFk
                                                  Jul 22, 2024 12:34:30.699867964 CEST1236INData Raw: ac 50 d8 52 44 ee 8b 8f d4 d8 b2 84 d1 cb d6 f7 f8 05 a5 aa 41 48 05 36 3c 93 56 87 e3 e6 2f 47 40 72 47 91 28 bd 1e de c7 43 06 15 aa c9 07 7f 4b 86 10 6b 1f 41 44 6f 91 db 30 a2 f9 46 11 1a 4b 58 16 a1 31 d1 5e b4 59 ca fc 47 fc bc 25 05 70 a5
                                                  Data Ascii: PRDAH6<V/G@rG(CKkADo0FKX1^YG%p8P*rH|idu{"PBv`DWG&O*rD:V4#{>51Zy4U-&SSIgFkZpYN~L-6Fed~ex>3
                                                  Jul 22, 2024 12:34:30.699888945 CEST1236INData Raw: a8 b4 43 f7 18 27 39 99 b5 09 5b b0 21 e4 89 cd dc d8 80 8f ba 2c 76 5f 49 78 e0 a0 e6 a4 e8 61 8a 0a 7d 07 ae 7f 5b db 69 5b ab 4d 22 92 db 0e dc 5e ef db 36 83 5e 63 58 81 45 75 40 0c 8a 74 59 c3 e4 31 78 2a c9 f9 39 82 db c7 d7 e1 67 09 f5 da
                                                  Data Ascii: C'9[!,v_Ixa}[i[M"^6^cXEu@tY1x*9g&LIY+5kR@v<a.{G`#|<rPgAn><AhcF1NG_d~JFS}=l-z%Q\)Zm?)^afu
                                                  Jul 22, 2024 12:34:30.699901104 CEST1236INData Raw: a2 95 4e ba 4b 5c 16 c5 a5 51 be 5a 39 45 dd 17 61 63 b5 65 bb 34 9f 6d 7c 76 0b e7 cf 8a 28 b1 32 a3 4c 94 f3 9c 2d 3a d8 05 c3 70 d8 b9 9e ea 5e e2 8b aa 76 16 1e 66 9d 5b 09 8d b4 bd 0c df a4 f1 57 38 11 41 42 5a 8f 27 30 7a 45 dd 2c af 7e 69
                                                  Data Ascii: NK\QZ9Eace4m|v(2L-:p^vf[W8ABZ'0zE,~iY~^UiH-E`79_ue_f!t,f-X9^y0jgsotF8rUFX3\"T5p3WJBORFv
                                                  Jul 22, 2024 12:34:30.699912071 CEST1236INData Raw: 53 b8 3f 1e d4 8d 8b fb 22 dd 51 13 da db 37 c1 6d 8a c5 7d 9b 47 42 3f 8e c9 f0 52 59 f2 14 2a 9e 75 2e 6a 2e 7b 93 ce 8d 7f 03 7e d5 5c fc 25 45 10 44 72 a8 87 1c d2 e8 6e 79 f4 3a 12 2f 87 97 f4 7d 88 08 2a 70 f8 25 43 fc 4b 2d f3 25 a3 5d 46
                                                  Data Ascii: S?"Q7m}GB?RY*u.j.{~\%EDrny:/}*p%CK-%]F?TSkSG-^Bgv[1K+k9v&plE0P8t}BnUJXhBDBlfbG7Fsq3BI{?3>n
                                                  Jul 22, 2024 12:34:30.699917078 CEST1236INData Raw: 44 c0 9d 35 87 31 5c f2 45 f9 c7 ef 27 c4 f0 44 cb 1d 0f 1c d1 37 2a fd 7f 20 4f 38 65 99 02 a1 9a ea fd 15 94 74 5c 15 e4 8a 30 a5 11 66 30 df 52 31 9c c6 28 24 8c 3e 6f 18 50 ce cd 5b 40 65 9a 59 06 f5 bf 1e 38 1f 30 99 1f 31 4f 2a 69 da 0b 94
                                                  Data Ascii: D51\E'D7* O8et\0f0R1($>oP[@eY801O*iT2@#l0*z<F4a/dUF5iAzDScUSK:;{qQ.29h}w$/SZ24d2%h@"IT*w;W<-f.7p=ei ^C\aP`RyHaC!
                                                  Jul 22, 2024 12:34:30.699923038 CEST1236INData Raw: ba ca 62 79 64 b1 96 fc a3 e4 33 18 bf f2 b3 53 33 28 3d 94 63 da fc df 9a ab 61 96 4f fd 8f 75 23 dd b5 d3 bd b5 31 ab e5 e1 6d de 8b 88 11 1d 05 ed 75 9d 2f 58 00 23 9c b7 5e 9c be d2 46 a0 2b 67 71 a6 f8 75 c0 5f 80 c9 c6 7f 3b c9 9d 1b 53 08
                                                  Data Ascii: byd3S3(=caOu#1mu/X#^F+gqu_;Sv_HO=[Ipy`9|;!&uEv@~q+"`T].@ON/,V]Bn`;LGQNL0j*\x8j8cpo;Y|1x[
                                                  Jul 22, 2024 12:34:30.699932098 CEST383INData Raw: b8 35 15 54 a9 22 01 ba 8d 73 41 22 2d 5f 1c e5 c1 6a 64 1c 3a 02 da 84 ef c5 74 bd 9f 23 d9 32 44 34 28 27 d7 07 95 69 6b 95 3f 18 37 32 d0 a9 81 eb a5 e0 47 f9 bd 0e ce d3 e3 4e d2 40 77 fe 00 a1 df bb a6 9f 2e ba ee eb a2 f0 8c 0d bc fe f1 95
                                                  Data Ascii: 5T"sA"-_jd:t#2D4('ik?72GN@w.o[C4PcJ3 [mrE&r8U,%,uzs(q7r%Hr1]>D!M#C7xJW/5oZ~Wr4gB6SE^C8LT_4'8rC&:<uMz#
                                                  Jul 22, 2024 12:34:30.708055019 CEST383INData Raw: b8 35 15 54 a9 22 01 ba 8d 73 41 22 2d 5f 1c e5 c1 6a 64 1c 3a 02 da 84 ef c5 74 bd 9f 23 d9 32 44 34 28 27 d7 07 95 69 6b 95 3f 18 37 32 d0 a9 81 eb a5 e0 47 f9 bd 0e ce d3 e3 4e d2 40 77 fe 00 a1 df bb a6 9f 2e ba ee eb a2 f0 8c 0d bc fe f1 95
                                                  Data Ascii: 5T"sA"-_jd:t#2D4('ik?72GN@w.o[C4PcJ3 [mrE&r8U,%,uzs(q7r%Hr1]>D!M#C7xJW/5oZ~Wr4gB6SE^C8LT_4'8rC&:<uMz#


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  35192.168.2.449845104.16.149.13080940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:30.286237001 CEST179OUTPOST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 239
                                                  Connection: Keep-Alive
                                                  Jul 22, 2024 12:34:30.291182041 CEST239OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","CurrentSearch":"Google","CurrentHomepage":"about:home","LanguageIso2":"en-GB","IP":null,"CreateDate":0}}
                                                  Jul 22, 2024 12:34:30.807549000 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:30 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c755dc990f8b-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0
                                                  Jul 22, 2024 12:34:30.807873964 CEST155OUTPOST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 239
                                                  Jul 22, 2024 12:34:30.812829971 CEST239OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","CurrentSearch":"Google","CurrentHomepage":"about:home","LanguageIso2":"en-GB","IP":null,"CreateDate":0}}
                                                  Jul 22, 2024 12:34:30.933248043 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:30 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c756dd720f8b-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0
                                                  Jul 22, 2024 12:34:30.939380884 CEST155OUTPOST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 239
                                                  Jul 22, 2024 12:34:30.944679976 CEST239OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","CurrentSearch":"Google","CurrentHomepage":"about:home","LanguageIso2":"en-GB","IP":null,"CreateDate":0}}
                                                  Jul 22, 2024 12:34:31.076908112 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:31 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c757ae150f8b-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0
                                                  Jul 22, 2024 12:34:31.099018097 CEST155OUTPOST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 239
                                                  Jul 22, 2024 12:34:31.104387999 CEST239OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","CurrentSearch":"Google","CurrentHomepage":"about:home","LanguageIso2":"en-GB","IP":null,"CreateDate":0}}
                                                  Jul 22, 2024 12:34:31.247983932 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:31 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c758aec90f8b-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  36192.168.2.449846104.16.149.13080940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:30.312127113 CEST179OUTPOST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 239
                                                  Connection: Keep-Alive
                                                  Jul 22, 2024 12:34:30.317564011 CEST239OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","CurrentSearch":"Google","CurrentHomepage":"about:home","LanguageIso2":"en-GB","IP":null,"CreateDate":0}}
                                                  Jul 22, 2024 12:34:30.890563011 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:30 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7560980729f-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0
                                                  Jul 22, 2024 12:34:30.900738001 CEST155OUTPOST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 239
                                                  Jul 22, 2024 12:34:30.905864000 CEST239OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","CurrentSearch":"Google","CurrentHomepage":"about:home","LanguageIso2":"en-GB","IP":null,"CreateDate":0}}
                                                  Jul 22, 2024 12:34:31.029488087 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:30 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7577a9a729f-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0
                                                  Jul 22, 2024 12:34:31.123050928 CEST155OUTPOST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 239
                                                  Jul 22, 2024 12:34:31.129837990 CEST239OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","CurrentSearch":"Google","CurrentHomepage":"about:home","LanguageIso2":"en-GB","IP":null,"CreateDate":0}}
                                                  Jul 22, 2024 12:34:31.306551933 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:31 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c758dba3729f-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0
                                                  Jul 22, 2024 12:34:31.316333055 CEST155OUTPOST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 239
                                                  Jul 22, 2024 12:34:31.323388100 CEST239OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","CurrentSearch":"Google","CurrentHomepage":"about:home","LanguageIso2":"en-GB","IP":null,"CreateDate":0}}
                                                  Jul 22, 2024 12:34:31.484146118 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:31 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c75a0cbd729f-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  37192.168.2.449852104.19.208.15280940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:31.779943943 CEST105OUTGET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Jul 22, 2024 12:34:32.246933937 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:32 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 9891
                                                  Connection: keep-alive
                                                  ETag: "3914547665"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 99
                                                  Expires: Mon, 22 Jul 2024 14:34:32 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c75f2c574294-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d [TRUNCATED]
                                                  Data Ascii: PKIX6%FeatureActions.txtBPZ&KE9(0p<a}9g<D)9k@4y'!=~Zk`1J2[)_,{FF?q;fL*=1ZI->m%>`ml,sWITPu*;Pxxhgl$M]I}ogZL5?BZLxukU1P4mW-Ntf?I-/!w90/^%X-.0(mVPn]=cr_A$<BWye2bK{jOdxZv@[NLDU|_1Sp~Paq>})$qH7,hm)Ias<TWu$?Ey@Xu@5*UJLja0v^Q (O}k+fwvfzbhFE<plLWZI*.4#,X`=beVW)W*;Q,'x>Jq _T<ea&wo/RM2`rXFEc:A97A4FT0@wuJIBd5Bhw}oE@N=Z$)6@sXru%eIg5ruA:81&"e_'Be
                                                  Jul 22, 2024 12:34:32.246948957 CEST1236INData Raw: 27 91 1f 4b c3 11 60 77 a1 43 f9 f7 10 07 63 36 80 1a 86 ad 48 a7 d3 8f 6f 01 ae 9e 9c 3f a2 79 6e 3b 81 f2 7e 33 72 dc 17 7b 3c b2 f2 80 9b 26 a0 a9 76 69 9d e2 6e 9e 4d 47 96 36 9b c5 b5 27 68 b5 b4 84 34 1c 56 23 a3 50 e1 9f 24 02 89 9a 6e b0
                                                  Data Ascii: 'K`wCc6Ho?yn;~3r{<&vinMG6'h4V#P$n/Kt'<4oOa"xGTVBfE<eG#Bw{#@mc]os}uE6@e`^](9A,NjbNYnOF\8p"CLFk
                                                  Jul 22, 2024 12:34:32.246961117 CEST448INData Raw: ac 50 d8 52 44 ee 8b 8f d4 d8 b2 84 d1 cb d6 f7 f8 05 a5 aa 41 48 05 36 3c 93 56 87 e3 e6 2f 47 40 72 47 91 28 bd 1e de c7 43 06 15 aa c9 07 7f 4b 86 10 6b 1f 41 44 6f 91 db 30 a2 f9 46 11 1a 4b 58 16 a1 31 d1 5e b4 59 ca fc 47 fc bc 25 05 70 a5
                                                  Data Ascii: PRDAH6<V/G@rG(CKkADo0FKX1^YG%p8P*rH|idu{"PBv`DWG&O*rD:V4#{>51Zy4U-&SSIgFkZpYN~L-6Fed~ex>3
                                                  Jul 22, 2024 12:34:32.246978998 CEST1236INData Raw: 74 78 bf d1 4f e7 e2 3d a6 1b 87 fe 74 57 73 46 8d ae 81 4e b5 95 90 a6 0a 32 29 67 d8 c7 21 47 50 3f 92 00 6e 58 3b 68 5c 39 a5 27 c3 8f c6 c3 8b c1 8c d3 eb 6c 55 ca 97 c2 12 dc 83 bc 08 95 eb a8 4f e9 a1 3f bb dc 6a d0 fc 87 68 26 35 4f 63 0d
                                                  Data Ascii: txO=tWsFN2)g!GP?nX;h\9'lUO?jh&5OcRM;BY={yMNSVJLSl-\yBNM*T0X8o'm#ZIfHr,-^D[GWan]k0:t)Q^smAJ)
                                                  Jul 22, 2024 12:34:32.246989012 CEST1236INData Raw: b0 ea 69 48 6f 97 04 cc 88 51 65 16 41 0f a1 ce 2c 5f 44 27 b4 16 c6 86 90 c5 74 9d 98 5d 14 f8 08 95 7f e2 c9 8d df e0 61 32 78 a6 c0 e5 93 d3 34 b3 91 b6 26 79 c9 cd 07 9a 62 a6 cf 86 1f ee 30 1e 7a 04 9f ef 39 86 3c 67 7f 09 77 56 ca 33 18 43
                                                  Data Ascii: iHoQeA,_D't]a2x4&yb0z9<gwV3CvY8]N{cF4y<o8.P"w(t[%c{,KC`m[EPi<YfugDJbQec4!RA$y>TJ,r9aN 9Ql3
                                                  Jul 22, 2024 12:34:32.247000933 CEST1236INData Raw: 85 11 40 a7 22 b6 de 95 b0 8a 6b 3a 12 0f 9c 4c b5 60 f3 af 2d 30 08 fe 13 b2 b5 10 9a 51 94 73 ac 93 15 e2 75 a0 26 8b c7 60 6a e3 be a2 46 fd 5f ba 02 5c d6 7e ff 8e 35 8a 0e 01 1d 8d 4a c0 74 ac 56 39 45 fd 19 a0 ee a5 44 1c 37 f5 33 92 44 33
                                                  Data Ascii: @"k:L`-0Qsu&`jF_\~5JtV9ED73D32.>DA;.+}X:JFRlO%kqys|w- 7/Sw7XD<M7v-98L:"Dx.Z]Di0\*XE2
                                                  Jul 22, 2024 12:34:32.247013092 CEST1236INData Raw: dc 3b 12 c6 14 12 66 b4 19 fc ce 11 d8 0d 7d f3 c3 4a d1 1a 02 97 bc b8 14 8b 96 9d 56 5a 73 2e 85 85 d7 cf 3d 64 8c 69 c0 30 fb 5e 7d e7 20 2d 5e 5a e0 42 46 09 48 cc a1 dc fc 6b 7c 2a 51 62 6e fe cf 57 d5 fc 84 cb 4b 2b ef d0 7b 39 ea 6d 7a 5d
                                                  Data Ascii: ;f}JVZs.=di0^} -^ZBFHk|*QbnWK+{9mz]1.D8s@ 7i: %}?^!5xjfr<ANSYmJgZA}a_p(']JY+;j,k"DPm -SR|Em{!q
                                                  Jul 22, 2024 12:34:32.247025013 CEST1236INData Raw: 99 a9 82 0e 0f a3 58 f4 7d 18 81 e6 a0 dd 09 3a b4 58 64 5c c9 4a 5b 3c ee c2 4a ba 20 31 25 b6 c4 02 8d 36 f7 08 58 08 92 21 54 cc 0f 1f b4 85 c1 26 3a 05 db 9b c7 7e 35 0f cb ba 03 be 24 56 88 8f bc 33 ea ac 9c b5 7c a9 46 95 3b 6b be 19 3d 79
                                                  Data Ascii: X}:Xd\J[<J 1%6X!T&:~5$V3|F;k=yL6Q;*DA-. +cR7FzrxHg]w;rIOgPBVsFCSb0Y!7hy*iWFW:/,`fv2NuK(91{-3~>ou}[C.m,$*CbD]3rd
                                                  Jul 22, 2024 12:34:32.247036934 CEST1171INData Raw: 68 2f 29 33 c0 21 37 b1 35 86 46 34 86 31 ee 33 5e b0 27 38 88 08 ad 39 0d ed ff 58 9e a8 66 31 2f 5d 2b 9a 7f c6 51 6f 84 4b e4 da a0 4b 15 f4 48 14 b1 8e e8 ef f0 5d b8 b0 bf a2 fa aa 75 58 74 0d ae 47 26 7c ef 9b f0 93 81 cc 83 9b 21 8a 68 4f
                                                  Data Ascii: h/)3!75F413^'89Xf1/]+QoKKH]uXtG&|!hO|TTaz-@Qlm=(\IN7m12m+tvFob4}"S%na,KyAw{iPhz,Sk:34m,\YBq{]nffv5%"(


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  38192.168.2.44985964.18.87.480940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:32.436554909 CEST192OUTPOST /ipservice.asmx HTTP/1.1
                                                  Content-Type: text/xml; charset=utf-8
                                                  SOAPAction: "http://lavasoft.com/GetLocation"
                                                  Host: wsgeoip.lavasoft.com
                                                  Content-Length: 236
                                                  Connection: Keep-Alive
                                                  Jul 22, 2024 12:34:32.436583042 CEST236OUTData Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 20 78 6d 6c 6e 73 3a 78 73 69 3d
                                                  Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"><GetLocation xmlns="http://lavasoft.com/"/></s:Body></s:Envelope>
                                                  Jul 22, 2024 12:34:32.916743040 CEST702INHTTP/1.1 200 OK
                                                  Server: nginx
                                                  Date: Mon, 22 Jul 2024 10:34:32 GMT
                                                  Content-Type: text/xml; charset=utf-8
                                                  Content-Length: 446
                                                  Connection: keep-alive
                                                  Cache-Control: private, max-age=0
                                                  X-AspNet-Version: 4.0.30319
                                                  X-Powered-By: ASP.NET
                                                  x-here: true
                                                  Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 47 65 74 4c 6f 63 61 74 69 6f 6e 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 6c 61 76 61 73 6f 66 74 2e 63 6f 6d 2f 22 3e 3c 47 65 74 4c 6f 63 61 74 69 6f 6e 52 65 73 75 6c 74 3e 26 6c 74 3b 47 65 6f 49 50 26 67 74 3b 26 6c 74 3b 43 6f 75 6e 74 72 79 26 67 74 3b 55 53 26 6c 74 3b 2f 43 6f 75 6e 74 72 79 26 67 74 3b 26 6c 74 3b 53 [TRUNCATED]
                                                  Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"><soap:Body><GetLocationResponse xmlns="http://lavasoft.com/"><GetLocationResult>&lt;GeoIP&gt;&lt;Country&gt;US&lt;/Country&gt;&lt;State&gt;CA&lt;/State&gt;&lt;/GeoIP&gt;</GetLocationResult></GetLocationResponse></soap:Body></soap:Envelope>


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  39192.168.2.449861104.19.208.15280984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:32.759946108 CEST113OUTGET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Connection: Keep-Alive
                                                  Jul 22, 2024 12:34:33.262881994 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:33 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 17770
                                                  Connection: keep-alive
                                                  ETag: "770472110"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 403
                                                  Expires: Mon, 22 Jul 2024 14:34:33 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7657f3d0f70-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 [TRUNCATED]
                                                  Data Ascii: PK:=AX7\0DrActiveFeatures.txt+@sjp#K1;/-[[ABexq)7 7:^gK !ibUVsO$v7|e\W'ZdveU*oR>%w$-;Q4Tf$+T$&Q?9#"6>0o@j(*i)H"B1`=&0I8CR"ycM7g\@8xE4S|Iyy7~%W?7!JhrfdB^OQ"IDG!o+^6VY6<wNNPP2\?EY^j>i[p`L_sXq>#~nY>LO9rsAS+g5FBiqgUf{*vBUBqTpKF;/[&WIAPuS-&v3!Y'bMl{[:5sVL3om7'O4'(V#:\#VOO&<s}Yd|<P@jM%O5lHs^SYfaCDDwVcE8~cETL0YIEd@._PQ~w\fAT7Kiywq|+#]N">(A0bU-lDM#ETYa-h}ep<),
                                                  Jul 22, 2024 12:34:33.262954950 CEST1236INData Raw: c3 e9 0b b5 94 79 f6 cd ab db ef 95 d6 d1 32 bc 03 27 b0 a7 67 bb 67 5c 5f 47 4a 97 f1 f7 fc 80 a5 3d 5e cb d2 21 fd 16 4d f6 ed 94 f2 d0 41 ec b6 8d 9b cb af 44 4b 5e 3f 92 fc ae 08 db 64 a5 1d 86 78 29 a2 a9 c5 2d c1 7a 36 38 e0 81 84 1a 34 f5
                                                  Data Ascii: y2'gg\_GJ=^!MADK^?dx)-z684R|YSgynUf1qbEFO?'[a`bF\rsZL0q\vgrP:ZbPw^l^|Vov^'D0\mJh*I{X14
                                                  Jul 22, 2024 12:34:33.263021946 CEST1236INData Raw: e3 09 b7 93 e7 ef 55 87 a5 e2 4a 0e 55 3c 50 4f 28 65 ca 9a de 34 88 d5 59 ab cd 64 54 2a 94 93 b6 b8 c7 f1 34 a6 fe 9a 9e 58 e1 5b 68 04 08 88 1d 07 7a 22 8c f4 8b 1a 37 f4 2d 18 02 f7 c9 7a e3 8d 30 e6 e5 c6 72 4a b5 33 12 97 f2 9b 9f 3d 2b 49
                                                  Data Ascii: UJU<PO(e4YdT*4X[hz"7-z0rJ3=+I:QrVjeAU|0e r.-nFs%U@_G~W}E^ns]W6.Jg4)Kk~9"4{i#W}_&L'HNOp
                                                  Jul 22, 2024 12:34:33.263068914 CEST1236INData Raw: a2 40 45 ad 3e 10 cc d4 22 b8 18 aa b5 83 15 5b 5f 79 62 da f6 64 de 89 40 91 c6 e3 e6 3c 48 f6 f2 37 d0 b4 a2 87 ed 8b 72 11 f9 fa 1d 84 ca dd 63 7c e6 56 65 74 e8 c3 ce 0a 52 78 3d f5 2c 69 ad 82 46 5f 21 19 b5 ed d3 bf 7e 98 76 8d 6a 94 b7 ed
                                                  Data Ascii: @E>"[_ybd@<H7rc|VetRx=,iF_!~vj5s,yL/[g{QosVz%{A|PSeC)PYzSZ/]E?kINr|Pg!\2-;@&Lb<maS
                                                  Jul 22, 2024 12:34:33.263118029 CEST1236INData Raw: ef ec e3 a3 78 02 50 1e 6e 18 3a c8 ef 40 01 47 df 2f 67 75 81 ee e7 ed 5c 86 a7 cd ff 50 b9 61 08 00 fa a5 b9 0e 2f 50 8f 87 fd 80 44 ec bf 7d 28 a2 50 86 c4 d0 81 34 04 f9 9d 19 90 5d 6c c8 6f a3 82 62 5f 8a 77 97 ae e6 15 32 ec 5b 3c d5 d1 50
                                                  Data Ascii: xPn:@G/gu\Pa/PD}(P4]lob_w2[<Pz|<gzX],af!:$uMs)m74Tf8Q0Ee@>i~p#D'uma{4q-x.{W)x,0Fm'*wTn
                                                  Jul 22, 2024 12:34:33.263164997 CEST1236INData Raw: ea fe e8 9b 44 1e 62 80 9f 85 5d b4 ed 54 9a 62 26 5d f9 5f e9 66 31 79 1a ec 5d eb 3b 42 de 2a 12 2f 99 5a 51 ad 2c 4e fc b2 cd 25 8a df 0b d7 07 24 1e 16 60 15 f2 23 fe 84 ec 28 ca cb ea 25 a1 6f 30 22 39 cc 4f eb 80 ec b0 87 73 03 c9 e2 6f cb
                                                  Data Ascii: Db]Tb&]_f1y];B*/ZQ,N%$`#(%o0"9OsosUN^m9N)&8))QK}b9"@T~yu?V7j7y)vJ_EEW58X+:CP~T,{/s" a*=_lJ
                                                  Jul 22, 2024 12:34:33.263212919 CEST776INData Raw: c6 ac fb 85 2b c7 a3 2f 2f d9 73 66 a6 d5 b3 dc bc 4c 89 64 2f f9 a1 b7 40 bf dd 84 b3 f4 0d 92 fa d2 49 45 fc 27 f8 14 9d 3f bd 02 3a c4 6a 3c 68 f4 ec 55 d8 20 1b ea 58 1f 15 63 0c 4e fc 76 39 e9 cc 71 40 69 5b b9 5b c5 4e 6d 50 82 e3 2b 3d 15
                                                  Data Ascii: +//sfLd/@IE'?:j<hU XcNv9q@i[[NmP+=127ZS$rHxh7[m15'1Z91 #%|^s\obPTPUO:$9pgLNTKqmc_xE]uUW\&6Ijo
                                                  Jul 22, 2024 12:34:33.263258934 CEST1236INData Raw: d8 55 39 07 81 24 01 07 44 95 57 e7 60 2b d2 a5 bd 52 20 06 5d 6d 80 a3 f0 2d 04 be f6 c4 36 f1 38 a7 eb 6a 35 61 be 2e 7c 73 13 4f 8d 09 88 42 b0 bd 85 7e 1c 31 f2 7a d1 7f a9 63 dd 5b 75 a3 67 d4 de b1 93 51 3e b1 c5 0d 54 c8 76 fd 9b 11 7e 11
                                                  Data Ascii: U9$DW`+R ]m-68j5a.|sOB~1zc[ugQ>Tv~Fa&<pX caENsE0aUC3WE4eP0!W%]VKw7u:Uw`=n&l\r\0kXL0n)vneEw6h,{>Vo
                                                  Jul 22, 2024 12:34:33.263309002 CEST1236INData Raw: e7 b7 5b 52 84 a3 65 20 65 10 bf a4 cf 1e 23 cf 87 ab 48 1a 64 35 a1 c4 c9 49 17 07 2e 2a b5 70 13 92 00 da b1 7b 6f cb 09 2e 48 8a 27 c7 e5 2a 7c 61 32 06 ef 8d ef 69 86 b1 a5 5a cf 14 e3 2e be 59 f3 70 3f 58 1f f9 19 c3 e4 d6 3d d0 5b 49 5c 56
                                                  Data Ascii: [Re e#Hd5I.*p{o.H'*|a2iZ.Yp?X=[I\V~^{z7F: G5C*w 0sB=z+K3wV}aS)BlUD`a%z1-/a{aZ@";AsW_DL[hArN~+;6]._
                                                  Jul 22, 2024 12:34:33.263358116 CEST1236INData Raw: 18 76 dd 0b 34 ab e4 4a 6f f1 34 d1 63 c7 18 e9 2b a2 3b 4a 7c 23 0f 05 ff 30 bf 2c 4e b5 39 8b 92 8a 8a b6 4d 75 f8 02 27 6c 5e b0 df 44 bd 46 0b 0d 9a 2b 69 4c cf 34 03 5c 57 42 3e a3 89 54 04 6f 2a 2b 68 02 69 ad c5 d9 c8 9b 5a 61 a1 3b 90 0a
                                                  Data Ascii: v4Jo4c+;J|#0,N9Mu'l^DF+iL4\WB>To*+hiZa;;-c.T12=ZLXZbdBNRyib[FEv.=K36A#:O;#MjJ?N7k]^0huT [^o}
                                                  Jul 22, 2024 12:34:33.269778013 CEST1236INData Raw: b8 b3 f7 91 1f 9d 29 cb f6 de b0 17 73 f0 26 f7 4b 69 cd 63 ec 41 5d 59 62 41 b8 60 3e 59 3c dd 80 84 98 78 c8 c6 f1 43 62 44 9e 73 2d ca 48 10 af 3a 9a 06 4a ab 30 bb 10 e4 53 db 19 2b 39 c0 86 cd 79 20 1a 1e 93 96 68 8b 8b 89 11 98 38 0e cc 2e
                                                  Data Ascii: )s&KicA]YbA`>Y<xCbDs-H:J0S+9y h8.7BmJPl/T5(^,Ke}g#:zEf!%Zwk=6^d$?.a"hZLjMl:a]J!`wVRDwa*|bM#lx
                                                  Jul 22, 2024 12:34:33.560549021 CEST89OUTGET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Jul 22, 2024 12:34:33.669305086 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:33 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 17770
                                                  Connection: keep-alive
                                                  ETag: "770472110"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 403
                                                  Expires: Mon, 22 Jul 2024 14:34:33 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c76818ff0f70-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 [TRUNCATED]
                                                  Data Ascii: PK:=AX7\0DrActiveFeatures.txt+@sjp#K1;/-[[ABexq)7 7:^gK !ibUVsO$v7|e\W'ZdveU*oR>%w$-;Q4Tf$+T$&Q?9#"6>0o@j(*i)H"B1`=&0I8CR"ycM7g\@8xE4S|Iyy7~%W?7!JhrfdB^OQ"IDG!o+^6VY6<wNNPP2\?EY^j>i[p`L_sXq>#~nY>LO9rsAS+g5FBiqgUf{*vBUBqTpKF;/[&WIAPuS-&v3!Y'bMl{[:5sVL3om7'O4'(V#:\#VOO&<s}Yd|<P@jM%O5lHs^SYfaCDDwVcE8~cETL0YIEd@._PQ~w\fAT7Kiywq|+#]N">(A0bU-lDM#ETYa-h}ep<),


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  40192.168.2.449870104.19.208.15280984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:34.305816889 CEST113OUTGET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Connection: Keep-Alive


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  41192.168.2.449872104.19.208.15280984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:34.630671024 CEST113OUTGET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Connection: Keep-Alive
                                                  Jul 22, 2024 12:34:35.116899014 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:35 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 17770
                                                  Connection: keep-alive
                                                  ETag: "770472110"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 405
                                                  Expires: Mon, 22 Jul 2024 14:34:35 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7711c227c6c-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 [TRUNCATED]
                                                  Data Ascii: PK:=AX7\0DrActiveFeatures.txt+@sjp#K1;/-[[ABexq)7 7:^gK !ibUVsO$v7|e\W'ZdveU*oR>%w$-;Q4Tf$+T$&Q?9#"6>0o@j(*i)H"B1`=&0I8CR"ycM7g\@8xE4S|Iyy7~%W?7!JhrfdB^OQ"IDG!o+^6VY6<wNNPP2\?EY^j>i[p`L_sXq>#~nY>LO9rsAS+g5FBiqgUf{*vBUBqTpKF;/[&WIAPuS-&v3!Y'bMl{[:5sVL3om7'O4'(V#:\#VOO&<s}Yd|<P@jM%O5lHs^SYfaCDDwVcE8~cETL0YIEd@._PQ~w\fAT7Kiywq|+#]N">(A0bU-lDM#ETYa-h}ep<),
                                                  Jul 22, 2024 12:34:35.116997957 CEST1236INData Raw: c3 e9 0b b5 94 79 f6 cd ab db ef 95 d6 d1 32 bc 03 27 b0 a7 67 bb 67 5c 5f 47 4a 97 f1 f7 fc 80 a5 3d 5e cb d2 21 fd 16 4d f6 ed 94 f2 d0 41 ec b6 8d 9b cb af 44 4b 5e 3f 92 fc ae 08 db 64 a5 1d 86 78 29 a2 a9 c5 2d c1 7a 36 38 e0 81 84 1a 34 f5
                                                  Data Ascii: y2'gg\_GJ=^!MADK^?dx)-z684R|YSgynUf1qbEFO?'[a`bF\rsZL0q\vgrP:ZbPw^l^|Vov^'D0\mJh*I{X14
                                                  Jul 22, 2024 12:34:35.117048025 CEST1236INData Raw: e3 09 b7 93 e7 ef 55 87 a5 e2 4a 0e 55 3c 50 4f 28 65 ca 9a de 34 88 d5 59 ab cd 64 54 2a 94 93 b6 b8 c7 f1 34 a6 fe 9a 9e 58 e1 5b 68 04 08 88 1d 07 7a 22 8c f4 8b 1a 37 f4 2d 18 02 f7 c9 7a e3 8d 30 e6 e5 c6 72 4a b5 33 12 97 f2 9b 9f 3d 2b 49
                                                  Data Ascii: UJU<PO(e4YdT*4X[hz"7-z0rJ3=+I:QrVjeAU|0e r.-nFs%U@_G~W}E^ns]W6.Jg4)Kk~9"4{i#W}_&L'HNOp
                                                  Jul 22, 2024 12:34:35.117093086 CEST1236INData Raw: a2 40 45 ad 3e 10 cc d4 22 b8 18 aa b5 83 15 5b 5f 79 62 da f6 64 de 89 40 91 c6 e3 e6 3c 48 f6 f2 37 d0 b4 a2 87 ed 8b 72 11 f9 fa 1d 84 ca dd 63 7c e6 56 65 74 e8 c3 ce 0a 52 78 3d f5 2c 69 ad 82 46 5f 21 19 b5 ed d3 bf 7e 98 76 8d 6a 94 b7 ed
                                                  Data Ascii: @E>"[_ybd@<H7rc|VetRx=,iF_!~vj5s,yL/[g{QosVz%{A|PSeC)PYzSZ/]E?kINr|Pg!\2-;@&Lb<maS
                                                  Jul 22, 2024 12:34:35.117141008 CEST1236INData Raw: ef ec e3 a3 78 02 50 1e 6e 18 3a c8 ef 40 01 47 df 2f 67 75 81 ee e7 ed 5c 86 a7 cd ff 50 b9 61 08 00 fa a5 b9 0e 2f 50 8f 87 fd 80 44 ec bf 7d 28 a2 50 86 c4 d0 81 34 04 f9 9d 19 90 5d 6c c8 6f a3 82 62 5f 8a 77 97 ae e6 15 32 ec 5b 3c d5 d1 50
                                                  Data Ascii: xPn:@G/gu\Pa/PD}(P4]lob_w2[<Pz|<gzX],af!:$uMs)m74Tf8Q0Ee@>i~p#D'uma{4q-x.{W)x,0Fm'*wTn
                                                  Jul 22, 2024 12:34:35.117187977 CEST1236INData Raw: ea fe e8 9b 44 1e 62 80 9f 85 5d b4 ed 54 9a 62 26 5d f9 5f e9 66 31 79 1a ec 5d eb 3b 42 de 2a 12 2f 99 5a 51 ad 2c 4e fc b2 cd 25 8a df 0b d7 07 24 1e 16 60 15 f2 23 fe 84 ec 28 ca cb ea 25 a1 6f 30 22 39 cc 4f eb 80 ec b0 87 73 03 c9 e2 6f cb
                                                  Data Ascii: Db]Tb&]_f1y];B*/ZQ,N%$`#(%o0"9OsosUN^m9N)&8))QK}b9"@T~yu?V7j7y)vJ_EEW58X+:CP~T,{/s" a*=_lJ
                                                  Jul 22, 2024 12:34:35.117237091 CEST1236INData Raw: c6 ac fb 85 2b c7 a3 2f 2f d9 73 66 a6 d5 b3 dc bc 4c 89 64 2f f9 a1 b7 40 bf dd 84 b3 f4 0d 92 fa d2 49 45 fc 27 f8 14 9d 3f bd 02 3a c4 6a 3c 68 f4 ec 55 d8 20 1b ea 58 1f 15 63 0c 4e fc 76 39 e9 cc 71 40 69 5b b9 5b c5 4e 6d 50 82 e3 2b 3d 15
                                                  Data Ascii: +//sfLd/@IE'?:j<hU XcNv9q@i[[NmP+=127ZS$rHxh7[m15'1Z91 #%|^s\obPTPUO:$9pgLNTKqmc_xE]uUW\&6Ijo
                                                  Jul 22, 2024 12:34:35.117281914 CEST1236INData Raw: e7 41 3d ce 7d 33 4d 0f 6d da 2d 57 cd 6d 7c 72 20 41 5f e2 85 cb 48 2a 2c 1b 25 2d ea 0b 8c 30 58 68 ec 5b 67 54 17 0b 09 36 f0 a1 5f 55 d0 81 77 eb 76 58 90 be 59 9e ba 3f be 84 2b 42 29 6f 5c df c6 42 5f 49 8a 9f 97 26 07 55 9d da 50 6a e6 dc
                                                  Data Ascii: A=}3Mm-Wm|r A_H*,%-0Xh[gT6_UwvXY?+B)o\B_I&UPj?n,\_%N&gFx!7^"*w/:=\-?2$(<9#oPa7Z+iIU1B($k!XdI<#7s(,\~1~@SfHTn
                                                  Jul 22, 2024 12:34:35.117326975 CEST1236INData Raw: 20 19 6a 5f 78 89 c4 93 e5 38 5a 6e de 37 da e2 c6 06 b0 e8 f5 8e ec 2a 4d 52 53 7c c0 ce f1 b1 9d 84 d3 91 ba fc 29 13 39 6d 22 59 ca f4 90 ba 24 c3 b5 86 27 17 f3 8a b2 8c 0f d9 b9 6d 97 6d 9b 96 f5 eb e7 ae 0b 71 31 03 84 41 72 7d a7 8d f4 99
                                                  Data Ascii: j_x8Zn7*MRS|)9m"Y$'mmq1Ar}sWC@T^n2I%j+r|kpjq%<OjYSO)o+`qK18oLXG#F?sTds%>qWY2qf[n XR`
                                                  Jul 22, 2024 12:34:35.117374897 CEST1236INData Raw: d1 d2 9b 08 03 2c 5a d5 0d b5 24 ba 57 06 e9 82 13 06 b8 76 cd 11 85 df 30 60 c7 4a 68 fc 62 33 d3 a3 33 4a 36 3d a8 67 bb a3 56 33 7d 3d 9a 83 2c 2e ab 79 ba 0d fb 01 11 b8 6d 84 ce cd 88 2e 7d f5 4f 3e 3e d1 e4 3c 13 83 fa 27 77 82 c7 e2 d9 4b
                                                  Data Ascii: ,Z$Wv0`Jhb33J6=gV3}=,.ym.}O>><'wK\U}&El?<tl%}v%HSA*gH(vqd00Dan~Jlax_K9#+Rfl?uhLO{.FLRS
                                                  Jul 22, 2024 12:34:35.123786926 CEST1236INData Raw: 12 42 b8 dd e5 1f 9e 6b 33 d0 27 64 66 67 09 75 13 4e 4f e9 2f 56 c0 a1 26 a6 e7 0f 48 59 99 5e 9a 7b ee 13 0a e1 b2 7e 95 bf 06 41 45 43 c3 c5 43 45 37 b4 fd 4d f1 ee 9a 9c 98 53 15 42 01 8c fa ef a5 44 d0 97 33 99 81 2a 36 6b 2c 46 c1 0c 71 2f
                                                  Data Ascii: Bk3'dfguNO/V&HY^{~AECCE7MSBD3*6k,Fq/D:-E|OylOR-BS)2,o(P.Ibk@1F] 9X&;/<MZ5 `CLg`h*EH=|EZpoC/j{1,u;


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  42192.168.2.449877104.16.149.13080984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:35.271907091 CEST179OUTPOST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 239
                                                  Connection: Keep-Alive
                                                  Jul 22, 2024 12:34:35.277070999 CEST239OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","CurrentSearch":"Google","CurrentHomepage":"about:home","LanguageIso2":"en-GB","IP":null,"CreateDate":0}}
                                                  Jul 22, 2024 12:34:36.064496994 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:36 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c776ce3c0ca0-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0
                                                  Jul 22, 2024 12:34:36.076397896 CEST155OUTPOST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 239
                                                  Jul 22, 2024 12:34:36.081517935 CEST239OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","CurrentSearch":"Google","CurrentHomepage":"about:home","LanguageIso2":"en-GB","IP":null,"CreateDate":0}}
                                                  Jul 22, 2024 12:34:36.324038029 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:36 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7788f630ca0-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  43192.168.2.449879104.19.208.15280984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:35.300892115 CEST89OUTGET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Jul 22, 2024 12:34:35.880775928 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:35 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 17770
                                                  Connection: keep-alive
                                                  ETag: "770472110"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 405
                                                  Expires: Mon, 22 Jul 2024 14:34:35 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7752d286a56-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 [TRUNCATED]
                                                  Data Ascii: PK:=AX7\0DrActiveFeatures.txt+@sjp#K1;/-[[ABexq)7 7:^gK !ibUVsO$v7|e\W'ZdveU*oR>%w$-;Q4Tf$+T$&Q?9#"6>0o@j(*i)H"B1`=&0I8CR"ycM7g\@8xE4S|Iyy7~%W?7!JhrfdB^OQ"IDG!o+^6VY6<wNNPP2\?EY^j>i[p`L_sXq>#~nY>LO9rsAS+g5FBiqgUf{*vBUBqTpKF;/[&WIAPuS-&v3!Y'bMl{[:5sVL3om7'O4'(V#:\#VOO&<s}Yd|<P@jM%O5lHs^SYfaCDDwVcE8~cETL0YIEd@._PQ~w\fAT7Kiywq|+#]N">(A0bU-lDM#ETYa-h}ep<),
                                                  Jul 22, 2024 12:34:35.880808115 CEST1236INData Raw: c3 e9 0b b5 94 79 f6 cd ab db ef 95 d6 d1 32 bc 03 27 b0 a7 67 bb 67 5c 5f 47 4a 97 f1 f7 fc 80 a5 3d 5e cb d2 21 fd 16 4d f6 ed 94 f2 d0 41 ec b6 8d 9b cb af 44 4b 5e 3f 92 fc ae 08 db 64 a5 1d 86 78 29 a2 a9 c5 2d c1 7a 36 38 e0 81 84 1a 34 f5
                                                  Data Ascii: y2'gg\_GJ=^!MADK^?dx)-z684R|YSgynUf1qbEFO?'[a`bF\rsZL0q\vgrP:ZbPw^l^|Vov^'D0\mJh*I{X14
                                                  Jul 22, 2024 12:34:35.880819082 CEST1236INData Raw: e3 09 b7 93 e7 ef 55 87 a5 e2 4a 0e 55 3c 50 4f 28 65 ca 9a de 34 88 d5 59 ab cd 64 54 2a 94 93 b6 b8 c7 f1 34 a6 fe 9a 9e 58 e1 5b 68 04 08 88 1d 07 7a 22 8c f4 8b 1a 37 f4 2d 18 02 f7 c9 7a e3 8d 30 e6 e5 c6 72 4a b5 33 12 97 f2 9b 9f 3d 2b 49
                                                  Data Ascii: UJU<PO(e4YdT*4X[hz"7-z0rJ3=+I:QrVjeAU|0e r.-nFs%U@_G~W}E^ns]W6.Jg4)Kk~9"4{i#W}_&L'HNOp
                                                  Jul 22, 2024 12:34:35.880836964 CEST1236INData Raw: a2 40 45 ad 3e 10 cc d4 22 b8 18 aa b5 83 15 5b 5f 79 62 da f6 64 de 89 40 91 c6 e3 e6 3c 48 f6 f2 37 d0 b4 a2 87 ed 8b 72 11 f9 fa 1d 84 ca dd 63 7c e6 56 65 74 e8 c3 ce 0a 52 78 3d f5 2c 69 ad 82 46 5f 21 19 b5 ed d3 bf 7e 98 76 8d 6a 94 b7 ed
                                                  Data Ascii: @E>"[_ybd@<H7rc|VetRx=,iF_!~vj5s,yL/[g{QosVz%{A|PSeC)PYzSZ/]E?kINr|Pg!\2-;@&Lb<maS
                                                  Jul 22, 2024 12:34:35.880846977 CEST1236INData Raw: ef ec e3 a3 78 02 50 1e 6e 18 3a c8 ef 40 01 47 df 2f 67 75 81 ee e7 ed 5c 86 a7 cd ff 50 b9 61 08 00 fa a5 b9 0e 2f 50 8f 87 fd 80 44 ec bf 7d 28 a2 50 86 c4 d0 81 34 04 f9 9d 19 90 5d 6c c8 6f a3 82 62 5f 8a 77 97 ae e6 15 32 ec 5b 3c d5 d1 50
                                                  Data Ascii: xPn:@G/gu\Pa/PD}(P4]lob_w2[<Pz|<gzX],af!:$uMs)m74Tf8Q0Ee@>i~p#D'uma{4q-x.{W)x,0Fm'*wTn
                                                  Jul 22, 2024 12:34:35.880862951 CEST1236INData Raw: ea fe e8 9b 44 1e 62 80 9f 85 5d b4 ed 54 9a 62 26 5d f9 5f e9 66 31 79 1a ec 5d eb 3b 42 de 2a 12 2f 99 5a 51 ad 2c 4e fc b2 cd 25 8a df 0b d7 07 24 1e 16 60 15 f2 23 fe 84 ec 28 ca cb ea 25 a1 6f 30 22 39 cc 4f eb 80 ec b0 87 73 03 c9 e2 6f cb
                                                  Data Ascii: Db]Tb&]_f1y];B*/ZQ,N%$`#(%o0"9OsosUN^m9N)&8))QK}b9"@T~yu?V7j7y)vJ_EEW58X+:CP~T,{/s" a*=_lJ
                                                  Jul 22, 2024 12:34:35.880882978 CEST776INData Raw: c6 ac fb 85 2b c7 a3 2f 2f d9 73 66 a6 d5 b3 dc bc 4c 89 64 2f f9 a1 b7 40 bf dd 84 b3 f4 0d 92 fa d2 49 45 fc 27 f8 14 9d 3f bd 02 3a c4 6a 3c 68 f4 ec 55 d8 20 1b ea 58 1f 15 63 0c 4e fc 76 39 e9 cc 71 40 69 5b b9 5b c5 4e 6d 50 82 e3 2b 3d 15
                                                  Data Ascii: +//sfLd/@IE'?:j<hU XcNv9q@i[[NmP+=127ZS$rHxh7[m15'1Z91 #%|^s\obPTPUO:$9pgLNTKqmc_xE]uUW\&6Ijo
                                                  Jul 22, 2024 12:34:35.880893946 CEST1236INData Raw: d8 55 39 07 81 24 01 07 44 95 57 e7 60 2b d2 a5 bd 52 20 06 5d 6d 80 a3 f0 2d 04 be f6 c4 36 f1 38 a7 eb 6a 35 61 be 2e 7c 73 13 4f 8d 09 88 42 b0 bd 85 7e 1c 31 f2 7a d1 7f a9 63 dd 5b 75 a3 67 d4 de b1 93 51 3e b1 c5 0d 54 c8 76 fd 9b 11 7e 11
                                                  Data Ascii: U9$DW`+R ]m-68j5a.|sOB~1zc[ugQ>Tv~Fa&<pX caENsE0aUC3WE4eP0!W%]VKw7u:Uw`=n&l\r\0kXL0n)vneEw6h,{>Vo
                                                  Jul 22, 2024 12:34:35.880914927 CEST1236INData Raw: e7 b7 5b 52 84 a3 65 20 65 10 bf a4 cf 1e 23 cf 87 ab 48 1a 64 35 a1 c4 c9 49 17 07 2e 2a b5 70 13 92 00 da b1 7b 6f cb 09 2e 48 8a 27 c7 e5 2a 7c 61 32 06 ef 8d ef 69 86 b1 a5 5a cf 14 e3 2e be 59 f3 70 3f 58 1f f9 19 c3 e4 d6 3d d0 5b 49 5c 56
                                                  Data Ascii: [Re e#Hd5I.*p{o.H'*|a2iZ.Yp?X=[I\V~^{z7F: G5C*w 0sB=z+K3wV}aS)BlUD`a%z1-/a{aZ@";AsW_DL[hArN~+;6]._
                                                  Jul 22, 2024 12:34:35.880923986 CEST1236INData Raw: 18 76 dd 0b 34 ab e4 4a 6f f1 34 d1 63 c7 18 e9 2b a2 3b 4a 7c 23 0f 05 ff 30 bf 2c 4e b5 39 8b 92 8a 8a b6 4d 75 f8 02 27 6c 5e b0 df 44 bd 46 0b 0d 9a 2b 69 4c cf 34 03 5c 57 42 3e a3 89 54 04 6f 2a 2b 68 02 69 ad c5 d9 c8 9b 5a 61 a1 3b 90 0a
                                                  Data Ascii: v4Jo4c+;J|#0,N9Mu'l^DF+iL4\WB>To*+hiZa;;-c.T12=ZLXZbdBNRyib[FEv.=K36A#:O;#MjJ?N7k]^0huT [^o}
                                                  Jul 22, 2024 12:34:35.880973101 CEST1236INData Raw: b8 b3 f7 91 1f 9d 29 cb f6 de b0 17 73 f0 26 f7 4b 69 cd 63 ec 41 5d 59 62 41 b8 60 3e 59 3c dd 80 84 98 78 c8 c6 f1 43 62 44 9e 73 2d ca 48 10 af 3a 9a 06 4a ab 30 bb 10 e4 53 db 19 2b 39 c0 86 cd 79 20 1a 1e 93 96 68 8b 8b 89 11 98 38 0e cc 2e
                                                  Data Ascii: )s&KicA]YbA`>Y<xCbDs-H:J0S+9y h8.7BmJPl/T5(^,Ke}g#:zEf!%Zwk=6^d$?.a"hZLjMl:a]J!`wVRDwa*|bM#lx


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  44192.168.2.449883104.19.208.15280984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:35.351450920 CEST105OUTGET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Jul 22, 2024 12:34:35.882431984 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:35 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 9891
                                                  Connection: keep-alive
                                                  ETag: "3914547665"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 102
                                                  Expires: Mon, 22 Jul 2024 14:34:35 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7759c3241fe-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d [TRUNCATED]
                                                  Data Ascii: PKIX6%FeatureActions.txtBPZ&KE9(0p<a}9g<D)9k@4y'!=~Zk`1J2[)_,{FF?q;fL*=1ZI->m%>`ml,sWITPu*;Pxxhgl$M]I}ogZL5?BZLxukU1P4mW-Ntf?I-/!w90/^%X-.0(mVPn]=cr_A$<BWye2bK{jOdxZv@[NLDU|_1Sp~Paq>})$qH7,hm)Ias<TWu$?Ey@Xu@5*UJLja0v^Q (O}k+fwvfzbhFE<plLWZI*.4#,X`=beVW)W*;Q,'x>Jq _T<ea&wo/RM2`rXFEc:A97A4FT0@wuJIBd5Bhw}oE@N=Z$)6@sXru%eIg5ruA:81&"e_'Be
                                                  Jul 22, 2024 12:34:35.882443905 CEST1236INData Raw: aa 27 91 1f 4b c3 11 60 77 a1 43 f9 f7 10 07 63 36 80 1a 86 ad 48 a7 d3 8f 6f 01 ae 9e 9c 3f a2 79 6e 3b 81 f2 7e 33 72 dc 17 7b 3c b2 f2 80 9b 26 a0 a9 76 69 9d e2 6e 9e 4d 47 96 36 9b c5 b5 27 68 b5 b4 84 34 1c 56 23 a3 50 e1 9f 24 02 89 9a 6e
                                                  Data Ascii: 'K`wCc6Ho?yn;~3r{<&vinMG6'h4V#P$n/Kt'<4oOa"xGTVBfE<eG#Bw{#@mc]os}uE6@e`^](9A,NjbNYnOF\8p"CLFk
                                                  Jul 22, 2024 12:34:35.882462978 CEST1236INData Raw: fd ac 50 d8 52 44 ee 8b 8f d4 d8 b2 84 d1 cb d6 f7 f8 05 a5 aa 41 48 05 36 3c 93 56 87 e3 e6 2f 47 40 72 47 91 28 bd 1e de c7 43 06 15 aa c9 07 7f 4b 86 10 6b 1f 41 44 6f 91 db 30 a2 f9 46 11 1a 4b 58 16 a1 31 d1 5e b4 59 ca fc 47 fc bc 25 05 70
                                                  Data Ascii: PRDAH6<V/G@rG(CKkADo0FKX1^YG%p8P*rH|idu{"PBv`DWG&O*rD:V4#{>51Zy4U-&SSIgFkZpYN~L-6Fed~ex>3
                                                  Jul 22, 2024 12:34:35.882472038 CEST1236INData Raw: 88 a8 b4 43 f7 18 27 39 99 b5 09 5b b0 21 e4 89 cd dc d8 80 8f ba 2c 76 5f 49 78 e0 a0 e6 a4 e8 61 8a 0a 7d 07 ae 7f 5b db 69 5b ab 4d 22 92 db 0e dc 5e ef db 36 83 5e 63 58 81 45 75 40 0c 8a 74 59 c3 e4 31 78 2a c9 f9 39 82 db c7 d7 e1 67 09 f5
                                                  Data Ascii: C'9[!,v_Ixa}[i[M"^6^cXEu@tY1x*9g&LIY+5kR@v<a.{G`#|<rPgAn><AhcF1NG_d~JFS}=l-z%Q\)Zm?)^afu
                                                  Jul 22, 2024 12:34:35.882491112 CEST1236INData Raw: 51 a2 95 4e ba 4b 5c 16 c5 a5 51 be 5a 39 45 dd 17 61 63 b5 65 bb 34 9f 6d 7c 76 0b e7 cf 8a 28 b1 32 a3 4c 94 f3 9c 2d 3a d8 05 c3 70 d8 b9 9e ea 5e e2 8b aa 76 16 1e 66 9d 5b 09 8d b4 bd 0c df a4 f1 57 38 11 41 42 5a 8f 27 30 7a 45 dd 2c af 7e
                                                  Data Ascii: QNK\QZ9Eace4m|v(2L-:p^vf[W8ABZ'0zE,~iY~^UiH-E`79_ue_f!t,f-X9^y0jgsotF8rUFX3\"T5p3WJBORFv
                                                  Jul 22, 2024 12:34:35.882503033 CEST1236INData Raw: ad 53 b8 3f 1e d4 8d 8b fb 22 dd 51 13 da db 37 c1 6d 8a c5 7d 9b 47 42 3f 8e c9 f0 52 59 f2 14 2a 9e 75 2e 6a 2e 7b 93 ce 8d 7f 03 7e d5 5c fc 25 45 10 44 72 a8 87 1c d2 e8 6e 79 f4 3a 12 2f 87 97 f4 7d 88 08 2a 70 f8 25 43 fc 4b 2d f3 25 a3 5d
                                                  Data Ascii: S?"Q7m}GB?RY*u.j.{~\%EDrny:/}*p%CK-%]F?TSkSG-^Bgv[1K+k9v&plE0P8t}BnUJXhBDBlfbG7Fsq3BI{?3>n
                                                  Jul 22, 2024 12:34:35.882524014 CEST1236INData Raw: 98 44 c0 9d 35 87 31 5c f2 45 f9 c7 ef 27 c4 f0 44 cb 1d 0f 1c d1 37 2a fd 7f 20 4f 38 65 99 02 a1 9a ea fd 15 94 74 5c 15 e4 8a 30 a5 11 66 30 df 52 31 9c c6 28 24 8c 3e 6f 18 50 ce cd 5b 40 65 9a 59 06 f5 bf 1e 38 1f 30 99 1f 31 4f 2a 69 da 0b
                                                  Data Ascii: D51\E'D7* O8et\0f0R1($>oP[@eY801O*iT2@#l0*z<F4a/dUF5iAzDScUSK:;{qQ.29h}w$/SZ24d2%h@"IT*w;W<-f.7p=ei ^C\aP`RyHaC!
                                                  Jul 22, 2024 12:34:35.882543087 CEST1236INData Raw: 39 ba ca 62 79 64 b1 96 fc a3 e4 33 18 bf f2 b3 53 33 28 3d 94 63 da fc df 9a ab 61 96 4f fd 8f 75 23 dd b5 d3 bd b5 31 ab e5 e1 6d de 8b 88 11 1d 05 ed 75 9d 2f 58 00 23 9c b7 5e 9c be d2 46 a0 2b 67 71 a6 f8 75 c0 5f 80 c9 c6 7f 3b c9 9d 1b 53
                                                  Data Ascii: 9byd3S3(=caOu#1mu/X#^F+gqu_;Sv_HO=[Ipy`9|;!&uEv@~q+"`T].@ON/,V]Bn`;LGQNL0j*\x8j8cpo;Y|1x[
                                                  Jul 22, 2024 12:34:35.882559061 CEST384INData Raw: e7 b8 35 15 54 a9 22 01 ba 8d 73 41 22 2d 5f 1c e5 c1 6a 64 1c 3a 02 da 84 ef c5 74 bd 9f 23 d9 32 44 34 28 27 d7 07 95 69 6b 95 3f 18 37 32 d0 a9 81 eb a5 e0 47 f9 bd 0e ce d3 e3 4e d2 40 77 fe 00 a1 df bb a6 9f 2e ba ee eb a2 f0 8c 0d bc fe f1
                                                  Data Ascii: 5T"sA"-_jd:t#2D4('ik?72GN@w.o[C4PcJ3 [mrE&r8U,%,uzs(q7r%Hr1]>D!M#C7xJW/5oZ~Wr4gB6SE^C8LT_4'8rC&:<uMz
                                                  Jul 22, 2024 12:34:35.882572889 CEST384INData Raw: e7 b8 35 15 54 a9 22 01 ba 8d 73 41 22 2d 5f 1c e5 c1 6a 64 1c 3a 02 da 84 ef c5 74 bd 9f 23 d9 32 44 34 28 27 d7 07 95 69 6b 95 3f 18 37 32 d0 a9 81 eb a5 e0 47 f9 bd 0e ce d3 e3 4e d2 40 77 fe 00 a1 df bb a6 9f 2e ba ee eb a2 f0 8c 0d bc fe f1
                                                  Data Ascii: 5T"sA"-_jd:t#2D4('ik?72GN@w.o[C4PcJ3 [mrE&r8U,%,uzs(q7r%Hr1]>D!M#C7xJW/5oZ~Wr4gB6SE^C8LT_4'8rC&:<uMz


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  45192.168.2.449885104.16.149.13080984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:35.882952929 CEST179OUTPOST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 239
                                                  Connection: Keep-Alive
                                                  Jul 22, 2024 12:34:35.888705015 CEST239OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","CurrentSearch":"Google","CurrentHomepage":"about:home","LanguageIso2":"en-GB","IP":null,"CreateDate":0}}
                                                  Jul 22, 2024 12:34:36.412067890 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:36 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c778ef26423f-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  46192.168.2.449898104.19.208.15280984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:36.875193119 CEST129OUTGET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Connection: Keep-Alive
                                                  Jul 22, 2024 12:34:37.351730108 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:37 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 9891
                                                  Connection: keep-alive
                                                  ETag: "3914547665"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 104
                                                  Expires: Mon, 22 Jul 2024 14:34:37 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c77f1ec37c6c-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d [TRUNCATED]
                                                  Data Ascii: PKIX6%FeatureActions.txtBPZ&KE9(0p<a}9g<D)9k@4y'!=~Zk`1J2[)_,{FF?q;fL*=1ZI->m%>`ml,sWITPu*;Pxxhgl$M]I}ogZL5?BZLxukU1P4mW-Ntf?I-/!w90/^%X-.0(mVPn]=cr_A$<BWye2bK{jOdxZv@[NLDU|_1Sp~Paq>})$qH7,hm)Ias<TWu$?Ey@Xu@5*UJLja0v^Q (O}k+fwvfzbhFE<plLWZI*.4#,X`=beVW)W*;Q,'x>Jq _T<ea&wo/RM2`rXFEc:A97A4FT0@wuJIBd5Bhw}oE@N=Z$)6@sXru%eIg5ruA:81&"e_'Be
                                                  Jul 22, 2024 12:34:37.351772070 CEST1236INData Raw: aa 27 91 1f 4b c3 11 60 77 a1 43 f9 f7 10 07 63 36 80 1a 86 ad 48 a7 d3 8f 6f 01 ae 9e 9c 3f a2 79 6e 3b 81 f2 7e 33 72 dc 17 7b 3c b2 f2 80 9b 26 a0 a9 76 69 9d e2 6e 9e 4d 47 96 36 9b c5 b5 27 68 b5 b4 84 34 1c 56 23 a3 50 e1 9f 24 02 89 9a 6e
                                                  Data Ascii: 'K`wCc6Ho?yn;~3r{<&vinMG6'h4V#P$n/Kt'<4oOa"xGTVBfE<eG#Bw{#@mc]os}uE6@e`^](9A,NjbNYnOF\8p"CLFk
                                                  Jul 22, 2024 12:34:37.351784945 CEST1236INData Raw: fd ac 50 d8 52 44 ee 8b 8f d4 d8 b2 84 d1 cb d6 f7 f8 05 a5 aa 41 48 05 36 3c 93 56 87 e3 e6 2f 47 40 72 47 91 28 bd 1e de c7 43 06 15 aa c9 07 7f 4b 86 10 6b 1f 41 44 6f 91 db 30 a2 f9 46 11 1a 4b 58 16 a1 31 d1 5e b4 59 ca fc 47 fc bc 25 05 70
                                                  Data Ascii: PRDAH6<V/G@rG(CKkADo0FKX1^YG%p8P*rH|idu{"PBv`DWG&O*rD:V4#{>51Zy4U-&SSIgFkZpYN~L-6Fed~ex>3
                                                  Jul 22, 2024 12:34:37.351802111 CEST1236INData Raw: 88 a8 b4 43 f7 18 27 39 99 b5 09 5b b0 21 e4 89 cd dc d8 80 8f ba 2c 76 5f 49 78 e0 a0 e6 a4 e8 61 8a 0a 7d 07 ae 7f 5b db 69 5b ab 4d 22 92 db 0e dc 5e ef db 36 83 5e 63 58 81 45 75 40 0c 8a 74 59 c3 e4 31 78 2a c9 f9 39 82 db c7 d7 e1 67 09 f5
                                                  Data Ascii: C'9[!,v_Ixa}[i[M"^6^cXEu@tY1x*9g&LIY+5kR@v<a.{G`#|<rPgAn><AhcF1NG_d~JFS}=l-z%Q\)Zm?)^afu
                                                  Jul 22, 2024 12:34:37.351815939 CEST1236INData Raw: 51 a2 95 4e ba 4b 5c 16 c5 a5 51 be 5a 39 45 dd 17 61 63 b5 65 bb 34 9f 6d 7c 76 0b e7 cf 8a 28 b1 32 a3 4c 94 f3 9c 2d 3a d8 05 c3 70 d8 b9 9e ea 5e e2 8b aa 76 16 1e 66 9d 5b 09 8d b4 bd 0c df a4 f1 57 38 11 41 42 5a 8f 27 30 7a 45 dd 2c af 7e
                                                  Data Ascii: QNK\QZ9Eace4m|v(2L-:p^vf[W8ABZ'0zE,~iY~^UiH-E`79_ue_f!t,f-X9^y0jgsotF8rUFX3\"T5p3WJBORFv
                                                  Jul 22, 2024 12:34:37.351826906 CEST1236INData Raw: ad 53 b8 3f 1e d4 8d 8b fb 22 dd 51 13 da db 37 c1 6d 8a c5 7d 9b 47 42 3f 8e c9 f0 52 59 f2 14 2a 9e 75 2e 6a 2e 7b 93 ce 8d 7f 03 7e d5 5c fc 25 45 10 44 72 a8 87 1c d2 e8 6e 79 f4 3a 12 2f 87 97 f4 7d 88 08 2a 70 f8 25 43 fc 4b 2d f3 25 a3 5d
                                                  Data Ascii: S?"Q7m}GB?RY*u.j.{~\%EDrny:/}*p%CK-%]F?TSkSG-^Bgv[1K+k9v&plE0P8t}BnUJXhBDBlfbG7Fsq3BI{?3>n
                                                  Jul 22, 2024 12:34:37.351839066 CEST1236INData Raw: 98 44 c0 9d 35 87 31 5c f2 45 f9 c7 ef 27 c4 f0 44 cb 1d 0f 1c d1 37 2a fd 7f 20 4f 38 65 99 02 a1 9a ea fd 15 94 74 5c 15 e4 8a 30 a5 11 66 30 df 52 31 9c c6 28 24 8c 3e 6f 18 50 ce cd 5b 40 65 9a 59 06 f5 bf 1e 38 1f 30 99 1f 31 4f 2a 69 da 0b
                                                  Data Ascii: D51\E'D7* O8et\0f0R1($>oP[@eY801O*iT2@#l0*z<F4a/dUF5iAzDScUSK:;{qQ.29h}w$/SZ24d2%h@"IT*w;W<-f.7p=ei ^C\aP`RyHaC!
                                                  Jul 22, 2024 12:34:37.351891994 CEST1236INData Raw: 39 ba ca 62 79 64 b1 96 fc a3 e4 33 18 bf f2 b3 53 33 28 3d 94 63 da fc df 9a ab 61 96 4f fd 8f 75 23 dd b5 d3 bd b5 31 ab e5 e1 6d de 8b 88 11 1d 05 ed 75 9d 2f 58 00 23 9c b7 5e 9c be d2 46 a0 2b 67 71 a6 f8 75 c0 5f 80 c9 c6 7f 3b c9 9d 1b 53
                                                  Data Ascii: 9byd3S3(=caOu#1mu/X#^F+gqu_;Sv_HO=[Ipy`9|;!&uEv@~q+"`T].@ON/,V]Bn`;LGQNL0j*\x8j8cpo;Y|1x[
                                                  Jul 22, 2024 12:34:37.351902962 CEST384INData Raw: e7 b8 35 15 54 a9 22 01 ba 8d 73 41 22 2d 5f 1c e5 c1 6a 64 1c 3a 02 da 84 ef c5 74 bd 9f 23 d9 32 44 34 28 27 d7 07 95 69 6b 95 3f 18 37 32 d0 a9 81 eb a5 e0 47 f9 bd 0e ce d3 e3 4e d2 40 77 fe 00 a1 df bb a6 9f 2e ba ee eb a2 f0 8c 0d bc fe f1
                                                  Data Ascii: 5T"sA"-_jd:t#2D4('ik?72GN@w.o[C4PcJ3 [mrE&r8U,%,uzs(q7r%Hr1]>D!M#C7xJW/5oZ~Wr4gB6SE^C8LT_4'8rC&:<uMz


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  47192.168.2.449902104.19.208.15280984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:36.981626987 CEST113OUTGET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Connection: Keep-Alive
                                                  Jul 22, 2024 12:34:37.486736059 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:37 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 17770
                                                  Connection: keep-alive
                                                  ETag: "770472110"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 407
                                                  Expires: Mon, 22 Jul 2024 14:34:37 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c77fcf088c0b-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 [TRUNCATED]
                                                  Data Ascii: PK:=AX7\0DrActiveFeatures.txt+@sjp#K1;/-[[ABexq)7 7:^gK !ibUVsO$v7|e\W'ZdveU*oR>%w$-;Q4Tf$+T$&Q?9#"6>0o@j(*i)H"B1`=&0I8CR"ycM7g\@8xE4S|Iyy7~%W?7!JhrfdB^OQ"IDG!o+^6VY6<wNNPP2\?EY^j>i[p`L_sXq>#~nY>LO9rsAS+g5FBiqgUf{*vBUBqTpKF;/[&WIAPuS-&v3!Y'bMl{[:5sVL3om7'O4'(V#:\#VOO&<s}Yd|<P@jM%O5lHs^SYfaCDDwVcE8~cETL0YIEd@._PQ~w\fAT7Kiywq|+#]N">(A0bU-lDM#ETYa-h}ep<),
                                                  Jul 22, 2024 12:34:37.487139940 CEST1236INData Raw: c3 e9 0b b5 94 79 f6 cd ab db ef 95 d6 d1 32 bc 03 27 b0 a7 67 bb 67 5c 5f 47 4a 97 f1 f7 fc 80 a5 3d 5e cb d2 21 fd 16 4d f6 ed 94 f2 d0 41 ec b6 8d 9b cb af 44 4b 5e 3f 92 fc ae 08 db 64 a5 1d 86 78 29 a2 a9 c5 2d c1 7a 36 38 e0 81 84 1a 34 f5
                                                  Data Ascii: y2'gg\_GJ=^!MADK^?dx)-z684R|YSgynUf1qbEFO?'[a`bF\rsZL0q\vgrP:ZbPw^l^|Vov^'D0\mJh*I{X14
                                                  Jul 22, 2024 12:34:37.487154007 CEST1236INData Raw: e3 09 b7 93 e7 ef 55 87 a5 e2 4a 0e 55 3c 50 4f 28 65 ca 9a de 34 88 d5 59 ab cd 64 54 2a 94 93 b6 b8 c7 f1 34 a6 fe 9a 9e 58 e1 5b 68 04 08 88 1d 07 7a 22 8c f4 8b 1a 37 f4 2d 18 02 f7 c9 7a e3 8d 30 e6 e5 c6 72 4a b5 33 12 97 f2 9b 9f 3d 2b 49
                                                  Data Ascii: UJU<PO(e4YdT*4X[hz"7-z0rJ3=+I:QrVjeAU|0e r.-nFs%U@_G~W}E^ns]W6.Jg4)Kk~9"4{i#W}_&L'HNOp
                                                  Jul 22, 2024 12:34:37.488842964 CEST672INData Raw: a2 40 45 ad 3e 10 cc d4 22 b8 18 aa b5 83 15 5b 5f 79 62 da f6 64 de 89 40 91 c6 e3 e6 3c 48 f6 f2 37 d0 b4 a2 87 ed 8b 72 11 f9 fa 1d 84 ca dd 63 7c e6 56 65 74 e8 c3 ce 0a 52 78 3d f5 2c 69 ad 82 46 5f 21 19 b5 ed d3 bf 7e 98 76 8d 6a 94 b7 ed
                                                  Data Ascii: @E>"[_ybd@<H7rc|VetRx=,iF_!~vj5s,yL/[g{QosVz%{A|PSeC)PYzSZ/]E?kINr|Pg!\2-;@&Lb<maS
                                                  Jul 22, 2024 12:34:37.488858938 CEST1236INData Raw: 1f 5f 95 40 e0 2f 2f b3 58 36 a8 5f 26 2b c1 d7 d8 86 95 ec 9b 23 f0 6b a3 48 55 63 47 ab 98 a2 7c a9 9d 44 46 9a cb 72 d4 ab 80 27 62 e2 20 b8 23 fe ab f6 c3 e1 79 ff 0e d6 3c ae d6 7b e4 a2 37 6f 8b fd 67 76 72 8f 8e e1 72 fa 02 77 a5 81 f5 71
                                                  Data Ascii: _@//X6_&+#kHUcG|DFr'b #y<{7ogvrrwq&PsTo=D8?^7(Xg@1~;sJa\o%PX=$cvb7fS:."$qC!QFmfWCW#H]WNsiz %Na)
                                                  Jul 22, 2024 12:34:37.490761042 CEST1236INData Raw: 67 d8 a1 30 25 3f 02 55 01 20 6a 51 4c 25 98 eb 97 f9 7e 66 ee d7 b1 f9 f9 c8 52 7e e9 cc 8c e0 85 81 9e 75 92 0d 4f 55 71 18 6b 3b 1f c1 38 42 6b c9 86 6d cb de b0 bc b5 62 17 da 81 40 69 af 0f ae 34 73 51 45 5a 4f 43 9b dc 83 af 7b a1 89 68 fd
                                                  Data Ascii: g0%?U jQL%~fR~uOUqk;8Bkmb@i4sQEZOC{h'VuuDyznvDn(&J;Px=Uc05;VT7!X<lA"}#&7qB(m5-r#N)4z7Axi)8r
                                                  Jul 22, 2024 12:34:37.490777016 CEST1236INData Raw: 4c 5f 22 a6 8e 97 9a b0 ae 42 00 ee 93 fe be c4 67 bd a1 03 61 4e 84 cb a0 67 6a e2 91 dc 77 40 da 04 53 1c 7e 5e 16 ac 6c 1f ad 21 43 29 ae 3c b5 6d 41 17 ce 99 37 75 7e 83 67 64 da 98 5f 52 48 92 39 2f a2 7b 79 5a a9 1c 84 29 a1 75 fe 35 2d ea
                                                  Data Ascii: L_"BgaNgjw@S~^l!C)<mA7u~gd_RH9/{yZ)u5-U|1.rwx#x{LOmV>y)YT+h"j^mf}xmk{KE[.ntTv#odHsfIu4@/=i ,Dm4%,],>A3
                                                  Jul 22, 2024 12:34:37.492682934 CEST1236INData Raw: 75 6b 9d 8e 72 bf 44 65 cd 9c 9a 81 c2 f5 91 b3 95 bd 7b f5 9b de 51 be c3 87 77 77 67 95 16 8e 08 8e 1a 8e 6e c8 38 25 3e bd 63 08 bf 5a 34 ee d4 84 0d 42 59 77 2e 68 0a cb 58 92 56 1e 99 7e 84 53 66 25 79 5a d7 07 7c 54 81 63 e7 ae b9 a1 c5 26
                                                  Data Ascii: ukrDe{Qwwgn8%>cZ4BYw.hXV~Sf%yZ|Tc&=0q5WKl\<U9$DW`+R ]m-68j5a.|sOB~1zc[ugQ>Tv~Fa&<pX caENsE0aUC3WE4e
                                                  Jul 22, 2024 12:34:37.492697954 CEST1236INData Raw: f9 3e cc a5 15 56 a3 fe af c3 ae f4 bf 6c 0a 0a b9 c0 08 ad a0 b3 98 77 db d1 2a a8 8c 8b 5c 92 11 d5 ff b8 b8 3d fa 21 dd 30 57 52 0f 90 76 97 46 49 f3 b0 f5 1b b1 d7 21 08 dd d8 77 eb 88 74 07 5c 0f f6 4f 41 ea 5c 09 37 2b b0 f3 16 f6 1c 9c 0d
                                                  Data Ascii: >Vlw*\=!0WRvFI!wt\OA\7+y;#+KsF14:FD[Re e#Hd5I.*p{o.H'*|a2iZ.Yp?X=[I\V~^{z7F: G5C*w 0sB=
                                                  Jul 22, 2024 12:34:37.492710114 CEST1236INData Raw: b1 86 60 62 c7 ed 7f be af 7b 96 5f 3d 9d 9d 0b 56 26 89 40 3d 3d 97 72 1b ff ea ff 35 46 a1 b9 be f8 fb 17 02 f9 23 5a 8c 2f 75 73 1d 7f e5 15 20 69 d1 52 03 6b f3 fa 6b 65 c5 b8 c6 cd 06 e9 35 8a c7 49 1e 7f 22 66 29 5b 8c 7b b9 3b fa e7 df 0d
                                                  Data Ascii: `b{_=V&@==r5F#Z/us iRkke5I"f)[{;5j0F7$v4Jo4c+;J|#0,N9Mu'l^DF+iL4\WB>To*+hiZa;;-c.T12=ZLXZbdBNRy
                                                  Jul 22, 2024 12:34:37.494539022 CEST1236INData Raw: f9 49 6f 29 45 36 42 64 47 c0 f6 2b 3b 0d 4e 0b 0c 4f 75 f7 e1 a9 d9 62 7e b0 9e a9 0d 23 ac 38 b6 3e 0a 62 8b 00 d4 53 2a a0 b4 00 65 cd d9 c4 7d d3 d0 be 79 36 da 1f 52 38 aa 3e 71 45 bc 26 08 37 85 56 e2 ac 04 06 4f 33 f9 f7 c0 c6 d0 a7 69 04
                                                  Data Ascii: Io)E6BdG+;NOub~#8>bS*e}y6R8>qE&7VO3iGxK'~V~GP)s&KicA]YbA`>Y<xCbDs-H:J0S+9y h8.7BmJPl/T5(^,Ke}g#:zEf


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  48192.168.2.449914104.19.208.15280940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:38.224505901 CEST113OUTGET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Connection: Keep-Alive
                                                  Jul 22, 2024 12:34:38.698856115 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:38 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 17770
                                                  Connection: keep-alive
                                                  ETag: "770472110"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 408
                                                  Expires: Mon, 22 Jul 2024 14:34:38 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c787784c0cc2-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 [TRUNCATED]
                                                  Data Ascii: PK:=AX7\0DrActiveFeatures.txt+@sjp#K1;/-[[ABexq)7 7:^gK !ibUVsO$v7|e\W'ZdveU*oR>%w$-;Q4Tf$+T$&Q?9#"6>0o@j(*i)H"B1`=&0I8CR"ycM7g\@8xE4S|Iyy7~%W?7!JhrfdB^OQ"IDG!o+^6VY6<wNNPP2\?EY^j>i[p`L_sXq>#~nY>LO9rsAS+g5FBiqgUf{*vBUBqTpKF;/[&WIAPuS-&v3!Y'bMl{[:5sVL3om7'O4'(V#:\#VOO&<s}Yd|<P@jM%O5lHs^SYfaCDDwVcE8~cETL0YIEd@._PQ~w\fAT7Kiywq|+#]N">(A0bU-lDM#ETYa-h}ep<),
                                                  Jul 22, 2024 12:34:38.698923111 CEST1236INData Raw: c3 e9 0b b5 94 79 f6 cd ab db ef 95 d6 d1 32 bc 03 27 b0 a7 67 bb 67 5c 5f 47 4a 97 f1 f7 fc 80 a5 3d 5e cb d2 21 fd 16 4d f6 ed 94 f2 d0 41 ec b6 8d 9b cb af 44 4b 5e 3f 92 fc ae 08 db 64 a5 1d 86 78 29 a2 a9 c5 2d c1 7a 36 38 e0 81 84 1a 34 f5
                                                  Data Ascii: y2'gg\_GJ=^!MADK^?dx)-z684R|YSgynUf1qbEFO?'[a`bF\rsZL0q\vgrP:ZbPw^l^|Vov^'D0\mJh*I{X14
                                                  Jul 22, 2024 12:34:38.698959112 CEST1236INData Raw: e3 09 b7 93 e7 ef 55 87 a5 e2 4a 0e 55 3c 50 4f 28 65 ca 9a de 34 88 d5 59 ab cd 64 54 2a 94 93 b6 b8 c7 f1 34 a6 fe 9a 9e 58 e1 5b 68 04 08 88 1d 07 7a 22 8c f4 8b 1a 37 f4 2d 18 02 f7 c9 7a e3 8d 30 e6 e5 c6 72 4a b5 33 12 97 f2 9b 9f 3d 2b 49
                                                  Data Ascii: UJU<PO(e4YdT*4X[hz"7-z0rJ3=+I:QrVjeAU|0e r.-nFs%U@_G~W}E^ns]W6.Jg4)Kk~9"4{i#W}_&L'HNOp
                                                  Jul 22, 2024 12:34:38.699923992 CEST1236INData Raw: a2 40 45 ad 3e 10 cc d4 22 b8 18 aa b5 83 15 5b 5f 79 62 da f6 64 de 89 40 91 c6 e3 e6 3c 48 f6 f2 37 d0 b4 a2 87 ed 8b 72 11 f9 fa 1d 84 ca dd 63 7c e6 56 65 74 e8 c3 ce 0a 52 78 3d f5 2c 69 ad 82 46 5f 21 19 b5 ed d3 bf 7e 98 76 8d 6a 94 b7 ed
                                                  Data Ascii: @E>"[_ybd@<H7rc|VetRx=,iF_!~vj5s,yL/[g{QosVz%{A|PSeC)PYzSZ/]E?kINr|Pg!\2-;@&Lb<maS
                                                  Jul 22, 2024 12:34:38.699959040 CEST1236INData Raw: ef ec e3 a3 78 02 50 1e 6e 18 3a c8 ef 40 01 47 df 2f 67 75 81 ee e7 ed 5c 86 a7 cd ff 50 b9 61 08 00 fa a5 b9 0e 2f 50 8f 87 fd 80 44 ec bf 7d 28 a2 50 86 c4 d0 81 34 04 f9 9d 19 90 5d 6c c8 6f a3 82 62 5f 8a 77 97 ae e6 15 32 ec 5b 3c d5 d1 50
                                                  Data Ascii: xPn:@G/gu\Pa/PD}(P4]lob_w2[<Pz|<gzX],af!:$uMs)m74Tf8Q0Ee@>i~p#D'uma{4q-x.{W)x,0Fm'*wTn
                                                  Jul 22, 2024 12:34:38.700982094 CEST1236INData Raw: ea fe e8 9b 44 1e 62 80 9f 85 5d b4 ed 54 9a 62 26 5d f9 5f e9 66 31 79 1a ec 5d eb 3b 42 de 2a 12 2f 99 5a 51 ad 2c 4e fc b2 cd 25 8a df 0b d7 07 24 1e 16 60 15 f2 23 fe 84 ec 28 ca cb ea 25 a1 6f 30 22 39 cc 4f eb 80 ec b0 87 73 03 c9 e2 6f cb
                                                  Data Ascii: Db]Tb&]_f1y];B*/ZQ,N%$`#(%o0"9OsosUN^m9N)&8))QK}b9"@T~yu?V7j7y)vJ_EEW58X+:CP~T,{/s" a*=_lJ
                                                  Jul 22, 2024 12:34:38.701018095 CEST1236INData Raw: c6 ac fb 85 2b c7 a3 2f 2f d9 73 66 a6 d5 b3 dc bc 4c 89 64 2f f9 a1 b7 40 bf dd 84 b3 f4 0d 92 fa d2 49 45 fc 27 f8 14 9d 3f bd 02 3a c4 6a 3c 68 f4 ec 55 d8 20 1b ea 58 1f 15 63 0c 4e fc 76 39 e9 cc 71 40 69 5b b9 5b c5 4e 6d 50 82 e3 2b 3d 15
                                                  Data Ascii: +//sfLd/@IE'?:j<hU XcNv9q@i[[NmP+=127ZS$rHxh7[m15'1Z91 #%|^s\obPTPUO:$9pgLNTKqmc_xE]uUW\&6Ijo
                                                  Jul 22, 2024 12:34:38.701987028 CEST1236INData Raw: e7 41 3d ce 7d 33 4d 0f 6d da 2d 57 cd 6d 7c 72 20 41 5f e2 85 cb 48 2a 2c 1b 25 2d ea 0b 8c 30 58 68 ec 5b 67 54 17 0b 09 36 f0 a1 5f 55 d0 81 77 eb 76 58 90 be 59 9e ba 3f be 84 2b 42 29 6f 5c df c6 42 5f 49 8a 9f 97 26 07 55 9d da 50 6a e6 dc
                                                  Data Ascii: A=}3Mm-Wm|r A_H*,%-0Xh[gT6_UwvXY?+B)o\B_I&UPj?n,\_%N&gFx!7^"*w/:=\-?2$(<9#oPa7Z+iIU1B($k!XdI<#7s(,\~1~@SfHTn
                                                  Jul 22, 2024 12:34:38.702023029 CEST1236INData Raw: 20 19 6a 5f 78 89 c4 93 e5 38 5a 6e de 37 da e2 c6 06 b0 e8 f5 8e ec 2a 4d 52 53 7c c0 ce f1 b1 9d 84 d3 91 ba fc 29 13 39 6d 22 59 ca f4 90 ba 24 c3 b5 86 27 17 f3 8a b2 8c 0f d9 b9 6d 97 6d 9b 96 f5 eb e7 ae 0b 71 31 03 84 41 72 7d a7 8d f4 99
                                                  Data Ascii: j_x8Zn7*MRS|)9m"Y$'mmq1Ar}sWC@T^n2I%j+r|kpjq%<OjYSO)o+`qK18oLXG#F?sTds%>qWY2qf[n XR`
                                                  Jul 22, 2024 12:34:38.703027010 CEST1236INData Raw: d1 d2 9b 08 03 2c 5a d5 0d b5 24 ba 57 06 e9 82 13 06 b8 76 cd 11 85 df 30 60 c7 4a 68 fc 62 33 d3 a3 33 4a 36 3d a8 67 bb a3 56 33 7d 3d 9a 83 2c 2e ab 79 ba 0d fb 01 11 b8 6d 84 ce cd 88 2e 7d f5 4f 3e 3e d1 e4 3c 13 83 fa 27 77 82 c7 e2 d9 4b
                                                  Data Ascii: ,Z$Wv0`Jhb33J6=gV3}=,.ym.}O>><'wK\U}&El?<tl%}v%HSA*gH(vqd00Dan~Jlax_K9#+Rfl?uhLO{.FLRS
                                                  Jul 22, 2024 12:34:38.704034090 CEST1236INData Raw: 12 42 b8 dd e5 1f 9e 6b 33 d0 27 64 66 67 09 75 13 4e 4f e9 2f 56 c0 a1 26 a6 e7 0f 48 59 99 5e 9a 7b ee 13 0a e1 b2 7e 95 bf 06 41 45 43 c3 c5 43 45 37 b4 fd 4d f1 ee 9a 9c 98 53 15 42 01 8c fa ef a5 44 d0 97 33 99 81 2a 36 6b 2c 46 c1 0c 71 2f
                                                  Data Ascii: Bk3'dfguNO/V&HY^{~AECCE7MSBD3*6k,Fq/D:-E|OylOR-BS)2,o(P.Ibk@1F] 9X&;/<MZ5 `CLg`h*EH=|EZpoC/j{1,u;


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  49192.168.2.44991764.18.87.480984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:39.618266106 CEST192OUTPOST /ipservice.asmx HTTP/1.1
                                                  Content-Type: text/xml; charset=utf-8
                                                  SOAPAction: "http://lavasoft.com/GetLocation"
                                                  Host: wsgeoip.lavasoft.com
                                                  Content-Length: 236
                                                  Connection: Keep-Alive
                                                  Jul 22, 2024 12:34:39.618311882 CEST236OUTData Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 20 78 6d 6c 6e 73 3a 78 73 69 3d
                                                  Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"><GetLocation xmlns="http://lavasoft.com/"/></s:Body></s:Envelope>
                                                  Jul 22, 2024 12:34:39.728998899 CEST702INHTTP/1.1 200 OK
                                                  Server: nginx
                                                  Date: Mon, 22 Jul 2024 10:34:39 GMT
                                                  Content-Type: text/xml; charset=utf-8
                                                  Content-Length: 446
                                                  Connection: keep-alive
                                                  Cache-Control: private, max-age=0
                                                  X-AspNet-Version: 4.0.30319
                                                  X-Powered-By: ASP.NET
                                                  x-here: true
                                                  Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 47 65 74 4c 6f 63 61 74 69 6f 6e 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 6c 61 76 61 73 6f 66 74 2e 63 6f 6d 2f 22 3e 3c 47 65 74 4c 6f 63 61 74 69 6f 6e 52 65 73 75 6c 74 3e 26 6c 74 3b 47 65 6f 49 50 26 67 74 3b 26 6c 74 3b 43 6f 75 6e 74 72 79 26 67 74 3b 55 53 26 6c 74 3b 2f 43 6f 75 6e 74 72 79 26 67 74 3b 26 6c 74 3b 53 [TRUNCATED]
                                                  Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"><soap:Body><GetLocationResponse xmlns="http://lavasoft.com/"><GetLocationResult>&lt;GeoIP&gt;&lt;Country&gt;US&lt;/Country&gt;&lt;State&gt;CA&lt;/State&gt;&lt;/GeoIP&gt;</GetLocationResult></GetLocationResponse></soap:Body></soap:Envelope>
                                                  Jul 22, 2024 12:34:40.741559982 CEST168OUTPOST /ipservice.asmx HTTP/1.1
                                                  Content-Type: text/xml; charset=utf-8
                                                  SOAPAction: "http://lavasoft.com/GetLocation"
                                                  Host: wsgeoip.lavasoft.com
                                                  Content-Length: 236
                                                  Jul 22, 2024 12:34:40.743083000 CEST236OUTData Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 20 78 6d 6c 6e 73 3a 78 73 69 3d
                                                  Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"><GetLocation xmlns="http://lavasoft.com/"/></s:Body></s:Envelope>
                                                  Jul 22, 2024 12:34:40.895540953 CEST702INHTTP/1.1 200 OK
                                                  Server: nginx
                                                  Date: Mon, 22 Jul 2024 10:34:40 GMT
                                                  Content-Type: text/xml; charset=utf-8
                                                  Content-Length: 446
                                                  Connection: keep-alive
                                                  Cache-Control: private, max-age=0
                                                  X-AspNet-Version: 4.0.30319
                                                  X-Powered-By: ASP.NET
                                                  x-here: true
                                                  Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 47 65 74 4c 6f 63 61 74 69 6f 6e 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 6c 61 76 61 73 6f 66 74 2e 63 6f 6d 2f 22 3e 3c 47 65 74 4c 6f 63 61 74 69 6f 6e 52 65 73 75 6c 74 3e 26 6c 74 3b 47 65 6f 49 50 26 67 74 3b 26 6c 74 3b 43 6f 75 6e 74 72 79 26 67 74 3b 55 53 26 6c 74 3b 2f 43 6f 75 6e 74 72 79 26 67 74 3b 26 6c 74 3b 53 [TRUNCATED]
                                                  Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"><soap:Body><GetLocationResponse xmlns="http://lavasoft.com/"><GetLocationResult>&lt;GeoIP&gt;&lt;Country&gt;US&lt;/Country&gt;&lt;State&gt;CA&lt;/State&gt;&lt;/GeoIP&gt;</GetLocationResult></GetLocationResponse></soap:Body></soap:Envelope>


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  50192.168.2.44991864.18.87.480984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:40.071719885 CEST192OUTPOST /ipservice.asmx HTTP/1.1
                                                  Content-Type: text/xml; charset=utf-8
                                                  SOAPAction: "http://lavasoft.com/GetLocation"
                                                  Host: wsgeoip.lavasoft.com
                                                  Content-Length: 236
                                                  Connection: Keep-Alive
                                                  Jul 22, 2024 12:34:40.071751118 CEST236OUTData Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 20 78 6d 6c 6e 73 3a 78 73 69 3d
                                                  Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"><GetLocation xmlns="http://lavasoft.com/"/></s:Body></s:Envelope>
                                                  Jul 22, 2024 12:34:40.179932117 CEST702INHTTP/1.1 200 OK
                                                  Server: nginx
                                                  Date: Mon, 22 Jul 2024 10:34:40 GMT
                                                  Content-Type: text/xml; charset=utf-8
                                                  Content-Length: 446
                                                  Connection: keep-alive
                                                  Cache-Control: private, max-age=0
                                                  X-AspNet-Version: 4.0.30319
                                                  X-Powered-By: ASP.NET
                                                  x-here: true
                                                  Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 47 65 74 4c 6f 63 61 74 69 6f 6e 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 6c 61 76 61 73 6f 66 74 2e 63 6f 6d 2f 22 3e 3c 47 65 74 4c 6f 63 61 74 69 6f 6e 52 65 73 75 6c 74 3e 26 6c 74 3b 47 65 6f 49 50 26 67 74 3b 26 6c 74 3b 43 6f 75 6e 74 72 79 26 67 74 3b 55 53 26 6c 74 3b 2f 43 6f 75 6e 74 72 79 26 67 74 3b 26 6c 74 3b 53 [TRUNCATED]
                                                  Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"><soap:Body><GetLocationResponse xmlns="http://lavasoft.com/"><GetLocationResult>&lt;GeoIP&gt;&lt;Country&gt;US&lt;/Country&gt;&lt;State&gt;CA&lt;/State&gt;&lt;/GeoIP&gt;</GetLocationResult></GetLocationResponse></soap:Body></soap:Envelope>
                                                  Jul 22, 2024 12:34:40.395823956 CEST702INHTTP/1.1 200 OK
                                                  Server: nginx
                                                  Date: Mon, 22 Jul 2024 10:34:40 GMT
                                                  Content-Type: text/xml; charset=utf-8
                                                  Content-Length: 446
                                                  Connection: keep-alive
                                                  Cache-Control: private, max-age=0
                                                  X-AspNet-Version: 4.0.30319
                                                  X-Powered-By: ASP.NET
                                                  x-here: true
                                                  Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 47 65 74 4c 6f 63 61 74 69 6f 6e 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 6c 61 76 61 73 6f 66 74 2e 63 6f 6d 2f 22 3e 3c 47 65 74 4c 6f 63 61 74 69 6f 6e 52 65 73 75 6c 74 3e 26 6c 74 3b 47 65 6f 49 50 26 67 74 3b 26 6c 74 3b 43 6f 75 6e 74 72 79 26 67 74 3b 55 53 26 6c 74 3b 2f 43 6f 75 6e 74 72 79 26 67 74 3b 26 6c 74 3b 53 [TRUNCATED]
                                                  Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"><soap:Body><GetLocationResponse xmlns="http://lavasoft.com/"><GetLocationResult>&lt;GeoIP&gt;&lt;Country&gt;US&lt;/Country&gt;&lt;State&gt;CA&lt;/State&gt;&lt;/GeoIP&gt;</GetLocationResult></GetLocationResponse></soap:Body></soap:Envelope>
                                                  Jul 22, 2024 12:34:40.943057060 CEST168OUTPOST /ipservice.asmx HTTP/1.1
                                                  Content-Type: text/xml; charset=utf-8
                                                  SOAPAction: "http://lavasoft.com/GetLocation"
                                                  Host: wsgeoip.lavasoft.com
                                                  Content-Length: 236
                                                  Jul 22, 2024 12:34:40.943100929 CEST236OUTData Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 20 78 6d 6c 6e 73 3a 78 73 69 3d
                                                  Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"><GetLocation xmlns="http://lavasoft.com/"/></s:Body></s:Envelope>
                                                  Jul 22, 2024 12:34:41.070314884 CEST702INHTTP/1.1 200 OK
                                                  Server: nginx
                                                  Date: Mon, 22 Jul 2024 10:34:40 GMT
                                                  Content-Type: text/xml; charset=utf-8
                                                  Content-Length: 446
                                                  Connection: keep-alive
                                                  Cache-Control: private, max-age=0
                                                  X-AspNet-Version: 4.0.30319
                                                  X-Powered-By: ASP.NET
                                                  x-here: true
                                                  Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 47 65 74 4c 6f 63 61 74 69 6f 6e 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 6c 61 76 61 73 6f 66 74 2e 63 6f 6d 2f 22 3e 3c 47 65 74 4c 6f 63 61 74 69 6f 6e 52 65 73 75 6c 74 3e 26 6c 74 3b 47 65 6f 49 50 26 67 74 3b 26 6c 74 3b 43 6f 75 6e 74 72 79 26 67 74 3b 55 53 26 6c 74 3b 2f 43 6f 75 6e 74 72 79 26 67 74 3b 26 6c 74 3b 53 [TRUNCATED]
                                                  Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"><soap:Body><GetLocationResponse xmlns="http://lavasoft.com/"><GetLocationResult>&lt;GeoIP&gt;&lt;Country&gt;US&lt;/Country&gt;&lt;State&gt;CA&lt;/State&gt;&lt;/GeoIP&gt;</GetLocationResult></GetLocationResponse></soap:Body></soap:Envelope>
                                                  Jul 22, 2024 12:34:41.215183020 CEST168OUTPOST /ipservice.asmx HTTP/1.1
                                                  Content-Type: text/xml; charset=utf-8
                                                  SOAPAction: "http://lavasoft.com/GetLocation"
                                                  Host: wsgeoip.lavasoft.com
                                                  Content-Length: 236
                                                  Jul 22, 2024 12:34:41.215454102 CEST236OUTData Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 20 78 6d 6c 6e 73 3a 78 73 69 3d
                                                  Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"><GetLocation xmlns="http://lavasoft.com/"/></s:Body></s:Envelope>
                                                  Jul 22, 2024 12:34:41.319601059 CEST702INHTTP/1.1 200 OK
                                                  Server: nginx
                                                  Date: Mon, 22 Jul 2024 10:34:41 GMT
                                                  Content-Type: text/xml; charset=utf-8
                                                  Content-Length: 446
                                                  Connection: keep-alive
                                                  Cache-Control: private, max-age=0
                                                  X-AspNet-Version: 4.0.30319
                                                  X-Powered-By: ASP.NET
                                                  x-here: true
                                                  Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 47 65 74 4c 6f 63 61 74 69 6f 6e 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 6c 61 76 61 73 6f 66 74 2e 63 6f 6d 2f 22 3e 3c 47 65 74 4c 6f 63 61 74 69 6f 6e 52 65 73 75 6c 74 3e 26 6c 74 3b 47 65 6f 49 50 26 67 74 3b 26 6c 74 3b 43 6f 75 6e 74 72 79 26 67 74 3b 55 53 26 6c 74 3b 2f 43 6f 75 6e 74 72 79 26 67 74 3b 26 6c 74 3b 53 [TRUNCATED]
                                                  Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"><soap:Body><GetLocationResponse xmlns="http://lavasoft.com/"><GetLocationResult>&lt;GeoIP&gt;&lt;Country&gt;US&lt;/Country&gt;&lt;State&gt;CA&lt;/State&gt;&lt;/GeoIP&gt;</GetLocationResult></GetLocationResponse></soap:Body></soap:Envelope>
                                                  Jul 22, 2024 12:34:41.355721951 CEST168OUTPOST /ipservice.asmx HTTP/1.1
                                                  Content-Type: text/xml; charset=utf-8
                                                  SOAPAction: "http://lavasoft.com/GetLocation"
                                                  Host: wsgeoip.lavasoft.com
                                                  Content-Length: 236
                                                  Jul 22, 2024 12:34:41.355752945 CEST236OUTData Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 20 78 6d 6c 6e 73 3a 78 73 69 3d
                                                  Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"><GetLocation xmlns="http://lavasoft.com/"/></s:Body></s:Envelope>
                                                  Jul 22, 2024 12:34:41.468457937 CEST702INHTTP/1.1 200 OK
                                                  Server: nginx
                                                  Date: Mon, 22 Jul 2024 10:34:41 GMT
                                                  Content-Type: text/xml; charset=utf-8
                                                  Content-Length: 446
                                                  Connection: keep-alive
                                                  Cache-Control: private, max-age=0
                                                  X-AspNet-Version: 4.0.30319
                                                  X-Powered-By: ASP.NET
                                                  x-here: true
                                                  Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 47 65 74 4c 6f 63 61 74 69 6f 6e 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 6c 61 76 61 73 6f 66 74 2e 63 6f 6d 2f 22 3e 3c 47 65 74 4c 6f 63 61 74 69 6f 6e 52 65 73 75 6c 74 3e 26 6c 74 3b 47 65 6f 49 50 26 67 74 3b 26 6c 74 3b 43 6f 75 6e 74 72 79 26 67 74 3b 55 53 26 6c 74 3b 2f 43 6f 75 6e 74 72 79 26 67 74 3b 26 6c 74 3b 53 [TRUNCATED]
                                                  Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"><soap:Body><GetLocationResponse xmlns="http://lavasoft.com/"><GetLocationResult>&lt;GeoIP&gt;&lt;Country&gt;US&lt;/Country&gt;&lt;State&gt;CA&lt;/State&gt;&lt;/GeoIP&gt;</GetLocationResult></GetLocationResponse></soap:Body></soap:Envelope>


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  51192.168.2.44992664.18.87.8180984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:40.960532904 CEST208OUTPOST /components.asmx HTTP/1.1
                                                  Content-Type: text/xml; charset=utf-8
                                                  SOAPAction: "http://tempuri.org/GetComponentsInfo"
                                                  Host: wc-update-service.lavasoft.com
                                                  Content-Length: 342
                                                  Connection: Keep-Alive
                                                  Jul 22, 2024 12:34:40.960557938 CEST342OUTData Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 20 78 6d 6c 6e 73 3a 78 73 69 3d
                                                  Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"><GetComponentsInfo xmlns="http://tempuri.org/"><request><Platform>prod</
                                                  Jul 22, 2024 12:34:41.467576027 CEST1236INHTTP/1.1 200 OK
                                                  Server: nginx
                                                  Date: Mon, 22 Jul 2024 10:34:41 GMT
                                                  Content-Type: text/xml; charset=utf-8
                                                  Content-Length: 1461
                                                  Connection: keep-alive
                                                  Cache-Control: private, max-age=0
                                                  X-AspNet-Version: 4.0.30319
                                                  X-Powered-By: ASP.NET
                                                  Access-Control-Allow-Origin: http://webcompanion.com
                                                  Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 47 65 74 43 6f 6d 70 6f 6e 65 6e 74 73 49 6e 66 6f 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 47 65 74 43 6f 6d 70 6f 6e 65 6e 74 73 49 6e 66 6f 52 65 73 75 6c 74 3e 3c 43 6f 6d 70 6f 6e 65 6e 74 73 3e 3c 43 6f 6d 70 6f 6e 65 6e 74 49 6e 66 6f 52 65 73 70 6f 6e 73 65 3e 3c 4e 61 6d 65 [TRUNCATED]
                                                  Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"><soap:Body><GetComponentsInfoResponse xmlns="http://tempuri.org/"><GetComponentsInfoResult><Components><ComponentInfoResponse><Name>installer</Name><Version>9.1.0.993</Version><DownloadUrl>http://wcdownloadercdn.lavasoft.com/9.1.0.993/Installer.exe</DownloadUrl></ComponentInfoResponse><ComponentInfoResponse><Name>application</Name><Version>2.1.1117.2317</Version><DownloadUrl>http://wcdownloadercdn.lavasoft.com/9.1.0.993/Installer.msi</DownloadUrl></ComponentInfoResponse><ComponentInfoResponse><Name>tcpservice</Name><Version>2.3.4.7</Version><DownloadUrl>http://wcdownloadercdn.lavasoft.com/9.1.0.993/TcpService.msi</DownloadUrl></ComponentInfoResponse><ComponentInfoResponse><Name>42f00399-529e-4915-83ce-5b4c18049fc8</Name><V
                                                  Jul 22, 2024 12:34:41.467593908 CEST522INData Raw: 65 72 73 69 6f 6e 3e 39 2e 31 2e 30 2e 39 39 33 3c 2f 56 65 72 73 69 6f 6e 3e 3c 44 6f 77 6e 6c 6f 61 64 55 72 6c 3e 68 74 74 70 3a 2f 2f 77 63 64 6f 77 6e 6c 6f 61 64 65 72 63 64 6e 2e 6c 61 76 61 73 6f 66 74 2e 63 6f 6d 2f 39 2e 31 2e 30 2e 39
                                                  Data Ascii: ersion>9.1.0.993</Version><DownloadUrl>http://wcdownloadercdn.lavasoft.com/9.1.0.993/WcInstaller.exe</DownloadUrl></ComponentInfoResponse><ComponentInfoResponse><Name>webcompanion</Name><Version>9.1.0.993</Version><DownloadUrl>http://wcdownloa


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  52192.168.2.449929104.19.208.15280940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:41.517047882 CEST105OUTGET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Jul 22, 2024 12:34:41.986071110 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:41 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 9891
                                                  Connection: keep-alive
                                                  ETag: "3914547665"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 108
                                                  Expires: Mon, 22 Jul 2024 14:34:41 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c79c08de1a3c-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d [TRUNCATED]
                                                  Data Ascii: PKIX6%FeatureActions.txtBPZ&KE9(0p<a}9g<D)9k@4y'!=~Zk`1J2[)_,{FF?q;fL*=1ZI->m%>`ml,sWITPu*;Pxxhgl$M]I}ogZL5?BZLxukU1P4mW-Ntf?I-/!w90/^%X-.0(mVPn]=cr_A$<BWye2bK{jOdxZv@[NLDU|_1Sp~Paq>})$qH7,hm)Ias<TWu$?Ey@Xu@5*UJLja0v^Q (O}k+fwvfzbhFE<plLWZI*.4#,X`=beVW)W*;Q,'x>Jq _T<ea&wo/RM2`rXFEc:A97A4FT0@wuJIBd5Bhw}oE@N=Z$)6@sXru%eIg5ruA:81&"e_'Be
                                                  Jul 22, 2024 12:34:41.986171007 CEST1236INData Raw: aa 27 91 1f 4b c3 11 60 77 a1 43 f9 f7 10 07 63 36 80 1a 86 ad 48 a7 d3 8f 6f 01 ae 9e 9c 3f a2 79 6e 3b 81 f2 7e 33 72 dc 17 7b 3c b2 f2 80 9b 26 a0 a9 76 69 9d e2 6e 9e 4d 47 96 36 9b c5 b5 27 68 b5 b4 84 34 1c 56 23 a3 50 e1 9f 24 02 89 9a 6e
                                                  Data Ascii: 'K`wCc6Ho?yn;~3r{<&vinMG6'h4V#P$n/Kt'<4oOa"xGTVBfE<eG#Bw{#@mc]os}uE6@e`^](9A,NjbNYnOF\8p"CLFk
                                                  Jul 22, 2024 12:34:41.986182928 CEST1236INData Raw: fd ac 50 d8 52 44 ee 8b 8f d4 d8 b2 84 d1 cb d6 f7 f8 05 a5 aa 41 48 05 36 3c 93 56 87 e3 e6 2f 47 40 72 47 91 28 bd 1e de c7 43 06 15 aa c9 07 7f 4b 86 10 6b 1f 41 44 6f 91 db 30 a2 f9 46 11 1a 4b 58 16 a1 31 d1 5e b4 59 ca fc 47 fc bc 25 05 70
                                                  Data Ascii: PRDAH6<V/G@rG(CKkADo0FKX1^YG%p8P*rH|idu{"PBv`DWG&O*rD:V4#{>51Zy4U-&SSIgFkZpYN~L-6Fed~ex>3
                                                  Jul 22, 2024 12:34:41.986548901 CEST1236INData Raw: 88 a8 b4 43 f7 18 27 39 99 b5 09 5b b0 21 e4 89 cd dc d8 80 8f ba 2c 76 5f 49 78 e0 a0 e6 a4 e8 61 8a 0a 7d 07 ae 7f 5b db 69 5b ab 4d 22 92 db 0e dc 5e ef db 36 83 5e 63 58 81 45 75 40 0c 8a 74 59 c3 e4 31 78 2a c9 f9 39 82 db c7 d7 e1 67 09 f5
                                                  Data Ascii: C'9[!,v_Ixa}[i[M"^6^cXEu@tY1x*9g&LIY+5kR@v<a.{G`#|<rPgAn><AhcF1NG_d~JFS}=l-z%Q\)Zm?)^afu
                                                  Jul 22, 2024 12:34:41.986562014 CEST1236INData Raw: 51 a2 95 4e ba 4b 5c 16 c5 a5 51 be 5a 39 45 dd 17 61 63 b5 65 bb 34 9f 6d 7c 76 0b e7 cf 8a 28 b1 32 a3 4c 94 f3 9c 2d 3a d8 05 c3 70 d8 b9 9e ea 5e e2 8b aa 76 16 1e 66 9d 5b 09 8d b4 bd 0c df a4 f1 57 38 11 41 42 5a 8f 27 30 7a 45 dd 2c af 7e
                                                  Data Ascii: QNK\QZ9Eace4m|v(2L-:p^vf[W8ABZ'0zE,~iY~^UiH-E`79_ue_f!t,f-X9^y0jgsotF8rUFX3\"T5p3WJBORFv
                                                  Jul 22, 2024 12:34:41.986573935 CEST1236INData Raw: ad 53 b8 3f 1e d4 8d 8b fb 22 dd 51 13 da db 37 c1 6d 8a c5 7d 9b 47 42 3f 8e c9 f0 52 59 f2 14 2a 9e 75 2e 6a 2e 7b 93 ce 8d 7f 03 7e d5 5c fc 25 45 10 44 72 a8 87 1c d2 e8 6e 79 f4 3a 12 2f 87 97 f4 7d 88 08 2a 70 f8 25 43 fc 4b 2d f3 25 a3 5d
                                                  Data Ascii: S?"Q7m}GB?RY*u.j.{~\%EDrny:/}*p%CK-%]F?TSkSG-^Bgv[1K+k9v&plE0P8t}BnUJXhBDBlfbG7Fsq3BI{?3>n
                                                  Jul 22, 2024 12:34:41.986586094 CEST776INData Raw: 98 44 c0 9d 35 87 31 5c f2 45 f9 c7 ef 27 c4 f0 44 cb 1d 0f 1c d1 37 2a fd 7f 20 4f 38 65 99 02 a1 9a ea fd 15 94 74 5c 15 e4 8a 30 a5 11 66 30 df 52 31 9c c6 28 24 8c 3e 6f 18 50 ce cd 5b 40 65 9a 59 06 f5 bf 1e 38 1f 30 99 1f 31 4f 2a 69 da 0b
                                                  Data Ascii: D51\E'D7* O8et\0f0R1($>oP[@eY801O*iT2@#l0*z<F4a/dUF5iAzDScUSK:;{qQ.29h}w$/SZ24d2%h@"IT*w;W<-f.7p=ei ^C\aP`RyHaC!
                                                  Jul 22, 2024 12:34:41.987126112 CEST1236INData Raw: dd 8e 72 29 8a c0 1d 3f 7c b1 47 79 69 06 1b 3b 20 2d d3 80 fd 5e 0a 7f 7f e8 ac f4 e0 91 49 12 b0 45 b9 40 ab 32 8c 4a 2c dd e0 c4 f6 c7 5b a6 da 77 23 f9 11 08 27 df 00 b7 d1 0d 68 61 65 ca f5 94 2c 49 3c 23 b4 dd 71 44 19 8b 85 07 c3 c3 a6 5d
                                                  Data Ascii: r)?|Gyi; -^IE@2J,[w#'hae,I<#qD]qHo;p,jU_lMhL)BBJLrKgUCb`oRg#{u$KG*0[F1#>#>!kH|$1YfA
                                                  Jul 22, 2024 12:34:41.987140894 CEST844INData Raw: 34 a7 f3 80 a8 8b 39 a9 af ac 8e 4d da 0c 3c 6c 36 b0 93 fa 50 57 5d e6 d6 54 d3 bb 51 f7 01 1d 87 fa 6c b7 82 35 42 59 dd 7f d6 79 6b 59 93 d4 fb e9 e3 20 7b d7 09 a6 58 da ea fc 4e 90 3d 02 ef 8f ea cd 54 72 61 9d c2 bb 32 3c b4 4d 8e a9 d3 78
                                                  Data Ascii: 49M<l6PW]TQl5BYykY {XN=Tra2<MxC)Z}-&%djyiwm^G<s 1u%pv#"SQd$S$!kUnf^RnG\vb&%65VXV@ha;aOiM3+EtU{o$o


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  53192.168.2.449930104.19.208.15280940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:41.585411072 CEST89OUTGET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Jul 22, 2024 12:34:42.066287994 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:42 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 17770
                                                  Connection: keep-alive
                                                  ETag: "770472110"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 412
                                                  Expires: Mon, 22 Jul 2024 14:34:42 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c79c6b2a41f9-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 [TRUNCATED]
                                                  Data Ascii: PK:=AX7\0DrActiveFeatures.txt+@sjp#K1;/-[[ABexq)7 7:^gK !ibUVsO$v7|e\W'ZdveU*oR>%w$-;Q4Tf$+T$&Q?9#"6>0o@j(*i)H"B1`=&0I8CR"ycM7g\@8xE4S|Iyy7~%W?7!JhrfdB^OQ"IDG!o+^6VY6<wNNPP2\?EY^j>i[p`L_sXq>#~nY>LO9rsAS+g5FBiqgUf{*vBUBqTpKF;/[&WIAPuS-&v3!Y'bMl{[:5sVL3om7'O4'(V#:\#VOO&<s}Yd|<P@jM%O5lHs^SYfaCDDwVcE8~cETL0YIEd@._PQ~w\fAT7Kiywq|+#]N">(A0bU-lDM#ETYa-h}ep<),
                                                  Jul 22, 2024 12:34:42.066330910 CEST1236INData Raw: c3 e9 0b b5 94 79 f6 cd ab db ef 95 d6 d1 32 bc 03 27 b0 a7 67 bb 67 5c 5f 47 4a 97 f1 f7 fc 80 a5 3d 5e cb d2 21 fd 16 4d f6 ed 94 f2 d0 41 ec b6 8d 9b cb af 44 4b 5e 3f 92 fc ae 08 db 64 a5 1d 86 78 29 a2 a9 c5 2d c1 7a 36 38 e0 81 84 1a 34 f5
                                                  Data Ascii: y2'gg\_GJ=^!MADK^?dx)-z684R|YSgynUf1qbEFO?'[a`bF\rsZL0q\vgrP:ZbPw^l^|Vov^'D0\mJh*I{X14
                                                  Jul 22, 2024 12:34:42.066343069 CEST1236INData Raw: e3 09 b7 93 e7 ef 55 87 a5 e2 4a 0e 55 3c 50 4f 28 65 ca 9a de 34 88 d5 59 ab cd 64 54 2a 94 93 b6 b8 c7 f1 34 a6 fe 9a 9e 58 e1 5b 68 04 08 88 1d 07 7a 22 8c f4 8b 1a 37 f4 2d 18 02 f7 c9 7a e3 8d 30 e6 e5 c6 72 4a b5 33 12 97 f2 9b 9f 3d 2b 49
                                                  Data Ascii: UJU<PO(e4YdT*4X[hz"7-z0rJ3=+I:QrVjeAU|0e r.-nFs%U@_G~W}E^ns]W6.Jg4)Kk~9"4{i#W}_&L'HNOp
                                                  Jul 22, 2024 12:34:42.066706896 CEST1236INData Raw: a2 40 45 ad 3e 10 cc d4 22 b8 18 aa b5 83 15 5b 5f 79 62 da f6 64 de 89 40 91 c6 e3 e6 3c 48 f6 f2 37 d0 b4 a2 87 ed 8b 72 11 f9 fa 1d 84 ca dd 63 7c e6 56 65 74 e8 c3 ce 0a 52 78 3d f5 2c 69 ad 82 46 5f 21 19 b5 ed d3 bf 7e 98 76 8d 6a 94 b7 ed
                                                  Data Ascii: @E>"[_ybd@<H7rc|VetRx=,iF_!~vj5s,yL/[g{QosVz%{A|PSeC)PYzSZ/]E?kINr|Pg!\2-;@&Lb<maS
                                                  Jul 22, 2024 12:34:42.066719055 CEST1236INData Raw: ef ec e3 a3 78 02 50 1e 6e 18 3a c8 ef 40 01 47 df 2f 67 75 81 ee e7 ed 5c 86 a7 cd ff 50 b9 61 08 00 fa a5 b9 0e 2f 50 8f 87 fd 80 44 ec bf 7d 28 a2 50 86 c4 d0 81 34 04 f9 9d 19 90 5d 6c c8 6f a3 82 62 5f 8a 77 97 ae e6 15 32 ec 5b 3c d5 d1 50
                                                  Data Ascii: xPn:@G/gu\Pa/PD}(P4]lob_w2[<Pz|<gzX],af!:$uMs)m74Tf8Q0Ee@>i~p#D'uma{4q-x.{W)x,0Fm'*wTn
                                                  Jul 22, 2024 12:34:42.066730976 CEST1236INData Raw: ea fe e8 9b 44 1e 62 80 9f 85 5d b4 ed 54 9a 62 26 5d f9 5f e9 66 31 79 1a ec 5d eb 3b 42 de 2a 12 2f 99 5a 51 ad 2c 4e fc b2 cd 25 8a df 0b d7 07 24 1e 16 60 15 f2 23 fe 84 ec 28 ca cb ea 25 a1 6f 30 22 39 cc 4f eb 80 ec b0 87 73 03 c9 e2 6f cb
                                                  Data Ascii: Db]Tb&]_f1y];B*/ZQ,N%$`#(%o0"9OsosUN^m9N)&8))QK}b9"@T~yu?V7j7y)vJ_EEW58X+:CP~T,{/s" a*=_lJ
                                                  Jul 22, 2024 12:34:42.066742897 CEST1236INData Raw: c6 ac fb 85 2b c7 a3 2f 2f d9 73 66 a6 d5 b3 dc bc 4c 89 64 2f f9 a1 b7 40 bf dd 84 b3 f4 0d 92 fa d2 49 45 fc 27 f8 14 9d 3f bd 02 3a c4 6a 3c 68 f4 ec 55 d8 20 1b ea 58 1f 15 63 0c 4e fc 76 39 e9 cc 71 40 69 5b b9 5b c5 4e 6d 50 82 e3 2b 3d 15
                                                  Data Ascii: +//sfLd/@IE'?:j<hU XcNv9q@i[[NmP+=127ZS$rHxh7[m15'1Z91 #%|^s\obPTPUO:$9pgLNTKqmc_xE]uUW\&6Ijo
                                                  Jul 22, 2024 12:34:42.067388058 CEST1236INData Raw: e7 41 3d ce 7d 33 4d 0f 6d da 2d 57 cd 6d 7c 72 20 41 5f e2 85 cb 48 2a 2c 1b 25 2d ea 0b 8c 30 58 68 ec 5b 67 54 17 0b 09 36 f0 a1 5f 55 d0 81 77 eb 76 58 90 be 59 9e ba 3f be 84 2b 42 29 6f 5c df c6 42 5f 49 8a 9f 97 26 07 55 9d da 50 6a e6 dc
                                                  Data Ascii: A=}3Mm-Wm|r A_H*,%-0Xh[gT6_UwvXY?+B)o\B_I&UPj?n,\_%N&gFx!7^"*w/:=\-?2$(<9#oPa7Z+iIU1B($k!XdI<#7s(,\~1~@SfHTn
                                                  Jul 22, 2024 12:34:42.067401886 CEST1236INData Raw: 20 19 6a 5f 78 89 c4 93 e5 38 5a 6e de 37 da e2 c6 06 b0 e8 f5 8e ec 2a 4d 52 53 7c c0 ce f1 b1 9d 84 d3 91 ba fc 29 13 39 6d 22 59 ca f4 90 ba 24 c3 b5 86 27 17 f3 8a b2 8c 0f d9 b9 6d 97 6d 9b 96 f5 eb e7 ae 0b 71 31 03 84 41 72 7d a7 8d f4 99
                                                  Data Ascii: j_x8Zn7*MRS|)9m"Y$'mmq1Ar}sWC@T^n2I%j+r|kpjq%<OjYSO)o+`qK18oLXG#F?sTds%>qWY2qf[n XR`
                                                  Jul 22, 2024 12:34:42.067414045 CEST1236INData Raw: d1 d2 9b 08 03 2c 5a d5 0d b5 24 ba 57 06 e9 82 13 06 b8 76 cd 11 85 df 30 60 c7 4a 68 fc 62 33 d3 a3 33 4a 36 3d a8 67 bb a3 56 33 7d 3d 9a 83 2c 2e ab 79 ba 0d fb 01 11 b8 6d 84 ce cd 88 2e 7d f5 4f 3e 3e d1 e4 3c 13 83 fa 27 77 82 c7 e2 d9 4b
                                                  Data Ascii: ,Z$Wv0`Jhb33J6=gV3}=,.ym.}O>><'wK\U}&El?<tl%}v%HSA*gH(vqd00Dan~Jlax_K9#+Rfl?uhLO{.FLRS
                                                  Jul 22, 2024 12:34:42.071273088 CEST1236INData Raw: 12 42 b8 dd e5 1f 9e 6b 33 d0 27 64 66 67 09 75 13 4e 4f e9 2f 56 c0 a1 26 a6 e7 0f 48 59 99 5e 9a 7b ee 13 0a e1 b2 7e 95 bf 06 41 45 43 c3 c5 43 45 37 b4 fd 4d f1 ee 9a 9c 98 53 15 42 01 8c fa ef a5 44 d0 97 33 99 81 2a 36 6b 2c 46 c1 0c 71 2f
                                                  Data Ascii: Bk3'dfguNO/V&HY^{~AECCE7MSBD3*6k,Fq/D:-E|OylOR-BS)2,o(P.Ibk@1F] 9X&;/<MZ5 `CLg`h*EH=|EZpoC/j{1,u;


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  54192.168.2.449931104.19.159.22480984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:42.513281107 CEST106OUTGET /version_logs?json=true&version=9.1.0.993 HTTP/1.1
                                                  Host: webcompanion.com
                                                  Connection: Keep-Alive


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  55192.168.2.44993264.18.87.480984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:42.522903919 CEST192OUTPOST /ipservice.asmx HTTP/1.1
                                                  Content-Type: text/xml; charset=utf-8
                                                  SOAPAction: "http://lavasoft.com/GetLocation"
                                                  Host: wsgeoip.lavasoft.com
                                                  Content-Length: 236
                                                  Connection: Keep-Alive
                                                  Jul 22, 2024 12:34:42.522927046 CEST236OUTData Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 20 78 6d 6c 6e 73 3a 78 73 69 3d
                                                  Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"><GetLocation xmlns="http://lavasoft.com/"/></s:Body></s:Envelope>
                                                  Jul 22, 2024 12:34:43.016086102 CEST702INHTTP/1.1 200 OK
                                                  Server: nginx
                                                  Date: Mon, 22 Jul 2024 10:34:42 GMT
                                                  Content-Type: text/xml; charset=utf-8
                                                  Content-Length: 446
                                                  Connection: keep-alive
                                                  Cache-Control: private, max-age=0
                                                  X-AspNet-Version: 4.0.30319
                                                  X-Powered-By: ASP.NET
                                                  x-here: true
                                                  Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 47 65 74 4c 6f 63 61 74 69 6f 6e 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 6c 61 76 61 73 6f 66 74 2e 63 6f 6d 2f 22 3e 3c 47 65 74 4c 6f 63 61 74 69 6f 6e 52 65 73 75 6c 74 3e 26 6c 74 3b 47 65 6f 49 50 26 67 74 3b 26 6c 74 3b 43 6f 75 6e 74 72 79 26 67 74 3b 55 53 26 6c 74 3b 2f 43 6f 75 6e 74 72 79 26 67 74 3b 26 6c 74 3b 53 [TRUNCATED]
                                                  Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"><soap:Body><GetLocationResponse xmlns="http://lavasoft.com/"><GetLocationResult>&lt;GeoIP&gt;&lt;Country&gt;US&lt;/Country&gt;&lt;State&gt;CA&lt;/State&gt;&lt;/GeoIP&gt;</GetLocationResult></GetLocationResponse></soap:Body></soap:Envelope>


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  56192.168.2.449940104.19.208.15280940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:45.280270100 CEST105OUTGET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Jul 22, 2024 12:34:45.762023926 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:45 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 9891
                                                  Connection: keep-alive
                                                  ETag: "3914547665"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 112
                                                  Expires: Mon, 22 Jul 2024 14:34:45 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7b3aae00cc9-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d [TRUNCATED]
                                                  Data Ascii: PKIX6%FeatureActions.txtBPZ&KE9(0p<a}9g<D)9k@4y'!=~Zk`1J2[)_,{FF?q;fL*=1ZI->m%>`ml,sWITPu*;Pxxhgl$M]I}ogZL5?BZLxukU1P4mW-Ntf?I-/!w90/^%X-.0(mVPn]=cr_A$<BWye2bK{jOdxZv@[NLDU|_1Sp~Paq>})$qH7,hm)Ias<TWu$?Ey@Xu@5*UJLja0v^Q (O}k+fwvfzbhFE<plLWZI*.4#,X`=beVW)W*;Q,'x>Jq _T<ea&wo/RM2`rXFEc:A97A4FT0@wuJIBd5Bhw}oE@N=Z$)6@sXru%eIg5ruA:81&"e_'Be
                                                  Jul 22, 2024 12:34:45.762037992 CEST1236INData Raw: aa 27 91 1f 4b c3 11 60 77 a1 43 f9 f7 10 07 63 36 80 1a 86 ad 48 a7 d3 8f 6f 01 ae 9e 9c 3f a2 79 6e 3b 81 f2 7e 33 72 dc 17 7b 3c b2 f2 80 9b 26 a0 a9 76 69 9d e2 6e 9e 4d 47 96 36 9b c5 b5 27 68 b5 b4 84 34 1c 56 23 a3 50 e1 9f 24 02 89 9a 6e
                                                  Data Ascii: 'K`wCc6Ho?yn;~3r{<&vinMG6'h4V#P$n/Kt'<4oOa"xGTVBfE<eG#Bw{#@mc]os}uE6@e`^](9A,NjbNYnOF\8p"CLFk
                                                  Jul 22, 2024 12:34:45.762048960 CEST1236INData Raw: fd ac 50 d8 52 44 ee 8b 8f d4 d8 b2 84 d1 cb d6 f7 f8 05 a5 aa 41 48 05 36 3c 93 56 87 e3 e6 2f 47 40 72 47 91 28 bd 1e de c7 43 06 15 aa c9 07 7f 4b 86 10 6b 1f 41 44 6f 91 db 30 a2 f9 46 11 1a 4b 58 16 a1 31 d1 5e b4 59 ca fc 47 fc bc 25 05 70
                                                  Data Ascii: PRDAH6<V/G@rG(CKkADo0FKX1^YG%p8P*rH|idu{"PBv`DWG&O*rD:V4#{>51Zy4U-&SSIgFkZpYN~L-6Fed~ex>3
                                                  Jul 22, 2024 12:34:45.762139082 CEST672INData Raw: 88 a8 b4 43 f7 18 27 39 99 b5 09 5b b0 21 e4 89 cd dc d8 80 8f ba 2c 76 5f 49 78 e0 a0 e6 a4 e8 61 8a 0a 7d 07 ae 7f 5b db 69 5b ab 4d 22 92 db 0e dc 5e ef db 36 83 5e 63 58 81 45 75 40 0c 8a 74 59 c3 e4 31 78 2a c9 f9 39 82 db c7 d7 e1 67 09 f5
                                                  Data Ascii: C'9[!,v_Ixa}[i[M"^6^cXEu@tY1x*9g&LIY+5kR@v<a.{G`#|<rPgAn><AhcF1NG_d~JFS}=l-z%Q\)Zm?)^afu
                                                  Jul 22, 2024 12:34:45.762315035 CEST1236INData Raw: 61 aa 08 dd ae 4e a9 20 f0 86 f7 d2 0f bd b4 39 51 dc 6c 33 d7 4b 59 37 fc f7 27 f0 c4 f9 d3 95 5a f2 29 96 f8 42 a5 0c b6 84 33 2f 08 22 4d 2f 67 4f 0e 19 1f 04 d0 88 32 94 39 52 e1 72 44 82 04 2b b2 26 cc b4 46 dd c8 06 3e de ac 55 f6 d8 97 a5
                                                  Data Ascii: aN 9Ql3KY7'Z)B3/"M/gO29RrD+&F>Uuw<}}S3_"z)fv@L@eHlwla%<Xc1}Q&<MY;%6e5hL^iG.uY+k+}`"^D]5 G@k_?Ph?
                                                  Jul 22, 2024 12:34:45.762325048 CEST1236INData Raw: be 69 1d 30 0d 5c 2a ba f9 58 02 c6 be 7f 45 32 1c f3 80 01 4d 28 6d da 0e 3e 73 b4 6c be 91 b4 80 1b 2b ff 47 33 2e 6a 3e 0c 39 53 e6 e7 f1 79 63 74 fb 11 57 6b bd 8d 24 63 24 74 f3 e0 c2 f1 76 c9 d6 7b 50 b0 b8 89 59 3f 7d 70 4e e5 5c b0 92 d6
                                                  Data Ascii: i0\*XE2M(m>sl+G3.j>9SyctWk$c$tv{PY?}pN\H/4<y`<AP8T1|=4jj"AEpp@dS|!3huK*As+w$)8EEL9^FjcA1!%X
                                                  Jul 22, 2024 12:34:45.762335062 CEST1236INData Raw: 1e 0e 93 87 8d b3 85 ef 08 7c 0d 45 6d 7b 10 18 92 21 a2 71 1a 1d 55 d2 de 2a 63 e6 9a 74 56 20 c3 43 8a 85 42 d4 4d 4e 2e ad 1a 95 92 9e b4 e7 63 fa a1 b9 e8 1c 02 8f 70 9b e6 cf 9f f8 3c 3c e8 c4 67 e2 b3 8b 74 02 bb 5c aa 48 97 2c 46 7d 35 98
                                                  Data Ascii: |Em{!qU*ctV CBMN.cp<<gt\H,F}5OwB(q_0bL)w,!u|Y?{:h1|o/7.cb-4k3ZrFZP,_zDiNxblgF|!&J;dhP48}U%vHEOXu
                                                  Jul 22, 2024 12:34:45.762345076 CEST1236INData Raw: 2c ef 24 2a 94 f8 43 62 85 44 5d 33 06 a5 72 64 8d 0a 06 12 a1 13 62 5b 09 17 65 35 d1 f2 96 a0 fa 4a a5 1b a7 25 ad 29 6d 69 33 cb cb e6 ab 13 bc 3c 29 c1 02 ee ad ad 32 d8 7d 60 fa 6d 52 37 a2 f8 27 e3 22 e2 70 ec f5 22 64 6a b0 cb 71 dc 53 f5
                                                  Data Ascii: ,$*CbD]3rdb[e5J%)mi3<)2}`mR7'"p"djqSxzay67*3.dr)?|Gyi; -^IE@2J,[w#'hae,I<#qD]qHo;p,jU_lMhL)BBJLrKgU
                                                  Jul 22, 2024 12:34:45.762849092 CEST948INData Raw: 66 66 80 ed 76 d6 35 eb bc 80 83 86 e2 b5 e2 25 22 0f 28 83 e9 87 de 13 76 c6 60 31 e3 91 8e 37 2a f7 86 a5 ac 6e bc 46 3e 3d c8 f0 c5 5a 0d 14 22 10 45 f9 a9 60 83 34 73 e9 32 fb 3f fe 11 93 46 cf 4e 92 cc 2f 8b 7a 3a fe d5 74 d6 5b cf c5 0c 2a
                                                  Data Ascii: ffv5%"(v`17*nF>=Z"E`4s2?FN/z:t[*jKQ6*`F"*49M<l6PW]TQl5BYykY {XN=Tra2<MxC)Z}-&%djyiwm^G<s 1u%pv#


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  57192.168.2.449946104.19.208.15280984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:45.789433956 CEST129OUTGET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Connection: Keep-Alive
                                                  Jul 22, 2024 12:34:46.288289070 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:46 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 9891
                                                  Connection: keep-alive
                                                  ETag: "3914547665"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 113
                                                  Expires: Mon, 22 Jul 2024 14:34:46 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7b6dab10cc4-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d [TRUNCATED]
                                                  Data Ascii: PKIX6%FeatureActions.txtBPZ&KE9(0p<a}9g<D)9k@4y'!=~Zk`1J2[)_,{FF?q;fL*=1ZI->m%>`ml,sWITPu*;Pxxhgl$M]I}ogZL5?BZLxukU1P4mW-Ntf?I-/!w90/^%X-.0(mVPn]=cr_A$<BWye2bK{jOdxZv@[NLDU|_1Sp~Paq>})$qH7,hm)Ias<TWu$?Ey@Xu@5*UJLja0v^Q (O}k+fwvfzbhFE<plLWZI*.4#,X`=beVW)W*;Q,'x>Jq _T<ea&wo/RM2`rXFEc:A97A4FT0@wuJIBd5Bhw}oE@N=Z$)6@sXru%eIg5ruA:81&"e_'Be
                                                  Jul 22, 2024 12:34:46.288333893 CEST1236INData Raw: aa 27 91 1f 4b c3 11 60 77 a1 43 f9 f7 10 07 63 36 80 1a 86 ad 48 a7 d3 8f 6f 01 ae 9e 9c 3f a2 79 6e 3b 81 f2 7e 33 72 dc 17 7b 3c b2 f2 80 9b 26 a0 a9 76 69 9d e2 6e 9e 4d 47 96 36 9b c5 b5 27 68 b5 b4 84 34 1c 56 23 a3 50 e1 9f 24 02 89 9a 6e
                                                  Data Ascii: 'K`wCc6Ho?yn;~3r{<&vinMG6'h4V#P$n/Kt'<4oOa"xGTVBfE<eG#Bw{#@mc]os}uE6@e`^](9A,NjbNYnOF\8p"CLFk
                                                  Jul 22, 2024 12:34:46.288343906 CEST1236INData Raw: fd ac 50 d8 52 44 ee 8b 8f d4 d8 b2 84 d1 cb d6 f7 f8 05 a5 aa 41 48 05 36 3c 93 56 87 e3 e6 2f 47 40 72 47 91 28 bd 1e de c7 43 06 15 aa c9 07 7f 4b 86 10 6b 1f 41 44 6f 91 db 30 a2 f9 46 11 1a 4b 58 16 a1 31 d1 5e b4 59 ca fc 47 fc bc 25 05 70
                                                  Data Ascii: PRDAH6<V/G@rG(CKkADo0FKX1^YG%p8P*rH|idu{"PBv`DWG&O*rD:V4#{>51Zy4U-&SSIgFkZpYN~L-6Fed~ex>3
                                                  Jul 22, 2024 12:34:46.288923025 CEST1236INData Raw: 88 a8 b4 43 f7 18 27 39 99 b5 09 5b b0 21 e4 89 cd dc d8 80 8f ba 2c 76 5f 49 78 e0 a0 e6 a4 e8 61 8a 0a 7d 07 ae 7f 5b db 69 5b ab 4d 22 92 db 0e dc 5e ef db 36 83 5e 63 58 81 45 75 40 0c 8a 74 59 c3 e4 31 78 2a c9 f9 39 82 db c7 d7 e1 67 09 f5
                                                  Data Ascii: C'9[!,v_Ixa}[i[M"^6^cXEu@tY1x*9g&LIY+5kR@v<a.{G`#|<rPgAn><AhcF1NG_d~JFS}=l-z%Q\)Zm?)^afu
                                                  Jul 22, 2024 12:34:46.288933039 CEST1236INData Raw: 51 a2 95 4e ba 4b 5c 16 c5 a5 51 be 5a 39 45 dd 17 61 63 b5 65 bb 34 9f 6d 7c 76 0b e7 cf 8a 28 b1 32 a3 4c 94 f3 9c 2d 3a d8 05 c3 70 d8 b9 9e ea 5e e2 8b aa 76 16 1e 66 9d 5b 09 8d b4 bd 0c df a4 f1 57 38 11 41 42 5a 8f 27 30 7a 45 dd 2c af 7e
                                                  Data Ascii: QNK\QZ9Eace4m|v(2L-:p^vf[W8ABZ'0zE,~iY~^UiH-E`79_ue_f!t,f-X9^y0jgsotF8rUFX3\"T5p3WJBORFv
                                                  Jul 22, 2024 12:34:46.288942099 CEST1236INData Raw: ad 53 b8 3f 1e d4 8d 8b fb 22 dd 51 13 da db 37 c1 6d 8a c5 7d 9b 47 42 3f 8e c9 f0 52 59 f2 14 2a 9e 75 2e 6a 2e 7b 93 ce 8d 7f 03 7e d5 5c fc 25 45 10 44 72 a8 87 1c d2 e8 6e 79 f4 3a 12 2f 87 97 f4 7d 88 08 2a 70 f8 25 43 fc 4b 2d f3 25 a3 5d
                                                  Data Ascii: S?"Q7m}GB?RY*u.j.{~\%EDrny:/}*p%CK-%]F?TSkSG-^Bgv[1K+k9v&plE0P8t}BnUJXhBDBlfbG7Fsq3BI{?3>n
                                                  Jul 22, 2024 12:34:46.288953066 CEST1236INData Raw: 98 44 c0 9d 35 87 31 5c f2 45 f9 c7 ef 27 c4 f0 44 cb 1d 0f 1c d1 37 2a fd 7f 20 4f 38 65 99 02 a1 9a ea fd 15 94 74 5c 15 e4 8a 30 a5 11 66 30 df 52 31 9c c6 28 24 8c 3e 6f 18 50 ce cd 5b 40 65 9a 59 06 f5 bf 1e 38 1f 30 99 1f 31 4f 2a 69 da 0b
                                                  Data Ascii: D51\E'D7* O8et\0f0R1($>oP[@eY801O*iT2@#l0*z<F4a/dUF5iAzDScUSK:;{qQ.29h}w$/SZ24d2%h@"IT*w;W<-f.7p=ei ^C\aP`RyHaC!
                                                  Jul 22, 2024 12:34:46.289434910 CEST1236INData Raw: 39 ba ca 62 79 64 b1 96 fc a3 e4 33 18 bf f2 b3 53 33 28 3d 94 63 da fc df 9a ab 61 96 4f fd 8f 75 23 dd b5 d3 bd b5 31 ab e5 e1 6d de 8b 88 11 1d 05 ed 75 9d 2f 58 00 23 9c b7 5e 9c be d2 46 a0 2b 67 71 a6 f8 75 c0 5f 80 c9 c6 7f 3b c9 9d 1b 53
                                                  Data Ascii: 9byd3S3(=caOu#1mu/X#^F+gqu_;Sv_HO=[Ipy`9|;!&uEv@~q+"`T].@ON/,V]Bn`;LGQNL0j*\x8j8cpo;Y|1x[
                                                  Jul 22, 2024 12:34:46.289444923 CEST384INData Raw: e7 b8 35 15 54 a9 22 01 ba 8d 73 41 22 2d 5f 1c e5 c1 6a 64 1c 3a 02 da 84 ef c5 74 bd 9f 23 d9 32 44 34 28 27 d7 07 95 69 6b 95 3f 18 37 32 d0 a9 81 eb a5 e0 47 f9 bd 0e ce d3 e3 4e d2 40 77 fe 00 a1 df bb a6 9f 2e ba ee eb a2 f0 8c 0d bc fe f1
                                                  Data Ascii: 5T"sA"-_jd:t#2D4('ik?72GN@w.o[C4PcJ3 [mrE&r8U,%,uzs(q7r%Hr1]>D!M#C7xJW/5oZ~Wr4gB6SE^C8LT_4'8rC&:<uMz


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  58192.168.2.449944104.16.149.13080984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:46.229537010 CEST179OUTPOST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 239
                                                  Connection: Keep-Alive
                                                  Jul 22, 2024 12:34:46.237034082 CEST239OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","CurrentSearch":"Google","CurrentHomepage":"about:home","LanguageIso2":"en-GB","IP":null,"CreateDate":0}}
                                                  Jul 22, 2024 12:34:46.820579052 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:46 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7ba1b464240-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  59192.168.2.449948104.19.208.15280940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:46.281224012 CEST89OUTGET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Jul 22, 2024 12:34:46.755274057 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:46 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 17770
                                                  Connection: keep-alive
                                                  ETag: "770472110"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 416
                                                  Expires: Mon, 22 Jul 2024 14:34:46 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7b9deb618f6-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 [TRUNCATED]
                                                  Data Ascii: PK:=AX7\0DrActiveFeatures.txt+@sjp#K1;/-[[ABexq)7 7:^gK !ibUVsO$v7|e\W'ZdveU*oR>%w$-;Q4Tf$+T$&Q?9#"6>0o@j(*i)H"B1`=&0I8CR"ycM7g\@8xE4S|Iyy7~%W?7!JhrfdB^OQ"IDG!o+^6VY6<wNNPP2\?EY^j>i[p`L_sXq>#~nY>LO9rsAS+g5FBiqgUf{*vBUBqTpKF;/[&WIAPuS-&v3!Y'bMl{[:5sVL3om7'O4'(V#:\#VOO&<s}Yd|<P@jM%O5lHs^SYfaCDDwVcE8~cETL0YIEd@._PQ~w\fAT7Kiywq|+#]N">(A0bU-lDM#ETYa-h}ep<),
                                                  Jul 22, 2024 12:34:46.755377054 CEST1236INData Raw: c3 e9 0b b5 94 79 f6 cd ab db ef 95 d6 d1 32 bc 03 27 b0 a7 67 bb 67 5c 5f 47 4a 97 f1 f7 fc 80 a5 3d 5e cb d2 21 fd 16 4d f6 ed 94 f2 d0 41 ec b6 8d 9b cb af 44 4b 5e 3f 92 fc ae 08 db 64 a5 1d 86 78 29 a2 a9 c5 2d c1 7a 36 38 e0 81 84 1a 34 f5
                                                  Data Ascii: y2'gg\_GJ=^!MADK^?dx)-z684R|YSgynUf1qbEFO?'[a`bF\rsZL0q\vgrP:ZbPw^l^|Vov^'D0\mJh*I{X14
                                                  Jul 22, 2024 12:34:46.755389929 CEST1236INData Raw: e3 09 b7 93 e7 ef 55 87 a5 e2 4a 0e 55 3c 50 4f 28 65 ca 9a de 34 88 d5 59 ab cd 64 54 2a 94 93 b6 b8 c7 f1 34 a6 fe 9a 9e 58 e1 5b 68 04 08 88 1d 07 7a 22 8c f4 8b 1a 37 f4 2d 18 02 f7 c9 7a e3 8d 30 e6 e5 c6 72 4a b5 33 12 97 f2 9b 9f 3d 2b 49
                                                  Data Ascii: UJU<PO(e4YdT*4X[hz"7-z0rJ3=+I:QrVjeAU|0e r.-nFs%U@_G~W}E^ns]W6.Jg4)Kk~9"4{i#W}_&L'HNOp
                                                  Jul 22, 2024 12:34:46.755606890 CEST1236INData Raw: a2 40 45 ad 3e 10 cc d4 22 b8 18 aa b5 83 15 5b 5f 79 62 da f6 64 de 89 40 91 c6 e3 e6 3c 48 f6 f2 37 d0 b4 a2 87 ed 8b 72 11 f9 fa 1d 84 ca dd 63 7c e6 56 65 74 e8 c3 ce 0a 52 78 3d f5 2c 69 ad 82 46 5f 21 19 b5 ed d3 bf 7e 98 76 8d 6a 94 b7 ed
                                                  Data Ascii: @E>"[_ybd@<H7rc|VetRx=,iF_!~vj5s,yL/[g{QosVz%{A|PSeC)PYzSZ/]E?kINr|Pg!\2-;@&Lb<maS
                                                  Jul 22, 2024 12:34:46.755675077 CEST1236INData Raw: ef ec e3 a3 78 02 50 1e 6e 18 3a c8 ef 40 01 47 df 2f 67 75 81 ee e7 ed 5c 86 a7 cd ff 50 b9 61 08 00 fa a5 b9 0e 2f 50 8f 87 fd 80 44 ec bf 7d 28 a2 50 86 c4 d0 81 34 04 f9 9d 19 90 5d 6c c8 6f a3 82 62 5f 8a 77 97 ae e6 15 32 ec 5b 3c d5 d1 50
                                                  Data Ascii: xPn:@G/gu\Pa/PD}(P4]lob_w2[<Pz|<gzX],af!:$uMs)m74Tf8Q0Ee@>i~p#D'uma{4q-x.{W)x,0Fm'*wTn
                                                  Jul 22, 2024 12:34:46.755688906 CEST1236INData Raw: ea fe e8 9b 44 1e 62 80 9f 85 5d b4 ed 54 9a 62 26 5d f9 5f e9 66 31 79 1a ec 5d eb 3b 42 de 2a 12 2f 99 5a 51 ad 2c 4e fc b2 cd 25 8a df 0b d7 07 24 1e 16 60 15 f2 23 fe 84 ec 28 ca cb ea 25 a1 6f 30 22 39 cc 4f eb 80 ec b0 87 73 03 c9 e2 6f cb
                                                  Data Ascii: Db]Tb&]_f1y];B*/ZQ,N%$`#(%o0"9OsosUN^m9N)&8))QK}b9"@T~yu?V7j7y)vJ_EEW58X+:CP~T,{/s" a*=_lJ
                                                  Jul 22, 2024 12:34:46.755700111 CEST1236INData Raw: c6 ac fb 85 2b c7 a3 2f 2f d9 73 66 a6 d5 b3 dc bc 4c 89 64 2f f9 a1 b7 40 bf dd 84 b3 f4 0d 92 fa d2 49 45 fc 27 f8 14 9d 3f bd 02 3a c4 6a 3c 68 f4 ec 55 d8 20 1b ea 58 1f 15 63 0c 4e fc 76 39 e9 cc 71 40 69 5b b9 5b c5 4e 6d 50 82 e3 2b 3d 15
                                                  Data Ascii: +//sfLd/@IE'?:j<hU XcNv9q@i[[NmP+=127ZS$rHxh7[m15'1Z91 #%|^s\obPTPUO:$9pgLNTKqmc_xE]uUW\&6Ijo
                                                  Jul 22, 2024 12:34:46.756243944 CEST1236INData Raw: e7 41 3d ce 7d 33 4d 0f 6d da 2d 57 cd 6d 7c 72 20 41 5f e2 85 cb 48 2a 2c 1b 25 2d ea 0b 8c 30 58 68 ec 5b 67 54 17 0b 09 36 f0 a1 5f 55 d0 81 77 eb 76 58 90 be 59 9e ba 3f be 84 2b 42 29 6f 5c df c6 42 5f 49 8a 9f 97 26 07 55 9d da 50 6a e6 dc
                                                  Data Ascii: A=}3Mm-Wm|r A_H*,%-0Xh[gT6_UwvXY?+B)o\B_I&UPj?n,\_%N&gFx!7^"*w/:=\-?2$(<9#oPa7Z+iIU1B($k!XdI<#7s(,\~1~@SfHTn
                                                  Jul 22, 2024 12:34:46.756258965 CEST1236INData Raw: 20 19 6a 5f 78 89 c4 93 e5 38 5a 6e de 37 da e2 c6 06 b0 e8 f5 8e ec 2a 4d 52 53 7c c0 ce f1 b1 9d 84 d3 91 ba fc 29 13 39 6d 22 59 ca f4 90 ba 24 c3 b5 86 27 17 f3 8a b2 8c 0f d9 b9 6d 97 6d 9b 96 f5 eb e7 ae 0b 71 31 03 84 41 72 7d a7 8d f4 99
                                                  Data Ascii: j_x8Zn7*MRS|)9m"Y$'mmq1Ar}sWC@T^n2I%j+r|kpjq%<OjYSO)o+`qK18oLXG#F?sTds%>qWY2qf[n XR`
                                                  Jul 22, 2024 12:34:46.756268024 CEST1236INData Raw: d1 d2 9b 08 03 2c 5a d5 0d b5 24 ba 57 06 e9 82 13 06 b8 76 cd 11 85 df 30 60 c7 4a 68 fc 62 33 d3 a3 33 4a 36 3d a8 67 bb a3 56 33 7d 3d 9a 83 2c 2e ab 79 ba 0d fb 01 11 b8 6d 84 ce cd 88 2e 7d f5 4f 3e 3e d1 e4 3c 13 83 fa 27 77 82 c7 e2 d9 4b
                                                  Data Ascii: ,Z$Wv0`Jhb33J6=gV3}=,.ym.}O>><'wK\U}&El?<tl%}v%HSA*gH(vqd00Dan~Jlax_K9#+Rfl?uhLO{.FLRS
                                                  Jul 22, 2024 12:34:46.760504961 CEST1236INData Raw: 12 42 b8 dd e5 1f 9e 6b 33 d0 27 64 66 67 09 75 13 4e 4f e9 2f 56 c0 a1 26 a6 e7 0f 48 59 99 5e 9a 7b ee 13 0a e1 b2 7e 95 bf 06 41 45 43 c3 c5 43 45 37 b4 fd 4d f1 ee 9a 9c 98 53 15 42 01 8c fa ef a5 44 d0 97 33 99 81 2a 36 6b 2c 46 c1 0c 71 2f
                                                  Data Ascii: Bk3'dfguNO/V&HY^{~AECCE7MSBD3*6k,Fq/D:-E|OylOR-BS)2,o(P.Ibk@1F] 9X&;/<MZ5 `CLg`h*EH=|EZpoC/j{1,u;


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  60192.168.2.449953104.19.208.15280940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:46.465864897 CEST105OUTGET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Jul 22, 2024 12:34:46.944699049 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:46 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 9891
                                                  Connection: keep-alive
                                                  ETag: "3914547665"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 113
                                                  Expires: Mon, 22 Jul 2024 14:34:46 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7bb0a081912-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d [TRUNCATED]
                                                  Data Ascii: PKIX6%FeatureActions.txtBPZ&KE9(0p<a}9g<D)9k@4y'!=~Zk`1J2[)_,{FF?q;fL*=1ZI->m%>`ml,sWITPu*;Pxxhgl$M]I}ogZL5?BZLxukU1P4mW-Ntf?I-/!w90/^%X-.0(mVPn]=cr_A$<BWye2bK{jOdxZv@[NLDU|_1Sp~Paq>})$qH7,hm)Ias<TWu$?Ey@Xu@5*UJLja0v^Q (O}k+fwvfzbhFE<plLWZI*.4#,X`=beVW)W*;Q,'x>Jq _T<ea&wo/RM2`rXFEc:A97A4FT0@wuJIBd5Bhw}oE@N=Z$)6@sXru%eIg5ruA:81&"e_'Be
                                                  Jul 22, 2024 12:34:46.944772959 CEST1236INData Raw: aa 27 91 1f 4b c3 11 60 77 a1 43 f9 f7 10 07 63 36 80 1a 86 ad 48 a7 d3 8f 6f 01 ae 9e 9c 3f a2 79 6e 3b 81 f2 7e 33 72 dc 17 7b 3c b2 f2 80 9b 26 a0 a9 76 69 9d e2 6e 9e 4d 47 96 36 9b c5 b5 27 68 b5 b4 84 34 1c 56 23 a3 50 e1 9f 24 02 89 9a 6e
                                                  Data Ascii: 'K`wCc6Ho?yn;~3r{<&vinMG6'h4V#P$n/Kt'<4oOa"xGTVBfE<eG#Bw{#@mc]os}uE6@e`^](9A,NjbNYnOF\8p"CLFk
                                                  Jul 22, 2024 12:34:46.944789886 CEST1236INData Raw: fd ac 50 d8 52 44 ee 8b 8f d4 d8 b2 84 d1 cb d6 f7 f8 05 a5 aa 41 48 05 36 3c 93 56 87 e3 e6 2f 47 40 72 47 91 28 bd 1e de c7 43 06 15 aa c9 07 7f 4b 86 10 6b 1f 41 44 6f 91 db 30 a2 f9 46 11 1a 4b 58 16 a1 31 d1 5e b4 59 ca fc 47 fc bc 25 05 70
                                                  Data Ascii: PRDAH6<V/G@rG(CKkADo0FKX1^YG%p8P*rH|idu{"PBv`DWG&O*rD:V4#{>51Zy4U-&SSIgFkZpYN~L-6Fed~ex>3
                                                  Jul 22, 2024 12:34:46.945040941 CEST1236INData Raw: 88 a8 b4 43 f7 18 27 39 99 b5 09 5b b0 21 e4 89 cd dc d8 80 8f ba 2c 76 5f 49 78 e0 a0 e6 a4 e8 61 8a 0a 7d 07 ae 7f 5b db 69 5b ab 4d 22 92 db 0e dc 5e ef db 36 83 5e 63 58 81 45 75 40 0c 8a 74 59 c3 e4 31 78 2a c9 f9 39 82 db c7 d7 e1 67 09 f5
                                                  Data Ascii: C'9[!,v_Ixa}[i[M"^6^cXEu@tY1x*9g&LIY+5kR@v<a.{G`#|<rPgAn><AhcF1NG_d~JFS}=l-z%Q\)Zm?)^afu
                                                  Jul 22, 2024 12:34:46.945102930 CEST1236INData Raw: 51 a2 95 4e ba 4b 5c 16 c5 a5 51 be 5a 39 45 dd 17 61 63 b5 65 bb 34 9f 6d 7c 76 0b e7 cf 8a 28 b1 32 a3 4c 94 f3 9c 2d 3a d8 05 c3 70 d8 b9 9e ea 5e e2 8b aa 76 16 1e 66 9d 5b 09 8d b4 bd 0c df a4 f1 57 38 11 41 42 5a 8f 27 30 7a 45 dd 2c af 7e
                                                  Data Ascii: QNK\QZ9Eace4m|v(2L-:p^vf[W8ABZ'0zE,~iY~^UiH-E`79_ue_f!t,f-X9^y0jgsotF8rUFX3\"T5p3WJBORFv
                                                  Jul 22, 2024 12:34:46.945122004 CEST1236INData Raw: ad 53 b8 3f 1e d4 8d 8b fb 22 dd 51 13 da db 37 c1 6d 8a c5 7d 9b 47 42 3f 8e c9 f0 52 59 f2 14 2a 9e 75 2e 6a 2e 7b 93 ce 8d 7f 03 7e d5 5c fc 25 45 10 44 72 a8 87 1c d2 e8 6e 79 f4 3a 12 2f 87 97 f4 7d 88 08 2a 70 f8 25 43 fc 4b 2d f3 25 a3 5d
                                                  Data Ascii: S?"Q7m}GB?RY*u.j.{~\%EDrny:/}*p%CK-%]F?TSkSG-^Bgv[1K+k9v&plE0P8t}BnUJXhBDBlfbG7Fsq3BI{?3>n
                                                  Jul 22, 2024 12:34:46.945137978 CEST1236INData Raw: 98 44 c0 9d 35 87 31 5c f2 45 f9 c7 ef 27 c4 f0 44 cb 1d 0f 1c d1 37 2a fd 7f 20 4f 38 65 99 02 a1 9a ea fd 15 94 74 5c 15 e4 8a 30 a5 11 66 30 df 52 31 9c c6 28 24 8c 3e 6f 18 50 ce cd 5b 40 65 9a 59 06 f5 bf 1e 38 1f 30 99 1f 31 4f 2a 69 da 0b
                                                  Data Ascii: D51\E'D7* O8et\0f0R1($>oP[@eY801O*iT2@#l0*z<F4a/dUF5iAzDScUSK:;{qQ.29h}w$/SZ24d2%h@"IT*w;W<-f.7p=ei ^C\aP`RyHaC!
                                                  Jul 22, 2024 12:34:46.945502996 CEST1236INData Raw: 39 ba ca 62 79 64 b1 96 fc a3 e4 33 18 bf f2 b3 53 33 28 3d 94 63 da fc df 9a ab 61 96 4f fd 8f 75 23 dd b5 d3 bd b5 31 ab e5 e1 6d de 8b 88 11 1d 05 ed 75 9d 2f 58 00 23 9c b7 5e 9c be d2 46 a0 2b 67 71 a6 f8 75 c0 5f 80 c9 c6 7f 3b c9 9d 1b 53
                                                  Data Ascii: 9byd3S3(=caOu#1mu/X#^F+gqu_;Sv_HO=[Ipy`9|;!&uEv@~q+"`T].@ON/,V]Bn`;LGQNL0j*\x8j8cpo;Y|1x[
                                                  Jul 22, 2024 12:34:46.945518970 CEST384INData Raw: e7 b8 35 15 54 a9 22 01 ba 8d 73 41 22 2d 5f 1c e5 c1 6a 64 1c 3a 02 da 84 ef c5 74 bd 9f 23 d9 32 44 34 28 27 d7 07 95 69 6b 95 3f 18 37 32 d0 a9 81 eb a5 e0 47 f9 bd 0e ce d3 e3 4e d2 40 77 fe 00 a1 df bb a6 9f 2e ba ee eb a2 f0 8c 0d bc fe f1
                                                  Data Ascii: 5T"sA"-_jd:t#2D4('ik?72GN@w.o[C4PcJ3 [mrE&r8U,%,uzs(q7r%Hr1]>D!M#C7xJW/5oZ~Wr4gB6SE^C8LT_4'8rC&:<uMz


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  61192.168.2.449954104.16.149.13080940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:46.468153954 CEST179OUTPOST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 239
                                                  Connection: Keep-Alive
                                                  Jul 22, 2024 12:34:46.475171089 CEST239OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","CurrentSearch":"Google","CurrentHomepage":"about:home","LanguageIso2":"en-GB","IP":null,"CreateDate":0}}
                                                  Jul 22, 2024 12:34:46.994216919 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:46 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7bb08527d06-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0
                                                  Jul 22, 2024 12:34:47.211899996 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:46 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7bb08527d06-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  62192.168.2.449955104.16.149.13080940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:46.476114988 CEST179OUTPOST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 239
                                                  Connection: Keep-Alive
                                                  Jul 22, 2024 12:34:46.481956005 CEST239OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","CurrentSearch":"Google","CurrentHomepage":"about:home","LanguageIso2":"en-GB","IP":null,"CreateDate":0}}
                                                  Jul 22, 2024 12:34:46.981513977 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:46 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7bb0cfa8c3c-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  63192.168.2.449968104.16.149.13080984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:49.769185066 CEST179OUTPOST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 239
                                                  Connection: Keep-Alive
                                                  Jul 22, 2024 12:34:49.774368048 CEST239OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","CurrentSearch":"Google","CurrentHomepage":"about:home","LanguageIso2":"en-GB","IP":null,"CreateDate":0}}
                                                  Jul 22, 2024 12:34:50.293092966 CEST519INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:50 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7cfbaa90f55-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}
                                                  Jul 22, 2024 12:34:50.429632902 CEST5INData Raw: 30 0d 0a 0d 0a
                                                  Data Ascii: 0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  64192.168.2.449969104.19.208.15280984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:49.776510000 CEST113OUTGET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Connection: Keep-Alive
                                                  Jul 22, 2024 12:34:50.261656046 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:50 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 17770
                                                  Connection: keep-alive
                                                  ETag: "770472110"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 420
                                                  Expires: Mon, 22 Jul 2024 14:34:50 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7cfbb511a03-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 [TRUNCATED]
                                                  Data Ascii: PK:=AX7\0DrActiveFeatures.txt+@sjp#K1;/-[[ABexq)7 7:^gK !ibUVsO$v7|e\W'ZdveU*oR>%w$-;Q4Tf$+T$&Q?9#"6>0o@j(*i)H"B1`=&0I8CR"ycM7g\@8xE4S|Iyy7~%W?7!JhrfdB^OQ"IDG!o+^6VY6<wNNPP2\?EY^j>i[p`L_sXq>#~nY>LO9rsAS+g5FBiqgUf{*vBUBqTpKF;/[&WIAPuS-&v3!Y'bMl{[:5sVL3om7'O4'(V#:\#VOO&<s}Yd|<P@jM%O5lHs^SYfaCDDwVcE8~cETL0YIEd@._PQ~w\fAT7Kiywq|+#]N">(A0bU-lDM#ETYa-h}ep<),
                                                  Jul 22, 2024 12:34:50.261837006 CEST1236INData Raw: c3 e9 0b b5 94 79 f6 cd ab db ef 95 d6 d1 32 bc 03 27 b0 a7 67 bb 67 5c 5f 47 4a 97 f1 f7 fc 80 a5 3d 5e cb d2 21 fd 16 4d f6 ed 94 f2 d0 41 ec b6 8d 9b cb af 44 4b 5e 3f 92 fc ae 08 db 64 a5 1d 86 78 29 a2 a9 c5 2d c1 7a 36 38 e0 81 84 1a 34 f5
                                                  Data Ascii: y2'gg\_GJ=^!MADK^?dx)-z684R|YSgynUf1qbEFO?'[a`bF\rsZL0q\vgrP:ZbPw^l^|Vov^'D0\mJh*I{X14
                                                  Jul 22, 2024 12:34:50.261847973 CEST1236INData Raw: e3 09 b7 93 e7 ef 55 87 a5 e2 4a 0e 55 3c 50 4f 28 65 ca 9a de 34 88 d5 59 ab cd 64 54 2a 94 93 b6 b8 c7 f1 34 a6 fe 9a 9e 58 e1 5b 68 04 08 88 1d 07 7a 22 8c f4 8b 1a 37 f4 2d 18 02 f7 c9 7a e3 8d 30 e6 e5 c6 72 4a b5 33 12 97 f2 9b 9f 3d 2b 49
                                                  Data Ascii: UJU<PO(e4YdT*4X[hz"7-z0rJ3=+I:QrVjeAU|0e r.-nFs%U@_G~W}E^ns]W6.Jg4)Kk~9"4{i#W}_&L'HNOp
                                                  Jul 22, 2024 12:34:50.263057947 CEST1236INData Raw: a2 40 45 ad 3e 10 cc d4 22 b8 18 aa b5 83 15 5b 5f 79 62 da f6 64 de 89 40 91 c6 e3 e6 3c 48 f6 f2 37 d0 b4 a2 87 ed 8b 72 11 f9 fa 1d 84 ca dd 63 7c e6 56 65 74 e8 c3 ce 0a 52 78 3d f5 2c 69 ad 82 46 5f 21 19 b5 ed d3 bf 7e 98 76 8d 6a 94 b7 ed
                                                  Data Ascii: @E>"[_ybd@<H7rc|VetRx=,iF_!~vj5s,yL/[g{QosVz%{A|PSeC)PYzSZ/]E?kINr|Pg!\2-;@&Lb<maS
                                                  Jul 22, 2024 12:34:50.263077021 CEST1236INData Raw: ef ec e3 a3 78 02 50 1e 6e 18 3a c8 ef 40 01 47 df 2f 67 75 81 ee e7 ed 5c 86 a7 cd ff 50 b9 61 08 00 fa a5 b9 0e 2f 50 8f 87 fd 80 44 ec bf 7d 28 a2 50 86 c4 d0 81 34 04 f9 9d 19 90 5d 6c c8 6f a3 82 62 5f 8a 77 97 ae e6 15 32 ec 5b 3c d5 d1 50
                                                  Data Ascii: xPn:@G/gu\Pa/PD}(P4]lob_w2[<Pz|<gzX],af!:$uMs)m74Tf8Q0Ee@>i~p#D'uma{4q-x.{W)x,0Fm'*wTn
                                                  Jul 22, 2024 12:34:50.265157938 CEST1236INData Raw: ea fe e8 9b 44 1e 62 80 9f 85 5d b4 ed 54 9a 62 26 5d f9 5f e9 66 31 79 1a ec 5d eb 3b 42 de 2a 12 2f 99 5a 51 ad 2c 4e fc b2 cd 25 8a df 0b d7 07 24 1e 16 60 15 f2 23 fe 84 ec 28 ca cb ea 25 a1 6f 30 22 39 cc 4f eb 80 ec b0 87 73 03 c9 e2 6f cb
                                                  Data Ascii: Db]Tb&]_f1y];B*/ZQ,N%$`#(%o0"9OsosUN^m9N)&8))QK}b9"@T~yu?V7j7y)vJ_EEW58X+:CP~T,{/s" a*=_lJ
                                                  Jul 22, 2024 12:34:50.265167952 CEST1236INData Raw: c6 ac fb 85 2b c7 a3 2f 2f d9 73 66 a6 d5 b3 dc bc 4c 89 64 2f f9 a1 b7 40 bf dd 84 b3 f4 0d 92 fa d2 49 45 fc 27 f8 14 9d 3f bd 02 3a c4 6a 3c 68 f4 ec 55 d8 20 1b ea 58 1f 15 63 0c 4e fc 76 39 e9 cc 71 40 69 5b b9 5b c5 4e 6d 50 82 e3 2b 3d 15
                                                  Data Ascii: +//sfLd/@IE'?:j<hU XcNv9q@i[[NmP+=127ZS$rHxh7[m15'1Z91 #%|^s\obPTPUO:$9pgLNTKqmc_xE]uUW\&6Ijo
                                                  Jul 22, 2024 12:34:50.267158985 CEST1236INData Raw: e7 41 3d ce 7d 33 4d 0f 6d da 2d 57 cd 6d 7c 72 20 41 5f e2 85 cb 48 2a 2c 1b 25 2d ea 0b 8c 30 58 68 ec 5b 67 54 17 0b 09 36 f0 a1 5f 55 d0 81 77 eb 76 58 90 be 59 9e ba 3f be 84 2b 42 29 6f 5c df c6 42 5f 49 8a 9f 97 26 07 55 9d da 50 6a e6 dc
                                                  Data Ascii: A=}3Mm-Wm|r A_H*,%-0Xh[gT6_UwvXY?+B)o\B_I&UPj?n,\_%N&gFx!7^"*w/:=\-?2$(<9#oPa7Z+iIU1B($k!XdI<#7s(,\~1~@SfHTn
                                                  Jul 22, 2024 12:34:50.267172098 CEST1236INData Raw: 20 19 6a 5f 78 89 c4 93 e5 38 5a 6e de 37 da e2 c6 06 b0 e8 f5 8e ec 2a 4d 52 53 7c c0 ce f1 b1 9d 84 d3 91 ba fc 29 13 39 6d 22 59 ca f4 90 ba 24 c3 b5 86 27 17 f3 8a b2 8c 0f d9 b9 6d 97 6d 9b 96 f5 eb e7 ae 0b 71 31 03 84 41 72 7d a7 8d f4 99
                                                  Data Ascii: j_x8Zn7*MRS|)9m"Y$'mmq1Ar}sWC@T^n2I%j+r|kpjq%<OjYSO)o+`qK18oLXG#F?sTds%>qWY2qf[n XR`
                                                  Jul 22, 2024 12:34:50.268445969 CEST1236INData Raw: d1 d2 9b 08 03 2c 5a d5 0d b5 24 ba 57 06 e9 82 13 06 b8 76 cd 11 85 df 30 60 c7 4a 68 fc 62 33 d3 a3 33 4a 36 3d a8 67 bb a3 56 33 7d 3d 9a 83 2c 2e ab 79 ba 0d fb 01 11 b8 6d 84 ce cd 88 2e 7d f5 4f 3e 3e d1 e4 3c 13 83 fa 27 77 82 c7 e2 d9 4b
                                                  Data Ascii: ,Z$Wv0`Jhb33J6=gV3}=,.ym.}O>><'wK\U}&El?<tl%}v%HSA*gH(vqd00Dan~Jlax_K9#+Rfl?uhLO{.FLRS
                                                  Jul 22, 2024 12:34:50.268662930 CEST1236INData Raw: 12 42 b8 dd e5 1f 9e 6b 33 d0 27 64 66 67 09 75 13 4e 4f e9 2f 56 c0 a1 26 a6 e7 0f 48 59 99 5e 9a 7b ee 13 0a e1 b2 7e 95 bf 06 41 45 43 c3 c5 43 45 37 b4 fd 4d f1 ee 9a 9c 98 53 15 42 01 8c fa ef a5 44 d0 97 33 99 81 2a 36 6b 2c 46 c1 0c 71 2f
                                                  Data Ascii: Bk3'dfguNO/V&HY^{~AECCE7MSBD3*6k,Fq/D:-E|OylOR-BS)2,o(P.Ibk@1F] 9X&;/<MZ5 `CLg`h*EH=|EZpoC/j{1,u;


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  65192.168.2.449977104.19.208.15280984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:51.373347044 CEST89OUTGET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Jul 22, 2024 12:34:51.746269941 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:51 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 17770
                                                  Connection: keep-alive
                                                  ETag: "770472110"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 421
                                                  Expires: Mon, 22 Jul 2024 14:34:51 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7d8df4d7285-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 [TRUNCATED]
                                                  Data Ascii: PK:=AX7\0DrActiveFeatures.txt+@sjp#K1;/-[[ABexq)7 7:^gK !ibUVsO$v7|e\W'ZdveU*oR>%w$-;Q4Tf$+T$&Q?9#"6>0o@j(*i)H"B1`=&0I8CR"ycM7g\@8xE4S|Iyy7~%W?7!JhrfdB^OQ"IDG!o+^6VY6<wNNPP2\?EY^j>i[p`L_sXq>#~nY>LO9rsAS+g5FBiqgUf{*vBUBqTpKF;/[&WIAPuS-&v3!Y'bMl{[:5sVL3om7'O4'(V#:\#VOO&<s}Yd|<P@jM%O5lHs^SYfaCDDwVcE8~cETL0YIEd@._PQ~w\fAT7Kiywq|+#]N">(A0bU-lDM#ETYa-h}ep<),
                                                  Jul 22, 2024 12:34:51.746361971 CEST1236INData Raw: c3 e9 0b b5 94 79 f6 cd ab db ef 95 d6 d1 32 bc 03 27 b0 a7 67 bb 67 5c 5f 47 4a 97 f1 f7 fc 80 a5 3d 5e cb d2 21 fd 16 4d f6 ed 94 f2 d0 41 ec b6 8d 9b cb af 44 4b 5e 3f 92 fc ae 08 db 64 a5 1d 86 78 29 a2 a9 c5 2d c1 7a 36 38 e0 81 84 1a 34 f5
                                                  Data Ascii: y2'gg\_GJ=^!MADK^?dx)-z684R|YSgynUf1qbEFO?'[a`bF\rsZL0q\vgrP:ZbPw^l^|Vov^'D0\mJh*I{X14
                                                  Jul 22, 2024 12:34:51.746371031 CEST1236INData Raw: e3 09 b7 93 e7 ef 55 87 a5 e2 4a 0e 55 3c 50 4f 28 65 ca 9a de 34 88 d5 59 ab cd 64 54 2a 94 93 b6 b8 c7 f1 34 a6 fe 9a 9e 58 e1 5b 68 04 08 88 1d 07 7a 22 8c f4 8b 1a 37 f4 2d 18 02 f7 c9 7a e3 8d 30 e6 e5 c6 72 4a b5 33 12 97 f2 9b 9f 3d 2b 49
                                                  Data Ascii: UJU<PO(e4YdT*4X[hz"7-z0rJ3=+I:QrVjeAU|0e r.-nFs%U@_G~W}E^ns]W6.Jg4)Kk~9"4{i#W}_&L'HNOp
                                                  Jul 22, 2024 12:34:51.746790886 CEST1236INData Raw: a2 40 45 ad 3e 10 cc d4 22 b8 18 aa b5 83 15 5b 5f 79 62 da f6 64 de 89 40 91 c6 e3 e6 3c 48 f6 f2 37 d0 b4 a2 87 ed 8b 72 11 f9 fa 1d 84 ca dd 63 7c e6 56 65 74 e8 c3 ce 0a 52 78 3d f5 2c 69 ad 82 46 5f 21 19 b5 ed d3 bf 7e 98 76 8d 6a 94 b7 ed
                                                  Data Ascii: @E>"[_ybd@<H7rc|VetRx=,iF_!~vj5s,yL/[g{QosVz%{A|PSeC)PYzSZ/]E?kINr|Pg!\2-;@&Lb<maS
                                                  Jul 22, 2024 12:34:51.746802092 CEST1236INData Raw: ef ec e3 a3 78 02 50 1e 6e 18 3a c8 ef 40 01 47 df 2f 67 75 81 ee e7 ed 5c 86 a7 cd ff 50 b9 61 08 00 fa a5 b9 0e 2f 50 8f 87 fd 80 44 ec bf 7d 28 a2 50 86 c4 d0 81 34 04 f9 9d 19 90 5d 6c c8 6f a3 82 62 5f 8a 77 97 ae e6 15 32 ec 5b 3c d5 d1 50
                                                  Data Ascii: xPn:@G/gu\Pa/PD}(P4]lob_w2[<Pz|<gzX],af!:$uMs)m74Tf8Q0Ee@>i~p#D'uma{4q-x.{W)x,0Fm'*wTn
                                                  Jul 22, 2024 12:34:51.746812105 CEST1236INData Raw: ea fe e8 9b 44 1e 62 80 9f 85 5d b4 ed 54 9a 62 26 5d f9 5f e9 66 31 79 1a ec 5d eb 3b 42 de 2a 12 2f 99 5a 51 ad 2c 4e fc b2 cd 25 8a df 0b d7 07 24 1e 16 60 15 f2 23 fe 84 ec 28 ca cb ea 25 a1 6f 30 22 39 cc 4f eb 80 ec b0 87 73 03 c9 e2 6f cb
                                                  Data Ascii: Db]Tb&]_f1y];B*/ZQ,N%$`#(%o0"9OsosUN^m9N)&8))QK}b9"@T~yu?V7j7y)vJ_EEW58X+:CP~T,{/s" a*=_lJ
                                                  Jul 22, 2024 12:34:51.746823072 CEST1236INData Raw: c6 ac fb 85 2b c7 a3 2f 2f d9 73 66 a6 d5 b3 dc bc 4c 89 64 2f f9 a1 b7 40 bf dd 84 b3 f4 0d 92 fa d2 49 45 fc 27 f8 14 9d 3f bd 02 3a c4 6a 3c 68 f4 ec 55 d8 20 1b ea 58 1f 15 63 0c 4e fc 76 39 e9 cc 71 40 69 5b b9 5b c5 4e 6d 50 82 e3 2b 3d 15
                                                  Data Ascii: +//sfLd/@IE'?:j<hU XcNv9q@i[[NmP+=127ZS$rHxh7[m15'1Z91 #%|^s\obPTPUO:$9pgLNTKqmc_xE]uUW\&6Ijo
                                                  Jul 22, 2024 12:34:51.747575998 CEST1236INData Raw: e7 41 3d ce 7d 33 4d 0f 6d da 2d 57 cd 6d 7c 72 20 41 5f e2 85 cb 48 2a 2c 1b 25 2d ea 0b 8c 30 58 68 ec 5b 67 54 17 0b 09 36 f0 a1 5f 55 d0 81 77 eb 76 58 90 be 59 9e ba 3f be 84 2b 42 29 6f 5c df c6 42 5f 49 8a 9f 97 26 07 55 9d da 50 6a e6 dc
                                                  Data Ascii: A=}3Mm-Wm|r A_H*,%-0Xh[gT6_UwvXY?+B)o\B_I&UPj?n,\_%N&gFx!7^"*w/:=\-?2$(<9#oPa7Z+iIU1B($k!XdI<#7s(,\~1~@SfHTn
                                                  Jul 22, 2024 12:34:51.747586966 CEST1236INData Raw: 20 19 6a 5f 78 89 c4 93 e5 38 5a 6e de 37 da e2 c6 06 b0 e8 f5 8e ec 2a 4d 52 53 7c c0 ce f1 b1 9d 84 d3 91 ba fc 29 13 39 6d 22 59 ca f4 90 ba 24 c3 b5 86 27 17 f3 8a b2 8c 0f d9 b9 6d 97 6d 9b 96 f5 eb e7 ae 0b 71 31 03 84 41 72 7d a7 8d f4 99
                                                  Data Ascii: j_x8Zn7*MRS|)9m"Y$'mmq1Ar}sWC@T^n2I%j+r|kpjq%<OjYSO)o+`qK18oLXG#F?sTds%>qWY2qf[n XR`
                                                  Jul 22, 2024 12:34:51.747596025 CEST1236INData Raw: d1 d2 9b 08 03 2c 5a d5 0d b5 24 ba 57 06 e9 82 13 06 b8 76 cd 11 85 df 30 60 c7 4a 68 fc 62 33 d3 a3 33 4a 36 3d a8 67 bb a3 56 33 7d 3d 9a 83 2c 2e ab 79 ba 0d fb 01 11 b8 6d 84 ce cd 88 2e 7d f5 4f 3e 3e d1 e4 3c 13 83 fa 27 77 82 c7 e2 d9 4b
                                                  Data Ascii: ,Z$Wv0`Jhb33J6=gV3}=,.ym.}O>><'wK\U}&El?<tl%}v%HSA*gH(vqd00Dan~Jlax_K9#+Rfl?uhLO{.FLRS
                                                  Jul 22, 2024 12:34:51.753456116 CEST1236INData Raw: 12 42 b8 dd e5 1f 9e 6b 33 d0 27 64 66 67 09 75 13 4e 4f e9 2f 56 c0 a1 26 a6 e7 0f 48 59 99 5e 9a 7b ee 13 0a e1 b2 7e 95 bf 06 41 45 43 c3 c5 43 45 37 b4 fd 4d f1 ee 9a 9c 98 53 15 42 01 8c fa ef a5 44 d0 97 33 99 81 2a 36 6b 2c 46 c1 0c 71 2f
                                                  Data Ascii: Bk3'dfguNO/V&HY^{~AECCE7MSBD3*6k,Fq/D:-E|OylOR-BS)2,o(P.Ibk@1F] 9X&;/<MZ5 `CLg`h*EH=|EZpoC/j{1,u;


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  66192.168.2.449984104.16.149.13080984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:52.166841030 CEST155OUTPOST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 239
                                                  Jul 22, 2024 12:34:52.171753883 CEST239OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","CurrentSearch":"Google","CurrentHomepage":"about:home","LanguageIso2":"en-GB","IP":null,"CreateDate":0}}
                                                  Jul 22, 2024 12:34:52.847047091 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:52 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7deaed25e74-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0
                                                  Jul 22, 2024 12:34:52.911818027 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:52 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7deaed25e74-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  67192.168.2.449987104.19.208.15280984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:52.849499941 CEST105OUTGET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Jul 22, 2024 12:34:53.614626884 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:53 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 9891
                                                  Connection: keep-alive
                                                  ETag: "3914547665"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 120
                                                  Expires: Mon, 22 Jul 2024 14:34:53 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7e2f8fe1855-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d [TRUNCATED]
                                                  Data Ascii: PKIX6%FeatureActions.txtBPZ&KE9(0p<a}9g<D)9k@4y'!=~Zk`1J2[)_,{FF?q;fL*=1ZI->m%>`ml,sWITPu*;Pxxhgl$M]I}ogZL5?BZLxukU1P4mW-Ntf?I-/!w90/^%X-.0(mVPn]=cr_A$<BWye2bK{jOdxZv@[NLDU|_1Sp~Paq>})$qH7,hm)Ias<TWu$?Ey@Xu@5*UJLja0v^Q (O}k+fwvfzbhFE<plLWZI*.4#,X`=beVW)W*;Q,'x>Jq _T<ea&wo/RM2`rXFEc:A97A4FT0@wuJIBd5Bhw}oE@N=Z$)6@sXru%eIg5ruA:81&"e_'Be
                                                  Jul 22, 2024 12:34:53.614645004 CEST1236INData Raw: aa 27 91 1f 4b c3 11 60 77 a1 43 f9 f7 10 07 63 36 80 1a 86 ad 48 a7 d3 8f 6f 01 ae 9e 9c 3f a2 79 6e 3b 81 f2 7e 33 72 dc 17 7b 3c b2 f2 80 9b 26 a0 a9 76 69 9d e2 6e 9e 4d 47 96 36 9b c5 b5 27 68 b5 b4 84 34 1c 56 23 a3 50 e1 9f 24 02 89 9a 6e
                                                  Data Ascii: 'K`wCc6Ho?yn;~3r{<&vinMG6'h4V#P$n/Kt'<4oOa"xGTVBfE<eG#Bw{#@mc]os}uE6@e`^](9A,NjbNYnOF\8p"CLFk
                                                  Jul 22, 2024 12:34:53.614660025 CEST1236INData Raw: fd ac 50 d8 52 44 ee 8b 8f d4 d8 b2 84 d1 cb d6 f7 f8 05 a5 aa 41 48 05 36 3c 93 56 87 e3 e6 2f 47 40 72 47 91 28 bd 1e de c7 43 06 15 aa c9 07 7f 4b 86 10 6b 1f 41 44 6f 91 db 30 a2 f9 46 11 1a 4b 58 16 a1 31 d1 5e b4 59 ca fc 47 fc bc 25 05 70
                                                  Data Ascii: PRDAH6<V/G@rG(CKkADo0FKX1^YG%p8P*rH|idu{"PBv`DWG&O*rD:V4#{>51Zy4U-&SSIgFkZpYN~L-6Fed~ex>3
                                                  Jul 22, 2024 12:34:53.615576029 CEST672INData Raw: 88 a8 b4 43 f7 18 27 39 99 b5 09 5b b0 21 e4 89 cd dc d8 80 8f ba 2c 76 5f 49 78 e0 a0 e6 a4 e8 61 8a 0a 7d 07 ae 7f 5b db 69 5b ab 4d 22 92 db 0e dc 5e ef db 36 83 5e 63 58 81 45 75 40 0c 8a 74 59 c3 e4 31 78 2a c9 f9 39 82 db c7 d7 e1 67 09 f5
                                                  Data Ascii: C'9[!,v_Ixa}[i[M"^6^cXEu@tY1x*9g&LIY+5kR@v<a.{G`#|<rPgAn><AhcF1NG_d~JFS}=l-z%Q\)Zm?)^afu
                                                  Jul 22, 2024 12:34:53.615593910 CEST1236INData Raw: 61 aa 08 dd ae 4e a9 20 f0 86 f7 d2 0f bd b4 39 51 dc 6c 33 d7 4b 59 37 fc f7 27 f0 c4 f9 d3 95 5a f2 29 96 f8 42 a5 0c b6 84 33 2f 08 22 4d 2f 67 4f 0e 19 1f 04 d0 88 32 94 39 52 e1 72 44 82 04 2b b2 26 cc b4 46 dd c8 06 3e de ac 55 f6 d8 97 a5
                                                  Data Ascii: aN 9Ql3KY7'Z)B3/"M/gO29RrD+&F>Uuw<}}S3_"z)fv@L@eHlwla%<Xc1}Q&<MY;%6e5hL^iG.uY+k+}`"^D]5 G@k_?Ph?
                                                  Jul 22, 2024 12:34:53.616518974 CEST1236INData Raw: be 69 1d 30 0d 5c 2a ba f9 58 02 c6 be 7f 45 32 1c f3 80 01 4d 28 6d da 0e 3e 73 b4 6c be 91 b4 80 1b 2b ff 47 33 2e 6a 3e 0c 39 53 e6 e7 f1 79 63 74 fb 11 57 6b bd 8d 24 63 24 74 f3 e0 c2 f1 76 c9 d6 7b 50 b0 b8 89 59 3f 7d 70 4e e5 5c b0 92 d6
                                                  Data Ascii: i0\*XE2M(m>sl+G3.j>9SyctWk$c$tv{PY?}pN\H/4<y`<AP8T1|=4jj"AEpp@dS|!3huK*As+w$)8EEL9^FjcA1!%X
                                                  Jul 22, 2024 12:34:53.616537094 CEST1236INData Raw: 1e 0e 93 87 8d b3 85 ef 08 7c 0d 45 6d 7b 10 18 92 21 a2 71 1a 1d 55 d2 de 2a 63 e6 9a 74 56 20 c3 43 8a 85 42 d4 4d 4e 2e ad 1a 95 92 9e b4 e7 63 fa a1 b9 e8 1c 02 8f 70 9b e6 cf 9f f8 3c 3c e8 c4 67 e2 b3 8b 74 02 bb 5c aa 48 97 2c 46 7d 35 98
                                                  Data Ascii: |Em{!qU*ctV CBMN.cp<<gt\H,F}5OwB(q_0bL)w,!u|Y?{:h1|o/7.cb-4k3ZrFZP,_zDiNxblgF|!&J;dhP48}U%vHEOXu
                                                  Jul 22, 2024 12:34:53.616552114 CEST1236INData Raw: 2c ef 24 2a 94 f8 43 62 85 44 5d 33 06 a5 72 64 8d 0a 06 12 a1 13 62 5b 09 17 65 35 d1 f2 96 a0 fa 4a a5 1b a7 25 ad 29 6d 69 33 cb cb e6 ab 13 bc 3c 29 c1 02 ee ad ad 32 d8 7d 60 fa 6d 52 37 a2 f8 27 e3 22 e2 70 ec f5 22 64 6a b0 cb 71 dc 53 f5
                                                  Data Ascii: ,$*CbD]3rdb[e5J%)mi3<)2}`mR7'"p"djqSxzay67*3.dr)?|Gyi; -^IE@2J,[w#'hae,I<#qD]qHo;p,jU_lMhL)BBJLrKgU
                                                  Jul 22, 2024 12:34:53.617466927 CEST948INData Raw: 66 66 80 ed 76 d6 35 eb bc 80 83 86 e2 b5 e2 25 22 0f 28 83 e9 87 de 13 76 c6 60 31 e3 91 8e 37 2a f7 86 a5 ac 6e bc 46 3e 3d c8 f0 c5 5a 0d 14 22 10 45 f9 a9 60 83 34 73 e9 32 fb 3f fe 11 93 46 cf 4e 92 cc 2f 8b 7a 3a fe d5 74 d6 5b cf c5 0c 2a
                                                  Data Ascii: ffv5%"(v`17*nF>=Z"E`4s2?FN/z:t[*jKQ6*`F"*49M<l6PW]TQl5BYykY {XN=Tra2<MxC)Z}-&%djyiwm^G<s 1u%pv#
                                                  Jul 22, 2024 12:34:53.619365931 CEST948INData Raw: 66 66 80 ed 76 d6 35 eb bc 80 83 86 e2 b5 e2 25 22 0f 28 83 e9 87 de 13 76 c6 60 31 e3 91 8e 37 2a f7 86 a5 ac 6e bc 46 3e 3d c8 f0 c5 5a 0d 14 22 10 45 f9 a9 60 83 34 73 e9 32 fb 3f fe 11 93 46 cf 4e 92 cc 2f 8b 7a 3a fe d5 74 d6 5b cf c5 0c 2a
                                                  Data Ascii: ffv5%"(v`17*nF>=Z"E`4s2?FN/z:t[*jKQ6*`F"*49M<l6PW]TQl5BYykY {XN=Tra2<MxC)Z}-&%djyiwm^G<s 1u%pv#


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  68192.168.2.449988104.19.208.15280984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:52.849626064 CEST89OUTGET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Jul 22, 2024 12:34:53.608975887 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:53 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 17770
                                                  Connection: keep-alive
                                                  ETag: "770472110"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 423
                                                  Expires: Mon, 22 Jul 2024 14:34:53 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7e2fddd0f81-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 [TRUNCATED]
                                                  Data Ascii: PK:=AX7\0DrActiveFeatures.txt+@sjp#K1;/-[[ABexq)7 7:^gK !ibUVsO$v7|e\W'ZdveU*oR>%w$-;Q4Tf$+T$&Q?9#"6>0o@j(*i)H"B1`=&0I8CR"ycM7g\@8xE4S|Iyy7~%W?7!JhrfdB^OQ"IDG!o+^6VY6<wNNPP2\?EY^j>i[p`L_sXq>#~nY>LO9rsAS+g5FBiqgUf{*vBUBqTpKF;/[&WIAPuS-&v3!Y'bMl{[:5sVL3om7'O4'(V#:\#VOO&<s}Yd|<P@jM%O5lHs^SYfaCDDwVcE8~cETL0YIEd@._PQ~w\fAT7Kiywq|+#]N">(A0bU-lDM#ETYa-h}ep<),
                                                  Jul 22, 2024 12:34:53.608998060 CEST1236INData Raw: c3 e9 0b b5 94 79 f6 cd ab db ef 95 d6 d1 32 bc 03 27 b0 a7 67 bb 67 5c 5f 47 4a 97 f1 f7 fc 80 a5 3d 5e cb d2 21 fd 16 4d f6 ed 94 f2 d0 41 ec b6 8d 9b cb af 44 4b 5e 3f 92 fc ae 08 db 64 a5 1d 86 78 29 a2 a9 c5 2d c1 7a 36 38 e0 81 84 1a 34 f5
                                                  Data Ascii: y2'gg\_GJ=^!MADK^?dx)-z684R|YSgynUf1qbEFO?'[a`bF\rsZL0q\vgrP:ZbPw^l^|Vov^'D0\mJh*I{X14
                                                  Jul 22, 2024 12:34:53.610125065 CEST1236INData Raw: e3 09 b7 93 e7 ef 55 87 a5 e2 4a 0e 55 3c 50 4f 28 65 ca 9a de 34 88 d5 59 ab cd 64 54 2a 94 93 b6 b8 c7 f1 34 a6 fe 9a 9e 58 e1 5b 68 04 08 88 1d 07 7a 22 8c f4 8b 1a 37 f4 2d 18 02 f7 c9 7a e3 8d 30 e6 e5 c6 72 4a b5 33 12 97 f2 9b 9f 3d 2b 49
                                                  Data Ascii: UJU<PO(e4YdT*4X[hz"7-z0rJ3=+I:QrVjeAU|0e r.-nFs%U@_G~W}E^ns]W6.Jg4)Kk~9"4{i#W}_&L'HNOp
                                                  Jul 22, 2024 12:34:53.610141993 CEST1236INData Raw: a2 40 45 ad 3e 10 cc d4 22 b8 18 aa b5 83 15 5b 5f 79 62 da f6 64 de 89 40 91 c6 e3 e6 3c 48 f6 f2 37 d0 b4 a2 87 ed 8b 72 11 f9 fa 1d 84 ca dd 63 7c e6 56 65 74 e8 c3 ce 0a 52 78 3d f5 2c 69 ad 82 46 5f 21 19 b5 ed d3 bf 7e 98 76 8d 6a 94 b7 ed
                                                  Data Ascii: @E>"[_ybd@<H7rc|VetRx=,iF_!~vj5s,yL/[g{QosVz%{A|PSeC)PYzSZ/]E?kINr|Pg!\2-;@&Lb<maS
                                                  Jul 22, 2024 12:34:53.611308098 CEST1236INData Raw: ef ec e3 a3 78 02 50 1e 6e 18 3a c8 ef 40 01 47 df 2f 67 75 81 ee e7 ed 5c 86 a7 cd ff 50 b9 61 08 00 fa a5 b9 0e 2f 50 8f 87 fd 80 44 ec bf 7d 28 a2 50 86 c4 d0 81 34 04 f9 9d 19 90 5d 6c c8 6f a3 82 62 5f 8a 77 97 ae e6 15 32 ec 5b 3c d5 d1 50
                                                  Data Ascii: xPn:@G/gu\Pa/PD}(P4]lob_w2[<Pz|<gzX],af!:$uMs)m74Tf8Q0Ee@>i~p#D'uma{4q-x.{W)x,0Fm'*wTn
                                                  Jul 22, 2024 12:34:53.611325026 CEST1236INData Raw: ea fe e8 9b 44 1e 62 80 9f 85 5d b4 ed 54 9a 62 26 5d f9 5f e9 66 31 79 1a ec 5d eb 3b 42 de 2a 12 2f 99 5a 51 ad 2c 4e fc b2 cd 25 8a df 0b d7 07 24 1e 16 60 15 f2 23 fe 84 ec 28 ca cb ea 25 a1 6f 30 22 39 cc 4f eb 80 ec b0 87 73 03 c9 e2 6f cb
                                                  Data Ascii: Db]Tb&]_f1y];B*/ZQ,N%$`#(%o0"9OsosUN^m9N)&8))QK}b9"@T~yu?V7j7y)vJ_EEW58X+:CP~T,{/s" a*=_lJ
                                                  Jul 22, 2024 12:34:53.612504005 CEST1236INData Raw: c6 ac fb 85 2b c7 a3 2f 2f d9 73 66 a6 d5 b3 dc bc 4c 89 64 2f f9 a1 b7 40 bf dd 84 b3 f4 0d 92 fa d2 49 45 fc 27 f8 14 9d 3f bd 02 3a c4 6a 3c 68 f4 ec 55 d8 20 1b ea 58 1f 15 63 0c 4e fc 76 39 e9 cc 71 40 69 5b b9 5b c5 4e 6d 50 82 e3 2b 3d 15
                                                  Data Ascii: +//sfLd/@IE'?:j<hU XcNv9q@i[[NmP+=127ZS$rHxh7[m15'1Z91 #%|^s\obPTPUO:$9pgLNTKqmc_xE]uUW\&6Ijo
                                                  Jul 22, 2024 12:34:53.612521887 CEST1236INData Raw: e7 41 3d ce 7d 33 4d 0f 6d da 2d 57 cd 6d 7c 72 20 41 5f e2 85 cb 48 2a 2c 1b 25 2d ea 0b 8c 30 58 68 ec 5b 67 54 17 0b 09 36 f0 a1 5f 55 d0 81 77 eb 76 58 90 be 59 9e ba 3f be 84 2b 42 29 6f 5c df c6 42 5f 49 8a 9f 97 26 07 55 9d da 50 6a e6 dc
                                                  Data Ascii: A=}3Mm-Wm|r A_H*,%-0Xh[gT6_UwvXY?+B)o\B_I&UPj?n,\_%N&gFx!7^"*w/:=\-?2$(<9#oPa7Z+iIU1B($k!XdI<#7s(,\~1~@SfHTn
                                                  Jul 22, 2024 12:34:53.613675117 CEST1224INData Raw: 20 19 6a 5f 78 89 c4 93 e5 38 5a 6e de 37 da e2 c6 06 b0 e8 f5 8e ec 2a 4d 52 53 7c c0 ce f1 b1 9d 84 d3 91 ba fc 29 13 39 6d 22 59 ca f4 90 ba 24 c3 b5 86 27 17 f3 8a b2 8c 0f d9 b9 6d 97 6d 9b 96 f5 eb e7 ae 0b 71 31 03 84 41 72 7d a7 8d f4 99
                                                  Data Ascii: j_x8Zn7*MRS|)9m"Y$'mmq1Ar}sWC@T^n2I%j+r|kpjq%<OjYSO)o+`qK18oLXG#F?sTds%>qWY2qf[n XR`
                                                  Jul 22, 2024 12:34:53.613693953 CEST1236INData Raw: 1d 91 a7 27 8a 36 6b f3 5e 86 22 70 d1 d2 9b 08 03 2c 5a d5 0d b5 24 ba 57 06 e9 82 13 06 b8 76 cd 11 85 df 30 60 c7 4a 68 fc 62 33 d3 a3 33 4a 36 3d a8 67 bb a3 56 33 7d 3d 9a 83 2c 2e ab 79 ba 0d fb 01 11 b8 6d 84 ce cd 88 2e 7d f5 4f 3e 3e d1
                                                  Data Ascii: '6k^"p,Z$Wv0`Jhb33J6=gV3}=,.ym.}O>><'wK\U}&El?<tl%}v%HSA*gH(vqd00Dan~Jlax_K9#+Rfl?uhLO{
                                                  Jul 22, 2024 12:34:53.618426085 CEST1236INData Raw: 83 e2 2f 00 fa 5a 23 c6 47 bf 72 18 12 42 b8 dd e5 1f 9e 6b 33 d0 27 64 66 67 09 75 13 4e 4f e9 2f 56 c0 a1 26 a6 e7 0f 48 59 99 5e 9a 7b ee 13 0a e1 b2 7e 95 bf 06 41 45 43 c3 c5 43 45 37 b4 fd 4d f1 ee 9a 9c 98 53 15 42 01 8c fa ef a5 44 d0 97
                                                  Data Ascii: /Z#GrBk3'dfguNO/V&HY^{~AECCE7MSBD3*6k,Fq/D:-E|OylOR-BS)2,o(P.Ibk@1F] 9X&;/<MZ5 `CLg`h*EH=|EZpoC/
                                                  Jul 22, 2024 12:34:53.621228933 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:53 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 17770
                                                  Connection: keep-alive
                                                  ETag: "770472110"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 423
                                                  Expires: Mon, 22 Jul 2024 14:34:53 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7e2fddd0f81-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 [TRUNCATED]
                                                  Data Ascii: PK:=AX7\0DrActiveFeatures.txt+@sjp#K1;/-[[ABexq)7 7:^gK !ibUVsO$v7|e\W'ZdveU*oR>%w$-;Q4Tf$+T$&Q?9#"6>0o@j(*i)H"B1`=&0I8CR"ycM7g\@8xE4S|Iyy7~%W?7!JhrfdB^OQ"IDG!o+^6VY6<wNNPP2\?EY^j>i[p`L_sXq>#~nY>LO9rsAS+g5FBiqgUf{*vBUBqTpKF;/[&WIAPuS-&v3!Y'bMl{[:5sVL3om7'O4'(V#:\#VOO&<s}Yd|<P@jM%O5lHs^SYfaCDDwVcE8~cETL0YIEd@._PQ~w\fAT7Kiywq|+#]N">(A0bU-lDM#ETYa-h}ep<),


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  69192.168.2.449991104.16.149.13080984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:53.620678902 CEST155OUTPOST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 239
                                                  Jul 22, 2024 12:34:53.625757933 CEST239OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","CurrentSearch":"Google","CurrentHomepage":"about:home","LanguageIso2":"en-GB","IP":null,"CreateDate":0}}
                                                  Jul 22, 2024 12:34:54.127057076 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:54 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7e7bfda188d-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  70192.168.2.449993104.16.149.13080984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:53.850944996 CEST179OUTPOST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 239
                                                  Connection: Keep-Alive
                                                  Jul 22, 2024 12:34:53.884598017 CEST239OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","CurrentSearch":"Google","CurrentHomepage":"about:home","LanguageIso2":"en-GB","IP":null,"CreateDate":0}}
                                                  Jul 22, 2024 12:34:54.423368931 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:54 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7e95fc743ed-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  71192.168.2.449995104.16.149.13080984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:53.960987091 CEST179OUTPOST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 239
                                                  Connection: Keep-Alive
                                                  Jul 22, 2024 12:34:53.968657017 CEST239OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","CurrentSearch":"Google","CurrentHomepage":"about:home","LanguageIso2":"en-GB","IP":null,"CreateDate":0}}
                                                  Jul 22, 2024 12:34:54.482218981 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:54 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7e9ed91178c-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  72192.168.2.449999104.19.208.15280984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:54.757814884 CEST129OUTGET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Connection: Keep-Alive


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  73192.168.2.45000064.18.87.8180984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:54.776969910 CEST208OUTPOST /components.asmx HTTP/1.1
                                                  Content-Type: text/xml; charset=utf-8
                                                  SOAPAction: "http://tempuri.org/GetComponentsInfo"
                                                  Host: wc-update-service.lavasoft.com
                                                  Content-Length: 342
                                                  Connection: Keep-Alive
                                                  Jul 22, 2024 12:34:54.776992083 CEST342OUTData Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 20 78 6d 6c 6e 73 3a 78 73 69 3d
                                                  Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"><GetComponentsInfo xmlns="http://tempuri.org/"><request><Platform>prod</
                                                  Jul 22, 2024 12:34:55.254792929 CEST1236INHTTP/1.1 200 OK
                                                  Server: nginx
                                                  Date: Mon, 22 Jul 2024 10:34:55 GMT
                                                  Content-Type: text/xml; charset=utf-8
                                                  Content-Length: 1461
                                                  Connection: keep-alive
                                                  Cache-Control: private, max-age=0
                                                  X-AspNet-Version: 4.0.30319
                                                  X-Powered-By: ASP.NET
                                                  Access-Control-Allow-Origin: http://webcompanion.com
                                                  Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 47 65 74 43 6f 6d 70 6f 6e 65 6e 74 73 49 6e 66 6f 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 47 65 74 43 6f 6d 70 6f 6e 65 6e 74 73 49 6e 66 6f 52 65 73 75 6c 74 3e 3c 43 6f 6d 70 6f 6e 65 6e 74 73 3e 3c 43 6f 6d 70 6f 6e 65 6e 74 49 6e 66 6f 52 65 73 70 6f 6e 73 65 3e 3c 4e 61 6d 65 [TRUNCATED]
                                                  Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"><soap:Body><GetComponentsInfoResponse xmlns="http://tempuri.org/"><GetComponentsInfoResult><Components><ComponentInfoResponse><Name>installer</Name><Version>9.1.0.993</Version><DownloadUrl>http://wcdownloadercdn.lavasoft.com/9.1.0.993/Installer.exe</DownloadUrl></ComponentInfoResponse><ComponentInfoResponse><Name>application</Name><Version>2.1.1117.2317</Version><DownloadUrl>http://wcdownloadercdn.lavasoft.com/9.1.0.993/Installer.msi</DownloadUrl></ComponentInfoResponse><ComponentInfoResponse><Name>tcpservice</Name><Version>2.3.4.7</Version><DownloadUrl>http://wcdownloadercdn.lavasoft.com/9.1.0.993/TcpService.msi</DownloadUrl></ComponentInfoResponse><ComponentInfoResponse><Name>42f00399-529e-4915-83ce-5b4c18049fc8</Name><V
                                                  Jul 22, 2024 12:34:55.254878998 CEST522INData Raw: 65 72 73 69 6f 6e 3e 39 2e 31 2e 30 2e 39 39 33 3c 2f 56 65 72 73 69 6f 6e 3e 3c 44 6f 77 6e 6c 6f 61 64 55 72 6c 3e 68 74 74 70 3a 2f 2f 77 63 64 6f 77 6e 6c 6f 61 64 65 72 63 64 6e 2e 6c 61 76 61 73 6f 66 74 2e 63 6f 6d 2f 39 2e 31 2e 30 2e 39
                                                  Data Ascii: ersion>9.1.0.993</Version><DownloadUrl>http://wcdownloadercdn.lavasoft.com/9.1.0.993/WcInstaller.exe</DownloadUrl></ComponentInfoResponse><ComponentInfoResponse><Name>webcompanion</Name><Version>9.1.0.993</Version><DownloadUrl>http://wcdownloa


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  74192.168.2.450004104.19.208.15280984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:55.005381107 CEST113OUTGET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Connection: Keep-Alive
                                                  Jul 22, 2024 12:34:55.512094975 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:55 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 17770
                                                  Connection: keep-alive
                                                  ETag: "770472110"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 425
                                                  Expires: Mon, 22 Jul 2024 14:34:55 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7f08e01436f-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 [TRUNCATED]
                                                  Data Ascii: PK:=AX7\0DrActiveFeatures.txt+@sjp#K1;/-[[ABexq)7 7:^gK !ibUVsO$v7|e\W'ZdveU*oR>%w$-;Q4Tf$+T$&Q?9#"6>0o@j(*i)H"B1`=&0I8CR"ycM7g\@8xE4S|Iyy7~%W?7!JhrfdB^OQ"IDG!o+^6VY6<wNNPP2\?EY^j>i[p`L_sXq>#~nY>LO9rsAS+g5FBiqgUf{*vBUBqTpKF;/[&WIAPuS-&v3!Y'bMl{[:5sVL3om7'O4'(V#:\#VOO&<s}Yd|<P@jM%O5lHs^SYfaCDDwVcE8~cETL0YIEd@._PQ~w\fAT7Kiywq|+#]N">(A0bU-lDM#ETYa-h}ep<),
                                                  Jul 22, 2024 12:34:55.512114048 CEST1236INData Raw: c3 e9 0b b5 94 79 f6 cd ab db ef 95 d6 d1 32 bc 03 27 b0 a7 67 bb 67 5c 5f 47 4a 97 f1 f7 fc 80 a5 3d 5e cb d2 21 fd 16 4d f6 ed 94 f2 d0 41 ec b6 8d 9b cb af 44 4b 5e 3f 92 fc ae 08 db 64 a5 1d 86 78 29 a2 a9 c5 2d c1 7a 36 38 e0 81 84 1a 34 f5
                                                  Data Ascii: y2'gg\_GJ=^!MADK^?dx)-z684R|YSgynUf1qbEFO?'[a`bF\rsZL0q\vgrP:ZbPw^l^|Vov^'D0\mJh*I{X14
                                                  Jul 22, 2024 12:34:55.512145996 CEST1236INData Raw: e3 09 b7 93 e7 ef 55 87 a5 e2 4a 0e 55 3c 50 4f 28 65 ca 9a de 34 88 d5 59 ab cd 64 54 2a 94 93 b6 b8 c7 f1 34 a6 fe 9a 9e 58 e1 5b 68 04 08 88 1d 07 7a 22 8c f4 8b 1a 37 f4 2d 18 02 f7 c9 7a e3 8d 30 e6 e5 c6 72 4a b5 33 12 97 f2 9b 9f 3d 2b 49
                                                  Data Ascii: UJU<PO(e4YdT*4X[hz"7-z0rJ3=+I:QrVjeAU|0e r.-nFs%U@_G~W}E^ns]W6.Jg4)Kk~9"4{i#W}_&L'HNOp
                                                  Jul 22, 2024 12:34:55.512658119 CEST1236INData Raw: a2 40 45 ad 3e 10 cc d4 22 b8 18 aa b5 83 15 5b 5f 79 62 da f6 64 de 89 40 91 c6 e3 e6 3c 48 f6 f2 37 d0 b4 a2 87 ed 8b 72 11 f9 fa 1d 84 ca dd 63 7c e6 56 65 74 e8 c3 ce 0a 52 78 3d f5 2c 69 ad 82 46 5f 21 19 b5 ed d3 bf 7e 98 76 8d 6a 94 b7 ed
                                                  Data Ascii: @E>"[_ybd@<H7rc|VetRx=,iF_!~vj5s,yL/[g{QosVz%{A|PSeC)PYzSZ/]E?kINr|Pg!\2-;@&Lb<maS
                                                  Jul 22, 2024 12:34:55.512689114 CEST1236INData Raw: ef ec e3 a3 78 02 50 1e 6e 18 3a c8 ef 40 01 47 df 2f 67 75 81 ee e7 ed 5c 86 a7 cd ff 50 b9 61 08 00 fa a5 b9 0e 2f 50 8f 87 fd 80 44 ec bf 7d 28 a2 50 86 c4 d0 81 34 04 f9 9d 19 90 5d 6c c8 6f a3 82 62 5f 8a 77 97 ae e6 15 32 ec 5b 3c d5 d1 50
                                                  Data Ascii: xPn:@G/gu\Pa/PD}(P4]lob_w2[<Pz|<gzX],af!:$uMs)m74Tf8Q0Ee@>i~p#D'uma{4q-x.{W)x,0Fm'*wTn
                                                  Jul 22, 2024 12:34:55.513925076 CEST1236INData Raw: ea fe e8 9b 44 1e 62 80 9f 85 5d b4 ed 54 9a 62 26 5d f9 5f e9 66 31 79 1a ec 5d eb 3b 42 de 2a 12 2f 99 5a 51 ad 2c 4e fc b2 cd 25 8a df 0b d7 07 24 1e 16 60 15 f2 23 fe 84 ec 28 ca cb ea 25 a1 6f 30 22 39 cc 4f eb 80 ec b0 87 73 03 c9 e2 6f cb
                                                  Data Ascii: Db]Tb&]_f1y];B*/ZQ,N%$`#(%o0"9OsosUN^m9N)&8))QK}b9"@T~yu?V7j7y)vJ_EEW58X+:CP~T,{/s" a*=_lJ
                                                  Jul 22, 2024 12:34:55.513947010 CEST1236INData Raw: c6 ac fb 85 2b c7 a3 2f 2f d9 73 66 a6 d5 b3 dc bc 4c 89 64 2f f9 a1 b7 40 bf dd 84 b3 f4 0d 92 fa d2 49 45 fc 27 f8 14 9d 3f bd 02 3a c4 6a 3c 68 f4 ec 55 d8 20 1b ea 58 1f 15 63 0c 4e fc 76 39 e9 cc 71 40 69 5b b9 5b c5 4e 6d 50 82 e3 2b 3d 15
                                                  Data Ascii: +//sfLd/@IE'?:j<hU XcNv9q@i[[NmP+=127ZS$rHxh7[m15'1Z91 #%|^s\obPTPUO:$9pgLNTKqmc_xE]uUW\&6Ijo
                                                  Jul 22, 2024 12:34:55.514565945 CEST1236INData Raw: e7 41 3d ce 7d 33 4d 0f 6d da 2d 57 cd 6d 7c 72 20 41 5f e2 85 cb 48 2a 2c 1b 25 2d ea 0b 8c 30 58 68 ec 5b 67 54 17 0b 09 36 f0 a1 5f 55 d0 81 77 eb 76 58 90 be 59 9e ba 3f be 84 2b 42 29 6f 5c df c6 42 5f 49 8a 9f 97 26 07 55 9d da 50 6a e6 dc
                                                  Data Ascii: A=}3Mm-Wm|r A_H*,%-0Xh[gT6_UwvXY?+B)o\B_I&UPj?n,\_%N&gFx!7^"*w/:=\-?2$(<9#oPa7Z+iIU1B($k!XdI<#7s(,\~1~@SfHTn
                                                  Jul 22, 2024 12:34:55.514588118 CEST1236INData Raw: 20 19 6a 5f 78 89 c4 93 e5 38 5a 6e de 37 da e2 c6 06 b0 e8 f5 8e ec 2a 4d 52 53 7c c0 ce f1 b1 9d 84 d3 91 ba fc 29 13 39 6d 22 59 ca f4 90 ba 24 c3 b5 86 27 17 f3 8a b2 8c 0f d9 b9 6d 97 6d 9b 96 f5 eb e7 ae 0b 71 31 03 84 41 72 7d a7 8d f4 99
                                                  Data Ascii: j_x8Zn7*MRS|)9m"Y$'mmq1Ar}sWC@T^n2I%j+r|kpjq%<OjYSO)o+`qK18oLXG#F?sTds%>qWY2qf[n XR`
                                                  Jul 22, 2024 12:34:55.515443087 CEST1236INData Raw: d1 d2 9b 08 03 2c 5a d5 0d b5 24 ba 57 06 e9 82 13 06 b8 76 cd 11 85 df 30 60 c7 4a 68 fc 62 33 d3 a3 33 4a 36 3d a8 67 bb a3 56 33 7d 3d 9a 83 2c 2e ab 79 ba 0d fb 01 11 b8 6d 84 ce cd 88 2e 7d f5 4f 3e 3e d1 e4 3c 13 83 fa 27 77 82 c7 e2 d9 4b
                                                  Data Ascii: ,Z$Wv0`Jhb33J6=gV3}=,.ym.}O>><'wK\U}&El?<tl%}v%HSA*gH(vqd00Dan~Jlax_K9#+Rfl?uhLO{.FLRS
                                                  Jul 22, 2024 12:34:55.517097950 CEST1236INData Raw: 12 42 b8 dd e5 1f 9e 6b 33 d0 27 64 66 67 09 75 13 4e 4f e9 2f 56 c0 a1 26 a6 e7 0f 48 59 99 5e 9a 7b ee 13 0a e1 b2 7e 95 bf 06 41 45 43 c3 c5 43 45 37 b4 fd 4d f1 ee 9a 9c 98 53 15 42 01 8c fa ef a5 44 d0 97 33 99 81 2a 36 6b 2c 46 c1 0c 71 2f
                                                  Data Ascii: Bk3'dfguNO/V&HY^{~AECCE7MSBD3*6k,Fq/D:-E|OylOR-BS)2,o(P.Ibk@1F] 9X&;/<MZ5 `CLg`h*EH=|EZpoC/j{1,u;


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  75192.168.2.450007104.16.149.13080984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:55.100667953 CEST179OUTPOST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 239
                                                  Connection: Keep-Alive
                                                  Jul 22, 2024 12:34:55.110302925 CEST239OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","CurrentSearch":"Google","CurrentHomepage":"about:home","LanguageIso2":"en-GB","IP":null,"CreateDate":0}}
                                                  Jul 22, 2024 12:34:55.629740000 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:55 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7f11bb0433f-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  76192.168.2.450008104.19.159.22480984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:55.265614033 CEST106OUTGET /version_logs?json=true&version=9.1.0.993 HTTP/1.1
                                                  Host: webcompanion.com
                                                  Connection: Keep-Alive
                                                  Jul 22, 2024 12:34:55.758960962 CEST629INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:55 GMT
                                                  Content-Type: text/html; charset=UTF-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  X-Powered-By: PHP/7.2.34
                                                  Vary: Accept-Encoding
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7f1eb7d0f9f-EWR
                                                  Data Raw: 31 35 38 0d 0a 3c 62 72 20 2f 3e 0a 3c 62 3e 57 61 72 6e 69 6e 67 3c 2f 62 3e 3a 20 20 63 6f 75 6e 74 28 29 3a 20 50 61 72 61 6d 65 74 65 72 20 6d 75 73 74 20 62 65 20 61 6e 20 61 72 72 61 79 20 6f 72 20 61 6e 20 6f 62 6a 65 63 74 20 74 68 61 74 20 69 6d 70 6c 65 6d 65 6e 74 73 20 43 6f 75 6e 74 61 62 6c 65 20 69 6e 20 3c 62 3e 2f 76 61 72 2f 77 77 77 2f 68 74 6d 6c 2f 69 6e 63 6c 75 64 65 73 2f 66 75 6e 63 74 69 6f 6e 73 2e 70 68 70 3c 2f 62 3e 20 6f 6e 20 6c 69 6e 65 20 3c 62 3e 39 31 3c 2f 62 3e 3c 62 72 20 2f 3e 0a 3c 62 72 20 2f 3e 0a 3c 62 3e 57 61 72 6e 69 6e 67 3c 2f 62 3e 3a 20 20 63 6f 75 6e 74 28 29 3a 20 50 61 72 61 6d 65 74 65 72 20 6d 75 73 74 20 62 65 20 61 6e 20 61 72 72 61 79 20 6f 72 20 61 6e 20 6f 62 6a 65 63 74 20 74 68 61 74 20 69 6d 70 6c 65 6d 65 6e 74 73 20 43 6f 75 6e 74 61 62 6c 65 20 69 6e 20 3c 62 3e 2f 76 61 72 2f 77 77 77 2f 68 74 6d 6c 2f 69 6e 63 6c 75 64 65 73 2f 66 75 6e 63 74 69 6f 6e 73 2e 70 68 70 3c 2f 62 3e 20 6f 6e 20 6c 69 6e 65 20 3c 62 3e 39 38 3c 2f 62 3e [TRUNCATED]
                                                  Data Ascii: 158<br /><b>Warning</b>: count(): Parameter must be an array or an object that implements Countable in <b>/var/www/html/includes/functions.php</b> on line <b>91</b><br /><br /><b>Warning</b>: count(): Parameter must be an array or an object that implements Countable in <b>/var/www/html/includes/functions.php</b> on line <b>98</b><br />null0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  77192.168.2.450010104.19.208.15280984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:55.989203930 CEST113OUTGET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Connection: Keep-Alive
                                                  Jul 22, 2024 12:34:56.516206026 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:56 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 17770
                                                  Connection: keep-alive
                                                  ETag: "770472110"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 426
                                                  Expires: Mon, 22 Jul 2024 14:34:56 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7f6db3e4378-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 [TRUNCATED]
                                                  Data Ascii: PK:=AX7\0DrActiveFeatures.txt+@sjp#K1;/-[[ABexq)7 7:^gK !ibUVsO$v7|e\W'ZdveU*oR>%w$-;Q4Tf$+T$&Q?9#"6>0o@j(*i)H"B1`=&0I8CR"ycM7g\@8xE4S|Iyy7~%W?7!JhrfdB^OQ"IDG!o+^6VY6<wNNPP2\?EY^j>i[p`L_sXq>#~nY>LO9rsAS+g5FBiqgUf{*vBUBqTpKF;/[&WIAPuS-&v3!Y'bMl{[:5sVL3om7'O4'(V#:\#VOO&<s}Yd|<P@jM%O5lHs^SYfaCDDwVcE8~cETL0YIEd@._PQ~w\fAT7Kiywq|+#]N">(A0bU-lDM#ETYa-h}ep<),
                                                  Jul 22, 2024 12:34:56.516246080 CEST1236INData Raw: c3 e9 0b b5 94 79 f6 cd ab db ef 95 d6 d1 32 bc 03 27 b0 a7 67 bb 67 5c 5f 47 4a 97 f1 f7 fc 80 a5 3d 5e cb d2 21 fd 16 4d f6 ed 94 f2 d0 41 ec b6 8d 9b cb af 44 4b 5e 3f 92 fc ae 08 db 64 a5 1d 86 78 29 a2 a9 c5 2d c1 7a 36 38 e0 81 84 1a 34 f5
                                                  Data Ascii: y2'gg\_GJ=^!MADK^?dx)-z684R|YSgynUf1qbEFO?'[a`bF\rsZL0q\vgrP:ZbPw^l^|Vov^'D0\mJh*I{X14
                                                  Jul 22, 2024 12:34:56.516259909 CEST1236INData Raw: e3 09 b7 93 e7 ef 55 87 a5 e2 4a 0e 55 3c 50 4f 28 65 ca 9a de 34 88 d5 59 ab cd 64 54 2a 94 93 b6 b8 c7 f1 34 a6 fe 9a 9e 58 e1 5b 68 04 08 88 1d 07 7a 22 8c f4 8b 1a 37 f4 2d 18 02 f7 c9 7a e3 8d 30 e6 e5 c6 72 4a b5 33 12 97 f2 9b 9f 3d 2b 49
                                                  Data Ascii: UJU<PO(e4YdT*4X[hz"7-z0rJ3=+I:QrVjeAU|0e r.-nFs%U@_G~W}E^ns]W6.Jg4)Kk~9"4{i#W}_&L'HNOp
                                                  Jul 22, 2024 12:34:56.517098904 CEST1236INData Raw: a2 40 45 ad 3e 10 cc d4 22 b8 18 aa b5 83 15 5b 5f 79 62 da f6 64 de 89 40 91 c6 e3 e6 3c 48 f6 f2 37 d0 b4 a2 87 ed 8b 72 11 f9 fa 1d 84 ca dd 63 7c e6 56 65 74 e8 c3 ce 0a 52 78 3d f5 2c 69 ad 82 46 5f 21 19 b5 ed d3 bf 7e 98 76 8d 6a 94 b7 ed
                                                  Data Ascii: @E>"[_ybd@<H7rc|VetRx=,iF_!~vj5s,yL/[g{QosVz%{A|PSeC)PYzSZ/]E?kINr|Pg!\2-;@&Lb<maS
                                                  Jul 22, 2024 12:34:56.517112017 CEST1236INData Raw: ef ec e3 a3 78 02 50 1e 6e 18 3a c8 ef 40 01 47 df 2f 67 75 81 ee e7 ed 5c 86 a7 cd ff 50 b9 61 08 00 fa a5 b9 0e 2f 50 8f 87 fd 80 44 ec bf 7d 28 a2 50 86 c4 d0 81 34 04 f9 9d 19 90 5d 6c c8 6f a3 82 62 5f 8a 77 97 ae e6 15 32 ec 5b 3c d5 d1 50
                                                  Data Ascii: xPn:@G/gu\Pa/PD}(P4]lob_w2[<Pz|<gzX],af!:$uMs)m74Tf8Q0Ee@>i~p#D'uma{4q-x.{W)x,0Fm'*wTn
                                                  Jul 22, 2024 12:34:56.518024921 CEST1236INData Raw: ea fe e8 9b 44 1e 62 80 9f 85 5d b4 ed 54 9a 62 26 5d f9 5f e9 66 31 79 1a ec 5d eb 3b 42 de 2a 12 2f 99 5a 51 ad 2c 4e fc b2 cd 25 8a df 0b d7 07 24 1e 16 60 15 f2 23 fe 84 ec 28 ca cb ea 25 a1 6f 30 22 39 cc 4f eb 80 ec b0 87 73 03 c9 e2 6f cb
                                                  Data Ascii: Db]Tb&]_f1y];B*/ZQ,N%$`#(%o0"9OsosUN^m9N)&8))QK}b9"@T~yu?V7j7y)vJ_EEW58X+:CP~T,{/s" a*=_lJ
                                                  Jul 22, 2024 12:34:56.518038988 CEST1236INData Raw: c6 ac fb 85 2b c7 a3 2f 2f d9 73 66 a6 d5 b3 dc bc 4c 89 64 2f f9 a1 b7 40 bf dd 84 b3 f4 0d 92 fa d2 49 45 fc 27 f8 14 9d 3f bd 02 3a c4 6a 3c 68 f4 ec 55 d8 20 1b ea 58 1f 15 63 0c 4e fc 76 39 e9 cc 71 40 69 5b b9 5b c5 4e 6d 50 82 e3 2b 3d 15
                                                  Data Ascii: +//sfLd/@IE'?:j<hU XcNv9q@i[[NmP+=127ZS$rHxh7[m15'1Z91 #%|^s\obPTPUO:$9pgLNTKqmc_xE]uUW\&6Ijo
                                                  Jul 22, 2024 12:34:56.518950939 CEST1236INData Raw: e7 41 3d ce 7d 33 4d 0f 6d da 2d 57 cd 6d 7c 72 20 41 5f e2 85 cb 48 2a 2c 1b 25 2d ea 0b 8c 30 58 68 ec 5b 67 54 17 0b 09 36 f0 a1 5f 55 d0 81 77 eb 76 58 90 be 59 9e ba 3f be 84 2b 42 29 6f 5c df c6 42 5f 49 8a 9f 97 26 07 55 9d da 50 6a e6 dc
                                                  Data Ascii: A=}3Mm-Wm|r A_H*,%-0Xh[gT6_UwvXY?+B)o\B_I&UPj?n,\_%N&gFx!7^"*w/:=\-?2$(<9#oPa7Z+iIU1B($k!XdI<#7s(,\~1~@SfHTn
                                                  Jul 22, 2024 12:34:56.518965006 CEST1236INData Raw: 20 19 6a 5f 78 89 c4 93 e5 38 5a 6e de 37 da e2 c6 06 b0 e8 f5 8e ec 2a 4d 52 53 7c c0 ce f1 b1 9d 84 d3 91 ba fc 29 13 39 6d 22 59 ca f4 90 ba 24 c3 b5 86 27 17 f3 8a b2 8c 0f d9 b9 6d 97 6d 9b 96 f5 eb e7 ae 0b 71 31 03 84 41 72 7d a7 8d f4 99
                                                  Data Ascii: j_x8Zn7*MRS|)9m"Y$'mmq1Ar}sWC@T^n2I%j+r|kpjq%<OjYSO)o+`qK18oLXG#F?sTds%>qWY2qf[n XR`
                                                  Jul 22, 2024 12:34:56.519835949 CEST1236INData Raw: d1 d2 9b 08 03 2c 5a d5 0d b5 24 ba 57 06 e9 82 13 06 b8 76 cd 11 85 df 30 60 c7 4a 68 fc 62 33 d3 a3 33 4a 36 3d a8 67 bb a3 56 33 7d 3d 9a 83 2c 2e ab 79 ba 0d fb 01 11 b8 6d 84 ce cd 88 2e 7d f5 4f 3e 3e d1 e4 3c 13 83 fa 27 77 82 c7 e2 d9 4b
                                                  Data Ascii: ,Z$Wv0`Jhb33J6=gV3}=,.ym.}O>><'wK\U}&El?<tl%}v%HSA*gH(vqd00Dan~Jlax_K9#+Rfl?uhLO{.FLRS
                                                  Jul 22, 2024 12:34:56.521244049 CEST1236INData Raw: 12 42 b8 dd e5 1f 9e 6b 33 d0 27 64 66 67 09 75 13 4e 4f e9 2f 56 c0 a1 26 a6 e7 0f 48 59 99 5e 9a 7b ee 13 0a e1 b2 7e 95 bf 06 41 45 43 c3 c5 43 45 37 b4 fd 4d f1 ee 9a 9c 98 53 15 42 01 8c fa ef a5 44 d0 97 33 99 81 2a 36 6b 2c 46 c1 0c 71 2f
                                                  Data Ascii: Bk3'dfguNO/V&HY^{~AECCE7MSBD3*6k,Fq/D:-E|OylOR-BS)2,o(P.Ibk@1F] 9X&;/<MZ5 `CLg`h*EH=|EZpoC/j{1,u;


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  78192.168.2.450014104.19.208.15280940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:56.278642893 CEST105OUTGET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Jul 22, 2024 12:34:56.762729883 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:56 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 9891
                                                  Connection: keep-alive
                                                  ETag: "3914547665"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 123
                                                  Expires: Mon, 22 Jul 2024 14:34:56 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7f86b358c96-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d [TRUNCATED]
                                                  Data Ascii: PKIX6%FeatureActions.txtBPZ&KE9(0p<a}9g<D)9k@4y'!=~Zk`1J2[)_,{FF?q;fL*=1ZI->m%>`ml,sWITPu*;Pxxhgl$M]I}ogZL5?BZLxukU1P4mW-Ntf?I-/!w90/^%X-.0(mVPn]=cr_A$<BWye2bK{jOdxZv@[NLDU|_1Sp~Paq>})$qH7,hm)Ias<TWu$?Ey@Xu@5*UJLja0v^Q (O}k+fwvfzbhFE<plLWZI*.4#,X`=beVW)W*;Q,'x>Jq _T<ea&wo/RM2`rXFEc:A97A4FT0@wuJIBd5Bhw}oE@N=Z$)6@sXru%eIg5ruA:81&"e_'Be
                                                  Jul 22, 2024 12:34:56.762974024 CEST1236INData Raw: aa 27 91 1f 4b c3 11 60 77 a1 43 f9 f7 10 07 63 36 80 1a 86 ad 48 a7 d3 8f 6f 01 ae 9e 9c 3f a2 79 6e 3b 81 f2 7e 33 72 dc 17 7b 3c b2 f2 80 9b 26 a0 a9 76 69 9d e2 6e 9e 4d 47 96 36 9b c5 b5 27 68 b5 b4 84 34 1c 56 23 a3 50 e1 9f 24 02 89 9a 6e
                                                  Data Ascii: 'K`wCc6Ho?yn;~3r{<&vinMG6'h4V#P$n/Kt'<4oOa"xGTVBfE<eG#Bw{#@mc]os}uE6@e`^](9A,NjbNYnOF\8p"CLFk
                                                  Jul 22, 2024 12:34:56.762989044 CEST448INData Raw: fd ac 50 d8 52 44 ee 8b 8f d4 d8 b2 84 d1 cb d6 f7 f8 05 a5 aa 41 48 05 36 3c 93 56 87 e3 e6 2f 47 40 72 47 91 28 bd 1e de c7 43 06 15 aa c9 07 7f 4b 86 10 6b 1f 41 44 6f 91 db 30 a2 f9 46 11 1a 4b 58 16 a1 31 d1 5e b4 59 ca fc 47 fc bc 25 05 70
                                                  Data Ascii: PRDAH6<V/G@rG(CKkADo0FKX1^YG%p8P*rH|idu{"PBv`DWG&O*rD:V4#{>51Zy4U-&SSIgFkZpYN~L-6Fed~ex>3
                                                  Jul 22, 2024 12:34:56.763556004 CEST1236INData Raw: 46 74 78 bf d1 4f e7 e2 3d a6 1b 87 fe 74 57 73 46 8d ae 81 4e b5 95 90 a6 0a 32 29 67 d8 c7 21 47 50 3f 92 00 6e 58 3b 68 5c 39 a5 27 c3 8f c6 c3 8b c1 8c d3 eb 6c 55 ca 97 c2 12 dc 83 bc 08 95 eb a8 4f e9 a1 3f bb dc 6a d0 fc 87 68 26 35 4f 63
                                                  Data Ascii: FtxO=tWsFN2)g!GP?nX;h\9'lUO?jh&5OcRM;BY={yMNSVJLSl-\yBNM*T0X8o'm#ZIfHr,-^D[GWan]k0:t)Q^smAJ)
                                                  Jul 22, 2024 12:34:56.763976097 CEST1236INData Raw: 98 b0 ea 69 48 6f 97 04 cc 88 51 65 16 41 0f a1 ce 2c 5f 44 27 b4 16 c6 86 90 c5 74 9d 98 5d 14 f8 08 95 7f e2 c9 8d df e0 61 32 78 a6 c0 e5 93 d3 34 b3 91 b6 26 79 c9 cd 07 9a 62 a6 cf 86 1f ee 30 1e 7a 04 9f ef 39 86 3c 67 7f 09 77 56 ca 33 18
                                                  Data Ascii: iHoQeA,_D't]a2x4&yb0z9<gwV3CvY8]N{cF4y<o8.P"w(t[%c{,KC`m[EPi<YfugDJbQec4!RA$y>TJ,r9aN 9Ql
                                                  Jul 22, 2024 12:34:56.763992071 CEST1236INData Raw: 58 85 11 40 a7 22 b6 de 95 b0 8a 6b 3a 12 0f 9c 4c b5 60 f3 af 2d 30 08 fe 13 b2 b5 10 9a 51 94 73 ac 93 15 e2 75 a0 26 8b c7 60 6a e3 be a2 46 fd 5f ba 02 5c d6 7e ff 8e 35 8a 0e 01 1d 8d 4a c0 74 ac 56 39 45 fd 19 a0 ee a5 44 1c 37 f5 33 92 44
                                                  Data Ascii: X@"k:L`-0Qsu&`jF_\~5JtV9ED73D32.>DA;.+}X:JFRlO%kqys|w- 7/Sw7XD<M7v-98L:"Dx.Z]Di0\*XE2
                                                  Jul 22, 2024 12:34:56.764916897 CEST1236INData Raw: 93 dc 3b 12 c6 14 12 66 b4 19 fc ce 11 d8 0d 7d f3 c3 4a d1 1a 02 97 bc b8 14 8b 96 9d 56 5a 73 2e 85 85 d7 cf 3d 64 8c 69 c0 30 fb 5e 7d e7 20 2d 5e 5a e0 42 46 09 48 cc a1 dc fc 6b 7c 2a 51 62 6e fe cf 57 d5 fc 84 cb 4b 2b ef d0 7b 39 ea 6d 7a
                                                  Data Ascii: ;f}JVZs.=di0^} -^ZBFHk|*QbnWK+{9mz]1.D8s@ 7i: %}?^!5xjfr<ANSYmJgZA}a_p(']JY+;j,k"DPm -SR|Em{!
                                                  Jul 22, 2024 12:34:56.764934063 CEST328INData Raw: 75 99 a9 82 0e 0f a3 58 f4 7d 18 81 e6 a0 dd 09 3a b4 58 64 5c c9 4a 5b 3c ee c2 4a ba 20 31 25 b6 c4 02 8d 36 f7 08 58 08 92 21 54 cc 0f 1f b4 85 c1 26 3a 05 db 9b c7 7e 35 0f cb ba 03 be 24 56 88 8f bc 33 ea ac 9c b5 7c a9 46 95 3b 6b be 19 3d
                                                  Data Ascii: uX}:Xd\J[<J 1%6X!T&:~5$V3|F;k=yL6Q;*DA-. +cR7FzrxHg]w;rIOgPBVsFCSb0Y!7hy*iWFW:/,`fv2NuK(91{-3~>ou}[C.m,$*CbD]3rd
                                                  Jul 22, 2024 12:34:56.764950037 CEST1236INData Raw: dd 8e 72 29 8a c0 1d 3f 7c b1 47 79 69 06 1b 3b 20 2d d3 80 fd 5e 0a 7f 7f e8 ac f4 e0 91 49 12 b0 45 b9 40 ab 32 8c 4a 2c dd e0 c4 f6 c7 5b a6 da 77 23 f9 11 08 27 df 00 b7 d1 0d 68 61 65 ca f5 94 2c 49 3c 23 b4 dd 71 44 19 8b 85 07 c3 c3 a6 5d
                                                  Data Ascii: r)?|Gyi; -^IE@2J,[w#'hae,I<#qD]qHo;p,jU_lMhL)BBJLrKgUCb`oRg#{u$KG*0[F1#>#>!kH|$1YfA
                                                  Jul 22, 2024 12:34:56.765821934 CEST844INData Raw: 34 a7 f3 80 a8 8b 39 a9 af ac 8e 4d da 0c 3c 6c 36 b0 93 fa 50 57 5d e6 d6 54 d3 bb 51 f7 01 1d 87 fa 6c b7 82 35 42 59 dd 7f d6 79 6b 59 93 d4 fb e9 e3 20 7b d7 09 a6 58 da ea fc 4e 90 3d 02 ef 8f ea cd 54 72 61 9d c2 bb 32 3c b4 4d 8e a9 d3 78
                                                  Data Ascii: 49M<l6PW]TQl5BYykY {XN=Tra2<MxC)Z}-&%djyiwm^G<s 1u%pv#"SQd$S$!kUnf^RnG\vb&%65VXV@ha;aOiM3+EtU{o$o


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  79192.168.2.450016104.16.149.13080984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:56.586976051 CEST179OUTPOST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 239
                                                  Connection: Keep-Alive
                                                  Jul 22, 2024 12:34:56.592021942 CEST239OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","CurrentSearch":"Google","CurrentHomepage":"about:home","LanguageIso2":"en-GB","IP":null,"CreateDate":0}}
                                                  Jul 22, 2024 12:34:57.165457964 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:57 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7fa595d1815-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  80192.168.2.450018104.16.149.13080984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:56.840611935 CEST179OUTPOST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 239
                                                  Connection: Keep-Alive
                                                  Jul 22, 2024 12:34:56.846334934 CEST239OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","CurrentSearch":"Google","CurrentHomepage":"about:home","LanguageIso2":"en-GB","IP":null,"CreateDate":0}}
                                                  Jul 22, 2024 12:34:57.432549000 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:57 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7fc189241ad-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0
                                                  Jul 22, 2024 12:34:57.433176994 CEST155OUTPOST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 239
                                                  Jul 22, 2024 12:34:57.439455032 CEST239OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","CurrentSearch":"Google","CurrentHomepage":"about:home","LanguageIso2":"en-GB","IP":null,"CreateDate":0}}
                                                  Jul 22, 2024 12:34:57.564181089 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:57 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7fd494341ad-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  81192.168.2.450029104.16.149.13080984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:59.357969046 CEST155OUTPOST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 239
                                                  Jul 22, 2024 12:34:59.362878084 CEST239OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","CurrentSearch":"Google","CurrentHomepage":"about:home","LanguageIso2":"en-GB","IP":null,"CreateDate":0}}
                                                  Jul 22, 2024 12:34:59.871139050 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:59 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c80b99828cda-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  82192.168.2.450036104.19.208.15280940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:34:59.912349939 CEST89OUTGET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Jul 22, 2024 12:35:00.391587973 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:35:00 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 17770
                                                  Connection: keep-alive
                                                  ETag: "770472110"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 430
                                                  Expires: Mon, 22 Jul 2024 14:35:00 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c80f09f44233-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 [TRUNCATED]
                                                  Data Ascii: PK:=AX7\0DrActiveFeatures.txt+@sjp#K1;/-[[ABexq)7 7:^gK !ibUVsO$v7|e\W'ZdveU*oR>%w$-;Q4Tf$+T$&Q?9#"6>0o@j(*i)H"B1`=&0I8CR"ycM7g\@8xE4S|Iyy7~%W?7!JhrfdB^OQ"IDG!o+^6VY6<wNNPP2\?EY^j>i[p`L_sXq>#~nY>LO9rsAS+g5FBiqgUf{*vBUBqTpKF;/[&WIAPuS-&v3!Y'bMl{[:5sVL3om7'O4'(V#:\#VOO&<s}Yd|<P@jM%O5lHs^SYfaCDDwVcE8~cETL0YIEd@._PQ~w\fAT7Kiywq|+#]N">(A0bU-lDM#ETYa-h}ep<),
                                                  Jul 22, 2024 12:35:00.391864061 CEST1236INData Raw: c3 e9 0b b5 94 79 f6 cd ab db ef 95 d6 d1 32 bc 03 27 b0 a7 67 bb 67 5c 5f 47 4a 97 f1 f7 fc 80 a5 3d 5e cb d2 21 fd 16 4d f6 ed 94 f2 d0 41 ec b6 8d 9b cb af 44 4b 5e 3f 92 fc ae 08 db 64 a5 1d 86 78 29 a2 a9 c5 2d c1 7a 36 38 e0 81 84 1a 34 f5
                                                  Data Ascii: y2'gg\_GJ=^!MADK^?dx)-z684R|YSgynUf1qbEFO?'[a`bF\rsZL0q\vgrP:ZbPw^l^|Vov^'D0\mJh*I{X14
                                                  Jul 22, 2024 12:35:00.391876936 CEST1236INData Raw: e3 09 b7 93 e7 ef 55 87 a5 e2 4a 0e 55 3c 50 4f 28 65 ca 9a de 34 88 d5 59 ab cd 64 54 2a 94 93 b6 b8 c7 f1 34 a6 fe 9a 9e 58 e1 5b 68 04 08 88 1d 07 7a 22 8c f4 8b 1a 37 f4 2d 18 02 f7 c9 7a e3 8d 30 e6 e5 c6 72 4a b5 33 12 97 f2 9b 9f 3d 2b 49
                                                  Data Ascii: UJU<PO(e4YdT*4X[hz"7-z0rJ3=+I:QrVjeAU|0e r.-nFs%U@_G~W}E^ns]W6.Jg4)Kk~9"4{i#W}_&L'HNOp
                                                  Jul 22, 2024 12:35:00.392463923 CEST672INData Raw: a2 40 45 ad 3e 10 cc d4 22 b8 18 aa b5 83 15 5b 5f 79 62 da f6 64 de 89 40 91 c6 e3 e6 3c 48 f6 f2 37 d0 b4 a2 87 ed 8b 72 11 f9 fa 1d 84 ca dd 63 7c e6 56 65 74 e8 c3 ce 0a 52 78 3d f5 2c 69 ad 82 46 5f 21 19 b5 ed d3 bf 7e 98 76 8d 6a 94 b7 ed
                                                  Data Ascii: @E>"[_ybd@<H7rc|VetRx=,iF_!~vj5s,yL/[g{QosVz%{A|PSeC)PYzSZ/]E?kINr|Pg!\2-;@&Lb<maS
                                                  Jul 22, 2024 12:35:00.392477989 CEST1236INData Raw: 1f 5f 95 40 e0 2f 2f b3 58 36 a8 5f 26 2b c1 d7 d8 86 95 ec 9b 23 f0 6b a3 48 55 63 47 ab 98 a2 7c a9 9d 44 46 9a cb 72 d4 ab 80 27 62 e2 20 b8 23 fe ab f6 c3 e1 79 ff 0e d6 3c ae d6 7b e4 a2 37 6f 8b fd 67 76 72 8f 8e e1 72 fa 02 77 a5 81 f5 71
                                                  Data Ascii: _@//X6_&+#kHUcG|DFr'b #y<{7ogvrrwq&PsTo=D8?^7(Xg@1~;sJa\o%PX=$cvb7fS:."$qC!QFmfWCW#H]WNsiz %Na)
                                                  Jul 22, 2024 12:35:00.393433094 CEST1236INData Raw: 67 d8 a1 30 25 3f 02 55 01 20 6a 51 4c 25 98 eb 97 f9 7e 66 ee d7 b1 f9 f9 c8 52 7e e9 cc 8c e0 85 81 9e 75 92 0d 4f 55 71 18 6b 3b 1f c1 38 42 6b c9 86 6d cb de b0 bc b5 62 17 da 81 40 69 af 0f ae 34 73 51 45 5a 4f 43 9b dc 83 af 7b a1 89 68 fd
                                                  Data Ascii: g0%?U jQL%~fR~uOUqk;8Bkmb@i4sQEZOC{h'VuuDyznvDn(&J;Px=Uc05;VT7!X<lA"}#&7qB(m5-r#N)4z7Axi)8r
                                                  Jul 22, 2024 12:35:00.393448114 CEST1236INData Raw: 4c 5f 22 a6 8e 97 9a b0 ae 42 00 ee 93 fe be c4 67 bd a1 03 61 4e 84 cb a0 67 6a e2 91 dc 77 40 da 04 53 1c 7e 5e 16 ac 6c 1f ad 21 43 29 ae 3c b5 6d 41 17 ce 99 37 75 7e 83 67 64 da 98 5f 52 48 92 39 2f a2 7b 79 5a a9 1c 84 29 a1 75 fe 35 2d ea
                                                  Data Ascii: L_"BgaNgjw@S~^l!C)<mA7u~gd_RH9/{yZ)u5-U|1.rwx#x{LOmV>y)YT+h"j^mf}xmk{KE[.ntTv#odHsfIu4@/=i ,Dm4%,],>A3
                                                  Jul 22, 2024 12:35:00.394212008 CEST1236INData Raw: 75 6b 9d 8e 72 bf 44 65 cd 9c 9a 81 c2 f5 91 b3 95 bd 7b f5 9b de 51 be c3 87 77 77 67 95 16 8e 08 8e 1a 8e 6e c8 38 25 3e bd 63 08 bf 5a 34 ee d4 84 0d 42 59 77 2e 68 0a cb 58 92 56 1e 99 7e 84 53 66 25 79 5a d7 07 7c 54 81 63 e7 ae b9 a1 c5 26
                                                  Data Ascii: ukrDe{Qwwgn8%>cZ4BYw.hXV~Sf%yZ|Tc&=0q5WKl\<U9$DW`+R ]m-68j5a.|sOB~1zc[ugQ>Tv~Fa&<pX caENsE0aUC3WE4e
                                                  Jul 22, 2024 12:35:00.394224882 CEST1236INData Raw: f9 3e cc a5 15 56 a3 fe af c3 ae f4 bf 6c 0a 0a b9 c0 08 ad a0 b3 98 77 db d1 2a a8 8c 8b 5c 92 11 d5 ff b8 b8 3d fa 21 dd 30 57 52 0f 90 76 97 46 49 f3 b0 f5 1b b1 d7 21 08 dd d8 77 eb 88 74 07 5c 0f f6 4f 41 ea 5c 09 37 2b b0 f3 16 f6 1c 9c 0d
                                                  Data Ascii: >Vlw*\=!0WRvFI!wt\OA\7+y;#+KsF14:FD[Re e#Hd5I.*p{o.H'*|a2iZ.Yp?X=[I\V~^{z7F: G5C*w 0sB=
                                                  Jul 22, 2024 12:35:00.394237041 CEST1236INData Raw: b1 86 60 62 c7 ed 7f be af 7b 96 5f 3d 9d 9d 0b 56 26 89 40 3d 3d 97 72 1b ff ea ff 35 46 a1 b9 be f8 fb 17 02 f9 23 5a 8c 2f 75 73 1d 7f e5 15 20 69 d1 52 03 6b f3 fa 6b 65 c5 b8 c6 cd 06 e9 35 8a c7 49 1e 7f 22 66 29 5b 8c 7b b9 3b fa e7 df 0d
                                                  Data Ascii: `b{_=V&@==r5F#Z/us iRkke5I"f)[{;5j0F7$v4Jo4c+;J|#0,N9Mu'l^DF+iL4\WB>To*+hiZa;;-c.T12=ZLXZbdBNRy
                                                  Jul 22, 2024 12:35:00.396802902 CEST1236INData Raw: f9 49 6f 29 45 36 42 64 47 c0 f6 2b 3b 0d 4e 0b 0c 4f 75 f7 e1 a9 d9 62 7e b0 9e a9 0d 23 ac 38 b6 3e 0a 62 8b 00 d4 53 2a a0 b4 00 65 cd d9 c4 7d d3 d0 be 79 36 da 1f 52 38 aa 3e 71 45 bc 26 08 37 85 56 e2 ac 04 06 4f 33 f9 f7 c0 c6 d0 a7 69 04
                                                  Data Ascii: Io)E6BdG+;NOub~#8>bS*e}y6R8>qE&7VO3iGxK'~V~GP)s&KicA]YbA`>Y<xCbDs-H:J0S+9y h8.7BmJPl/T5(^,Ke}g#:zEf


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  83192.168.2.450044104.16.149.13080940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:35:01.900109053 CEST155OUTPOST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 239
                                                  Jul 22, 2024 12:35:01.905313015 CEST239OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","CurrentSearch":"Google","CurrentHomepage":"about:home","LanguageIso2":"en-GB","IP":null,"CreateDate":0}}
                                                  Jul 22, 2024 12:35:02.396636963 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:35:02 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c81b6a7d8c0f-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  84192.168.2.450048104.19.208.15280984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:35:02.369504929 CEST89OUTGET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Jul 22, 2024 12:35:02.845886946 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:35:02 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 17770
                                                  Connection: keep-alive
                                                  ETag: "770472110"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 432
                                                  Expires: Mon, 22 Jul 2024 14:35:02 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c81e6c45c342-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 [TRUNCATED]
                                                  Data Ascii: PK:=AX7\0DrActiveFeatures.txt+@sjp#K1;/-[[ABexq)7 7:^gK !ibUVsO$v7|e\W'ZdveU*oR>%w$-;Q4Tf$+T$&Q?9#"6>0o@j(*i)H"B1`=&0I8CR"ycM7g\@8xE4S|Iyy7~%W?7!JhrfdB^OQ"IDG!o+^6VY6<wNNPP2\?EY^j>i[p`L_sXq>#~nY>LO9rsAS+g5FBiqgUf{*vBUBqTpKF;/[&WIAPuS-&v3!Y'bMl{[:5sVL3om7'O4'(V#:\#VOO&<s}Yd|<P@jM%O5lHs^SYfaCDDwVcE8~cETL0YIEd@._PQ~w\fAT7Kiywq|+#]N">(A0bU-lDM#ETYa-h}ep<),
                                                  Jul 22, 2024 12:35:02.845937967 CEST1236INData Raw: c3 e9 0b b5 94 79 f6 cd ab db ef 95 d6 d1 32 bc 03 27 b0 a7 67 bb 67 5c 5f 47 4a 97 f1 f7 fc 80 a5 3d 5e cb d2 21 fd 16 4d f6 ed 94 f2 d0 41 ec b6 8d 9b cb af 44 4b 5e 3f 92 fc ae 08 db 64 a5 1d 86 78 29 a2 a9 c5 2d c1 7a 36 38 e0 81 84 1a 34 f5
                                                  Data Ascii: y2'gg\_GJ=^!MADK^?dx)-z684R|YSgynUf1qbEFO?'[a`bF\rsZL0q\vgrP:ZbPw^l^|Vov^'D0\mJh*I{X14
                                                  Jul 22, 2024 12:35:02.845953941 CEST1236INData Raw: e3 09 b7 93 e7 ef 55 87 a5 e2 4a 0e 55 3c 50 4f 28 65 ca 9a de 34 88 d5 59 ab cd 64 54 2a 94 93 b6 b8 c7 f1 34 a6 fe 9a 9e 58 e1 5b 68 04 08 88 1d 07 7a 22 8c f4 8b 1a 37 f4 2d 18 02 f7 c9 7a e3 8d 30 e6 e5 c6 72 4a b5 33 12 97 f2 9b 9f 3d 2b 49
                                                  Data Ascii: UJU<PO(e4YdT*4X[hz"7-z0rJ3=+I:QrVjeAU|0e r.-nFs%U@_G~W}E^ns]W6.Jg4)Kk~9"4{i#W}_&L'HNOp
                                                  Jul 22, 2024 12:35:02.846255064 CEST1236INData Raw: a2 40 45 ad 3e 10 cc d4 22 b8 18 aa b5 83 15 5b 5f 79 62 da f6 64 de 89 40 91 c6 e3 e6 3c 48 f6 f2 37 d0 b4 a2 87 ed 8b 72 11 f9 fa 1d 84 ca dd 63 7c e6 56 65 74 e8 c3 ce 0a 52 78 3d f5 2c 69 ad 82 46 5f 21 19 b5 ed d3 bf 7e 98 76 8d 6a 94 b7 ed
                                                  Data Ascii: @E>"[_ybd@<H7rc|VetRx=,iF_!~vj5s,yL/[g{QosVz%{A|PSeC)PYzSZ/]E?kINr|Pg!\2-;@&Lb<maS
                                                  Jul 22, 2024 12:35:02.846271992 CEST1236INData Raw: ef ec e3 a3 78 02 50 1e 6e 18 3a c8 ef 40 01 47 df 2f 67 75 81 ee e7 ed 5c 86 a7 cd ff 50 b9 61 08 00 fa a5 b9 0e 2f 50 8f 87 fd 80 44 ec bf 7d 28 a2 50 86 c4 d0 81 34 04 f9 9d 19 90 5d 6c c8 6f a3 82 62 5f 8a 77 97 ae e6 15 32 ec 5b 3c d5 d1 50
                                                  Data Ascii: xPn:@G/gu\Pa/PD}(P4]lob_w2[<Pz|<gzX],af!:$uMs)m74Tf8Q0Ee@>i~p#D'uma{4q-x.{W)x,0Fm'*wTn
                                                  Jul 22, 2024 12:35:02.846287966 CEST1236INData Raw: ea fe e8 9b 44 1e 62 80 9f 85 5d b4 ed 54 9a 62 26 5d f9 5f e9 66 31 79 1a ec 5d eb 3b 42 de 2a 12 2f 99 5a 51 ad 2c 4e fc b2 cd 25 8a df 0b d7 07 24 1e 16 60 15 f2 23 fe 84 ec 28 ca cb ea 25 a1 6f 30 22 39 cc 4f eb 80 ec b0 87 73 03 c9 e2 6f cb
                                                  Data Ascii: Db]Tb&]_f1y];B*/ZQ,N%$`#(%o0"9OsosUN^m9N)&8))QK}b9"@T~yu?V7j7y)vJ_EEW58X+:CP~T,{/s" a*=_lJ
                                                  Jul 22, 2024 12:35:02.846304893 CEST776INData Raw: c6 ac fb 85 2b c7 a3 2f 2f d9 73 66 a6 d5 b3 dc bc 4c 89 64 2f f9 a1 b7 40 bf dd 84 b3 f4 0d 92 fa d2 49 45 fc 27 f8 14 9d 3f bd 02 3a c4 6a 3c 68 f4 ec 55 d8 20 1b ea 58 1f 15 63 0c 4e fc 76 39 e9 cc 71 40 69 5b b9 5b c5 4e 6d 50 82 e3 2b 3d 15
                                                  Data Ascii: +//sfLd/@IE'?:j<hU XcNv9q@i[[NmP+=127ZS$rHxh7[m15'1Z91 #%|^s\obPTPUO:$9pgLNTKqmc_xE]uUW\&6Ijo
                                                  Jul 22, 2024 12:35:02.846787930 CEST1236INData Raw: d8 55 39 07 81 24 01 07 44 95 57 e7 60 2b d2 a5 bd 52 20 06 5d 6d 80 a3 f0 2d 04 be f6 c4 36 f1 38 a7 eb 6a 35 61 be 2e 7c 73 13 4f 8d 09 88 42 b0 bd 85 7e 1c 31 f2 7a d1 7f a9 63 dd 5b 75 a3 67 d4 de b1 93 51 3e b1 c5 0d 54 c8 76 fd 9b 11 7e 11
                                                  Data Ascii: U9$DW`+R ]m-68j5a.|sOB~1zc[ugQ>Tv~Fa&<pX caENsE0aUC3WE4eP0!W%]VKw7u:Uw`=n&l\r\0kXL0n)vneEw6h,{>Vo
                                                  Jul 22, 2024 12:35:02.846803904 CEST1236INData Raw: e7 b7 5b 52 84 a3 65 20 65 10 bf a4 cf 1e 23 cf 87 ab 48 1a 64 35 a1 c4 c9 49 17 07 2e 2a b5 70 13 92 00 da b1 7b 6f cb 09 2e 48 8a 27 c7 e5 2a 7c 61 32 06 ef 8d ef 69 86 b1 a5 5a cf 14 e3 2e be 59 f3 70 3f 58 1f f9 19 c3 e4 d6 3d d0 5b 49 5c 56
                                                  Data Ascii: [Re e#Hd5I.*p{o.H'*|a2iZ.Yp?X=[I\V~^{z7F: G5C*w 0sB=z+K3wV}aS)BlUD`a%z1-/a{aZ@";AsW_DL[hArN~+;6]._
                                                  Jul 22, 2024 12:35:02.846818924 CEST1236INData Raw: 18 76 dd 0b 34 ab e4 4a 6f f1 34 d1 63 c7 18 e9 2b a2 3b 4a 7c 23 0f 05 ff 30 bf 2c 4e b5 39 8b 92 8a 8a b6 4d 75 f8 02 27 6c 5e b0 df 44 bd 46 0b 0d 9a 2b 69 4c cf 34 03 5c 57 42 3e a3 89 54 04 6f 2a 2b 68 02 69 ad c5 d9 c8 9b 5a 61 a1 3b 90 0a
                                                  Data Ascii: v4Jo4c+;J|#0,N9Mu'l^DF+iL4\WB>To*+hiZa;;-c.T12=ZLXZbdBNRyib[FEv.=K36A#:O;#MjJ?N7k]^0huT [^o}
                                                  Jul 22, 2024 12:35:02.850951910 CEST1236INData Raw: b8 b3 f7 91 1f 9d 29 cb f6 de b0 17 73 f0 26 f7 4b 69 cd 63 ec 41 5d 59 62 41 b8 60 3e 59 3c dd 80 84 98 78 c8 c6 f1 43 62 44 9e 73 2d ca 48 10 af 3a 9a 06 4a ab 30 bb 10 e4 53 db 19 2b 39 c0 86 cd 79 20 1a 1e 93 96 68 8b 8b 89 11 98 38 0e cc 2e
                                                  Data Ascii: )s&KicA]YbA`>Y<xCbDs-H:J0S+9y h8.7BmJPl/T5(^,Ke}g#:zEf!%Zwk=6^d$?.a"hZLjMl:a]J!`wVRDwa*|bM#lx


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  85192.168.2.450051104.19.208.15280984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:35:02.799308062 CEST105OUTGET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Jul 22, 2024 12:35:03.275845051 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:35:03 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 9891
                                                  Connection: keep-alive
                                                  ETag: "3914547665"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 130
                                                  Expires: Mon, 22 Jul 2024 14:35:03 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c8211d1b190e-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d [TRUNCATED]
                                                  Data Ascii: PKIX6%FeatureActions.txtBPZ&KE9(0p<a}9g<D)9k@4y'!=~Zk`1J2[)_,{FF?q;fL*=1ZI->m%>`ml,sWITPu*;Pxxhgl$M]I}ogZL5?BZLxukU1P4mW-Ntf?I-/!w90/^%X-.0(mVPn]=cr_A$<BWye2bK{jOdxZv@[NLDU|_1Sp~Paq>})$qH7,hm)Ias<TWu$?Ey@Xu@5*UJLja0v^Q (O}k+fwvfzbhFE<plLWZI*.4#,X`=beVW)W*;Q,'x>Jq _T<ea&wo/RM2`rXFEc:A97A4FT0@wuJIBd5Bhw}oE@N=Z$)6@sXru%eIg5ruA:81&"e_'Be
                                                  Jul 22, 2024 12:35:03.275937080 CEST1236INData Raw: aa 27 91 1f 4b c3 11 60 77 a1 43 f9 f7 10 07 63 36 80 1a 86 ad 48 a7 d3 8f 6f 01 ae 9e 9c 3f a2 79 6e 3b 81 f2 7e 33 72 dc 17 7b 3c b2 f2 80 9b 26 a0 a9 76 69 9d e2 6e 9e 4d 47 96 36 9b c5 b5 27 68 b5 b4 84 34 1c 56 23 a3 50 e1 9f 24 02 89 9a 6e
                                                  Data Ascii: 'K`wCc6Ho?yn;~3r{<&vinMG6'h4V#P$n/Kt'<4oOa"xGTVBfE<eG#Bw{#@mc]os}uE6@e`^](9A,NjbNYnOF\8p"CLFk
                                                  Jul 22, 2024 12:35:03.275958061 CEST1236INData Raw: fd ac 50 d8 52 44 ee 8b 8f d4 d8 b2 84 d1 cb d6 f7 f8 05 a5 aa 41 48 05 36 3c 93 56 87 e3 e6 2f 47 40 72 47 91 28 bd 1e de c7 43 06 15 aa c9 07 7f 4b 86 10 6b 1f 41 44 6f 91 db 30 a2 f9 46 11 1a 4b 58 16 a1 31 d1 5e b4 59 ca fc 47 fc bc 25 05 70
                                                  Data Ascii: PRDAH6<V/G@rG(CKkADo0FKX1^YG%p8P*rH|idu{"PBv`DWG&O*rD:V4#{>51Zy4U-&SSIgFkZpYN~L-6Fed~ex>3
                                                  Jul 22, 2024 12:35:03.276654005 CEST672INData Raw: 88 a8 b4 43 f7 18 27 39 99 b5 09 5b b0 21 e4 89 cd dc d8 80 8f ba 2c 76 5f 49 78 e0 a0 e6 a4 e8 61 8a 0a 7d 07 ae 7f 5b db 69 5b ab 4d 22 92 db 0e dc 5e ef db 36 83 5e 63 58 81 45 75 40 0c 8a 74 59 c3 e4 31 78 2a c9 f9 39 82 db c7 d7 e1 67 09 f5
                                                  Data Ascii: C'9[!,v_Ixa}[i[M"^6^cXEu@tY1x*9g&LIY+5kR@v<a.{G`#|<rPgAn><AhcF1NG_d~JFS}=l-z%Q\)Zm?)^afu
                                                  Jul 22, 2024 12:35:03.276674032 CEST1236INData Raw: 61 aa 08 dd ae 4e a9 20 f0 86 f7 d2 0f bd b4 39 51 dc 6c 33 d7 4b 59 37 fc f7 27 f0 c4 f9 d3 95 5a f2 29 96 f8 42 a5 0c b6 84 33 2f 08 22 4d 2f 67 4f 0e 19 1f 04 d0 88 32 94 39 52 e1 72 44 82 04 2b b2 26 cc b4 46 dd c8 06 3e de ac 55 f6 d8 97 a5
                                                  Data Ascii: aN 9Ql3KY7'Z)B3/"M/gO29RrD+&F>Uuw<}}S3_"z)fv@L@eHlwla%<Xc1}Q&<MY;%6e5hL^iG.uY+k+}`"^D]5 G@k_?Ph?
                                                  Jul 22, 2024 12:35:03.276696920 CEST1236INData Raw: be 69 1d 30 0d 5c 2a ba f9 58 02 c6 be 7f 45 32 1c f3 80 01 4d 28 6d da 0e 3e 73 b4 6c be 91 b4 80 1b 2b ff 47 33 2e 6a 3e 0c 39 53 e6 e7 f1 79 63 74 fb 11 57 6b bd 8d 24 63 24 74 f3 e0 c2 f1 76 c9 d6 7b 50 b0 b8 89 59 3f 7d 70 4e e5 5c b0 92 d6
                                                  Data Ascii: i0\*XE2M(m>sl+G3.j>9SyctWk$c$tv{PY?}pN\H/4<y`<AP8T1|=4jj"AEpp@dS|!3huK*As+w$)8EEL9^FjcA1!%X
                                                  Jul 22, 2024 12:35:03.276712894 CEST1236INData Raw: 1e 0e 93 87 8d b3 85 ef 08 7c 0d 45 6d 7b 10 18 92 21 a2 71 1a 1d 55 d2 de 2a 63 e6 9a 74 56 20 c3 43 8a 85 42 d4 4d 4e 2e ad 1a 95 92 9e b4 e7 63 fa a1 b9 e8 1c 02 8f 70 9b e6 cf 9f f8 3c 3c e8 c4 67 e2 b3 8b 74 02 bb 5c aa 48 97 2c 46 7d 35 98
                                                  Data Ascii: |Em{!qU*ctV CBMN.cp<<gt\H,F}5OwB(q_0bL)w,!u|Y?{:h1|o/7.cb-4k3ZrFZP,_zDiNxblgF|!&J;dhP48}U%vHEOXu
                                                  Jul 22, 2024 12:35:03.276731014 CEST1236INData Raw: 2c ef 24 2a 94 f8 43 62 85 44 5d 33 06 a5 72 64 8d 0a 06 12 a1 13 62 5b 09 17 65 35 d1 f2 96 a0 fa 4a a5 1b a7 25 ad 29 6d 69 33 cb cb e6 ab 13 bc 3c 29 c1 02 ee ad ad 32 d8 7d 60 fa 6d 52 37 a2 f8 27 e3 22 e2 70 ec f5 22 64 6a b0 cb 71 dc 53 f5
                                                  Data Ascii: ,$*CbD]3rdb[e5J%)mi3<)2}`mR7'"p"djqSxzay67*3.dr)?|Gyi; -^IE@2J,[w#'hae,I<#qD]qHo;p,jU_lMhL)BBJLrKgU
                                                  Jul 22, 2024 12:35:03.277089119 CEST948INData Raw: 66 66 80 ed 76 d6 35 eb bc 80 83 86 e2 b5 e2 25 22 0f 28 83 e9 87 de 13 76 c6 60 31 e3 91 8e 37 2a f7 86 a5 ac 6e bc 46 3e 3d c8 f0 c5 5a 0d 14 22 10 45 f9 a9 60 83 34 73 e9 32 fb 3f fe 11 93 46 cf 4e 92 cc 2f 8b 7a 3a fe d5 74 d6 5b cf c5 0c 2a
                                                  Data Ascii: ffv5%"(v`17*nF>=Z"E`4s2?FN/z:t[*jKQ6*`F"*49M<l6PW]TQl5BYykY {XN=Tra2<MxC)Z}-&%djyiwm^G<s 1u%pv#
                                                  Jul 22, 2024 12:35:03.512224913 CEST948INData Raw: 66 66 80 ed 76 d6 35 eb bc 80 83 86 e2 b5 e2 25 22 0f 28 83 e9 87 de 13 76 c6 60 31 e3 91 8e 37 2a f7 86 a5 ac 6e bc 46 3e 3d c8 f0 c5 5a 0d 14 22 10 45 f9 a9 60 83 34 73 e9 32 fb 3f fe 11 93 46 cf 4e 92 cc 2f 8b 7a 3a fe d5 74 d6 5b cf c5 0c 2a
                                                  Data Ascii: ffv5%"(v`17*nF>=Z"E`4s2?FN/z:t[*jKQ6*`F"*49M<l6PW]TQl5BYykY {XN=Tra2<MxC)Z}-&%djyiwm^G<s 1u%pv#


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  86192.168.2.450059104.19.208.15280940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:35:04.325707912 CEST89OUTGET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Jul 22, 2024 12:35:04.441450119 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:35:04 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 17770
                                                  Connection: keep-alive
                                                  ETag: "770472110"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 434
                                                  Expires: Mon, 22 Jul 2024 14:35:04 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c828585f8c59-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 [TRUNCATED]
                                                  Data Ascii: PK:=AX7\0DrActiveFeatures.txt+@sjp#K1;/-[[ABexq)7 7:^gK !ibUVsO$v7|e\W'ZdveU*oR>%w$-;Q4Tf$+T$&Q?9#"6>0o@j(*i)H"B1`=&0I8CR"ycM7g\@8xE4S|Iyy7~%W?7!JhrfdB^OQ"IDG!o+^6VY6<wNNPP2\?EY^j>i[p`L_sXq>#~nY>LO9rsAS+g5FBiqgUf{*vBUBqTpKF;/[&WIAPuS-&v3!Y'bMl{[:5sVL3om7'O4'(V#:\#VOO&<s}Yd|<P@jM%O5lHs^SYfaCDDwVcE8~cETL0YIEd@._PQ~w\fAT7Kiywq|+#]N">(A0bU-lDM#ETYa-h}ep<),
                                                  Jul 22, 2024 12:35:04.441463947 CEST1236INData Raw: c3 e9 0b b5 94 79 f6 cd ab db ef 95 d6 d1 32 bc 03 27 b0 a7 67 bb 67 5c 5f 47 4a 97 f1 f7 fc 80 a5 3d 5e cb d2 21 fd 16 4d f6 ed 94 f2 d0 41 ec b6 8d 9b cb af 44 4b 5e 3f 92 fc ae 08 db 64 a5 1d 86 78 29 a2 a9 c5 2d c1 7a 36 38 e0 81 84 1a 34 f5
                                                  Data Ascii: y2'gg\_GJ=^!MADK^?dx)-z684R|YSgynUf1qbEFO?'[a`bF\rsZL0q\vgrP:ZbPw^l^|Vov^'D0\mJh*I{X14
                                                  Jul 22, 2024 12:35:04.442132950 CEST1236INData Raw: e3 09 b7 93 e7 ef 55 87 a5 e2 4a 0e 55 3c 50 4f 28 65 ca 9a de 34 88 d5 59 ab cd 64 54 2a 94 93 b6 b8 c7 f1 34 a6 fe 9a 9e 58 e1 5b 68 04 08 88 1d 07 7a 22 8c f4 8b 1a 37 f4 2d 18 02 f7 c9 7a e3 8d 30 e6 e5 c6 72 4a b5 33 12 97 f2 9b 9f 3d 2b 49
                                                  Data Ascii: UJU<PO(e4YdT*4X[hz"7-z0rJ3=+I:QrVjeAU|0e r.-nFs%U@_G~W}E^ns]W6.Jg4)Kk~9"4{i#W}_&L'HNOp
                                                  Jul 22, 2024 12:35:04.442146063 CEST1236INData Raw: a2 40 45 ad 3e 10 cc d4 22 b8 18 aa b5 83 15 5b 5f 79 62 da f6 64 de 89 40 91 c6 e3 e6 3c 48 f6 f2 37 d0 b4 a2 87 ed 8b 72 11 f9 fa 1d 84 ca dd 63 7c e6 56 65 74 e8 c3 ce 0a 52 78 3d f5 2c 69 ad 82 46 5f 21 19 b5 ed d3 bf 7e 98 76 8d 6a 94 b7 ed
                                                  Data Ascii: @E>"[_ybd@<H7rc|VetRx=,iF_!~vj5s,yL/[g{QosVz%{A|PSeC)PYzSZ/]E?kINr|Pg!\2-;@&Lb<maS
                                                  Jul 22, 2024 12:35:04.442807913 CEST1236INData Raw: ef ec e3 a3 78 02 50 1e 6e 18 3a c8 ef 40 01 47 df 2f 67 75 81 ee e7 ed 5c 86 a7 cd ff 50 b9 61 08 00 fa a5 b9 0e 2f 50 8f 87 fd 80 44 ec bf 7d 28 a2 50 86 c4 d0 81 34 04 f9 9d 19 90 5d 6c c8 6f a3 82 62 5f 8a 77 97 ae e6 15 32 ec 5b 3c d5 d1 50
                                                  Data Ascii: xPn:@G/gu\Pa/PD}(P4]lob_w2[<Pz|<gzX],af!:$uMs)m74Tf8Q0Ee@>i~p#D'uma{4q-x.{W)x,0Fm'*wTn
                                                  Jul 22, 2024 12:35:04.442821980 CEST1236INData Raw: ea fe e8 9b 44 1e 62 80 9f 85 5d b4 ed 54 9a 62 26 5d f9 5f e9 66 31 79 1a ec 5d eb 3b 42 de 2a 12 2f 99 5a 51 ad 2c 4e fc b2 cd 25 8a df 0b d7 07 24 1e 16 60 15 f2 23 fe 84 ec 28 ca cb ea 25 a1 6f 30 22 39 cc 4f eb 80 ec b0 87 73 03 c9 e2 6f cb
                                                  Data Ascii: Db]Tb&]_f1y];B*/ZQ,N%$`#(%o0"9OsosUN^m9N)&8))QK}b9"@T~yu?V7j7y)vJ_EEW58X+:CP~T,{/s" a*=_lJ
                                                  Jul 22, 2024 12:35:04.443528891 CEST1236INData Raw: c6 ac fb 85 2b c7 a3 2f 2f d9 73 66 a6 d5 b3 dc bc 4c 89 64 2f f9 a1 b7 40 bf dd 84 b3 f4 0d 92 fa d2 49 45 fc 27 f8 14 9d 3f bd 02 3a c4 6a 3c 68 f4 ec 55 d8 20 1b ea 58 1f 15 63 0c 4e fc 76 39 e9 cc 71 40 69 5b b9 5b c5 4e 6d 50 82 e3 2b 3d 15
                                                  Data Ascii: +//sfLd/@IE'?:j<hU XcNv9q@i[[NmP+=127ZS$rHxh7[m15'1Z91 #%|^s\obPTPUO:$9pgLNTKqmc_xE]uUW\&6Ijo
                                                  Jul 22, 2024 12:35:04.443542957 CEST1236INData Raw: e7 41 3d ce 7d 33 4d 0f 6d da 2d 57 cd 6d 7c 72 20 41 5f e2 85 cb 48 2a 2c 1b 25 2d ea 0b 8c 30 58 68 ec 5b 67 54 17 0b 09 36 f0 a1 5f 55 d0 81 77 eb 76 58 90 be 59 9e ba 3f be 84 2b 42 29 6f 5c df c6 42 5f 49 8a 9f 97 26 07 55 9d da 50 6a e6 dc
                                                  Data Ascii: A=}3Mm-Wm|r A_H*,%-0Xh[gT6_UwvXY?+B)o\B_I&UPj?n,\_%N&gFx!7^"*w/:=\-?2$(<9#oPa7Z+iIU1B($k!XdI<#7s(,\~1~@SfHTn
                                                  Jul 22, 2024 12:35:04.444174051 CEST1236INData Raw: 20 19 6a 5f 78 89 c4 93 e5 38 5a 6e de 37 da e2 c6 06 b0 e8 f5 8e ec 2a 4d 52 53 7c c0 ce f1 b1 9d 84 d3 91 ba fc 29 13 39 6d 22 59 ca f4 90 ba 24 c3 b5 86 27 17 f3 8a b2 8c 0f d9 b9 6d 97 6d 9b 96 f5 eb e7 ae 0b 71 31 03 84 41 72 7d a7 8d f4 99
                                                  Data Ascii: j_x8Zn7*MRS|)9m"Y$'mmq1Ar}sWC@T^n2I%j+r|kpjq%<OjYSO)o+`qK18oLXG#F?sTds%>qWY2qf[n XR`
                                                  Jul 22, 2024 12:35:04.444188118 CEST1236INData Raw: d1 d2 9b 08 03 2c 5a d5 0d b5 24 ba 57 06 e9 82 13 06 b8 76 cd 11 85 df 30 60 c7 4a 68 fc 62 33 d3 a3 33 4a 36 3d a8 67 bb a3 56 33 7d 3d 9a 83 2c 2e ab 79 ba 0d fb 01 11 b8 6d 84 ce cd 88 2e 7d f5 4f 3e 3e d1 e4 3c 13 83 fa 27 77 82 c7 e2 d9 4b
                                                  Data Ascii: ,Z$Wv0`Jhb33J6=gV3}=,.ym.}O>><'wK\U}&El?<tl%}v%HSA*gH(vqd00Dan~Jlax_K9#+Rfl?uhLO{.FLRS
                                                  Jul 22, 2024 12:35:04.446432114 CEST1236INData Raw: 12 42 b8 dd e5 1f 9e 6b 33 d0 27 64 66 67 09 75 13 4e 4f e9 2f 56 c0 a1 26 a6 e7 0f 48 59 99 5e 9a 7b ee 13 0a e1 b2 7e 95 bf 06 41 45 43 c3 c5 43 45 37 b4 fd 4d f1 ee 9a 9c 98 53 15 42 01 8c fa ef a5 44 d0 97 33 99 81 2a 36 6b 2c 46 c1 0c 71 2f
                                                  Data Ascii: Bk3'dfguNO/V&HY^{~AECCE7MSBD3*6k,Fq/D:-E|OylOR-BS)2,o(P.Ibk@1F] 9X&;/<MZ5 `CLg`h*EH=|EZpoC/j{1,u;


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  87192.168.2.450062104.16.149.13080940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:35:04.602088928 CEST155OUTPOST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 239
                                                  Jul 22, 2024 12:35:04.607038021 CEST239OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","CurrentSearch":"Google","CurrentHomepage":"about:home","LanguageIso2":"en-GB","IP":null,"CreateDate":0}}
                                                  Jul 22, 2024 12:35:05.165266991 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:35:05 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c82c7f002363-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  88192.168.2.450067104.16.149.13080940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:35:04.895174026 CEST155OUTPOST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 239
                                                  Jul 22, 2024 12:35:04.900376081 CEST239OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","CurrentSearch":"Google","CurrentHomepage":"about:home","LanguageIso2":"en-GB","IP":null,"CreateDate":0}}
                                                  Jul 22, 2024 12:35:05.419245958 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:35:05 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c82e2f834337-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  89192.168.2.450068104.19.208.15280940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:35:04.895288944 CEST105OUTGET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Jul 22, 2024 12:35:05.368340015 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:35:05 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 9891
                                                  Connection: keep-alive
                                                  ETag: "3914547665"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 132
                                                  Expires: Mon, 22 Jul 2024 14:35:05 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c82e2b384321-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d [TRUNCATED]
                                                  Data Ascii: PKIX6%FeatureActions.txtBPZ&KE9(0p<a}9g<D)9k@4y'!=~Zk`1J2[)_,{FF?q;fL*=1ZI->m%>`ml,sWITPu*;Pxxhgl$M]I}ogZL5?BZLxukU1P4mW-Ntf?I-/!w90/^%X-.0(mVPn]=cr_A$<BWye2bK{jOdxZv@[NLDU|_1Sp~Paq>})$qH7,hm)Ias<TWu$?Ey@Xu@5*UJLja0v^Q (O}k+fwvfzbhFE<plLWZI*.4#,X`=beVW)W*;Q,'x>Jq _T<ea&wo/RM2`rXFEc:A97A4FT0@wuJIBd5Bhw}oE@N=Z$)6@sXru%eIg5ruA:81&"e_'Be
                                                  Jul 22, 2024 12:35:05.368474960 CEST224INData Raw: aa 27 91 1f 4b c3 11 60 77 a1 43 f9 f7 10 07 63 36 80 1a 86 ad 48 a7 d3 8f 6f 01 ae 9e 9c 3f a2 79 6e 3b 81 f2 7e 33 72 dc 17 7b 3c b2 f2 80 9b 26 a0 a9 76 69 9d e2 6e 9e 4d 47 96 36 9b c5 b5 27 68 b5 b4 84 34 1c 56 23 a3 50 e1 9f 24 02 89 9a 6e
                                                  Data Ascii: 'K`wCc6Ho?yn;~3r{<&vinMG6'h4V#P$n/Kt'<4oOa"xGTVBfE<eG#Bw{#@mc]os}uE6@e`^](9A,NjbNYnOF
                                                  Jul 22, 2024 12:35:05.368558884 CEST1236INData Raw: fb 5c fb af 91 38 c0 70 fa 22 c9 e3 87 43 4c c7 46 87 6b 8a af 86 ca e5 38 84 51 e2 31 67 c1 63 b9 d7 47 9f 37 4f 2d 71 fd 69 57 47 d4 dc 26 8a 76 f3 93 e9 a6 7a 0e fb 36 64 28 35 ec 55 52 8c dc eb 55 ce 6e 46 75 24 4b 11 8f 9f 87 f7 53 d0 a7 ec
                                                  Data Ascii: \8p"CLFk8Q1gcG7O-qiWG&vz6d(5URUnFu$KS08Y8D CO^;Ag"B^%/M13%)fC0$vDoC(sr\ae!bm[4?d11DAPs-m]_/qb*bO8zZIPy5w
                                                  Jul 22, 2024 12:35:05.368659973 CEST1236INData Raw: 13 2d 36 46 65 93 ba 93 64 db 09 87 7e 65 78 e4 dc 3e 33 1f b1 dd 66 48 cc 13 93 85 c9 ef bd 59 3c 20 70 0c 0b cf 02 66 b8 56 3e 43 d8 5c 2a c4 7c bb 8e e2 35 e6 c7 ba 8e 6b 14 2c 73 38 6b 98 97 16 6c 2e 7c 78 82 9b 23 2c a9 f4 bf 83 30 91 68 4a
                                                  Data Ascii: -6Fed~ex>3fHY< pfV>C\*|5k,s8kl.|x#,0hJc^Tz|:,1Y| BUH`@2GBFz2xwP`/g}[%IuXG9(&q#&;2+.[FtxO=tWsF
                                                  Jul 22, 2024 12:35:05.368670940 CEST1236INData Raw: d7 29 5e ad 61 d9 d6 14 eb 66 fb 03 02 ac 75 86 07 1d f5 a5 bd e4 b3 0f 0f a6 93 7a f7 70 c7 19 35 81 53 89 6a 4b cd 9c 15 52 78 01 66 6c c6 ce 5d f9 49 cc e2 8b 10 1f 26 e8 18 85 14 d6 67 04 ab 7f 00 94 71 7c 1c 67 c5 b5 6e 26 36 fc 3c ec 82 c3
                                                  Data Ascii: )^afuzp5SjKRxfl]I&gq|gn&6<%<$3<3Mb_-H}3XH7~GV^f%B5\~unuF_+.8U<$gd2`-d=CWiHoQeA,_
                                                  Jul 22, 2024 12:35:05.368683100 CEST1236INData Raw: fd 4f 88 f3 92 8c 01 0d 52 d3 46 80 91 04 76 c4 15 bd d0 ed c2 d7 2d 51 8d 74 1f 7e c5 35 9c 7d 9f 86 4d de 32 65 21 76 54 ef 35 1f 1c d2 cf c3 84 95 98 de 7a 90 92 34 bc 0a 6f 5d 9f f9 c8 74 ea 46 b3 4d 92 e6 0f 72 f2 4e f6 f0 50 20 2b a8 5a 48
                                                  Data Ascii: ORFv-Qt~5}M2e!vT5z4o]tFMrNP +ZHZKjD[%m4p@g:XCRcu~t<3/57e.A.<3`jP:R]BR7P'xtatn'nCasex^X@"k:L`
                                                  Jul 22, 2024 12:35:05.368694067 CEST1236INData Raw: 33 f8 e9 ba e3 97 ff 9e d9 df f1 42 49 7b 3f 33 3e 6e 9f d9 53 de 65 73 ef c9 35 4e bf f0 5b 41 43 95 76 2b 53 c8 ab 74 39 dc 5e 4c 3b b4 77 03 73 13 55 c4 86 2c f6 c6 af 64 eb 4b 9d 68 e0 b3 2a 0e 69 17 9c ed 38 31 56 48 05 d5 1d e3 f2 8e b0 7d
                                                  Data Ascii: 3BI{?3>nSes5N[ACv+St9^L;wsU,dKh*i81VH}|>s"x=b-rBl`'0]L"{+.C]vCyCYdWw(JuOpfWvTiuvLD"E#k0Y_W+hp;f}J
                                                  Jul 22, 2024 12:35:05.369303942 CEST1236INData Raw: 61 dc be 50 92 09 e4 d6 c8 15 60 52 79 48 61 d3 d8 43 21 11 a0 dc e1 35 d2 35 a6 54 9c 19 22 0a 30 b2 e1 91 a7 bc 9e 22 a6 8b d1 7e 10 15 ea 2d 11 bb 3a 56 ed a0 3c df ae a6 db 24 c4 2f 88 c2 87 b5 43 8a 1a 50 d4 08 7e 02 3e ff 5d 4d 68 e9 97 de
                                                  Data Ascii: aP`RyHaC!55T"0"~-:V<$/CP~>]MhLkQbm5-4MGM,0V6 I)nSr8i?2TUVucdgd2h{@t)am_xt6.748uX}:X
                                                  Jul 22, 2024 12:35:05.369317055 CEST1236INData Raw: f0 63 ee 70 6f 0b 89 3b 9f a1 ca cc 1e 59 7c 31 78 a2 5b f9 9b bb f0 7b 28 85 19 23 d1 5c d7 71 36 5c 97 fb 87 e6 cc 83 4f 5a 6b c8 11 01 85 88 c4 7b 3e 88 1d 24 b5 c7 12 41 a2 3b ea 10 41 1f 02 da 12 80 75 fc 65 da 5d 11 e4 cf 15 ea 56 d2 49 05
                                                  Data Ascii: cpo;Y|1x[{(#\q6\OZk{>$A;Aue]VI3j3log)|f| U!qYtq/+08i`0z]Mb;zoKIA3\nk^xuLzgD8oi&k_#$!.h/)3!75F413^
                                                  Jul 22, 2024 12:35:05.369326115 CEST160INData Raw: 27 db 0b ff fc 38 dd 8d 72 89 43 26 3a 85 8c 3c 75 4d 7a 23 19 3a 13 5f 47 6d de 62 d7 14 67 0e 08 e6 e2 ee 49 81 50 4b 01 02 3f 00 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 24 00 00 00 00 00 00 00 20 00 08 00 00 00
                                                  Data Ascii: '8rC&:<uMz#:_GmbgIPK?IX6%$ FeatureActions.txt p8PKd)&


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  90192.168.2.450075104.19.208.15280984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:35:06.635696888 CEST89OUTGET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Jul 22, 2024 12:35:07.097973108 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:35:07 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 17770
                                                  Connection: keep-alive
                                                  ETag: "770472110"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 437
                                                  Expires: Mon, 22 Jul 2024 14:35:07 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c838ff6932fa-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 [TRUNCATED]
                                                  Data Ascii: PK:=AX7\0DrActiveFeatures.txt+@sjp#K1;/-[[ABexq)7 7:^gK !ibUVsO$v7|e\W'ZdveU*oR>%w$-;Q4Tf$+T$&Q?9#"6>0o@j(*i)H"B1`=&0I8CR"ycM7g\@8xE4S|Iyy7~%W?7!JhrfdB^OQ"IDG!o+^6VY6<wNNPP2\?EY^j>i[p`L_sXq>#~nY>LO9rsAS+g5FBiqgUf{*vBUBqTpKF;/[&WIAPuS-&v3!Y'bMl{[:5sVL3om7'O4'(V#:\#VOO&<s}Yd|<P@jM%O5lHs^SYfaCDDwVcE8~cETL0YIEd@._PQ~w\fAT7Kiywq|+#]N">(A0bU-lDM#ETYa-h}ep<),
                                                  Jul 22, 2024 12:35:07.098068953 CEST1236INData Raw: c3 e9 0b b5 94 79 f6 cd ab db ef 95 d6 d1 32 bc 03 27 b0 a7 67 bb 67 5c 5f 47 4a 97 f1 f7 fc 80 a5 3d 5e cb d2 21 fd 16 4d f6 ed 94 f2 d0 41 ec b6 8d 9b cb af 44 4b 5e 3f 92 fc ae 08 db 64 a5 1d 86 78 29 a2 a9 c5 2d c1 7a 36 38 e0 81 84 1a 34 f5
                                                  Data Ascii: y2'gg\_GJ=^!MADK^?dx)-z684R|YSgynUf1qbEFO?'[a`bF\rsZL0q\vgrP:ZbPw^l^|Vov^'D0\mJh*I{X14
                                                  Jul 22, 2024 12:35:07.098081112 CEST1236INData Raw: e3 09 b7 93 e7 ef 55 87 a5 e2 4a 0e 55 3c 50 4f 28 65 ca 9a de 34 88 d5 59 ab cd 64 54 2a 94 93 b6 b8 c7 f1 34 a6 fe 9a 9e 58 e1 5b 68 04 08 88 1d 07 7a 22 8c f4 8b 1a 37 f4 2d 18 02 f7 c9 7a e3 8d 30 e6 e5 c6 72 4a b5 33 12 97 f2 9b 9f 3d 2b 49
                                                  Data Ascii: UJU<PO(e4YdT*4X[hz"7-z0rJ3=+I:QrVjeAU|0e r.-nFs%U@_G~W}E^ns]W6.Jg4)Kk~9"4{i#W}_&L'HNOp
                                                  Jul 22, 2024 12:35:07.098417997 CEST1236INData Raw: a2 40 45 ad 3e 10 cc d4 22 b8 18 aa b5 83 15 5b 5f 79 62 da f6 64 de 89 40 91 c6 e3 e6 3c 48 f6 f2 37 d0 b4 a2 87 ed 8b 72 11 f9 fa 1d 84 ca dd 63 7c e6 56 65 74 e8 c3 ce 0a 52 78 3d f5 2c 69 ad 82 46 5f 21 19 b5 ed d3 bf 7e 98 76 8d 6a 94 b7 ed
                                                  Data Ascii: @E>"[_ybd@<H7rc|VetRx=,iF_!~vj5s,yL/[g{QosVz%{A|PSeC)PYzSZ/]E?kINr|Pg!\2-;@&Lb<maS
                                                  Jul 22, 2024 12:35:07.098429918 CEST1236INData Raw: ef ec e3 a3 78 02 50 1e 6e 18 3a c8 ef 40 01 47 df 2f 67 75 81 ee e7 ed 5c 86 a7 cd ff 50 b9 61 08 00 fa a5 b9 0e 2f 50 8f 87 fd 80 44 ec bf 7d 28 a2 50 86 c4 d0 81 34 04 f9 9d 19 90 5d 6c c8 6f a3 82 62 5f 8a 77 97 ae e6 15 32 ec 5b 3c d5 d1 50
                                                  Data Ascii: xPn:@G/gu\Pa/PD}(P4]lob_w2[<Pz|<gzX],af!:$uMs)m74Tf8Q0Ee@>i~p#D'uma{4q-x.{W)x,0Fm'*wTn
                                                  Jul 22, 2024 12:35:07.098826885 CEST1236INData Raw: ea fe e8 9b 44 1e 62 80 9f 85 5d b4 ed 54 9a 62 26 5d f9 5f e9 66 31 79 1a ec 5d eb 3b 42 de 2a 12 2f 99 5a 51 ad 2c 4e fc b2 cd 25 8a df 0b d7 07 24 1e 16 60 15 f2 23 fe 84 ec 28 ca cb ea 25 a1 6f 30 22 39 cc 4f eb 80 ec b0 87 73 03 c9 e2 6f cb
                                                  Data Ascii: Db]Tb&]_f1y];B*/ZQ,N%$`#(%o0"9OsosUN^m9N)&8))QK}b9"@T~yu?V7j7y)vJ_EEW58X+:CP~T,{/s" a*=_lJ
                                                  Jul 22, 2024 12:35:07.098839045 CEST1236INData Raw: c6 ac fb 85 2b c7 a3 2f 2f d9 73 66 a6 d5 b3 dc bc 4c 89 64 2f f9 a1 b7 40 bf dd 84 b3 f4 0d 92 fa d2 49 45 fc 27 f8 14 9d 3f bd 02 3a c4 6a 3c 68 f4 ec 55 d8 20 1b ea 58 1f 15 63 0c 4e fc 76 39 e9 cc 71 40 69 5b b9 5b c5 4e 6d 50 82 e3 2b 3d 15
                                                  Data Ascii: +//sfLd/@IE'?:j<hU XcNv9q@i[[NmP+=127ZS$rHxh7[m15'1Z91 #%|^s\obPTPUO:$9pgLNTKqmc_xE]uUW\&6Ijo
                                                  Jul 22, 2024 12:35:07.098850012 CEST1236INData Raw: e7 41 3d ce 7d 33 4d 0f 6d da 2d 57 cd 6d 7c 72 20 41 5f e2 85 cb 48 2a 2c 1b 25 2d ea 0b 8c 30 58 68 ec 5b 67 54 17 0b 09 36 f0 a1 5f 55 d0 81 77 eb 76 58 90 be 59 9e ba 3f be 84 2b 42 29 6f 5c df c6 42 5f 49 8a 9f 97 26 07 55 9d da 50 6a e6 dc
                                                  Data Ascii: A=}3Mm-Wm|r A_H*,%-0Xh[gT6_UwvXY?+B)o\B_I&UPj?n,\_%N&gFx!7^"*w/:=\-?2$(<9#oPa7Z+iIU1B($k!XdI<#7s(,\~1~@SfHTn
                                                  Jul 22, 2024 12:35:07.099291086 CEST1236INData Raw: 20 19 6a 5f 78 89 c4 93 e5 38 5a 6e de 37 da e2 c6 06 b0 e8 f5 8e ec 2a 4d 52 53 7c c0 ce f1 b1 9d 84 d3 91 ba fc 29 13 39 6d 22 59 ca f4 90 ba 24 c3 b5 86 27 17 f3 8a b2 8c 0f d9 b9 6d 97 6d 9b 96 f5 eb e7 ae 0b 71 31 03 84 41 72 7d a7 8d f4 99
                                                  Data Ascii: j_x8Zn7*MRS|)9m"Y$'mmq1Ar}sWC@T^n2I%j+r|kpjq%<OjYSO)o+`qK18oLXG#F?sTds%>qWY2qf[n XR`
                                                  Jul 22, 2024 12:35:07.099303961 CEST1236INData Raw: d1 d2 9b 08 03 2c 5a d5 0d b5 24 ba 57 06 e9 82 13 06 b8 76 cd 11 85 df 30 60 c7 4a 68 fc 62 33 d3 a3 33 4a 36 3d a8 67 bb a3 56 33 7d 3d 9a 83 2c 2e ab 79 ba 0d fb 01 11 b8 6d 84 ce cd 88 2e 7d f5 4f 3e 3e d1 e4 3c 13 83 fa 27 77 82 c7 e2 d9 4b
                                                  Data Ascii: ,Z$Wv0`Jhb33J6=gV3}=,.ym.}O>><'wK\U}&El?<tl%}v%HSA*gH(vqd00Dan~Jlax_K9#+Rfl?uhLO{.FLRS
                                                  Jul 22, 2024 12:35:07.103127003 CEST1236INData Raw: 12 42 b8 dd e5 1f 9e 6b 33 d0 27 64 66 67 09 75 13 4e 4f e9 2f 56 c0 a1 26 a6 e7 0f 48 59 99 5e 9a 7b ee 13 0a e1 b2 7e 95 bf 06 41 45 43 c3 c5 43 45 37 b4 fd 4d f1 ee 9a 9c 98 53 15 42 01 8c fa ef a5 44 d0 97 33 99 81 2a 36 6b 2c 46 c1 0c 71 2f
                                                  Data Ascii: Bk3'dfguNO/V&HY^{~AECCE7MSBD3*6k,Fq/D:-E|OylOR-BS)2,o(P.Ibk@1F] 9X&;/<MZ5 `CLg`h*EH=|EZpoC/j{1,u;


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  91192.168.2.450080104.19.208.15280984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:35:07.357029915 CEST105OUTGET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Jul 22, 2024 12:35:07.826618910 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:35:07 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 9891
                                                  Connection: keep-alive
                                                  ETag: "3914547665"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 134
                                                  Expires: Mon, 22 Jul 2024 14:35:07 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c83d88f442d0-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d [TRUNCATED]
                                                  Data Ascii: PKIX6%FeatureActions.txtBPZ&KE9(0p<a}9g<D)9k@4y'!=~Zk`1J2[)_,{FF?q;fL*=1ZI->m%>`ml,sWITPu*;Pxxhgl$M]I}ogZL5?BZLxukU1P4mW-Ntf?I-/!w90/^%X-.0(mVPn]=cr_A$<BWye2bK{jOdxZv@[NLDU|_1Sp~Paq>})$qH7,hm)Ias<TWu$?Ey@Xu@5*UJLja0v^Q (O}k+fwvfzbhFE<plLWZI*.4#,X`=beVW)W*;Q,'x>Jq _T<ea&wo/RM2`rXFEc:A97A4FT0@wuJIBd5Bhw}oE@N=Z$)6@sXru%eIg5ruA:81&"e_'Be
                                                  Jul 22, 2024 12:35:07.826739073 CEST1236INData Raw: aa 27 91 1f 4b c3 11 60 77 a1 43 f9 f7 10 07 63 36 80 1a 86 ad 48 a7 d3 8f 6f 01 ae 9e 9c 3f a2 79 6e 3b 81 f2 7e 33 72 dc 17 7b 3c b2 f2 80 9b 26 a0 a9 76 69 9d e2 6e 9e 4d 47 96 36 9b c5 b5 27 68 b5 b4 84 34 1c 56 23 a3 50 e1 9f 24 02 89 9a 6e
                                                  Data Ascii: 'K`wCc6Ho?yn;~3r{<&vinMG6'h4V#P$n/Kt'<4oOa"xGTVBfE<eG#Bw{#@mc]os}uE6@e`^](9A,NjbNYnOF\8p"CLFk
                                                  Jul 22, 2024 12:35:07.826829910 CEST1236INData Raw: fd ac 50 d8 52 44 ee 8b 8f d4 d8 b2 84 d1 cb d6 f7 f8 05 a5 aa 41 48 05 36 3c 93 56 87 e3 e6 2f 47 40 72 47 91 28 bd 1e de c7 43 06 15 aa c9 07 7f 4b 86 10 6b 1f 41 44 6f 91 db 30 a2 f9 46 11 1a 4b 58 16 a1 31 d1 5e b4 59 ca fc 47 fc bc 25 05 70
                                                  Data Ascii: PRDAH6<V/G@rG(CKkADo0FKX1^YG%p8P*rH|idu{"PBv`DWG&O*rD:V4#{>51Zy4U-&SSIgFkZpYN~L-6Fed~ex>3
                                                  Jul 22, 2024 12:35:07.826842070 CEST1236INData Raw: 88 a8 b4 43 f7 18 27 39 99 b5 09 5b b0 21 e4 89 cd dc d8 80 8f ba 2c 76 5f 49 78 e0 a0 e6 a4 e8 61 8a 0a 7d 07 ae 7f 5b db 69 5b ab 4d 22 92 db 0e dc 5e ef db 36 83 5e 63 58 81 45 75 40 0c 8a 74 59 c3 e4 31 78 2a c9 f9 39 82 db c7 d7 e1 67 09 f5
                                                  Data Ascii: C'9[!,v_Ixa}[i[M"^6^cXEu@tY1x*9g&LIY+5kR@v<a.{G`#|<rPgAn><AhcF1NG_d~JFS}=l-z%Q\)Zm?)^afu
                                                  Jul 22, 2024 12:35:07.827184916 CEST1236INData Raw: 51 a2 95 4e ba 4b 5c 16 c5 a5 51 be 5a 39 45 dd 17 61 63 b5 65 bb 34 9f 6d 7c 76 0b e7 cf 8a 28 b1 32 a3 4c 94 f3 9c 2d 3a d8 05 c3 70 d8 b9 9e ea 5e e2 8b aa 76 16 1e 66 9d 5b 09 8d b4 bd 0c df a4 f1 57 38 11 41 42 5a 8f 27 30 7a 45 dd 2c af 7e
                                                  Data Ascii: QNK\QZ9Eace4m|v(2L-:p^vf[W8ABZ'0zE,~iY~^UiH-E`79_ue_f!t,f-X9^y0jgsotF8rUFX3\"T5p3WJBORFv
                                                  Jul 22, 2024 12:35:07.827197075 CEST1236INData Raw: ad 53 b8 3f 1e d4 8d 8b fb 22 dd 51 13 da db 37 c1 6d 8a c5 7d 9b 47 42 3f 8e c9 f0 52 59 f2 14 2a 9e 75 2e 6a 2e 7b 93 ce 8d 7f 03 7e d5 5c fc 25 45 10 44 72 a8 87 1c d2 e8 6e 79 f4 3a 12 2f 87 97 f4 7d 88 08 2a 70 f8 25 43 fc 4b 2d f3 25 a3 5d
                                                  Data Ascii: S?"Q7m}GB?RY*u.j.{~\%EDrny:/}*p%CK-%]F?TSkSG-^Bgv[1K+k9v&plE0P8t}BnUJXhBDBlfbG7Fsq3BI{?3>n
                                                  Jul 22, 2024 12:35:07.827207088 CEST1236INData Raw: 98 44 c0 9d 35 87 31 5c f2 45 f9 c7 ef 27 c4 f0 44 cb 1d 0f 1c d1 37 2a fd 7f 20 4f 38 65 99 02 a1 9a ea fd 15 94 74 5c 15 e4 8a 30 a5 11 66 30 df 52 31 9c c6 28 24 8c 3e 6f 18 50 ce cd 5b 40 65 9a 59 06 f5 bf 1e 38 1f 30 99 1f 31 4f 2a 69 da 0b
                                                  Data Ascii: D51\E'D7* O8et\0f0R1($>oP[@eY801O*iT2@#l0*z<F4a/dUF5iAzDScUSK:;{qQ.29h}w$/SZ24d2%h@"IT*w;W<-f.7p=ei ^C\aP`RyHaC!
                                                  Jul 22, 2024 12:35:07.827219009 CEST1236INData Raw: 39 ba ca 62 79 64 b1 96 fc a3 e4 33 18 bf f2 b3 53 33 28 3d 94 63 da fc df 9a ab 61 96 4f fd 8f 75 23 dd b5 d3 bd b5 31 ab e5 e1 6d de 8b 88 11 1d 05 ed 75 9d 2f 58 00 23 9c b7 5e 9c be d2 46 a0 2b 67 71 a6 f8 75 c0 5f 80 c9 c6 7f 3b c9 9d 1b 53
                                                  Data Ascii: 9byd3S3(=caOu#1mu/X#^F+gqu_;Sv_HO=[Ipy`9|;!&uEv@~q+"`T].@ON/,V]Bn`;LGQNL0j*\x8j8cpo;Y|1x[
                                                  Jul 22, 2024 12:35:07.827677011 CEST384INData Raw: e7 b8 35 15 54 a9 22 01 ba 8d 73 41 22 2d 5f 1c e5 c1 6a 64 1c 3a 02 da 84 ef c5 74 bd 9f 23 d9 32 44 34 28 27 d7 07 95 69 6b 95 3f 18 37 32 d0 a9 81 eb a5 e0 47 f9 bd 0e ce d3 e3 4e d2 40 77 fe 00 a1 df bb a6 9f 2e ba ee eb a2 f0 8c 0d bc fe f1
                                                  Data Ascii: 5T"sA"-_jd:t#2D4('ik?72GN@w.o[C4PcJ3 [mrE&r8U,%,uzs(q7r%Hr1]>D!M#C7xJW/5oZ~Wr4gB6SE^C8LT_4'8rC&:<uMz


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  92192.168.2.450083104.19.208.15280984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:35:08.003588915 CEST89OUTGET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Jul 22, 2024 12:35:08.464265108 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:35:08 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 17770
                                                  Connection: keep-alive
                                                  ETag: "770472110"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 438
                                                  Expires: Mon, 22 Jul 2024 14:35:08 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c8418e715e78-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 [TRUNCATED]
                                                  Data Ascii: PK:=AX7\0DrActiveFeatures.txt+@sjp#K1;/-[[ABexq)7 7:^gK !ibUVsO$v7|e\W'ZdveU*oR>%w$-;Q4Tf$+T$&Q?9#"6>0o@j(*i)H"B1`=&0I8CR"ycM7g\@8xE4S|Iyy7~%W?7!JhrfdB^OQ"IDG!o+^6VY6<wNNPP2\?EY^j>i[p`L_sXq>#~nY>LO9rsAS+g5FBiqgUf{*vBUBqTpKF;/[&WIAPuS-&v3!Y'bMl{[:5sVL3om7'O4'(V#:\#VOO&<s}Yd|<P@jM%O5lHs^SYfaCDDwVcE8~cETL0YIEd@._PQ~w\fAT7Kiywq|+#]N">(A0bU-lDM#ETYa-h}ep<),
                                                  Jul 22, 2024 12:35:08.464324951 CEST1236INData Raw: c3 e9 0b b5 94 79 f6 cd ab db ef 95 d6 d1 32 bc 03 27 b0 a7 67 bb 67 5c 5f 47 4a 97 f1 f7 fc 80 a5 3d 5e cb d2 21 fd 16 4d f6 ed 94 f2 d0 41 ec b6 8d 9b cb af 44 4b 5e 3f 92 fc ae 08 db 64 a5 1d 86 78 29 a2 a9 c5 2d c1 7a 36 38 e0 81 84 1a 34 f5
                                                  Data Ascii: y2'gg\_GJ=^!MADK^?dx)-z684R|YSgynUf1qbEFO?'[a`bF\rsZL0q\vgrP:ZbPw^l^|Vov^'D0\mJh*I{X14
                                                  Jul 22, 2024 12:35:08.464337111 CEST448INData Raw: e3 09 b7 93 e7 ef 55 87 a5 e2 4a 0e 55 3c 50 4f 28 65 ca 9a de 34 88 d5 59 ab cd 64 54 2a 94 93 b6 b8 c7 f1 34 a6 fe 9a 9e 58 e1 5b 68 04 08 88 1d 07 7a 22 8c f4 8b 1a 37 f4 2d 18 02 f7 c9 7a e3 8d 30 e6 e5 c6 72 4a b5 33 12 97 f2 9b 9f 3d 2b 49
                                                  Data Ascii: UJU<PO(e4YdT*4X[hz"7-z0rJ3=+I:QrVjeAU|0e r.-nFs%U@_G~W}E^ns]W6.Jg4)Kk~9"4{i#W}_&L'HNOp
                                                  Jul 22, 2024 12:35:08.464562893 CEST1236INData Raw: c5 77 46 38 ef fa 01 cd 9b ea 71 97 9b 3b 18 32 16 9a 2e 50 1c 4c 1d 5b 1d 8d 18 bf 63 ed 90 f2 14 fb 9e 5c fc 96 c0 bd 03 46 78 99 99 29 13 42 50 a5 ca cf 1a f7 72 13 d7 60 42 a4 f0 f7 80 f0 d3 51 71 55 1a 83 2d 94 b6 34 c8 8e 41 1b cd 5b ce f4
                                                  Data Ascii: wF8q;2.PL[c\Fx)BPr`BQqU-4A[.M|@up*_}L7[Re='\'e@(<MI@q`g$^cnGW`?5jn|SjbRyS=<.9SVE@`oso&o%sPD;z'uE) dU1
                                                  Jul 22, 2024 12:35:08.464575052 CEST1236INData Raw: 70 c3 3a c0 db df 28 89 db 04 36 a6 c7 a6 e5 ef a7 02 b0 40 49 26 cd e0 bc be 3a cc a3 bd 08 b3 12 21 14 30 84 2f 8c 18 41 ed 95 5f 59 d4 3c 34 7c 0b af 36 20 a8 4a 98 b8 d8 e9 4e 93 10 b8 82 70 d8 7b 8a 33 aa ea 62 b9 81 f5 c3 cd e1 b3 0c 6f 42
                                                  Data Ascii: p:(6@I&:!0/A_Y<4|6 JNp{3boB8wkcKeW^N6y%L-xg\B'BY_ Er<rJ>xEu^akk9OiCpm(Z0;8S:,0#3G*S0WDqQ_@//X6_&+
                                                  Jul 22, 2024 12:35:08.464586020 CEST1236INData Raw: 85 0d c7 4f ef 1a 73 f2 8a cc 9b 1e 62 ee 85 89 82 82 ee 8f cc 34 01 13 1b 8b 82 13 09 56 bf ef ea 28 7c 71 3e 6e a9 3a 6f 08 b8 db bd 20 a5 0d 2f 6f 6a 36 15 85 03 4c f0 a7 47 e9 c7 81 d1 54 69 10 9c a6 76 ad a0 a4 40 7c 6c f1 e9 16 f6 52 37 28
                                                  Data Ascii: Osb4V(|q>n:o /oj6LGTiv@|lR7(>N(th19t.vcjEqlZ"Q=4c9Qi#DrJQhH=5w0jC&k)d@smPg0%?U jQL%~
                                                  Jul 22, 2024 12:35:08.464596987 CEST1236INData Raw: a2 87 6e df 0b 56 1a e6 94 9a 00 1c 13 d4 5e ba 81 49 63 cd ca 6d da ba 0e 29 fd 5b c4 f4 52 a5 78 d3 76 1e 43 c5 7f 49 f4 2d f3 56 36 85 02 fb 37 29 0e ce 7b 44 3b a4 24 2d 7f a2 bf 5b 10 7b fd 49 b6 73 0b cf 33 3a ba d0 a3 b1 c0 d8 b0 8a ce 66
                                                  Data Ascii: nV^Icm)[RxvCI-V67){D;$-[{Is3:f72/l$L#Dg4Vjg^e4%?b2:$=;Hs?JG%Ll"{mMVxI:bx<)@2kbN:5f2B.@L_"Bg
                                                  Jul 22, 2024 12:35:08.465127945 CEST1236INData Raw: 18 63 9a de 70 1f af eb cb 2f b1 86 5d b9 28 ac 06 79 01 94 af 84 58 80 7c ab d8 8e ff f1 72 c2 7a 37 bb 00 32 a6 f0 55 44 7b c0 2e 63 50 92 c7 10 24 fc 30 82 64 ce bd 29 63 0d d5 34 e7 1b 14 5f 14 22 74 2f f1 6b 64 0c ac 07 19 b6 8b f0 ac bc ea
                                                  Data Ascii: cp/](yX|rz72UD{.cP$0d)c4_"t/kdQ_c=jeN.TDp%<n@Em7k@Y_6EqhbMWsf"&8ZUlS:=}H`tApb#Ey_tI%,Qpi750GukrDe{
                                                  Jul 22, 2024 12:35:08.465140104 CEST1236INData Raw: d7 f0 7e e6 72 ef 9d 68 a9 74 9b bf ea 15 17 70 cf 36 37 2c 12 83 cf 60 53 c0 69 f2 8a 78 79 79 12 f6 3f 7f 86 ef 13 f6 f9 ad c3 47 a4 5f 17 2a 64 1a 16 5a be c7 e9 7f 41 c0 97 85 21 44 94 55 4c 18 af 11 94 ca 2a ea bd a9 26 97 ab bb b3 bb 7d 82
                                                  Data Ascii: ~rhtp67,`Sixyy?G_*dZA!DUL*&}:d&MQ3 iM5fny{b3FVmBzl;q-qk!bE?]QneV`7gwX"ln^bCp">GM&=zv>Vl
                                                  Jul 22, 2024 12:35:08.465151072 CEST1236INData Raw: fa 42 7b f0 87 4d e8 7d 64 37 a6 fe 2b a5 21 1c 89 62 12 fd b9 c7 a0 bd 80 e8 4c c2 f1 e3 10 0d 39 5a b5 61 e0 d5 e7 73 e3 b2 93 5e 20 04 9c 53 45 7d fb 69 16 c5 1f 98 e9 f5 ba 30 13 e7 f5 95 00 c3 79 c8 2c c9 af 6d 41 31 86 55 c5 06 ea b7 6c 6c
                                                  Data Ascii: B{M}d7+!bL9Zas^ SE}i0y,mA1Ull#&HwD(b`CZWLFywt?]%"D2#)FA~_svmRZY4u|9?@T7A.DRTN_P4#'fhRMi`b{_=V&
                                                  Jul 22, 2024 12:35:08.469232082 CEST1236INData Raw: 4a 42 3c 7c ee a9 89 3d 6a 88 1c dd f9 5e 6f c4 c5 fd fc 73 fa 8c 47 18 7d 4b 55 1f ca e9 e9 5d 7a d3 60 36 e8 e5 35 c1 7b d2 87 8a 58 b5 41 7f c4 6f bd a4 24 0f d2 70 17 03 10 fc 94 b1 e5 2c f6 d0 87 0c 38 e5 81 c1 3b 8e d8 82 dc 46 34 40 3c 55
                                                  Data Ascii: JB<|=j^osG}KU]z`65{XAo$p,8;F4@<U3u&\-7o|91JHthzE2/.Ru:c+p{B;XIjl.ahAV!Xxgq6*;\MIo)E6BdG+;NOu


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  93192.168.2.450090104.19.208.15280940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:35:10.384136915 CEST105OUTGET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Jul 22, 2024 12:35:10.779041052 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:35:10 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 9891
                                                  Connection: keep-alive
                                                  ETag: "3914547665"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 137
                                                  Expires: Mon, 22 Jul 2024 14:35:10 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c84ffe6072aa-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d [TRUNCATED]
                                                  Data Ascii: PKIX6%FeatureActions.txtBPZ&KE9(0p<a}9g<D)9k@4y'!=~Zk`1J2[)_,{FF?q;fL*=1ZI->m%>`ml,sWITPu*;Pxxhgl$M]I}ogZL5?BZLxukU1P4mW-Ntf?I-/!w90/^%X-.0(mVPn]=cr_A$<BWye2bK{jOdxZv@[NLDU|_1Sp~Paq>})$qH7,hm)Ias<TWu$?Ey@Xu@5*UJLja0v^Q (O}k+fwvfzbhFE<plLWZI*.4#,X`=beVW)W*;Q,'x>Jq _T<ea&wo/RM2`rXFEc:A97A4FT0@wuJIBd5Bhw}oE@N=Z$)6@sXru%eIg5ruA:81&"e_'Be
                                                  Jul 22, 2024 12:35:10.779081106 CEST1236INData Raw: aa 27 91 1f 4b c3 11 60 77 a1 43 f9 f7 10 07 63 36 80 1a 86 ad 48 a7 d3 8f 6f 01 ae 9e 9c 3f a2 79 6e 3b 81 f2 7e 33 72 dc 17 7b 3c b2 f2 80 9b 26 a0 a9 76 69 9d e2 6e 9e 4d 47 96 36 9b c5 b5 27 68 b5 b4 84 34 1c 56 23 a3 50 e1 9f 24 02 89 9a 6e
                                                  Data Ascii: 'K`wCc6Ho?yn;~3r{<&vinMG6'h4V#P$n/Kt'<4oOa"xGTVBfE<eG#Bw{#@mc]os}uE6@e`^](9A,NjbNYnOF\8p"CLFk
                                                  Jul 22, 2024 12:35:10.779092073 CEST1236INData Raw: fd ac 50 d8 52 44 ee 8b 8f d4 d8 b2 84 d1 cb d6 f7 f8 05 a5 aa 41 48 05 36 3c 93 56 87 e3 e6 2f 47 40 72 47 91 28 bd 1e de c7 43 06 15 aa c9 07 7f 4b 86 10 6b 1f 41 44 6f 91 db 30 a2 f9 46 11 1a 4b 58 16 a1 31 d1 5e b4 59 ca fc 47 fc bc 25 05 70
                                                  Data Ascii: PRDAH6<V/G@rG(CKkADo0FKX1^YG%p8P*rH|idu{"PBv`DWG&O*rD:V4#{>51Zy4U-&SSIgFkZpYN~L-6Fed~ex>3
                                                  Jul 22, 2024 12:35:10.779392958 CEST1236INData Raw: 88 a8 b4 43 f7 18 27 39 99 b5 09 5b b0 21 e4 89 cd dc d8 80 8f ba 2c 76 5f 49 78 e0 a0 e6 a4 e8 61 8a 0a 7d 07 ae 7f 5b db 69 5b ab 4d 22 92 db 0e dc 5e ef db 36 83 5e 63 58 81 45 75 40 0c 8a 74 59 c3 e4 31 78 2a c9 f9 39 82 db c7 d7 e1 67 09 f5
                                                  Data Ascii: C'9[!,v_Ixa}[i[M"^6^cXEu@tY1x*9g&LIY+5kR@v<a.{G`#|<rPgAn><AhcF1NG_d~JFS}=l-z%Q\)Zm?)^afu
                                                  Jul 22, 2024 12:35:10.779403925 CEST1236INData Raw: 51 a2 95 4e ba 4b 5c 16 c5 a5 51 be 5a 39 45 dd 17 61 63 b5 65 bb 34 9f 6d 7c 76 0b e7 cf 8a 28 b1 32 a3 4c 94 f3 9c 2d 3a d8 05 c3 70 d8 b9 9e ea 5e e2 8b aa 76 16 1e 66 9d 5b 09 8d b4 bd 0c df a4 f1 57 38 11 41 42 5a 8f 27 30 7a 45 dd 2c af 7e
                                                  Data Ascii: QNK\QZ9Eace4m|v(2L-:p^vf[W8ABZ'0zE,~iY~^UiH-E`79_ue_f!t,f-X9^y0jgsotF8rUFX3\"T5p3WJBORFv
                                                  Jul 22, 2024 12:35:10.779409885 CEST1236INData Raw: ad 53 b8 3f 1e d4 8d 8b fb 22 dd 51 13 da db 37 c1 6d 8a c5 7d 9b 47 42 3f 8e c9 f0 52 59 f2 14 2a 9e 75 2e 6a 2e 7b 93 ce 8d 7f 03 7e d5 5c fc 25 45 10 44 72 a8 87 1c d2 e8 6e 79 f4 3a 12 2f 87 97 f4 7d 88 08 2a 70 f8 25 43 fc 4b 2d f3 25 a3 5d
                                                  Data Ascii: S?"Q7m}GB?RY*u.j.{~\%EDrny:/}*p%CK-%]F?TSkSG-^Bgv[1K+k9v&plE0P8t}BnUJXhBDBlfbG7Fsq3BI{?3>n
                                                  Jul 22, 2024 12:35:10.779685020 CEST1236INData Raw: 98 44 c0 9d 35 87 31 5c f2 45 f9 c7 ef 27 c4 f0 44 cb 1d 0f 1c d1 37 2a fd 7f 20 4f 38 65 99 02 a1 9a ea fd 15 94 74 5c 15 e4 8a 30 a5 11 66 30 df 52 31 9c c6 28 24 8c 3e 6f 18 50 ce cd 5b 40 65 9a 59 06 f5 bf 1e 38 1f 30 99 1f 31 4f 2a 69 da 0b
                                                  Data Ascii: D51\E'D7* O8et\0f0R1($>oP[@eY801O*iT2@#l0*z<F4a/dUF5iAzDScUSK:;{qQ.29h}w$/SZ24d2%h@"IT*w;W<-f.7p=ei ^C\aP`RyHaC!
                                                  Jul 22, 2024 12:35:10.779696941 CEST1236INData Raw: 39 ba ca 62 79 64 b1 96 fc a3 e4 33 18 bf f2 b3 53 33 28 3d 94 63 da fc df 9a ab 61 96 4f fd 8f 75 23 dd b5 d3 bd b5 31 ab e5 e1 6d de 8b 88 11 1d 05 ed 75 9d 2f 58 00 23 9c b7 5e 9c be d2 46 a0 2b 67 71 a6 f8 75 c0 5f 80 c9 c6 7f 3b c9 9d 1b 53
                                                  Data Ascii: 9byd3S3(=caOu#1mu/X#^F+gqu_;Sv_HO=[Ipy`9|;!&uEv@~q+"`T].@ON/,V]Bn`;LGQNL0j*\x8j8cpo;Y|1x[
                                                  Jul 22, 2024 12:35:10.779709101 CEST384INData Raw: e7 b8 35 15 54 a9 22 01 ba 8d 73 41 22 2d 5f 1c e5 c1 6a 64 1c 3a 02 da 84 ef c5 74 bd 9f 23 d9 32 44 34 28 27 d7 07 95 69 6b 95 3f 18 37 32 d0 a9 81 eb a5 e0 47 f9 bd 0e ce d3 e3 4e d2 40 77 fe 00 a1 df bb a6 9f 2e ba ee eb a2 f0 8c 0d bc fe f1
                                                  Data Ascii: 5T"sA"-_jd:t#2D4('ik?72GN@w.o[C4PcJ3 [mrE&r8U,%,uzs(q7r%Hr1]>D!M#C7xJW/5oZ~Wr4gB6SE^C8LT_4'8rC&:<uMz


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  94192.168.2.450116104.19.208.15280984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:35:15.239226103 CEST105OUTGET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Jul 22, 2024 12:35:15.716217995 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:35:15 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 9891
                                                  Connection: keep-alive
                                                  ETag: "3914547665"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 142
                                                  Expires: Mon, 22 Jul 2024 14:35:15 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c86ec9427ca2-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d [TRUNCATED]
                                                  Data Ascii: PKIX6%FeatureActions.txtBPZ&KE9(0p<a}9g<D)9k@4y'!=~Zk`1J2[)_,{FF?q;fL*=1ZI->m%>`ml,sWITPu*;Pxxhgl$M]I}ogZL5?BZLxukU1P4mW-Ntf?I-/!w90/^%X-.0(mVPn]=cr_A$<BWye2bK{jOdxZv@[NLDU|_1Sp~Paq>})$qH7,hm)Ias<TWu$?Ey@Xu@5*UJLja0v^Q (O}k+fwvfzbhFE<plLWZI*.4#,X`=beVW)W*;Q,'x>Jq _T<ea&wo/RM2`rXFEc:A97A4FT0@wuJIBd5Bhw}oE@N=Z$)6@sXru%eIg5ruA:81&"e_'Be
                                                  Jul 22, 2024 12:35:15.716262102 CEST1236INData Raw: aa 27 91 1f 4b c3 11 60 77 a1 43 f9 f7 10 07 63 36 80 1a 86 ad 48 a7 d3 8f 6f 01 ae 9e 9c 3f a2 79 6e 3b 81 f2 7e 33 72 dc 17 7b 3c b2 f2 80 9b 26 a0 a9 76 69 9d e2 6e 9e 4d 47 96 36 9b c5 b5 27 68 b5 b4 84 34 1c 56 23 a3 50 e1 9f 24 02 89 9a 6e
                                                  Data Ascii: 'K`wCc6Ho?yn;~3r{<&vinMG6'h4V#P$n/Kt'<4oOa"xGTVBfE<eG#Bw{#@mc]os}uE6@e`^](9A,NjbNYnOF\8p"CLFk
                                                  Jul 22, 2024 12:35:15.716279030 CEST1236INData Raw: fd ac 50 d8 52 44 ee 8b 8f d4 d8 b2 84 d1 cb d6 f7 f8 05 a5 aa 41 48 05 36 3c 93 56 87 e3 e6 2f 47 40 72 47 91 28 bd 1e de c7 43 06 15 aa c9 07 7f 4b 86 10 6b 1f 41 44 6f 91 db 30 a2 f9 46 11 1a 4b 58 16 a1 31 d1 5e b4 59 ca fc 47 fc bc 25 05 70
                                                  Data Ascii: PRDAH6<V/G@rG(CKkADo0FKX1^YG%p8P*rH|idu{"PBv`DWG&O*rD:V4#{>51Zy4U-&SSIgFkZpYN~L-6Fed~ex>3
                                                  Jul 22, 2024 12:35:15.716527939 CEST1236INData Raw: 88 a8 b4 43 f7 18 27 39 99 b5 09 5b b0 21 e4 89 cd dc d8 80 8f ba 2c 76 5f 49 78 e0 a0 e6 a4 e8 61 8a 0a 7d 07 ae 7f 5b db 69 5b ab 4d 22 92 db 0e dc 5e ef db 36 83 5e 63 58 81 45 75 40 0c 8a 74 59 c3 e4 31 78 2a c9 f9 39 82 db c7 d7 e1 67 09 f5
                                                  Data Ascii: C'9[!,v_Ixa}[i[M"^6^cXEu@tY1x*9g&LIY+5kR@v<a.{G`#|<rPgAn><AhcF1NG_d~JFS}=l-z%Q\)Zm?)^afu
                                                  Jul 22, 2024 12:35:15.716541052 CEST1236INData Raw: 51 a2 95 4e ba 4b 5c 16 c5 a5 51 be 5a 39 45 dd 17 61 63 b5 65 bb 34 9f 6d 7c 76 0b e7 cf 8a 28 b1 32 a3 4c 94 f3 9c 2d 3a d8 05 c3 70 d8 b9 9e ea 5e e2 8b aa 76 16 1e 66 9d 5b 09 8d b4 bd 0c df a4 f1 57 38 11 41 42 5a 8f 27 30 7a 45 dd 2c af 7e
                                                  Data Ascii: QNK\QZ9Eace4m|v(2L-:p^vf[W8ABZ'0zE,~iY~^UiH-E`79_ue_f!t,f-X9^y0jgsotF8rUFX3\"T5p3WJBORFv
                                                  Jul 22, 2024 12:35:15.716552973 CEST1236INData Raw: ad 53 b8 3f 1e d4 8d 8b fb 22 dd 51 13 da db 37 c1 6d 8a c5 7d 9b 47 42 3f 8e c9 f0 52 59 f2 14 2a 9e 75 2e 6a 2e 7b 93 ce 8d 7f 03 7e d5 5c fc 25 45 10 44 72 a8 87 1c d2 e8 6e 79 f4 3a 12 2f 87 97 f4 7d 88 08 2a 70 f8 25 43 fc 4b 2d f3 25 a3 5d
                                                  Data Ascii: S?"Q7m}GB?RY*u.j.{~\%EDrny:/}*p%CK-%]F?TSkSG-^Bgv[1K+k9v&plE0P8t}BnUJXhBDBlfbG7Fsq3BI{?3>n
                                                  Jul 22, 2024 12:35:15.716845036 CEST1236INData Raw: 98 44 c0 9d 35 87 31 5c f2 45 f9 c7 ef 27 c4 f0 44 cb 1d 0f 1c d1 37 2a fd 7f 20 4f 38 65 99 02 a1 9a ea fd 15 94 74 5c 15 e4 8a 30 a5 11 66 30 df 52 31 9c c6 28 24 8c 3e 6f 18 50 ce cd 5b 40 65 9a 59 06 f5 bf 1e 38 1f 30 99 1f 31 4f 2a 69 da 0b
                                                  Data Ascii: D51\E'D7* O8et\0f0R1($>oP[@eY801O*iT2@#l0*z<F4a/dUF5iAzDScUSK:;{qQ.29h}w$/SZ24d2%h@"IT*w;W<-f.7p=ei ^C\aP`RyHaC!
                                                  Jul 22, 2024 12:35:15.716861963 CEST1236INData Raw: 39 ba ca 62 79 64 b1 96 fc a3 e4 33 18 bf f2 b3 53 33 28 3d 94 63 da fc df 9a ab 61 96 4f fd 8f 75 23 dd b5 d3 bd b5 31 ab e5 e1 6d de 8b 88 11 1d 05 ed 75 9d 2f 58 00 23 9c b7 5e 9c be d2 46 a0 2b 67 71 a6 f8 75 c0 5f 80 c9 c6 7f 3b c9 9d 1b 53
                                                  Data Ascii: 9byd3S3(=caOu#1mu/X#^F+gqu_;Sv_HO=[Ipy`9|;!&uEv@~q+"`T].@ON/,V]Bn`;LGQNL0j*\x8j8cpo;Y|1x[
                                                  Jul 22, 2024 12:35:15.716877937 CEST384INData Raw: e7 b8 35 15 54 a9 22 01 ba 8d 73 41 22 2d 5f 1c e5 c1 6a 64 1c 3a 02 da 84 ef c5 74 bd 9f 23 d9 32 44 34 28 27 d7 07 95 69 6b 95 3f 18 37 32 d0 a9 81 eb a5 e0 47 f9 bd 0e ce d3 e3 4e d2 40 77 fe 00 a1 df bb a6 9f 2e ba ee eb a2 f0 8c 0d bc fe f1
                                                  Data Ascii: 5T"sA"-_jd:t#2D4('ik?72GN@w.o[C4PcJ3 [mrE&r8U,%,uzs(q7r%Hr1]>D!M#C7xJW/5oZ~Wr4gB6SE^C8LT_4'8rC&:<uMz


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  95192.168.2.450114104.19.208.15280984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:35:15.320835114 CEST89OUTGET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Jul 22, 2024 12:35:15.523359060 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:35:15 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 17770
                                                  Connection: keep-alive
                                                  ETag: "770472110"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 445
                                                  Expires: Mon, 22 Jul 2024 14:35:15 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c86d9ace7283-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 [TRUNCATED]
                                                  Data Ascii: PK:=AX7\0DrActiveFeatures.txt+@sjp#K1;/-[[ABexq)7 7:^gK !ibUVsO$v7|e\W'ZdveU*oR>%w$-;Q4Tf$+T$&Q?9#"6>0o@j(*i)H"B1`=&0I8CR"ycM7g\@8xE4S|Iyy7~%W?7!JhrfdB^OQ"IDG!o+^6VY6<wNNPP2\?EY^j>i[p`L_sXq>#~nY>LO9rsAS+g5FBiqgUf{*vBUBqTpKF;/[&WIAPuS-&v3!Y'bMl{[:5sVL3om7'O4'(V#:\#VOO&<s}Yd|<P@jM%O5lHs^SYfaCDDwVcE8~cETL0YIEd@._PQ~w\fAT7Kiywq|+#]N">(A0bU-lDM#ETYa-h}ep<),
                                                  Jul 22, 2024 12:35:15.523410082 CEST1236INData Raw: c3 e9 0b b5 94 79 f6 cd ab db ef 95 d6 d1 32 bc 03 27 b0 a7 67 bb 67 5c 5f 47 4a 97 f1 f7 fc 80 a5 3d 5e cb d2 21 fd 16 4d f6 ed 94 f2 d0 41 ec b6 8d 9b cb af 44 4b 5e 3f 92 fc ae 08 db 64 a5 1d 86 78 29 a2 a9 c5 2d c1 7a 36 38 e0 81 84 1a 34 f5
                                                  Data Ascii: y2'gg\_GJ=^!MADK^?dx)-z684R|YSgynUf1qbEFO?'[a`bF\rsZL0q\vgrP:ZbPw^l^|Vov^'D0\mJh*I{X14
                                                  Jul 22, 2024 12:35:15.523427963 CEST1236INData Raw: e3 09 b7 93 e7 ef 55 87 a5 e2 4a 0e 55 3c 50 4f 28 65 ca 9a de 34 88 d5 59 ab cd 64 54 2a 94 93 b6 b8 c7 f1 34 a6 fe 9a 9e 58 e1 5b 68 04 08 88 1d 07 7a 22 8c f4 8b 1a 37 f4 2d 18 02 f7 c9 7a e3 8d 30 e6 e5 c6 72 4a b5 33 12 97 f2 9b 9f 3d 2b 49
                                                  Data Ascii: UJU<PO(e4YdT*4X[hz"7-z0rJ3=+I:QrVjeAU|0e r.-nFs%U@_G~W}E^ns]W6.Jg4)Kk~9"4{i#W}_&L'HNOp
                                                  Jul 22, 2024 12:35:15.523629904 CEST1236INData Raw: a2 40 45 ad 3e 10 cc d4 22 b8 18 aa b5 83 15 5b 5f 79 62 da f6 64 de 89 40 91 c6 e3 e6 3c 48 f6 f2 37 d0 b4 a2 87 ed 8b 72 11 f9 fa 1d 84 ca dd 63 7c e6 56 65 74 e8 c3 ce 0a 52 78 3d f5 2c 69 ad 82 46 5f 21 19 b5 ed d3 bf 7e 98 76 8d 6a 94 b7 ed
                                                  Data Ascii: @E>"[_ybd@<H7rc|VetRx=,iF_!~vj5s,yL/[g{QosVz%{A|PSeC)PYzSZ/]E?kINr|Pg!\2-;@&Lb<maS
                                                  Jul 22, 2024 12:35:15.523683071 CEST1236INData Raw: ef ec e3 a3 78 02 50 1e 6e 18 3a c8 ef 40 01 47 df 2f 67 75 81 ee e7 ed 5c 86 a7 cd ff 50 b9 61 08 00 fa a5 b9 0e 2f 50 8f 87 fd 80 44 ec bf 7d 28 a2 50 86 c4 d0 81 34 04 f9 9d 19 90 5d 6c c8 6f a3 82 62 5f 8a 77 97 ae e6 15 32 ec 5b 3c d5 d1 50
                                                  Data Ascii: xPn:@G/gu\Pa/PD}(P4]lob_w2[<Pz|<gzX],af!:$uMs)m74Tf8Q0Ee@>i~p#D'uma{4q-x.{W)x,0Fm'*wTn
                                                  Jul 22, 2024 12:35:15.523701906 CEST1236INData Raw: ea fe e8 9b 44 1e 62 80 9f 85 5d b4 ed 54 9a 62 26 5d f9 5f e9 66 31 79 1a ec 5d eb 3b 42 de 2a 12 2f 99 5a 51 ad 2c 4e fc b2 cd 25 8a df 0b d7 07 24 1e 16 60 15 f2 23 fe 84 ec 28 ca cb ea 25 a1 6f 30 22 39 cc 4f eb 80 ec b0 87 73 03 c9 e2 6f cb
                                                  Data Ascii: Db]Tb&]_f1y];B*/ZQ,N%$`#(%o0"9OsosUN^m9N)&8))QK}b9"@T~yu?V7j7y)vJ_EEW58X+:CP~T,{/s" a*=_lJ
                                                  Jul 22, 2024 12:35:15.524059057 CEST1236INData Raw: c6 ac fb 85 2b c7 a3 2f 2f d9 73 66 a6 d5 b3 dc bc 4c 89 64 2f f9 a1 b7 40 bf dd 84 b3 f4 0d 92 fa d2 49 45 fc 27 f8 14 9d 3f bd 02 3a c4 6a 3c 68 f4 ec 55 d8 20 1b ea 58 1f 15 63 0c 4e fc 76 39 e9 cc 71 40 69 5b b9 5b c5 4e 6d 50 82 e3 2b 3d 15
                                                  Data Ascii: +//sfLd/@IE'?:j<hU XcNv9q@i[[NmP+=127ZS$rHxh7[m15'1Z91 #%|^s\obPTPUO:$9pgLNTKqmc_xE]uUW\&6Ijo
                                                  Jul 22, 2024 12:35:15.524075031 CEST1236INData Raw: e7 41 3d ce 7d 33 4d 0f 6d da 2d 57 cd 6d 7c 72 20 41 5f e2 85 cb 48 2a 2c 1b 25 2d ea 0b 8c 30 58 68 ec 5b 67 54 17 0b 09 36 f0 a1 5f 55 d0 81 77 eb 76 58 90 be 59 9e ba 3f be 84 2b 42 29 6f 5c df c6 42 5f 49 8a 9f 97 26 07 55 9d da 50 6a e6 dc
                                                  Data Ascii: A=}3Mm-Wm|r A_H*,%-0Xh[gT6_UwvXY?+B)o\B_I&UPj?n,\_%N&gFx!7^"*w/:=\-?2$(<9#oPa7Z+iIU1B($k!XdI<#7s(,\~1~@SfHTn
                                                  Jul 22, 2024 12:35:15.524091959 CEST1236INData Raw: 20 19 6a 5f 78 89 c4 93 e5 38 5a 6e de 37 da e2 c6 06 b0 e8 f5 8e ec 2a 4d 52 53 7c c0 ce f1 b1 9d 84 d3 91 ba fc 29 13 39 6d 22 59 ca f4 90 ba 24 c3 b5 86 27 17 f3 8a b2 8c 0f d9 b9 6d 97 6d 9b 96 f5 eb e7 ae 0b 71 31 03 84 41 72 7d a7 8d f4 99
                                                  Data Ascii: j_x8Zn7*MRS|)9m"Y$'mmq1Ar}sWC@T^n2I%j+r|kpjq%<OjYSO)o+`qK18oLXG#F?sTds%>qWY2qf[n XR`
                                                  Jul 22, 2024 12:35:15.524415970 CEST1236INData Raw: d1 d2 9b 08 03 2c 5a d5 0d b5 24 ba 57 06 e9 82 13 06 b8 76 cd 11 85 df 30 60 c7 4a 68 fc 62 33 d3 a3 33 4a 36 3d a8 67 bb a3 56 33 7d 3d 9a 83 2c 2e ab 79 ba 0d fb 01 11 b8 6d 84 ce cd 88 2e 7d f5 4f 3e 3e d1 e4 3c 13 83 fa 27 77 82 c7 e2 d9 4b
                                                  Data Ascii: ,Z$Wv0`Jhb33J6=gV3}=,.ym.}O>><'wK\U}&El?<tl%}v%HSA*gH(vqd00Dan~Jlax_K9#+Rfl?uhLO{.FLRS
                                                  Jul 22, 2024 12:35:15.528551102 CEST1236INData Raw: 12 42 b8 dd e5 1f 9e 6b 33 d0 27 64 66 67 09 75 13 4e 4f e9 2f 56 c0 a1 26 a6 e7 0f 48 59 99 5e 9a 7b ee 13 0a e1 b2 7e 95 bf 06 41 45 43 c3 c5 43 45 37 b4 fd 4d f1 ee 9a 9c 98 53 15 42 01 8c fa ef a5 44 d0 97 33 99 81 2a 36 6b 2c 46 c1 0c 71 2f
                                                  Data Ascii: Bk3'dfguNO/V&HY^{~AECCE7MSBD3*6k,Fq/D:-E|OylOR-BS)2,o(P.Ibk@1F] 9X&;/<MZ5 `CLg`h*EH=|EZpoC/j{1,u;


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  96192.168.2.450125104.19.208.15280984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:35:17.166677952 CEST89OUTGET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Jul 22, 2024 12:35:17.912472963 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:35:17 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 17770
                                                  Connection: keep-alive
                                                  ETag: "770472110"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 447
                                                  Expires: Mon, 22 Jul 2024 14:35:17 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c87aef7a425d-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 [TRUNCATED]
                                                  Data Ascii: PK:=AX7\0DrActiveFeatures.txt+@sjp#K1;/-[[ABexq)7 7:^gK !ibUVsO$v7|e\W'ZdveU*oR>%w$-;Q4Tf$+T$&Q?9#"6>0o@j(*i)H"B1`=&0I8CR"ycM7g\@8xE4S|Iyy7~%W?7!JhrfdB^OQ"IDG!o+^6VY6<wNNPP2\?EY^j>i[p`L_sXq>#~nY>LO9rsAS+g5FBiqgUf{*vBUBqTpKF;/[&WIAPuS-&v3!Y'bMl{[:5sVL3om7'O4'(V#:\#VOO&<s}Yd|<P@jM%O5lHs^SYfaCDDwVcE8~cETL0YIEd@._PQ~w\fAT7Kiywq|+#]N">(A0bU-lDM#ETYa-h}ep<),
                                                  Jul 22, 2024 12:35:17.912499905 CEST1236INData Raw: c3 e9 0b b5 94 79 f6 cd ab db ef 95 d6 d1 32 bc 03 27 b0 a7 67 bb 67 5c 5f 47 4a 97 f1 f7 fc 80 a5 3d 5e cb d2 21 fd 16 4d f6 ed 94 f2 d0 41 ec b6 8d 9b cb af 44 4b 5e 3f 92 fc ae 08 db 64 a5 1d 86 78 29 a2 a9 c5 2d c1 7a 36 38 e0 81 84 1a 34 f5
                                                  Data Ascii: y2'gg\_GJ=^!MADK^?dx)-z684R|YSgynUf1qbEFO?'[a`bF\rsZL0q\vgrP:ZbPw^l^|Vov^'D0\mJh*I{X14
                                                  Jul 22, 2024 12:35:17.912513018 CEST1236INData Raw: e3 09 b7 93 e7 ef 55 87 a5 e2 4a 0e 55 3c 50 4f 28 65 ca 9a de 34 88 d5 59 ab cd 64 54 2a 94 93 b6 b8 c7 f1 34 a6 fe 9a 9e 58 e1 5b 68 04 08 88 1d 07 7a 22 8c f4 8b 1a 37 f4 2d 18 02 f7 c9 7a e3 8d 30 e6 e5 c6 72 4a b5 33 12 97 f2 9b 9f 3d 2b 49
                                                  Data Ascii: UJU<PO(e4YdT*4X[hz"7-z0rJ3=+I:QrVjeAU|0e r.-nFs%U@_G~W}E^ns]W6.Jg4)Kk~9"4{i#W}_&L'HNOp
                                                  Jul 22, 2024 12:35:17.912533045 CEST1236INData Raw: a2 40 45 ad 3e 10 cc d4 22 b8 18 aa b5 83 15 5b 5f 79 62 da f6 64 de 89 40 91 c6 e3 e6 3c 48 f6 f2 37 d0 b4 a2 87 ed 8b 72 11 f9 fa 1d 84 ca dd 63 7c e6 56 65 74 e8 c3 ce 0a 52 78 3d f5 2c 69 ad 82 46 5f 21 19 b5 ed d3 bf 7e 98 76 8d 6a 94 b7 ed
                                                  Data Ascii: @E>"[_ybd@<H7rc|VetRx=,iF_!~vj5s,yL/[g{QosVz%{A|PSeC)PYzSZ/]E?kINr|Pg!\2-;@&Lb<maS
                                                  Jul 22, 2024 12:35:17.912544966 CEST1236INData Raw: ef ec e3 a3 78 02 50 1e 6e 18 3a c8 ef 40 01 47 df 2f 67 75 81 ee e7 ed 5c 86 a7 cd ff 50 b9 61 08 00 fa a5 b9 0e 2f 50 8f 87 fd 80 44 ec bf 7d 28 a2 50 86 c4 d0 81 34 04 f9 9d 19 90 5d 6c c8 6f a3 82 62 5f 8a 77 97 ae e6 15 32 ec 5b 3c d5 d1 50
                                                  Data Ascii: xPn:@G/gu\Pa/PD}(P4]lob_w2[<Pz|<gzX],af!:$uMs)m74Tf8Q0Ee@>i~p#D'uma{4q-x.{W)x,0Fm'*wTn
                                                  Jul 22, 2024 12:35:17.912559032 CEST1236INData Raw: ea fe e8 9b 44 1e 62 80 9f 85 5d b4 ed 54 9a 62 26 5d f9 5f e9 66 31 79 1a ec 5d eb 3b 42 de 2a 12 2f 99 5a 51 ad 2c 4e fc b2 cd 25 8a df 0b d7 07 24 1e 16 60 15 f2 23 fe 84 ec 28 ca cb ea 25 a1 6f 30 22 39 cc 4f eb 80 ec b0 87 73 03 c9 e2 6f cb
                                                  Data Ascii: Db]Tb&]_f1y];B*/ZQ,N%$`#(%o0"9OsosUN^m9N)&8))QK}b9"@T~yu?V7j7y)vJ_EEW58X+:CP~T,{/s" a*=_lJ
                                                  Jul 22, 2024 12:35:17.912570953 CEST1236INData Raw: c6 ac fb 85 2b c7 a3 2f 2f d9 73 66 a6 d5 b3 dc bc 4c 89 64 2f f9 a1 b7 40 bf dd 84 b3 f4 0d 92 fa d2 49 45 fc 27 f8 14 9d 3f bd 02 3a c4 6a 3c 68 f4 ec 55 d8 20 1b ea 58 1f 15 63 0c 4e fc 76 39 e9 cc 71 40 69 5b b9 5b c5 4e 6d 50 82 e3 2b 3d 15
                                                  Data Ascii: +//sfLd/@IE'?:j<hU XcNv9q@i[[NmP+=127ZS$rHxh7[m15'1Z91 #%|^s\obPTPUO:$9pgLNTKqmc_xE]uUW\&6Ijo
                                                  Jul 22, 2024 12:35:17.912583113 CEST1236INData Raw: e7 41 3d ce 7d 33 4d 0f 6d da 2d 57 cd 6d 7c 72 20 41 5f e2 85 cb 48 2a 2c 1b 25 2d ea 0b 8c 30 58 68 ec 5b 67 54 17 0b 09 36 f0 a1 5f 55 d0 81 77 eb 76 58 90 be 59 9e ba 3f be 84 2b 42 29 6f 5c df c6 42 5f 49 8a 9f 97 26 07 55 9d da 50 6a e6 dc
                                                  Data Ascii: A=}3Mm-Wm|r A_H*,%-0Xh[gT6_UwvXY?+B)o\B_I&UPj?n,\_%N&gFx!7^"*w/:=\-?2$(<9#oPa7Z+iIU1B($k!XdI<#7s(,\~1~@SfHTn
                                                  Jul 22, 2024 12:35:17.912595987 CEST1236INData Raw: 20 19 6a 5f 78 89 c4 93 e5 38 5a 6e de 37 da e2 c6 06 b0 e8 f5 8e ec 2a 4d 52 53 7c c0 ce f1 b1 9d 84 d3 91 ba fc 29 13 39 6d 22 59 ca f4 90 ba 24 c3 b5 86 27 17 f3 8a b2 8c 0f d9 b9 6d 97 6d 9b 96 f5 eb e7 ae 0b 71 31 03 84 41 72 7d a7 8d f4 99
                                                  Data Ascii: j_x8Zn7*MRS|)9m"Y$'mmq1Ar}sWC@T^n2I%j+r|kpjq%<OjYSO)o+`qK18oLXG#F?sTds%>qWY2qf[n XR`
                                                  Jul 22, 2024 12:35:17.912606955 CEST1236INData Raw: d1 d2 9b 08 03 2c 5a d5 0d b5 24 ba 57 06 e9 82 13 06 b8 76 cd 11 85 df 30 60 c7 4a 68 fc 62 33 d3 a3 33 4a 36 3d a8 67 bb a3 56 33 7d 3d 9a 83 2c 2e ab 79 ba 0d fb 01 11 b8 6d 84 ce cd 88 2e 7d f5 4f 3e 3e d1 e4 3c 13 83 fa 27 77 82 c7 e2 d9 4b
                                                  Data Ascii: ,Z$Wv0`Jhb33J6=gV3}=,.ym.}O>><'wK\U}&El?<tl%}v%HSA*gH(vqd00Dan~Jlax_K9#+Rfl?uhLO{.FLRS
                                                  Jul 22, 2024 12:35:17.912729025 CEST1236INData Raw: 12 42 b8 dd e5 1f 9e 6b 33 d0 27 64 66 67 09 75 13 4e 4f e9 2f 56 c0 a1 26 a6 e7 0f 48 59 99 5e 9a 7b ee 13 0a e1 b2 7e 95 bf 06 41 45 43 c3 c5 43 45 37 b4 fd 4d f1 ee 9a 9c 98 53 15 42 01 8c fa ef a5 44 d0 97 33 99 81 2a 36 6b 2c 46 c1 0c 71 2f
                                                  Data Ascii: Bk3'dfguNO/V&HY^{~AECCE7MSBD3*6k,Fq/D:-E|OylOR-BS)2,o(P.Ibk@1F] 9X&;/<MZ5 `CLg`h*EH=|EZpoC/j{1,u;
                                                  Jul 22, 2024 12:35:17.913012981 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:35:17 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 17770
                                                  Connection: keep-alive
                                                  ETag: "770472110"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 447
                                                  Expires: Mon, 22 Jul 2024 14:35:17 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c87aef7a425d-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 [TRUNCATED]
                                                  Data Ascii: PK:=AX7\0DrActiveFeatures.txt+@sjp#K1;/-[[ABexq)7 7:^gK !ibUVsO$v7|e\W'ZdveU*oR>%w$-;Q4Tf$+T$&Q?9#"6>0o@j(*i)H"B1`=&0I8CR"ycM7g\@8xE4S|Iyy7~%W?7!JhrfdB^OQ"IDG!o+^6VY6<wNNPP2\?EY^j>i[p`L_sXq>#~nY>LO9rsAS+g5FBiqgUf{*vBUBqTpKF;/[&WIAPuS-&v3!Y'bMl{[:5sVL3om7'O4'(V#:\#VOO&<s}Yd|<P@jM%O5lHs^SYfaCDDwVcE8~cETL0YIEd@._PQ~w\fAT7Kiywq|+#]N">(A0bU-lDM#ETYa-h}ep<),


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  97192.168.2.450134104.19.208.15280984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:35:18.194320917 CEST105OUTGET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Jul 22, 2024 12:35:18.701607943 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:35:18 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 9891
                                                  Connection: keep-alive
                                                  ETag: "3914547665"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 145
                                                  Expires: Mon, 22 Jul 2024 14:35:18 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c8818b485e7d-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d [TRUNCATED]
                                                  Data Ascii: PKIX6%FeatureActions.txtBPZ&KE9(0p<a}9g<D)9k@4y'!=~Zk`1J2[)_,{FF?q;fL*=1ZI->m%>`ml,sWITPu*;Pxxhgl$M]I}ogZL5?BZLxukU1P4mW-Ntf?I-/!w90/^%X-.0(mVPn]=cr_A$<BWye2bK{jOdxZv@[NLDU|_1Sp~Paq>})$qH7,hm)Ias<TWu$?Ey@Xu@5*UJLja0v^Q (O}k+fwvfzbhFE<plLWZI*.4#,X`=beVW)W*;Q,'x>Jq _T<ea&wo/RM2`rXFEc:A97A4FT0@wuJIBd5Bhw}oE@N=Z$)6@sXru%eIg5ruA:81&"e_'Be
                                                  Jul 22, 2024 12:35:18.701661110 CEST1236INData Raw: aa 27 91 1f 4b c3 11 60 77 a1 43 f9 f7 10 07 63 36 80 1a 86 ad 48 a7 d3 8f 6f 01 ae 9e 9c 3f a2 79 6e 3b 81 f2 7e 33 72 dc 17 7b 3c b2 f2 80 9b 26 a0 a9 76 69 9d e2 6e 9e 4d 47 96 36 9b c5 b5 27 68 b5 b4 84 34 1c 56 23 a3 50 e1 9f 24 02 89 9a 6e
                                                  Data Ascii: 'K`wCc6Ho?yn;~3r{<&vinMG6'h4V#P$n/Kt'<4oOa"xGTVBfE<eG#Bw{#@mc]os}uE6@e`^](9A,NjbNYnOF\8p"CLFk
                                                  Jul 22, 2024 12:35:18.701675892 CEST1236INData Raw: fd ac 50 d8 52 44 ee 8b 8f d4 d8 b2 84 d1 cb d6 f7 f8 05 a5 aa 41 48 05 36 3c 93 56 87 e3 e6 2f 47 40 72 47 91 28 bd 1e de c7 43 06 15 aa c9 07 7f 4b 86 10 6b 1f 41 44 6f 91 db 30 a2 f9 46 11 1a 4b 58 16 a1 31 d1 5e b4 59 ca fc 47 fc bc 25 05 70
                                                  Data Ascii: PRDAH6<V/G@rG(CKkADo0FKX1^YG%p8P*rH|idu{"PBv`DWG&O*rD:V4#{>51Zy4U-&SSIgFkZpYN~L-6Fed~ex>3
                                                  Jul 22, 2024 12:35:18.701919079 CEST1236INData Raw: 88 a8 b4 43 f7 18 27 39 99 b5 09 5b b0 21 e4 89 cd dc d8 80 8f ba 2c 76 5f 49 78 e0 a0 e6 a4 e8 61 8a 0a 7d 07 ae 7f 5b db 69 5b ab 4d 22 92 db 0e dc 5e ef db 36 83 5e 63 58 81 45 75 40 0c 8a 74 59 c3 e4 31 78 2a c9 f9 39 82 db c7 d7 e1 67 09 f5
                                                  Data Ascii: C'9[!,v_Ixa}[i[M"^6^cXEu@tY1x*9g&LIY+5kR@v<a.{G`#|<rPgAn><AhcF1NG_d~JFS}=l-z%Q\)Zm?)^afu
                                                  Jul 22, 2024 12:35:18.701932907 CEST1236INData Raw: 51 a2 95 4e ba 4b 5c 16 c5 a5 51 be 5a 39 45 dd 17 61 63 b5 65 bb 34 9f 6d 7c 76 0b e7 cf 8a 28 b1 32 a3 4c 94 f3 9c 2d 3a d8 05 c3 70 d8 b9 9e ea 5e e2 8b aa 76 16 1e 66 9d 5b 09 8d b4 bd 0c df a4 f1 57 38 11 41 42 5a 8f 27 30 7a 45 dd 2c af 7e
                                                  Data Ascii: QNK\QZ9Eace4m|v(2L-:p^vf[W8ABZ'0zE,~iY~^UiH-E`79_ue_f!t,f-X9^y0jgsotF8rUFX3\"T5p3WJBORFv
                                                  Jul 22, 2024 12:35:18.701950073 CEST1236INData Raw: ad 53 b8 3f 1e d4 8d 8b fb 22 dd 51 13 da db 37 c1 6d 8a c5 7d 9b 47 42 3f 8e c9 f0 52 59 f2 14 2a 9e 75 2e 6a 2e 7b 93 ce 8d 7f 03 7e d5 5c fc 25 45 10 44 72 a8 87 1c d2 e8 6e 79 f4 3a 12 2f 87 97 f4 7d 88 08 2a 70 f8 25 43 fc 4b 2d f3 25 a3 5d
                                                  Data Ascii: S?"Q7m}GB?RY*u.j.{~\%EDrny:/}*p%CK-%]F?TSkSG-^Bgv[1K+k9v&plE0P8t}BnUJXhBDBlfbG7Fsq3BI{?3>n
                                                  Jul 22, 2024 12:35:18.701965094 CEST1236INData Raw: 98 44 c0 9d 35 87 31 5c f2 45 f9 c7 ef 27 c4 f0 44 cb 1d 0f 1c d1 37 2a fd 7f 20 4f 38 65 99 02 a1 9a ea fd 15 94 74 5c 15 e4 8a 30 a5 11 66 30 df 52 31 9c c6 28 24 8c 3e 6f 18 50 ce cd 5b 40 65 9a 59 06 f5 bf 1e 38 1f 30 99 1f 31 4f 2a 69 da 0b
                                                  Data Ascii: D51\E'D7* O8et\0f0R1($>oP[@eY801O*iT2@#l0*z<F4a/dUF5iAzDScUSK:;{qQ.29h}w$/SZ24d2%h@"IT*w;W<-f.7p=ei ^C\aP`RyHaC!
                                                  Jul 22, 2024 12:35:18.702369928 CEST1236INData Raw: 39 ba ca 62 79 64 b1 96 fc a3 e4 33 18 bf f2 b3 53 33 28 3d 94 63 da fc df 9a ab 61 96 4f fd 8f 75 23 dd b5 d3 bd b5 31 ab e5 e1 6d de 8b 88 11 1d 05 ed 75 9d 2f 58 00 23 9c b7 5e 9c be d2 46 a0 2b 67 71 a6 f8 75 c0 5f 80 c9 c6 7f 3b c9 9d 1b 53
                                                  Data Ascii: 9byd3S3(=caOu#1mu/X#^F+gqu_;Sv_HO=[Ipy`9|;!&uEv@~q+"`T].@ON/,V]Bn`;LGQNL0j*\x8j8cpo;Y|1x[
                                                  Jul 22, 2024 12:35:18.702384949 CEST384INData Raw: e7 b8 35 15 54 a9 22 01 ba 8d 73 41 22 2d 5f 1c e5 c1 6a 64 1c 3a 02 da 84 ef c5 74 bd 9f 23 d9 32 44 34 28 27 d7 07 95 69 6b 95 3f 18 37 32 d0 a9 81 eb a5 e0 47 f9 bd 0e ce d3 e3 4e d2 40 77 fe 00 a1 df bb a6 9f 2e ba ee eb a2 f0 8c 0d bc fe f1
                                                  Data Ascii: 5T"sA"-_jd:t#2D4('ik?72GN@w.o[C4PcJ3 [mrE&r8U,%,uzs(q7r%Hr1]>D!M#C7xJW/5oZ~Wr4gB6SE^C8LT_4'8rC&:<uMz
                                                  Jul 22, 2024 12:35:18.861205101 CEST89OUTGET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Jul 22, 2024 12:35:18.967144012 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:35:18 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 17770
                                                  Connection: keep-alive
                                                  ETag: "770472110"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 448
                                                  Expires: Mon, 22 Jul 2024 14:35:18 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c8833c525e7d-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 [TRUNCATED]
                                                  Data Ascii: PK:=AX7\0DrActiveFeatures.txt+@sjp#K1;/-[[ABexq)7 7:^gK !ibUVsO$v7|e\W'ZdveU*oR>%w$-;Q4Tf$+T$&Q?9#"6>0o@j(*i)H"B1`=&0I8CR"ycM7g\@8xE4S|Iyy7~%W?7!JhrfdB^OQ"IDG!o+^6VY6<wNNPP2\?EY^j>i[p`L_sXq>#~nY>LO9rsAS+g5FBiqgUf{*vBUBqTpKF;/[&WIAPuS-&v3!Y'bMl{[:5sVL3om7'O4'(V#:\#VOO&<s}Yd|<P@jM%O5lHs^SYfaCDDwVcE8~cETL0YIEd@._PQ~w\fAT7Kiywq|+#]N">(A0bU-lDM#ETYa-h}ep<),
                                                  Jul 22, 2024 12:35:18.967298985 CEST1236INData Raw: c3 e9 0b b5 94 79 f6 cd ab db ef 95 d6 d1 32 bc 03 27 b0 a7 67 bb 67 5c 5f 47 4a 97 f1 f7 fc 80 a5 3d 5e cb d2 21 fd 16 4d f6 ed 94 f2 d0 41 ec b6 8d 9b cb af 44 4b 5e 3f 92 fc ae 08 db 64 a5 1d 86 78 29 a2 a9 c5 2d c1 7a 36 38 e0 81 84 1a 34 f5
                                                  Data Ascii: y2'gg\_GJ=^!MADK^?dx)-z684R|YSgynUf1qbEFO?'[a`bF\rsZL0q\vgrP:ZbPw^l^|Vov^'D0\mJh*I{X14
                                                  Jul 22, 2024 12:35:18.967334986 CEST1236INData Raw: e3 09 b7 93 e7 ef 55 87 a5 e2 4a 0e 55 3c 50 4f 28 65 ca 9a de 34 88 d5 59 ab cd 64 54 2a 94 93 b6 b8 c7 f1 34 a6 fe 9a 9e 58 e1 5b 68 04 08 88 1d 07 7a 22 8c f4 8b 1a 37 f4 2d 18 02 f7 c9 7a e3 8d 30 e6 e5 c6 72 4a b5 33 12 97 f2 9b 9f 3d 2b 49
                                                  Data Ascii: UJU<PO(e4YdT*4X[hz"7-z0rJ3=+I:QrVjeAU|0e r.-nFs%U@_G~W}E^ns]W6.Jg4)Kk~9"4{i#W}_&L'HNOp


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  98192.168.2.450142104.19.208.15280940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:35:20.276500940 CEST89OUTGET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Jul 22, 2024 12:35:20.523132086 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:35:20 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 17770
                                                  Connection: keep-alive
                                                  ETag: "770472110"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 450
                                                  Expires: Mon, 22 Jul 2024 14:35:20 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c88cde4f8c81-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 [TRUNCATED]
                                                  Data Ascii: PK:=AX7\0DrActiveFeatures.txt+@sjp#K1;/-[[ABexq)7 7:^gK !ibUVsO$v7|e\W'ZdveU*oR>%w$-;Q4Tf$+T$&Q?9#"6>0o@j(*i)H"B1`=&0I8CR"ycM7g\@8xE4S|Iyy7~%W?7!JhrfdB^OQ"IDG!o+^6VY6<wNNPP2\?EY^j>i[p`L_sXq>#~nY>LO9rsAS+g5FBiqgUf{*vBUBqTpKF;/[&WIAPuS-&v3!Y'bMl{[:5sVL3om7'O4'(V#:\#VOO&<s}Yd|<P@jM%O5lHs^SYfaCDDwVcE8~cETL0YIEd@._PQ~w\fAT7Kiywq|+#]N">(A0bU-lDM#ETYa-h}ep<),
                                                  Jul 22, 2024 12:35:20.523190975 CEST1236INData Raw: c3 e9 0b b5 94 79 f6 cd ab db ef 95 d6 d1 32 bc 03 27 b0 a7 67 bb 67 5c 5f 47 4a 97 f1 f7 fc 80 a5 3d 5e cb d2 21 fd 16 4d f6 ed 94 f2 d0 41 ec b6 8d 9b cb af 44 4b 5e 3f 92 fc ae 08 db 64 a5 1d 86 78 29 a2 a9 c5 2d c1 7a 36 38 e0 81 84 1a 34 f5
                                                  Data Ascii: y2'gg\_GJ=^!MADK^?dx)-z684R|YSgynUf1qbEFO?'[a`bF\rsZL0q\vgrP:ZbPw^l^|Vov^'D0\mJh*I{X14
                                                  Jul 22, 2024 12:35:20.523205996 CEST1236INData Raw: e3 09 b7 93 e7 ef 55 87 a5 e2 4a 0e 55 3c 50 4f 28 65 ca 9a de 34 88 d5 59 ab cd 64 54 2a 94 93 b6 b8 c7 f1 34 a6 fe 9a 9e 58 e1 5b 68 04 08 88 1d 07 7a 22 8c f4 8b 1a 37 f4 2d 18 02 f7 c9 7a e3 8d 30 e6 e5 c6 72 4a b5 33 12 97 f2 9b 9f 3d 2b 49
                                                  Data Ascii: UJU<PO(e4YdT*4X[hz"7-z0rJ3=+I:QrVjeAU|0e r.-nFs%U@_G~W}E^ns]W6.Jg4)Kk~9"4{i#W}_&L'HNOp
                                                  Jul 22, 2024 12:35:20.523459911 CEST1236INData Raw: a2 40 45 ad 3e 10 cc d4 22 b8 18 aa b5 83 15 5b 5f 79 62 da f6 64 de 89 40 91 c6 e3 e6 3c 48 f6 f2 37 d0 b4 a2 87 ed 8b 72 11 f9 fa 1d 84 ca dd 63 7c e6 56 65 74 e8 c3 ce 0a 52 78 3d f5 2c 69 ad 82 46 5f 21 19 b5 ed d3 bf 7e 98 76 8d 6a 94 b7 ed
                                                  Data Ascii: @E>"[_ybd@<H7rc|VetRx=,iF_!~vj5s,yL/[g{QosVz%{A|PSeC)PYzSZ/]E?kINr|Pg!\2-;@&Lb<maS
                                                  Jul 22, 2024 12:35:20.523477077 CEST896INData Raw: ef ec e3 a3 78 02 50 1e 6e 18 3a c8 ef 40 01 47 df 2f 67 75 81 ee e7 ed 5c 86 a7 cd ff 50 b9 61 08 00 fa a5 b9 0e 2f 50 8f 87 fd 80 44 ec bf 7d 28 a2 50 86 c4 d0 81 34 04 f9 9d 19 90 5d 6c c8 6f a3 82 62 5f 8a 77 97 ae e6 15 32 ec 5b 3c d5 d1 50
                                                  Data Ascii: xPn:@G/gu\Pa/PD}(P4]lob_w2[<Pz|<gzX],af!:$uMs)m74Tf8Q0Ee@>i~p#D'uma{4q-x.{W)x,0Fm'*wTn
                                                  Jul 22, 2024 12:35:20.523664951 CEST1236INData Raw: 34 7a 37 eb 41 78 0e 69 ee 11 1c f5 8d 29 8d ef b3 38 72 f5 f7 cc fb 36 a3 c2 33 d4 82 c1 58 75 70 0c 5f 55 99 f6 e2 74 8f d1 5e 0b e5 76 62 a3 7a f8 a5 65 a6 ea 05 07 b9 eb 1e 5f bd 75 b6 c2 cc 94 6a a2 22 b3 d0 66 95 e4 94 13 d8 c8 ec e4 19 65
                                                  Data Ascii: 4z7Axi)8r63Xup_Ut^vbze_uj"feJ\<2FU[eLEcRkpa:wczZ;Q,T8[e?9`zhz&T*yQ4#'f+qT^Kk2}3cbN*B128SiC'wA0S
                                                  Jul 22, 2024 12:35:20.523682117 CEST1236INData Raw: 34 25 2c e5 9d 5d ed b5 e1 2c a7 3e 41 d6 a0 33 a8 93 ff c5 15 81 3d ce 94 01 98 a4 ff 99 54 e9 36 32 86 38 39 e8 14 27 87 a9 a8 9f f0 c1 3b 3a a6 4c fd 4a cf 51 44 77 61 5c 29 51 4a 98 3b 05 86 8d 76 04 df a6 3d d8 93 02 c0 90 00 e2 f0 b2 d1 83
                                                  Data Ascii: 4%,],>A3=T6289';:LJQDwa\)QJ;v=5i6we/YIa]ge:8J9a-HFpRD:}]8@4FG`t3b3Aci,JJ<G!:c`u,,g/h9FrxuuH?
                                                  Jul 22, 2024 12:35:20.523904085 CEST1236INData Raw: d0 f6 cb d1 b3 61 55 fa a4 43 33 57 d3 0e 45 b7 ed 34 65 50 30 eb db fd 21 57 25 e2 b9 5d 8b 01 56 d6 0f a7 e6 e8 ca 4b 1d 77 ed 37 d5 75 0f 3a 55 77 60 b3 3d 6e 16 26 b9 f0 de 11 f8 a3 6c 90 d4 5c dc 72 5c 30 6b 99 58 be 4c 30 6e 29 14 76 6e e0
                                                  Data Ascii: aUC3WE4eP0!W%]VKw7u:Uw`=n&l\r\0kXL0n)vneEw6h,{>VoJ[,"W2F##bl'h~T1&Cs_e-VYo[*r/zrC3{|Bt93CQ>E
                                                  Jul 22, 2024 12:35:20.523919106 CEST1236INData Raw: cb 2a 77 20 e5 30 06 0d 12 0f ce a0 a1 e4 a2 73 cb 42 3d 7a 87 cf 2b 4b a6 8c ef a7 33 77 c3 87 56 b0 a8 7d 61 53 08 eb 29 e8 42 6c 83 f3 55 44 60 61 ad b4 90 25 b4 10 8c 7a 04 31 2d f5 10 2f 61 7b 61 5a 40 a5 05 22 ef f9 09 3b 41 f7 73 57 a0 b1
                                                  Data Ascii: *w 0sB=z+K3wV}aS)BlUD`a%z1-/a{aZ@";AsW_DL[hArN~+;6]._#idF B;}+DIKv={k5G7>UPg-`N(w4!*@1?3@$Ji._r?aa_U
                                                  Jul 22, 2024 12:35:20.523936987 CEST1236INData Raw: b9 f2 d3 4c dc 58 95 5a 62 64 42 4e ba 0c 03 cb 52 79 d5 8d a2 fc 69 62 5b a7 46 45 a4 a7 8c 82 b3 e4 ed 76 ff b0 2e 3d 4b 87 33 1d 13 36 41 23 3a ef 4f 7f 83 bc 01 18 d8 ce ac 1b 15 fa ca d4 3b df c7 93 23 1b 4d 6a c4 4a 8a 3f fa 4e 10 f1 37 1a
                                                  Data Ascii: LXZbdBNRyib[FEv.=K36A#:O;#MjJ?N7k]^0huT [^o}r{498Q`JN<,R*je7Ij+{bZwziN}jN\qEcC\Esonti
                                                  Jul 22, 2024 12:35:20.528131962 CEST1236INData Raw: a4 07 67 23 06 91 b8 3a ff 7a c9 ec ef ba 9a 45 66 97 b6 21 25 5a 77 c7 6b a3 ff 3d c6 36 5e f1 64 1e 03 a2 d8 24 fa 3f 2e 85 88 e2 83 61 22 d8 68 dc ea fc f5 5a 9b 1a 4c 91 e3 d0 a5 6a 88 4d 6c 1c ed e6 b0 3a 61 f8 b0 5d e4 8b 4a cb 21 60 77 f2
                                                  Data Ascii: g#:zEf!%Zwk=6^d$?.a"hZLjMl:a]J!`wVRDwa*|bM#lx8aE%~~xLx)o_*[8lY)z(x~z-$Tg:$BD@uEHq\=*,LH+


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  99192.168.2.450151104.19.208.15280984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:35:21.960551023 CEST89OUTGET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Jul 22, 2024 12:35:22.425110102 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:35:22 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 17770
                                                  Connection: keep-alive
                                                  ETag: "770472110"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 452
                                                  Expires: Mon, 22 Jul 2024 14:35:22 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c898c9f98c75-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 [TRUNCATED]
                                                  Data Ascii: PK:=AX7\0DrActiveFeatures.txt+@sjp#K1;/-[[ABexq)7 7:^gK !ibUVsO$v7|e\W'ZdveU*oR>%w$-;Q4Tf$+T$&Q?9#"6>0o@j(*i)H"B1`=&0I8CR"ycM7g\@8xE4S|Iyy7~%W?7!JhrfdB^OQ"IDG!o+^6VY6<wNNPP2\?EY^j>i[p`L_sXq>#~nY>LO9rsAS+g5FBiqgUf{*vBUBqTpKF;/[&WIAPuS-&v3!Y'bMl{[:5sVL3om7'O4'(V#:\#VOO&<s}Yd|<P@jM%O5lHs^SYfaCDDwVcE8~cETL0YIEd@._PQ~w\fAT7Kiywq|+#]N">(A0bU-lDM#ETYa-h}ep<),
                                                  Jul 22, 2024 12:35:22.425127029 CEST1236INData Raw: c3 e9 0b b5 94 79 f6 cd ab db ef 95 d6 d1 32 bc 03 27 b0 a7 67 bb 67 5c 5f 47 4a 97 f1 f7 fc 80 a5 3d 5e cb d2 21 fd 16 4d f6 ed 94 f2 d0 41 ec b6 8d 9b cb af 44 4b 5e 3f 92 fc ae 08 db 64 a5 1d 86 78 29 a2 a9 c5 2d c1 7a 36 38 e0 81 84 1a 34 f5
                                                  Data Ascii: y2'gg\_GJ=^!MADK^?dx)-z684R|YSgynUf1qbEFO?'[a`bF\rsZL0q\vgrP:ZbPw^l^|Vov^'D0\mJh*I{X14
                                                  Jul 22, 2024 12:35:22.425139904 CEST1236INData Raw: e3 09 b7 93 e7 ef 55 87 a5 e2 4a 0e 55 3c 50 4f 28 65 ca 9a de 34 88 d5 59 ab cd 64 54 2a 94 93 b6 b8 c7 f1 34 a6 fe 9a 9e 58 e1 5b 68 04 08 88 1d 07 7a 22 8c f4 8b 1a 37 f4 2d 18 02 f7 c9 7a e3 8d 30 e6 e5 c6 72 4a b5 33 12 97 f2 9b 9f 3d 2b 49
                                                  Data Ascii: UJU<PO(e4YdT*4X[hz"7-z0rJ3=+I:QrVjeAU|0e r.-nFs%U@_G~W}E^ns]W6.Jg4)Kk~9"4{i#W}_&L'HNOp
                                                  Jul 22, 2024 12:35:22.425509930 CEST1236INData Raw: a2 40 45 ad 3e 10 cc d4 22 b8 18 aa b5 83 15 5b 5f 79 62 da f6 64 de 89 40 91 c6 e3 e6 3c 48 f6 f2 37 d0 b4 a2 87 ed 8b 72 11 f9 fa 1d 84 ca dd 63 7c e6 56 65 74 e8 c3 ce 0a 52 78 3d f5 2c 69 ad 82 46 5f 21 19 b5 ed d3 bf 7e 98 76 8d 6a 94 b7 ed
                                                  Data Ascii: @E>"[_ybd@<H7rc|VetRx=,iF_!~vj5s,yL/[g{QosVz%{A|PSeC)PYzSZ/]E?kINr|Pg!\2-;@&Lb<maS
                                                  Jul 22, 2024 12:35:22.425697088 CEST1236INData Raw: ef ec e3 a3 78 02 50 1e 6e 18 3a c8 ef 40 01 47 df 2f 67 75 81 ee e7 ed 5c 86 a7 cd ff 50 b9 61 08 00 fa a5 b9 0e 2f 50 8f 87 fd 80 44 ec bf 7d 28 a2 50 86 c4 d0 81 34 04 f9 9d 19 90 5d 6c c8 6f a3 82 62 5f 8a 77 97 ae e6 15 32 ec 5b 3c d5 d1 50
                                                  Data Ascii: xPn:@G/gu\Pa/PD}(P4]lob_w2[<Pz|<gzX],af!:$uMs)m74Tf8Q0Ee@>i~p#D'uma{4q-x.{W)x,0Fm'*wTn
                                                  Jul 22, 2024 12:35:22.425709963 CEST1236INData Raw: ea fe e8 9b 44 1e 62 80 9f 85 5d b4 ed 54 9a 62 26 5d f9 5f e9 66 31 79 1a ec 5d eb 3b 42 de 2a 12 2f 99 5a 51 ad 2c 4e fc b2 cd 25 8a df 0b d7 07 24 1e 16 60 15 f2 23 fe 84 ec 28 ca cb ea 25 a1 6f 30 22 39 cc 4f eb 80 ec b0 87 73 03 c9 e2 6f cb
                                                  Data Ascii: Db]Tb&]_f1y];B*/ZQ,N%$`#(%o0"9OsosUN^m9N)&8))QK}b9"@T~yu?V7j7y)vJ_EEW58X+:CP~T,{/s" a*=_lJ
                                                  Jul 22, 2024 12:35:22.425719976 CEST1236INData Raw: c6 ac fb 85 2b c7 a3 2f 2f d9 73 66 a6 d5 b3 dc bc 4c 89 64 2f f9 a1 b7 40 bf dd 84 b3 f4 0d 92 fa d2 49 45 fc 27 f8 14 9d 3f bd 02 3a c4 6a 3c 68 f4 ec 55 d8 20 1b ea 58 1f 15 63 0c 4e fc 76 39 e9 cc 71 40 69 5b b9 5b c5 4e 6d 50 82 e3 2b 3d 15
                                                  Data Ascii: +//sfLd/@IE'?:j<hU XcNv9q@i[[NmP+=127ZS$rHxh7[m15'1Z91 #%|^s\obPTPUO:$9pgLNTKqmc_xE]uUW\&6Ijo
                                                  Jul 22, 2024 12:35:22.425730944 CEST1236INData Raw: e7 41 3d ce 7d 33 4d 0f 6d da 2d 57 cd 6d 7c 72 20 41 5f e2 85 cb 48 2a 2c 1b 25 2d ea 0b 8c 30 58 68 ec 5b 67 54 17 0b 09 36 f0 a1 5f 55 d0 81 77 eb 76 58 90 be 59 9e ba 3f be 84 2b 42 29 6f 5c df c6 42 5f 49 8a 9f 97 26 07 55 9d da 50 6a e6 dc
                                                  Data Ascii: A=}3Mm-Wm|r A_H*,%-0Xh[gT6_UwvXY?+B)o\B_I&UPj?n,\_%N&gFx!7^"*w/:=\-?2$(<9#oPa7Z+iIU1B($k!XdI<#7s(,\~1~@SfHTn
                                                  Jul 22, 2024 12:35:22.425740957 CEST1236INData Raw: 20 19 6a 5f 78 89 c4 93 e5 38 5a 6e de 37 da e2 c6 06 b0 e8 f5 8e ec 2a 4d 52 53 7c c0 ce f1 b1 9d 84 d3 91 ba fc 29 13 39 6d 22 59 ca f4 90 ba 24 c3 b5 86 27 17 f3 8a b2 8c 0f d9 b9 6d 97 6d 9b 96 f5 eb e7 ae 0b 71 31 03 84 41 72 7d a7 8d f4 99
                                                  Data Ascii: j_x8Zn7*MRS|)9m"Y$'mmq1Ar}sWC@T^n2I%j+r|kpjq%<OjYSO)o+`qK18oLXG#F?sTds%>qWY2qf[n XR`
                                                  Jul 22, 2024 12:35:22.425750971 CEST1236INData Raw: d1 d2 9b 08 03 2c 5a d5 0d b5 24 ba 57 06 e9 82 13 06 b8 76 cd 11 85 df 30 60 c7 4a 68 fc 62 33 d3 a3 33 4a 36 3d a8 67 bb a3 56 33 7d 3d 9a 83 2c 2e ab 79 ba 0d fb 01 11 b8 6d 84 ce cd 88 2e 7d f5 4f 3e 3e d1 e4 3c 13 83 fa 27 77 82 c7 e2 d9 4b
                                                  Data Ascii: ,Z$Wv0`Jhb33J6=gV3}=,.ym.}O>><'wK\U}&El?<tl%}v%HSA*gH(vqd00Dan~Jlax_K9#+Rfl?uhLO{.FLRS
                                                  Jul 22, 2024 12:35:22.432336092 CEST1236INData Raw: 12 42 b8 dd e5 1f 9e 6b 33 d0 27 64 66 67 09 75 13 4e 4f e9 2f 56 c0 a1 26 a6 e7 0f 48 59 99 5e 9a 7b ee 13 0a e1 b2 7e 95 bf 06 41 45 43 c3 c5 43 45 37 b4 fd 4d f1 ee 9a 9c 98 53 15 42 01 8c fa ef a5 44 d0 97 33 99 81 2a 36 6b 2c 46 c1 0c 71 2f
                                                  Data Ascii: Bk3'dfguNO/V&HY^{~AECCE7MSBD3*6k,Fq/D:-E|OylOR-BS)2,o(P.Ibk@1F] 9X&;/<MZ5 `CLg`h*EH=|EZpoC/j{1,u;


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  100192.168.2.450152104.16.149.13080940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:35:22.328547001 CEST155OUTPOST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 239
                                                  Jul 22, 2024 12:35:22.334249020 CEST239OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","CurrentSearch":"Google","CurrentHomepage":"about:home","LanguageIso2":"en-GB","IP":null,"CreateDate":0}}
                                                  Jul 22, 2024 12:35:23.138339996 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:35:23 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c89d0a13427c-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  101192.168.2.450160104.16.149.13080940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:35:25.895138979 CEST155OUTPOST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 239
                                                  Jul 22, 2024 12:35:25.902885914 CEST239OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","CurrentSearch":"Google","CurrentHomepage":"about:home","LanguageIso2":"en-GB","IP":null,"CreateDate":0}}
                                                  Jul 22, 2024 12:35:26.399432898 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:35:26 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c8b16e43429e-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  102192.168.2.450161104.19.208.15280940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:35:25.906173944 CEST89OUTGET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Jul 22, 2024 12:35:26.404418945 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:35:26 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 17770
                                                  Connection: keep-alive
                                                  ETag: "770472110"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 456
                                                  Expires: Mon, 22 Jul 2024 14:35:26 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c8b19acd9e1a-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 [TRUNCATED]
                                                  Data Ascii: PK:=AX7\0DrActiveFeatures.txt+@sjp#K1;/-[[ABexq)7 7:^gK !ibUVsO$v7|e\W'ZdveU*oR>%w$-;Q4Tf$+T$&Q?9#"6>0o@j(*i)H"B1`=&0I8CR"ycM7g\@8xE4S|Iyy7~%W?7!JhrfdB^OQ"IDG!o+^6VY6<wNNPP2\?EY^j>i[p`L_sXq>#~nY>LO9rsAS+g5FBiqgUf{*vBUBqTpKF;/[&WIAPuS-&v3!Y'bMl{[:5sVL3om7'O4'(V#:\#VOO&<s}Yd|<P@jM%O5lHs^SYfaCDDwVcE8~cETL0YIEd@._PQ~w\fAT7Kiywq|+#]N">(A0bU-lDM#ETYa-h}ep<),
                                                  Jul 22, 2024 12:35:26.404460907 CEST1236INData Raw: c3 e9 0b b5 94 79 f6 cd ab db ef 95 d6 d1 32 bc 03 27 b0 a7 67 bb 67 5c 5f 47 4a 97 f1 f7 fc 80 a5 3d 5e cb d2 21 fd 16 4d f6 ed 94 f2 d0 41 ec b6 8d 9b cb af 44 4b 5e 3f 92 fc ae 08 db 64 a5 1d 86 78 29 a2 a9 c5 2d c1 7a 36 38 e0 81 84 1a 34 f5
                                                  Data Ascii: y2'gg\_GJ=^!MADK^?dx)-z684R|YSgynUf1qbEFO?'[a`bF\rsZL0q\vgrP:ZbPw^l^|Vov^'D0\mJh*I{X14
                                                  Jul 22, 2024 12:35:26.404472113 CEST1236INData Raw: e3 09 b7 93 e7 ef 55 87 a5 e2 4a 0e 55 3c 50 4f 28 65 ca 9a de 34 88 d5 59 ab cd 64 54 2a 94 93 b6 b8 c7 f1 34 a6 fe 9a 9e 58 e1 5b 68 04 08 88 1d 07 7a 22 8c f4 8b 1a 37 f4 2d 18 02 f7 c9 7a e3 8d 30 e6 e5 c6 72 4a b5 33 12 97 f2 9b 9f 3d 2b 49
                                                  Data Ascii: UJU<PO(e4YdT*4X[hz"7-z0rJ3=+I:QrVjeAU|0e r.-nFs%U@_G~W}E^ns]W6.Jg4)Kk~9"4{i#W}_&L'HNOp
                                                  Jul 22, 2024 12:35:26.404612064 CEST1236INData Raw: a2 40 45 ad 3e 10 cc d4 22 b8 18 aa b5 83 15 5b 5f 79 62 da f6 64 de 89 40 91 c6 e3 e6 3c 48 f6 f2 37 d0 b4 a2 87 ed 8b 72 11 f9 fa 1d 84 ca dd 63 7c e6 56 65 74 e8 c3 ce 0a 52 78 3d f5 2c 69 ad 82 46 5f 21 19 b5 ed d3 bf 7e 98 76 8d 6a 94 b7 ed
                                                  Data Ascii: @E>"[_ybd@<H7rc|VetRx=,iF_!~vj5s,yL/[g{QosVz%{A|PSeC)PYzSZ/]E?kINr|Pg!\2-;@&Lb<maS
                                                  Jul 22, 2024 12:35:26.404618025 CEST1236INData Raw: ef ec e3 a3 78 02 50 1e 6e 18 3a c8 ef 40 01 47 df 2f 67 75 81 ee e7 ed 5c 86 a7 cd ff 50 b9 61 08 00 fa a5 b9 0e 2f 50 8f 87 fd 80 44 ec bf 7d 28 a2 50 86 c4 d0 81 34 04 f9 9d 19 90 5d 6c c8 6f a3 82 62 5f 8a 77 97 ae e6 15 32 ec 5b 3c d5 d1 50
                                                  Data Ascii: xPn:@G/gu\Pa/PD}(P4]lob_w2[<Pz|<gzX],af!:$uMs)m74Tf8Q0Ee@>i~p#D'uma{4q-x.{W)x,0Fm'*wTn
                                                  Jul 22, 2024 12:35:26.404623032 CEST1236INData Raw: ea fe e8 9b 44 1e 62 80 9f 85 5d b4 ed 54 9a 62 26 5d f9 5f e9 66 31 79 1a ec 5d eb 3b 42 de 2a 12 2f 99 5a 51 ad 2c 4e fc b2 cd 25 8a df 0b d7 07 24 1e 16 60 15 f2 23 fe 84 ec 28 ca cb ea 25 a1 6f 30 22 39 cc 4f eb 80 ec b0 87 73 03 c9 e2 6f cb
                                                  Data Ascii: Db]Tb&]_f1y];B*/ZQ,N%$`#(%o0"9OsosUN^m9N)&8))QK}b9"@T~yu?V7j7y)vJ_EEW58X+:CP~T,{/s" a*=_lJ
                                                  Jul 22, 2024 12:35:26.404628992 CEST1236INData Raw: c6 ac fb 85 2b c7 a3 2f 2f d9 73 66 a6 d5 b3 dc bc 4c 89 64 2f f9 a1 b7 40 bf dd 84 b3 f4 0d 92 fa d2 49 45 fc 27 f8 14 9d 3f bd 02 3a c4 6a 3c 68 f4 ec 55 d8 20 1b ea 58 1f 15 63 0c 4e fc 76 39 e9 cc 71 40 69 5b b9 5b c5 4e 6d 50 82 e3 2b 3d 15
                                                  Data Ascii: +//sfLd/@IE'?:j<hU XcNv9q@i[[NmP+=127ZS$rHxh7[m15'1Z91 #%|^s\obPTPUO:$9pgLNTKqmc_xE]uUW\&6Ijo
                                                  Jul 22, 2024 12:35:26.404922009 CEST1236INData Raw: e7 41 3d ce 7d 33 4d 0f 6d da 2d 57 cd 6d 7c 72 20 41 5f e2 85 cb 48 2a 2c 1b 25 2d ea 0b 8c 30 58 68 ec 5b 67 54 17 0b 09 36 f0 a1 5f 55 d0 81 77 eb 76 58 90 be 59 9e ba 3f be 84 2b 42 29 6f 5c df c6 42 5f 49 8a 9f 97 26 07 55 9d da 50 6a e6 dc
                                                  Data Ascii: A=}3Mm-Wm|r A_H*,%-0Xh[gT6_UwvXY?+B)o\B_I&UPj?n,\_%N&gFx!7^"*w/:=\-?2$(<9#oPa7Z+iIU1B($k!XdI<#7s(,\~1~@SfHTn
                                                  Jul 22, 2024 12:35:26.404932022 CEST1236INData Raw: 20 19 6a 5f 78 89 c4 93 e5 38 5a 6e de 37 da e2 c6 06 b0 e8 f5 8e ec 2a 4d 52 53 7c c0 ce f1 b1 9d 84 d3 91 ba fc 29 13 39 6d 22 59 ca f4 90 ba 24 c3 b5 86 27 17 f3 8a b2 8c 0f d9 b9 6d 97 6d 9b 96 f5 eb e7 ae 0b 71 31 03 84 41 72 7d a7 8d f4 99
                                                  Data Ascii: j_x8Zn7*MRS|)9m"Y$'mmq1Ar}sWC@T^n2I%j+r|kpjq%<OjYSO)o+`qK18oLXG#F?sTds%>qWY2qf[n XR`
                                                  Jul 22, 2024 12:35:26.404941082 CEST1236INData Raw: d1 d2 9b 08 03 2c 5a d5 0d b5 24 ba 57 06 e9 82 13 06 b8 76 cd 11 85 df 30 60 c7 4a 68 fc 62 33 d3 a3 33 4a 36 3d a8 67 bb a3 56 33 7d 3d 9a 83 2c 2e ab 79 ba 0d fb 01 11 b8 6d 84 ce cd 88 2e 7d f5 4f 3e 3e d1 e4 3c 13 83 fa 27 77 82 c7 e2 d9 4b
                                                  Data Ascii: ,Z$Wv0`Jhb33J6=gV3}=,.ym.}O>><'wK\U}&El?<tl%}v%HSA*gH(vqd00Dan~Jlax_K9#+Rfl?uhLO{.FLRS
                                                  Jul 22, 2024 12:35:26.409420013 CEST1236INData Raw: 12 42 b8 dd e5 1f 9e 6b 33 d0 27 64 66 67 09 75 13 4e 4f e9 2f 56 c0 a1 26 a6 e7 0f 48 59 99 5e 9a 7b ee 13 0a e1 b2 7e 95 bf 06 41 45 43 c3 c5 43 45 37 b4 fd 4d f1 ee 9a 9c 98 53 15 42 01 8c fa ef a5 44 d0 97 33 99 81 2a 36 6b 2c 46 c1 0c 71 2f
                                                  Data Ascii: Bk3'dfguNO/V&HY^{~AECCE7MSBD3*6k,Fq/D:-E|OylOR-BS)2,o(P.Ibk@1F] 9X&;/<MZ5 `CLg`h*EH=|EZpoC/j{1,u;


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  103192.168.2.450164104.19.159.22480940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:35:26.120877981 CEST106OUTGET /version_logs?json=true&version=9.1.0.993 HTTP/1.1
                                                  Host: webcompanion.com
                                                  Connection: Keep-Alive
                                                  Jul 22, 2024 12:35:26.652493954 CEST629INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:35:26 GMT
                                                  Content-Type: text/html; charset=UTF-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  X-Powered-By: PHP/7.2.34
                                                  Vary: Accept-Encoding
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c8b2e85cc3eb-EWR
                                                  Data Raw: 31 35 38 0d 0a 3c 62 72 20 2f 3e 0a 3c 62 3e 57 61 72 6e 69 6e 67 3c 2f 62 3e 3a 20 20 63 6f 75 6e 74 28 29 3a 20 50 61 72 61 6d 65 74 65 72 20 6d 75 73 74 20 62 65 20 61 6e 20 61 72 72 61 79 20 6f 72 20 61 6e 20 6f 62 6a 65 63 74 20 74 68 61 74 20 69 6d 70 6c 65 6d 65 6e 74 73 20 43 6f 75 6e 74 61 62 6c 65 20 69 6e 20 3c 62 3e 2f 76 61 72 2f 77 77 77 2f 68 74 6d 6c 2f 69 6e 63 6c 75 64 65 73 2f 66 75 6e 63 74 69 6f 6e 73 2e 70 68 70 3c 2f 62 3e 20 6f 6e 20 6c 69 6e 65 20 3c 62 3e 39 31 3c 2f 62 3e 3c 62 72 20 2f 3e 0a 3c 62 72 20 2f 3e 0a 3c 62 3e 57 61 72 6e 69 6e 67 3c 2f 62 3e 3a 20 20 63 6f 75 6e 74 28 29 3a 20 50 61 72 61 6d 65 74 65 72 20 6d 75 73 74 20 62 65 20 61 6e 20 61 72 72 61 79 20 6f 72 20 61 6e 20 6f 62 6a 65 63 74 20 74 68 61 74 20 69 6d 70 6c 65 6d 65 6e 74 73 20 43 6f 75 6e 74 61 62 6c 65 20 69 6e 20 3c 62 3e 2f 76 61 72 2f 77 77 77 2f 68 74 6d 6c 2f 69 6e 63 6c 75 64 65 73 2f 66 75 6e 63 74 69 6f 6e 73 2e 70 68 70 3c 2f 62 3e 20 6f 6e 20 6c 69 6e 65 20 3c 62 3e 39 38 3c 2f 62 3e [TRUNCATED]
                                                  Data Ascii: 158<br /><b>Warning</b>: count(): Parameter must be an array or an object that implements Countable in <b>/var/www/html/includes/functions.php</b> on line <b>91</b><br /><br /><b>Warning</b>: count(): Parameter must be an array or an object that implements Countable in <b>/var/www/html/includes/functions.php</b> on line <b>98</b><br />null0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  104192.168.2.450170104.19.208.15280984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:35:27.693531990 CEST89OUTGET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Jul 22, 2024 12:35:28.180779934 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:35:28 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 17770
                                                  Connection: keep-alive
                                                  ETag: "770472110"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 458
                                                  Expires: Mon, 22 Jul 2024 14:35:28 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c8bcb8727c96-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 [TRUNCATED]
                                                  Data Ascii: PK:=AX7\0DrActiveFeatures.txt+@sjp#K1;/-[[ABexq)7 7:^gK !ibUVsO$v7|e\W'ZdveU*oR>%w$-;Q4Tf$+T$&Q?9#"6>0o@j(*i)H"B1`=&0I8CR"ycM7g\@8xE4S|Iyy7~%W?7!JhrfdB^OQ"IDG!o+^6VY6<wNNPP2\?EY^j>i[p`L_sXq>#~nY>LO9rsAS+g5FBiqgUf{*vBUBqTpKF;/[&WIAPuS-&v3!Y'bMl{[:5sVL3om7'O4'(V#:\#VOO&<s}Yd|<P@jM%O5lHs^SYfaCDDwVcE8~cETL0YIEd@._PQ~w\fAT7Kiywq|+#]N">(A0bU-lDM#ETYa-h}ep<),
                                                  Jul 22, 2024 12:35:28.180830956 CEST1236INData Raw: c3 e9 0b b5 94 79 f6 cd ab db ef 95 d6 d1 32 bc 03 27 b0 a7 67 bb 67 5c 5f 47 4a 97 f1 f7 fc 80 a5 3d 5e cb d2 21 fd 16 4d f6 ed 94 f2 d0 41 ec b6 8d 9b cb af 44 4b 5e 3f 92 fc ae 08 db 64 a5 1d 86 78 29 a2 a9 c5 2d c1 7a 36 38 e0 81 84 1a 34 f5
                                                  Data Ascii: y2'gg\_GJ=^!MADK^?dx)-z684R|YSgynUf1qbEFO?'[a`bF\rsZL0q\vgrP:ZbPw^l^|Vov^'D0\mJh*I{X14
                                                  Jul 22, 2024 12:35:28.180840969 CEST1236INData Raw: e3 09 b7 93 e7 ef 55 87 a5 e2 4a 0e 55 3c 50 4f 28 65 ca 9a de 34 88 d5 59 ab cd 64 54 2a 94 93 b6 b8 c7 f1 34 a6 fe 9a 9e 58 e1 5b 68 04 08 88 1d 07 7a 22 8c f4 8b 1a 37 f4 2d 18 02 f7 c9 7a e3 8d 30 e6 e5 c6 72 4a b5 33 12 97 f2 9b 9f 3d 2b 49
                                                  Data Ascii: UJU<PO(e4YdT*4X[hz"7-z0rJ3=+I:QrVjeAU|0e r.-nFs%U@_G~W}E^ns]W6.Jg4)Kk~9"4{i#W}_&L'HNOp
                                                  Jul 22, 2024 12:35:28.181005001 CEST1236INData Raw: a2 40 45 ad 3e 10 cc d4 22 b8 18 aa b5 83 15 5b 5f 79 62 da f6 64 de 89 40 91 c6 e3 e6 3c 48 f6 f2 37 d0 b4 a2 87 ed 8b 72 11 f9 fa 1d 84 ca dd 63 7c e6 56 65 74 e8 c3 ce 0a 52 78 3d f5 2c 69 ad 82 46 5f 21 19 b5 ed d3 bf 7e 98 76 8d 6a 94 b7 ed
                                                  Data Ascii: @E>"[_ybd@<H7rc|VetRx=,iF_!~vj5s,yL/[g{QosVz%{A|PSeC)PYzSZ/]E?kINr|Pg!\2-;@&Lb<maS
                                                  Jul 22, 2024 12:35:28.181016922 CEST1236INData Raw: ef ec e3 a3 78 02 50 1e 6e 18 3a c8 ef 40 01 47 df 2f 67 75 81 ee e7 ed 5c 86 a7 cd ff 50 b9 61 08 00 fa a5 b9 0e 2f 50 8f 87 fd 80 44 ec bf 7d 28 a2 50 86 c4 d0 81 34 04 f9 9d 19 90 5d 6c c8 6f a3 82 62 5f 8a 77 97 ae e6 15 32 ec 5b 3c d5 d1 50
                                                  Data Ascii: xPn:@G/gu\Pa/PD}(P4]lob_w2[<Pz|<gzX],af!:$uMs)m74Tf8Q0Ee@>i~p#D'uma{4q-x.{W)x,0Fm'*wTn
                                                  Jul 22, 2024 12:35:28.181025982 CEST1236INData Raw: ea fe e8 9b 44 1e 62 80 9f 85 5d b4 ed 54 9a 62 26 5d f9 5f e9 66 31 79 1a ec 5d eb 3b 42 de 2a 12 2f 99 5a 51 ad 2c 4e fc b2 cd 25 8a df 0b d7 07 24 1e 16 60 15 f2 23 fe 84 ec 28 ca cb ea 25 a1 6f 30 22 39 cc 4f eb 80 ec b0 87 73 03 c9 e2 6f cb
                                                  Data Ascii: Db]Tb&]_f1y];B*/ZQ,N%$`#(%o0"9OsosUN^m9N)&8))QK}b9"@T~yu?V7j7y)vJ_EEW58X+:CP~T,{/s" a*=_lJ
                                                  Jul 22, 2024 12:35:28.181036949 CEST1236INData Raw: c6 ac fb 85 2b c7 a3 2f 2f d9 73 66 a6 d5 b3 dc bc 4c 89 64 2f f9 a1 b7 40 bf dd 84 b3 f4 0d 92 fa d2 49 45 fc 27 f8 14 9d 3f bd 02 3a c4 6a 3c 68 f4 ec 55 d8 20 1b ea 58 1f 15 63 0c 4e fc 76 39 e9 cc 71 40 69 5b b9 5b c5 4e 6d 50 82 e3 2b 3d 15
                                                  Data Ascii: +//sfLd/@IE'?:j<hU XcNv9q@i[[NmP+=127ZS$rHxh7[m15'1Z91 #%|^s\obPTPUO:$9pgLNTKqmc_xE]uUW\&6Ijo
                                                  Jul 22, 2024 12:35:28.181339979 CEST1236INData Raw: e7 41 3d ce 7d 33 4d 0f 6d da 2d 57 cd 6d 7c 72 20 41 5f e2 85 cb 48 2a 2c 1b 25 2d ea 0b 8c 30 58 68 ec 5b 67 54 17 0b 09 36 f0 a1 5f 55 d0 81 77 eb 76 58 90 be 59 9e ba 3f be 84 2b 42 29 6f 5c df c6 42 5f 49 8a 9f 97 26 07 55 9d da 50 6a e6 dc
                                                  Data Ascii: A=}3Mm-Wm|r A_H*,%-0Xh[gT6_UwvXY?+B)o\B_I&UPj?n,\_%N&gFx!7^"*w/:=\-?2$(<9#oPa7Z+iIU1B($k!XdI<#7s(,\~1~@SfHTn
                                                  Jul 22, 2024 12:35:28.181349993 CEST1236INData Raw: 20 19 6a 5f 78 89 c4 93 e5 38 5a 6e de 37 da e2 c6 06 b0 e8 f5 8e ec 2a 4d 52 53 7c c0 ce f1 b1 9d 84 d3 91 ba fc 29 13 39 6d 22 59 ca f4 90 ba 24 c3 b5 86 27 17 f3 8a b2 8c 0f d9 b9 6d 97 6d 9b 96 f5 eb e7 ae 0b 71 31 03 84 41 72 7d a7 8d f4 99
                                                  Data Ascii: j_x8Zn7*MRS|)9m"Y$'mmq1Ar}sWC@T^n2I%j+r|kpjq%<OjYSO)o+`qK18oLXG#F?sTds%>qWY2qf[n XR`
                                                  Jul 22, 2024 12:35:28.181355953 CEST1236INData Raw: d1 d2 9b 08 03 2c 5a d5 0d b5 24 ba 57 06 e9 82 13 06 b8 76 cd 11 85 df 30 60 c7 4a 68 fc 62 33 d3 a3 33 4a 36 3d a8 67 bb a3 56 33 7d 3d 9a 83 2c 2e ab 79 ba 0d fb 01 11 b8 6d 84 ce cd 88 2e 7d f5 4f 3e 3e d1 e4 3c 13 83 fa 27 77 82 c7 e2 d9 4b
                                                  Data Ascii: ,Z$Wv0`Jhb33J6=gV3}=,.ym.}O>><'wK\U}&El?<tl%}v%HSA*gH(vqd00Dan~Jlax_K9#+Rfl?uhLO{.FLRS
                                                  Jul 22, 2024 12:35:28.185920000 CEST1236INData Raw: 12 42 b8 dd e5 1f 9e 6b 33 d0 27 64 66 67 09 75 13 4e 4f e9 2f 56 c0 a1 26 a6 e7 0f 48 59 99 5e 9a 7b ee 13 0a e1 b2 7e 95 bf 06 41 45 43 c3 c5 43 45 37 b4 fd 4d f1 ee 9a 9c 98 53 15 42 01 8c fa ef a5 44 d0 97 33 99 81 2a 36 6b 2c 46 c1 0c 71 2f
                                                  Data Ascii: Bk3'dfguNO/V&HY^{~AECCE7MSBD3*6k,Fq/D:-E|OylOR-BS)2,o(P.Ibk@1F] 9X&;/<MZ5 `CLg`h*EH=|EZpoC/j{1,u;


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  105192.168.2.450173104.19.208.15280984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:35:28.993949890 CEST105OUTGET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Jul 22, 2024 12:35:29.452327967 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:35:29 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 9891
                                                  Connection: keep-alive
                                                  ETag: "3914547665"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 156
                                                  Expires: Mon, 22 Jul 2024 14:35:29 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c8c4bc470f4a-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d [TRUNCATED]
                                                  Data Ascii: PKIX6%FeatureActions.txtBPZ&KE9(0p<a}9g<D)9k@4y'!=~Zk`1J2[)_,{FF?q;fL*=1ZI->m%>`ml,sWITPu*;Pxxhgl$M]I}ogZL5?BZLxukU1P4mW-Ntf?I-/!w90/^%X-.0(mVPn]=cr_A$<BWye2bK{jOdxZv@[NLDU|_1Sp~Paq>})$qH7,hm)Ias<TWu$?Ey@Xu@5*UJLja0v^Q (O}k+fwvfzbhFE<plLWZI*.4#,X`=beVW)W*;Q,'x>Jq _T<ea&wo/RM2`rXFEc:A97A4FT0@wuJIBd5Bhw}oE@N=Z$)6@sXru%eIg5ruA:81&"e_'Be
                                                  Jul 22, 2024 12:35:29.452344894 CEST1236INData Raw: aa 27 91 1f 4b c3 11 60 77 a1 43 f9 f7 10 07 63 36 80 1a 86 ad 48 a7 d3 8f 6f 01 ae 9e 9c 3f a2 79 6e 3b 81 f2 7e 33 72 dc 17 7b 3c b2 f2 80 9b 26 a0 a9 76 69 9d e2 6e 9e 4d 47 96 36 9b c5 b5 27 68 b5 b4 84 34 1c 56 23 a3 50 e1 9f 24 02 89 9a 6e
                                                  Data Ascii: 'K`wCc6Ho?yn;~3r{<&vinMG6'h4V#P$n/Kt'<4oOa"xGTVBfE<eG#Bw{#@mc]os}uE6@e`^](9A,NjbNYnOF\8p"CLFk
                                                  Jul 22, 2024 12:35:29.452357054 CEST1236INData Raw: fd ac 50 d8 52 44 ee 8b 8f d4 d8 b2 84 d1 cb d6 f7 f8 05 a5 aa 41 48 05 36 3c 93 56 87 e3 e6 2f 47 40 72 47 91 28 bd 1e de c7 43 06 15 aa c9 07 7f 4b 86 10 6b 1f 41 44 6f 91 db 30 a2 f9 46 11 1a 4b 58 16 a1 31 d1 5e b4 59 ca fc 47 fc bc 25 05 70
                                                  Data Ascii: PRDAH6<V/G@rG(CKkADo0FKX1^YG%p8P*rH|idu{"PBv`DWG&O*rD:V4#{>51Zy4U-&SSIgFkZpYN~L-6Fed~ex>3
                                                  Jul 22, 2024 12:35:29.452457905 CEST1236INData Raw: 88 a8 b4 43 f7 18 27 39 99 b5 09 5b b0 21 e4 89 cd dc d8 80 8f ba 2c 76 5f 49 78 e0 a0 e6 a4 e8 61 8a 0a 7d 07 ae 7f 5b db 69 5b ab 4d 22 92 db 0e dc 5e ef db 36 83 5e 63 58 81 45 75 40 0c 8a 74 59 c3 e4 31 78 2a c9 f9 39 82 db c7 d7 e1 67 09 f5
                                                  Data Ascii: C'9[!,v_Ixa}[i[M"^6^cXEu@tY1x*9g&LIY+5kR@v<a.{G`#|<rPgAn><AhcF1NG_d~JFS}=l-z%Q\)Zm?)^afu
                                                  Jul 22, 2024 12:35:29.452471018 CEST1236INData Raw: 51 a2 95 4e ba 4b 5c 16 c5 a5 51 be 5a 39 45 dd 17 61 63 b5 65 bb 34 9f 6d 7c 76 0b e7 cf 8a 28 b1 32 a3 4c 94 f3 9c 2d 3a d8 05 c3 70 d8 b9 9e ea 5e e2 8b aa 76 16 1e 66 9d 5b 09 8d b4 bd 0c df a4 f1 57 38 11 41 42 5a 8f 27 30 7a 45 dd 2c af 7e
                                                  Data Ascii: QNK\QZ9Eace4m|v(2L-:p^vf[W8ABZ'0zE,~iY~^UiH-E`79_ue_f!t,f-X9^y0jgsotF8rUFX3\"T5p3WJBORFv
                                                  Jul 22, 2024 12:35:29.452500105 CEST1236INData Raw: ad 53 b8 3f 1e d4 8d 8b fb 22 dd 51 13 da db 37 c1 6d 8a c5 7d 9b 47 42 3f 8e c9 f0 52 59 f2 14 2a 9e 75 2e 6a 2e 7b 93 ce 8d 7f 03 7e d5 5c fc 25 45 10 44 72 a8 87 1c d2 e8 6e 79 f4 3a 12 2f 87 97 f4 7d 88 08 2a 70 f8 25 43 fc 4b 2d f3 25 a3 5d
                                                  Data Ascii: S?"Q7m}GB?RY*u.j.{~\%EDrny:/}*p%CK-%]F?TSkSG-^Bgv[1K+k9v&plE0P8t}BnUJXhBDBlfbG7Fsq3BI{?3>n
                                                  Jul 22, 2024 12:35:29.452512980 CEST1236INData Raw: 98 44 c0 9d 35 87 31 5c f2 45 f9 c7 ef 27 c4 f0 44 cb 1d 0f 1c d1 37 2a fd 7f 20 4f 38 65 99 02 a1 9a ea fd 15 94 74 5c 15 e4 8a 30 a5 11 66 30 df 52 31 9c c6 28 24 8c 3e 6f 18 50 ce cd 5b 40 65 9a 59 06 f5 bf 1e 38 1f 30 99 1f 31 4f 2a 69 da 0b
                                                  Data Ascii: D51\E'D7* O8et\0f0R1($>oP[@eY801O*iT2@#l0*z<F4a/dUF5iAzDScUSK:;{qQ.29h}w$/SZ24d2%h@"IT*w;W<-f.7p=ei ^C\aP`RyHaC!
                                                  Jul 22, 2024 12:35:29.452749968 CEST1236INData Raw: 39 ba ca 62 79 64 b1 96 fc a3 e4 33 18 bf f2 b3 53 33 28 3d 94 63 da fc df 9a ab 61 96 4f fd 8f 75 23 dd b5 d3 bd b5 31 ab e5 e1 6d de 8b 88 11 1d 05 ed 75 9d 2f 58 00 23 9c b7 5e 9c be d2 46 a0 2b 67 71 a6 f8 75 c0 5f 80 c9 c6 7f 3b c9 9d 1b 53
                                                  Data Ascii: 9byd3S3(=caOu#1mu/X#^F+gqu_;Sv_HO=[Ipy`9|;!&uEv@~q+"`T].@ON/,V]Bn`;LGQNL0j*\x8j8cpo;Y|1x[
                                                  Jul 22, 2024 12:35:29.452766895 CEST384INData Raw: e7 b8 35 15 54 a9 22 01 ba 8d 73 41 22 2d 5f 1c e5 c1 6a 64 1c 3a 02 da 84 ef c5 74 bd 9f 23 d9 32 44 34 28 27 d7 07 95 69 6b 95 3f 18 37 32 d0 a9 81 eb a5 e0 47 f9 bd 0e ce d3 e3 4e d2 40 77 fe 00 a1 df bb a6 9f 2e ba ee eb a2 f0 8c 0d bc fe f1
                                                  Data Ascii: 5T"sA"-_jd:t#2D4('ik?72GN@w.o[C4PcJ3 [mrE&r8U,%,uzs(q7r%Hr1]>D!M#C7xJW/5oZ~Wr4gB6SE^C8LT_4'8rC&:<uMz


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  106192.168.2.450180104.19.208.15280984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:35:30.257240057 CEST89OUTGET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Jul 22, 2024 12:35:30.731688976 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:35:30 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 17770
                                                  Connection: keep-alive
                                                  ETag: "770472110"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 460
                                                  Expires: Mon, 22 Jul 2024 14:35:30 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c8cca92e4234-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 [TRUNCATED]
                                                  Data Ascii: PK:=AX7\0DrActiveFeatures.txt+@sjp#K1;/-[[ABexq)7 7:^gK !ibUVsO$v7|e\W'ZdveU*oR>%w$-;Q4Tf$+T$&Q?9#"6>0o@j(*i)H"B1`=&0I8CR"ycM7g\@8xE4S|Iyy7~%W?7!JhrfdB^OQ"IDG!o+^6VY6<wNNPP2\?EY^j>i[p`L_sXq>#~nY>LO9rsAS+g5FBiqgUf{*vBUBqTpKF;/[&WIAPuS-&v3!Y'bMl{[:5sVL3om7'O4'(V#:\#VOO&<s}Yd|<P@jM%O5lHs^SYfaCDDwVcE8~cETL0YIEd@._PQ~w\fAT7Kiywq|+#]N">(A0bU-lDM#ETYa-h}ep<),
                                                  Jul 22, 2024 12:35:30.731972933 CEST224INData Raw: c3 e9 0b b5 94 79 f6 cd ab db ef 95 d6 d1 32 bc 03 27 b0 a7 67 bb 67 5c 5f 47 4a 97 f1 f7 fc 80 a5 3d 5e cb d2 21 fd 16 4d f6 ed 94 f2 d0 41 ec b6 8d 9b cb af 44 4b 5e 3f 92 fc ae 08 db 64 a5 1d 86 78 29 a2 a9 c5 2d c1 7a 36 38 e0 81 84 1a 34 f5
                                                  Data Ascii: y2'gg\_GJ=^!MADK^?dx)-z684R|YSgynUf1qbEFO?'[a`bF\rsZL0q\vgrP:ZbPw^l^|Vov^'D0\mJ
                                                  Jul 22, 2024 12:35:30.732712030 CEST1236INData Raw: f5 d4 68 16 04 e9 da da 2a be b7 49 7b 58 31 f7 34 85 b1 a4 07 cc 22 41 cf 29 fe ef b6 ed 73 9e 33 db f2 de 67 08 80 87 c0 59 70 b7 3a a9 89 30 db 90 f2 7a ac d0 f9 13 06 39 ba ad 08 8e 8c 3d 34 b6 f7 51 cc 64 50 0a 4c cb 1c 11 70 9b bc dc e4 c7
                                                  Data Ascii: h*I{X14"A)s3gYp:0z9=4QdPLplngh'G|6t4U .Q|Hz^6HeLg1|BK@IO[EU4+(+B31l!c*c-:O6^-#9/Exk#
                                                  Jul 22, 2024 12:35:30.732728004 CEST1236INData Raw: 57 7d 88 bf 5f ac 0a 26 4c db d8 27 e5 c6 48 c7 4e 4f 70 d7 40 39 1e 4c 3d e5 95 51 3c 84 56 4a 31 88 69 36 00 05 b7 67 c2 0e e1 9f 28 42 4b 4c 42 c8 00 f9 cb 15 30 90 ff 8f fd 64 a2 fa 91 4f 39 90 d0 52 32 2c 3f d8 ef ab 3f c7 3e bf 20 2a e2 60
                                                  Data Ascii: W}_&L'HNOp@9L=Q<VJ1i6g(BKLB0dO9R2,??> *`H^VfknSSOX9m3y<*Imx/nbIMY<9a<1t3KV6\JqnJ6l8}FwF8q;2.
                                                  Jul 22, 2024 12:35:30.732744932 CEST1236INData Raw: 3b 40 26 c1 4c 94 62 06 3c 6d 86 61 1e 10 c4 b7 a3 f4 53 63 fc a5 99 7a 1f f5 f5 32 0e 04 59 da ed 79 80 52 10 ac 7f 78 79 f2 b8 79 4d 82 f3 7e d8 db a6 19 9f dd 60 d6 e2 23 fb fa 3b 3a 21 03 a4 03 5a e0 f4 6f b0 49 e3 59 10 46 c9 bb 91 d9 44 7f
                                                  Data Ascii: ;@&Lb<maScz2YyRxyyM~`#;:!ZoIYFDVW\n3Vij @*$W|fb3eUTaW1vmL{b24So)[N/qoCM:$+AYBwMnp:(6
                                                  Jul 22, 2024 12:35:30.732759953 CEST1236INData Raw: a1 46 99 6d 1f 27 8c f1 da 2a 00 ee 77 d7 f7 bc 0a 54 6e a1 6c ae 9d ec 99 3e 1c 4b 6f 6f 00 36 68 48 54 f6 c3 cb af 59 c7 84 5b b4 a7 27 60 9e 25 de 8d 4b 6b 7e db ca 98 e7 ac e8 2d 89 23 e6 56 7d 19 76 4d 3f 64 75 4c 29 e0 04 de 36 55 4c 1b ba
                                                  Data Ascii: Fm'*wTnl>Koo6hHTY['`%Kk~-#V}vM?duL)6ULIvUm9GAu#7&~@X%%[I*pw y{B/J=(y7<zQ.+km} Q}guHZ1$Bw-!xOsb
                                                  Jul 22, 2024 12:35:30.733166933 CEST1236INData Raw: 73 de 22 ab 20 cc 61 2a 3d 5f 8b 6c d8 b6 dd b5 ab f4 4a 86 63 0c 73 8c 15 e2 87 bb 54 5f 60 54 01 08 9e 33 b3 ad 38 3c 0d 94 fb 2a 66 af 06 83 e7 5b aa 49 c8 1f 1c c1 c4 7f 53 9d ba 82 f2 d4 21 64 46 fa 09 32 7c 69 f3 12 9c 6d 4c cb 53 ad 70 b9
                                                  Data Ascii: s" a*=_lJcsT_`T38<*f[IS!dF2|imLSpQu{8/P}/08OfVK^? Dt0.<8ElzqGs5mPM{1&q[&nV^Ic
                                                  Jul 22, 2024 12:35:30.733182907 CEST1236INData Raw: f1 7f 57 88 f3 5c 26 36 49 6a 6f 89 06 a3 b0 a8 9c 15 c1 c9 f1 6d b6 7c e6 e5 b2 76 86 e1 65 d5 06 1a 26 99 9b e7 46 d8 5c ba fc 05 82 66 3d cb 34 7b 41 05 76 ea 3d 7c b0 09 21 d6 ac a6 7a e1 37 56 91 bc 44 8d 55 cd ca ae 53 c7 ae 5d 17 86 78 59
                                                  Data Ascii: W\&6Ijom|ve&F\f=4{Av=|!z7VDUS]xYC~D{E/%$n/.!/W6n$!+#Ctvi(kRU;1PRbbHGSBS8__3h!FZ6%aZ8cp/](y
                                                  Jul 22, 2024 12:35:30.733196974 CEST1236INData Raw: 2c 5c 7e 31 7e 9c 06 40 a5 99 53 66 8a cf 48 54 b2 e3 6e ab 82 1a 0f a1 02 1e 47 b6 e3 ea 1a 70 19 12 1f 13 2e a2 e4 a9 32 1f 97 86 0d 51 8e 49 60 52 84 22 03 db 7a 6d 5d f1 8d fe e7 55 dd 46 8b 81 f6 6c 86 fb bd 0f 16 99 18 a1 78 7f 9f 39 f8 93
                                                  Data Ascii: ,\~1~@SfHTnGp.2QI`R"zm]UFlx9!I!6}l<"?&TH]VEICxR[?_9egyCS`uj5Qh>Tr),b2]:jb)u NkKL+!/,V ~rhtp67
                                                  Jul 22, 2024 12:35:30.733212948 CEST1236INData Raw: 84 07 c1 f3 5b 18 6e 20 58 ca d2 99 52 1c 99 12 0c 18 60 11 e6 42 28 fc c6 00 29 c3 f6 c2 9b a0 62 02 64 08 bf 3c f4 30 69 a7 02 1d 59 ce 2a bd ff 89 4e 7f ca d6 d7 11 39 00 67 46 7f e7 94 4f 02 99 e7 45 e5 f6 26 19 40 1b 4a 8f 33 71 7a dd 61 46
                                                  Data Ascii: [n XR`B()bd<0iY*N9gFOE&@J3qzaF7?c?*Fz.n4!o\^SB{Khe4YI;m!4!E7|DYxG-p^Ex|-7`W+eNyo)>B{M}d7+!b
                                                  Jul 22, 2024 12:35:30.737036943 CEST1236INData Raw: d9 f1 0d f2 cd 8b 7f f7 b6 98 c7 c1 2e 46 4c 04 e1 52 53 e8 31 ab f3 fd 1e 50 ae ac e4 a8 8c 7d 9f c2 dc 2c 9b 36 53 33 93 96 4b a3 f9 25 dc 96 6a 20 3c 9f 19 2e 65 dc 6d 56 82 93 8b 90 02 e9 05 20 b3 a1 bb aa 82 24 88 80 b4 43 4a 75 4a ab 0a 5e
                                                  Data Ascii: .FLRS1P},6S3K%j <.emV $CJuJ^G82;is9fF/jvr<`U+WGSgw3(ur}F]}dXJ4frDt]{^IE6!GSa$owdu~JB<|=j^o


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  107192.168.2.450184104.19.208.15280940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:35:31.101999044 CEST113OUTGET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Connection: Keep-Alive


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  108192.168.2.450186104.16.149.13080940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:35:31.480166912 CEST179OUTPOST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 239
                                                  Connection: Keep-Alive
                                                  Jul 22, 2024 12:35:31.485425949 CEST239OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","CurrentSearch":"Google","CurrentHomepage":"about:home","LanguageIso2":"en-GB","IP":null,"CreateDate":0}}
                                                  Jul 22, 2024 12:35:32.042891979 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:35:31 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c8d45f2d8c96-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  109192.168.2.450188104.19.208.15280984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:35:31.836883068 CEST105OUTGET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Jul 22, 2024 12:35:32.332285881 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:35:32 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 9891
                                                  Connection: keep-alive
                                                  ETag: "3914547665"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 159
                                                  Expires: Mon, 22 Jul 2024 14:35:32 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c8d6b8a243e2-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d [TRUNCATED]
                                                  Data Ascii: PKIX6%FeatureActions.txtBPZ&KE9(0p<a}9g<D)9k@4y'!=~Zk`1J2[)_,{FF?q;fL*=1ZI->m%>`ml,sWITPu*;Pxxhgl$M]I}ogZL5?BZLxukU1P4mW-Ntf?I-/!w90/^%X-.0(mVPn]=cr_A$<BWye2bK{jOdxZv@[NLDU|_1Sp~Paq>})$qH7,hm)Ias<TWu$?Ey@Xu@5*UJLja0v^Q (O}k+fwvfzbhFE<plLWZI*.4#,X`=beVW)W*;Q,'x>Jq _T<ea&wo/RM2`rXFEc:A97A4FT0@wuJIBd5Bhw}oE@N=Z$)6@sXru%eIg5ruA:81&"e_'Be
                                                  Jul 22, 2024 12:35:32.332356930 CEST1236INData Raw: aa 27 91 1f 4b c3 11 60 77 a1 43 f9 f7 10 07 63 36 80 1a 86 ad 48 a7 d3 8f 6f 01 ae 9e 9c 3f a2 79 6e 3b 81 f2 7e 33 72 dc 17 7b 3c b2 f2 80 9b 26 a0 a9 76 69 9d e2 6e 9e 4d 47 96 36 9b c5 b5 27 68 b5 b4 84 34 1c 56 23 a3 50 e1 9f 24 02 89 9a 6e
                                                  Data Ascii: 'K`wCc6Ho?yn;~3r{<&vinMG6'h4V#P$n/Kt'<4oOa"xGTVBfE<eG#Bw{#@mc]os}uE6@e`^](9A,NjbNYnOF\8p"CLFk
                                                  Jul 22, 2024 12:35:32.332391977 CEST1236INData Raw: fd ac 50 d8 52 44 ee 8b 8f d4 d8 b2 84 d1 cb d6 f7 f8 05 a5 aa 41 48 05 36 3c 93 56 87 e3 e6 2f 47 40 72 47 91 28 bd 1e de c7 43 06 15 aa c9 07 7f 4b 86 10 6b 1f 41 44 6f 91 db 30 a2 f9 46 11 1a 4b 58 16 a1 31 d1 5e b4 59 ca fc 47 fc bc 25 05 70
                                                  Data Ascii: PRDAH6<V/G@rG(CKkADo0FKX1^YG%p8P*rH|idu{"PBv`DWG&O*rD:V4#{>51Zy4U-&SSIgFkZpYN~L-6Fed~ex>3
                                                  Jul 22, 2024 12:35:32.332532883 CEST1236INData Raw: 88 a8 b4 43 f7 18 27 39 99 b5 09 5b b0 21 e4 89 cd dc d8 80 8f ba 2c 76 5f 49 78 e0 a0 e6 a4 e8 61 8a 0a 7d 07 ae 7f 5b db 69 5b ab 4d 22 92 db 0e dc 5e ef db 36 83 5e 63 58 81 45 75 40 0c 8a 74 59 c3 e4 31 78 2a c9 f9 39 82 db c7 d7 e1 67 09 f5
                                                  Data Ascii: C'9[!,v_Ixa}[i[M"^6^cXEu@tY1x*9g&LIY+5kR@v<a.{G`#|<rPgAn><AhcF1NG_d~JFS}=l-z%Q\)Zm?)^afu
                                                  Jul 22, 2024 12:35:32.332568884 CEST1236INData Raw: 51 a2 95 4e ba 4b 5c 16 c5 a5 51 be 5a 39 45 dd 17 61 63 b5 65 bb 34 9f 6d 7c 76 0b e7 cf 8a 28 b1 32 a3 4c 94 f3 9c 2d 3a d8 05 c3 70 d8 b9 9e ea 5e e2 8b aa 76 16 1e 66 9d 5b 09 8d b4 bd 0c df a4 f1 57 38 11 41 42 5a 8f 27 30 7a 45 dd 2c af 7e
                                                  Data Ascii: QNK\QZ9Eace4m|v(2L-:p^vf[W8ABZ'0zE,~iY~^UiH-E`79_ue_f!t,f-X9^y0jgsotF8rUFX3\"T5p3WJBORFv
                                                  Jul 22, 2024 12:35:32.332602978 CEST1236INData Raw: ad 53 b8 3f 1e d4 8d 8b fb 22 dd 51 13 da db 37 c1 6d 8a c5 7d 9b 47 42 3f 8e c9 f0 52 59 f2 14 2a 9e 75 2e 6a 2e 7b 93 ce 8d 7f 03 7e d5 5c fc 25 45 10 44 72 a8 87 1c d2 e8 6e 79 f4 3a 12 2f 87 97 f4 7d 88 08 2a 70 f8 25 43 fc 4b 2d f3 25 a3 5d
                                                  Data Ascii: S?"Q7m}GB?RY*u.j.{~\%EDrny:/}*p%CK-%]F?TSkSG-^Bgv[1K+k9v&plE0P8t}BnUJXhBDBlfbG7Fsq3BI{?3>n
                                                  Jul 22, 2024 12:35:32.332638979 CEST776INData Raw: 98 44 c0 9d 35 87 31 5c f2 45 f9 c7 ef 27 c4 f0 44 cb 1d 0f 1c d1 37 2a fd 7f 20 4f 38 65 99 02 a1 9a ea fd 15 94 74 5c 15 e4 8a 30 a5 11 66 30 df 52 31 9c c6 28 24 8c 3e 6f 18 50 ce cd 5b 40 65 9a 59 06 f5 bf 1e 38 1f 30 99 1f 31 4f 2a 69 da 0b
                                                  Data Ascii: D51\E'D7* O8et\0f0R1($>oP[@eY801O*iT2@#l0*z<F4a/dUF5iAzDScUSK:;{qQ.29h}w$/SZ24d2%h@"IT*w;W<-f.7p=ei ^C\aP`RyHaC!
                                                  Jul 22, 2024 12:35:32.332772017 CEST1236INData Raw: dd 8e 72 29 8a c0 1d 3f 7c b1 47 79 69 06 1b 3b 20 2d d3 80 fd 5e 0a 7f 7f e8 ac f4 e0 91 49 12 b0 45 b9 40 ab 32 8c 4a 2c dd e0 c4 f6 c7 5b a6 da 77 23 f9 11 08 27 df 00 b7 d1 0d 68 61 65 ca f5 94 2c 49 3c 23 b4 dd 71 44 19 8b 85 07 c3 c3 a6 5d
                                                  Data Ascii: r)?|Gyi; -^IE@2J,[w#'hae,I<#qD]qHo;p,jU_lMhL)BBJLrKgUCb`oRg#{u$KG*0[F1#>#>!kH|$1YfA
                                                  Jul 22, 2024 12:35:32.332808018 CEST844INData Raw: 34 a7 f3 80 a8 8b 39 a9 af ac 8e 4d da 0c 3c 6c 36 b0 93 fa 50 57 5d e6 d6 54 d3 bb 51 f7 01 1d 87 fa 6c b7 82 35 42 59 dd 7f d6 79 6b 59 93 d4 fb e9 e3 20 7b d7 09 a6 58 da ea fc 4e 90 3d 02 ef 8f ea cd 54 72 61 9d c2 bb 32 3c b4 4d 8e a9 d3 78
                                                  Data Ascii: 49M<l6PW]TQl5BYykY {XN=Tra2<MxC)Z}-&%djyiwm^G<s 1u%pv#"SQd$S$!kUnf^RnG\vb&%65VXV@ha;aOiM3+EtU{o$o


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  110192.168.2.450195104.19.208.15280940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:35:33.029011011 CEST113OUTGET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Connection: Keep-Alive
                                                  Jul 22, 2024 12:35:33.510191917 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:35:33 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 17770
                                                  Connection: keep-alive
                                                  ETag: "770472110"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 463
                                                  Expires: Mon, 22 Jul 2024 14:35:33 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c8de0d377d06-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 [TRUNCATED]
                                                  Data Ascii: PK:=AX7\0DrActiveFeatures.txt+@sjp#K1;/-[[ABexq)7 7:^gK !ibUVsO$v7|e\W'ZdveU*oR>%w$-;Q4Tf$+T$&Q?9#"6>0o@j(*i)H"B1`=&0I8CR"ycM7g\@8xE4S|Iyy7~%W?7!JhrfdB^OQ"IDG!o+^6VY6<wNNPP2\?EY^j>i[p`L_sXq>#~nY>LO9rsAS+g5FBiqgUf{*vBUBqTpKF;/[&WIAPuS-&v3!Y'bMl{[:5sVL3om7'O4'(V#:\#VOO&<s}Yd|<P@jM%O5lHs^SYfaCDDwVcE8~cETL0YIEd@._PQ~w\fAT7Kiywq|+#]N">(A0bU-lDM#ETYa-h}ep<),
                                                  Jul 22, 2024 12:35:33.510253906 CEST1236INData Raw: c3 e9 0b b5 94 79 f6 cd ab db ef 95 d6 d1 32 bc 03 27 b0 a7 67 bb 67 5c 5f 47 4a 97 f1 f7 fc 80 a5 3d 5e cb d2 21 fd 16 4d f6 ed 94 f2 d0 41 ec b6 8d 9b cb af 44 4b 5e 3f 92 fc ae 08 db 64 a5 1d 86 78 29 a2 a9 c5 2d c1 7a 36 38 e0 81 84 1a 34 f5
                                                  Data Ascii: y2'gg\_GJ=^!MADK^?dx)-z684R|YSgynUf1qbEFO?'[a`bF\rsZL0q\vgrP:ZbPw^l^|Vov^'D0\mJh*I{X14
                                                  Jul 22, 2024 12:35:33.510271072 CEST1236INData Raw: e3 09 b7 93 e7 ef 55 87 a5 e2 4a 0e 55 3c 50 4f 28 65 ca 9a de 34 88 d5 59 ab cd 64 54 2a 94 93 b6 b8 c7 f1 34 a6 fe 9a 9e 58 e1 5b 68 04 08 88 1d 07 7a 22 8c f4 8b 1a 37 f4 2d 18 02 f7 c9 7a e3 8d 30 e6 e5 c6 72 4a b5 33 12 97 f2 9b 9f 3d 2b 49
                                                  Data Ascii: UJU<PO(e4YdT*4X[hz"7-z0rJ3=+I:QrVjeAU|0e r.-nFs%U@_G~W}E^ns]W6.Jg4)Kk~9"4{i#W}_&L'HNOp
                                                  Jul 22, 2024 12:35:33.510386944 CEST1236INData Raw: a2 40 45 ad 3e 10 cc d4 22 b8 18 aa b5 83 15 5b 5f 79 62 da f6 64 de 89 40 91 c6 e3 e6 3c 48 f6 f2 37 d0 b4 a2 87 ed 8b 72 11 f9 fa 1d 84 ca dd 63 7c e6 56 65 74 e8 c3 ce 0a 52 78 3d f5 2c 69 ad 82 46 5f 21 19 b5 ed d3 bf 7e 98 76 8d 6a 94 b7 ed
                                                  Data Ascii: @E>"[_ybd@<H7rc|VetRx=,iF_!~vj5s,yL/[g{QosVz%{A|PSeC)PYzSZ/]E?kINr|Pg!\2-;@&Lb<maS
                                                  Jul 22, 2024 12:35:33.510402918 CEST1236INData Raw: ef ec e3 a3 78 02 50 1e 6e 18 3a c8 ef 40 01 47 df 2f 67 75 81 ee e7 ed 5c 86 a7 cd ff 50 b9 61 08 00 fa a5 b9 0e 2f 50 8f 87 fd 80 44 ec bf 7d 28 a2 50 86 c4 d0 81 34 04 f9 9d 19 90 5d 6c c8 6f a3 82 62 5f 8a 77 97 ae e6 15 32 ec 5b 3c d5 d1 50
                                                  Data Ascii: xPn:@G/gu\Pa/PD}(P4]lob_w2[<Pz|<gzX],af!:$uMs)m74Tf8Q0Ee@>i~p#D'uma{4q-x.{W)x,0Fm'*wTn
                                                  Jul 22, 2024 12:35:33.510416985 CEST1236INData Raw: ea fe e8 9b 44 1e 62 80 9f 85 5d b4 ed 54 9a 62 26 5d f9 5f e9 66 31 79 1a ec 5d eb 3b 42 de 2a 12 2f 99 5a 51 ad 2c 4e fc b2 cd 25 8a df 0b d7 07 24 1e 16 60 15 f2 23 fe 84 ec 28 ca cb ea 25 a1 6f 30 22 39 cc 4f eb 80 ec b0 87 73 03 c9 e2 6f cb
                                                  Data Ascii: Db]Tb&]_f1y];B*/ZQ,N%$`#(%o0"9OsosUN^m9N)&8))QK}b9"@T~yu?V7j7y)vJ_EEW58X+:CP~T,{/s" a*=_lJ
                                                  Jul 22, 2024 12:35:33.510432959 CEST1236INData Raw: c6 ac fb 85 2b c7 a3 2f 2f d9 73 66 a6 d5 b3 dc bc 4c 89 64 2f f9 a1 b7 40 bf dd 84 b3 f4 0d 92 fa d2 49 45 fc 27 f8 14 9d 3f bd 02 3a c4 6a 3c 68 f4 ec 55 d8 20 1b ea 58 1f 15 63 0c 4e fc 76 39 e9 cc 71 40 69 5b b9 5b c5 4e 6d 50 82 e3 2b 3d 15
                                                  Data Ascii: +//sfLd/@IE'?:j<hU XcNv9q@i[[NmP+=127ZS$rHxh7[m15'1Z91 #%|^s\obPTPUO:$9pgLNTKqmc_xE]uUW\&6Ijo
                                                  Jul 22, 2024 12:35:33.510646105 CEST1236INData Raw: e7 41 3d ce 7d 33 4d 0f 6d da 2d 57 cd 6d 7c 72 20 41 5f e2 85 cb 48 2a 2c 1b 25 2d ea 0b 8c 30 58 68 ec 5b 67 54 17 0b 09 36 f0 a1 5f 55 d0 81 77 eb 76 58 90 be 59 9e ba 3f be 84 2b 42 29 6f 5c df c6 42 5f 49 8a 9f 97 26 07 55 9d da 50 6a e6 dc
                                                  Data Ascii: A=}3Mm-Wm|r A_H*,%-0Xh[gT6_UwvXY?+B)o\B_I&UPj?n,\_%N&gFx!7^"*w/:=\-?2$(<9#oPa7Z+iIU1B($k!XdI<#7s(,\~1~@SfHTn
                                                  Jul 22, 2024 12:35:33.510695934 CEST1236INData Raw: 20 19 6a 5f 78 89 c4 93 e5 38 5a 6e de 37 da e2 c6 06 b0 e8 f5 8e ec 2a 4d 52 53 7c c0 ce f1 b1 9d 84 d3 91 ba fc 29 13 39 6d 22 59 ca f4 90 ba 24 c3 b5 86 27 17 f3 8a b2 8c 0f d9 b9 6d 97 6d 9b 96 f5 eb e7 ae 0b 71 31 03 84 41 72 7d a7 8d f4 99
                                                  Data Ascii: j_x8Zn7*MRS|)9m"Y$'mmq1Ar}sWC@T^n2I%j+r|kpjq%<OjYSO)o+`qK18oLXG#F?sTds%>qWY2qf[n XR`
                                                  Jul 22, 2024 12:35:33.510710001 CEST1236INData Raw: d1 d2 9b 08 03 2c 5a d5 0d b5 24 ba 57 06 e9 82 13 06 b8 76 cd 11 85 df 30 60 c7 4a 68 fc 62 33 d3 a3 33 4a 36 3d a8 67 bb a3 56 33 7d 3d 9a 83 2c 2e ab 79 ba 0d fb 01 11 b8 6d 84 ce cd 88 2e 7d f5 4f 3e 3e d1 e4 3c 13 83 fa 27 77 82 c7 e2 d9 4b
                                                  Data Ascii: ,Z$Wv0`Jhb33J6=gV3}=,.ym.}O>><'wK\U}&El?<tl%}v%HSA*gH(vqd00Dan~Jlax_K9#+Rfl?uhLO{.FLRS
                                                  Jul 22, 2024 12:35:33.515579939 CEST1236INData Raw: 12 42 b8 dd e5 1f 9e 6b 33 d0 27 64 66 67 09 75 13 4e 4f e9 2f 56 c0 a1 26 a6 e7 0f 48 59 99 5e 9a 7b ee 13 0a e1 b2 7e 95 bf 06 41 45 43 c3 c5 43 45 37 b4 fd 4d f1 ee 9a 9c 98 53 15 42 01 8c fa ef a5 44 d0 97 33 99 81 2a 36 6b 2c 46 c1 0c 71 2f
                                                  Data Ascii: Bk3'dfguNO/V&HY^{~AECCE7MSBD3*6k,Fq/D:-E|OylOR-BS)2,o(P.Ibk@1F] 9X&;/<MZ5 `CLg`h*EH=|EZpoC/j{1,u;


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  111192.168.2.450213104.19.208.15280984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:35:36.233027935 CEST105OUTGET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Jul 22, 2024 12:35:36.736991882 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:35:36 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 9891
                                                  Connection: keep-alive
                                                  ETag: "3914547665"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 163
                                                  Expires: Mon, 22 Jul 2024 14:35:36 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c8f22d080f7c-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d [TRUNCATED]
                                                  Data Ascii: PKIX6%FeatureActions.txtBPZ&KE9(0p<a}9g<D)9k@4y'!=~Zk`1J2[)_,{FF?q;fL*=1ZI->m%>`ml,sWITPu*;Pxxhgl$M]I}ogZL5?BZLxukU1P4mW-Ntf?I-/!w90/^%X-.0(mVPn]=cr_A$<BWye2bK{jOdxZv@[NLDU|_1Sp~Paq>})$qH7,hm)Ias<TWu$?Ey@Xu@5*UJLja0v^Q (O}k+fwvfzbhFE<plLWZI*.4#,X`=beVW)W*;Q,'x>Jq _T<ea&wo/RM2`rXFEc:A97A4FT0@wuJIBd5Bhw}oE@N=Z$)6@sXru%eIg5ruA:81&"e_'Be
                                                  Jul 22, 2024 12:35:36.737015009 CEST1236INData Raw: aa 27 91 1f 4b c3 11 60 77 a1 43 f9 f7 10 07 63 36 80 1a 86 ad 48 a7 d3 8f 6f 01 ae 9e 9c 3f a2 79 6e 3b 81 f2 7e 33 72 dc 17 7b 3c b2 f2 80 9b 26 a0 a9 76 69 9d e2 6e 9e 4d 47 96 36 9b c5 b5 27 68 b5 b4 84 34 1c 56 23 a3 50 e1 9f 24 02 89 9a 6e
                                                  Data Ascii: 'K`wCc6Ho?yn;~3r{<&vinMG6'h4V#P$n/Kt'<4oOa"xGTVBfE<eG#Bw{#@mc]os}uE6@e`^](9A,NjbNYnOF\8p"CLFk
                                                  Jul 22, 2024 12:35:36.737030983 CEST1236INData Raw: fd ac 50 d8 52 44 ee 8b 8f d4 d8 b2 84 d1 cb d6 f7 f8 05 a5 aa 41 48 05 36 3c 93 56 87 e3 e6 2f 47 40 72 47 91 28 bd 1e de c7 43 06 15 aa c9 07 7f 4b 86 10 6b 1f 41 44 6f 91 db 30 a2 f9 46 11 1a 4b 58 16 a1 31 d1 5e b4 59 ca fc 47 fc bc 25 05 70
                                                  Data Ascii: PRDAH6<V/G@rG(CKkADo0FKX1^YG%p8P*rH|idu{"PBv`DWG&O*rD:V4#{>51Zy4U-&SSIgFkZpYN~L-6Fed~ex>3
                                                  Jul 22, 2024 12:35:36.737097025 CEST1236INData Raw: 88 a8 b4 43 f7 18 27 39 99 b5 09 5b b0 21 e4 89 cd dc d8 80 8f ba 2c 76 5f 49 78 e0 a0 e6 a4 e8 61 8a 0a 7d 07 ae 7f 5b db 69 5b ab 4d 22 92 db 0e dc 5e ef db 36 83 5e 63 58 81 45 75 40 0c 8a 74 59 c3 e4 31 78 2a c9 f9 39 82 db c7 d7 e1 67 09 f5
                                                  Data Ascii: C'9[!,v_Ixa}[i[M"^6^cXEu@tY1x*9g&LIY+5kR@v<a.{G`#|<rPgAn><AhcF1NG_d~JFS}=l-z%Q\)Zm?)^afu
                                                  Jul 22, 2024 12:35:36.737112999 CEST1236INData Raw: 51 a2 95 4e ba 4b 5c 16 c5 a5 51 be 5a 39 45 dd 17 61 63 b5 65 bb 34 9f 6d 7c 76 0b e7 cf 8a 28 b1 32 a3 4c 94 f3 9c 2d 3a d8 05 c3 70 d8 b9 9e ea 5e e2 8b aa 76 16 1e 66 9d 5b 09 8d b4 bd 0c df a4 f1 57 38 11 41 42 5a 8f 27 30 7a 45 dd 2c af 7e
                                                  Data Ascii: QNK\QZ9Eace4m|v(2L-:p^vf[W8ABZ'0zE,~iY~^UiH-E`79_ue_f!t,f-X9^y0jgsotF8rUFX3\"T5p3WJBORFv
                                                  Jul 22, 2024 12:35:36.737129927 CEST1236INData Raw: ad 53 b8 3f 1e d4 8d 8b fb 22 dd 51 13 da db 37 c1 6d 8a c5 7d 9b 47 42 3f 8e c9 f0 52 59 f2 14 2a 9e 75 2e 6a 2e 7b 93 ce 8d 7f 03 7e d5 5c fc 25 45 10 44 72 a8 87 1c d2 e8 6e 79 f4 3a 12 2f 87 97 f4 7d 88 08 2a 70 f8 25 43 fc 4b 2d f3 25 a3 5d
                                                  Data Ascii: S?"Q7m}GB?RY*u.j.{~\%EDrny:/}*p%CK-%]F?TSkSG-^Bgv[1K+k9v&plE0P8t}BnUJXhBDBlfbG7Fsq3BI{?3>n
                                                  Jul 22, 2024 12:35:36.737329960 CEST1236INData Raw: 98 44 c0 9d 35 87 31 5c f2 45 f9 c7 ef 27 c4 f0 44 cb 1d 0f 1c d1 37 2a fd 7f 20 4f 38 65 99 02 a1 9a ea fd 15 94 74 5c 15 e4 8a 30 a5 11 66 30 df 52 31 9c c6 28 24 8c 3e 6f 18 50 ce cd 5b 40 65 9a 59 06 f5 bf 1e 38 1f 30 99 1f 31 4f 2a 69 da 0b
                                                  Data Ascii: D51\E'D7* O8et\0f0R1($>oP[@eY801O*iT2@#l0*z<F4a/dUF5iAzDScUSK:;{qQ.29h}w$/SZ24d2%h@"IT*w;W<-f.7p=ei ^C\aP`RyHaC!
                                                  Jul 22, 2024 12:35:36.737345934 CEST1236INData Raw: 39 ba ca 62 79 64 b1 96 fc a3 e4 33 18 bf f2 b3 53 33 28 3d 94 63 da fc df 9a ab 61 96 4f fd 8f 75 23 dd b5 d3 bd b5 31 ab e5 e1 6d de 8b 88 11 1d 05 ed 75 9d 2f 58 00 23 9c b7 5e 9c be d2 46 a0 2b 67 71 a6 f8 75 c0 5f 80 c9 c6 7f 3b c9 9d 1b 53
                                                  Data Ascii: 9byd3S3(=caOu#1mu/X#^F+gqu_;Sv_HO=[Ipy`9|;!&uEv@~q+"`T].@ON/,V]Bn`;LGQNL0j*\x8j8cpo;Y|1x[
                                                  Jul 22, 2024 12:35:36.737360001 CEST384INData Raw: e7 b8 35 15 54 a9 22 01 ba 8d 73 41 22 2d 5f 1c e5 c1 6a 64 1c 3a 02 da 84 ef c5 74 bd 9f 23 d9 32 44 34 28 27 d7 07 95 69 6b 95 3f 18 37 32 d0 a9 81 eb a5 e0 47 f9 bd 0e ce d3 e3 4e d2 40 77 fe 00 a1 df bb a6 9f 2e ba ee eb a2 f0 8c 0d bc fe f1
                                                  Data Ascii: 5T"sA"-_jd:t#2D4('ik?72GN@w.o[C4PcJ3 [mrE&r8U,%,uzs(q7r%Hr1]>D!M#C7xJW/5oZ~Wr4gB6SE^C8LT_4'8rC&:<uMz


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  112192.168.2.450214104.16.149.13080984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:35:36.367593050 CEST155OUTPOST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 239
                                                  Jul 22, 2024 12:35:36.372436047 CEST239OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","CurrentSearch":"Google","CurrentHomepage":"about:home","LanguageIso2":"en-GB","IP":null,"CreateDate":0}}
                                                  Jul 22, 2024 12:35:36.859102964 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:35:36 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c8f2ddaf8cca-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  113192.168.2.450215104.19.208.15280984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:35:37.119968891 CEST89OUTGET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Jul 22, 2024 12:35:37.608522892 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:35:37 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 17770
                                                  Connection: keep-alive
                                                  ETag: "770472110"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 467
                                                  Expires: Mon, 22 Jul 2024 14:35:37 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c8f7a8da80e2-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 [TRUNCATED]
                                                  Data Ascii: PK:=AX7\0DrActiveFeatures.txt+@sjp#K1;/-[[ABexq)7 7:^gK !ibUVsO$v7|e\W'ZdveU*oR>%w$-;Q4Tf$+T$&Q?9#"6>0o@j(*i)H"B1`=&0I8CR"ycM7g\@8xE4S|Iyy7~%W?7!JhrfdB^OQ"IDG!o+^6VY6<wNNPP2\?EY^j>i[p`L_sXq>#~nY>LO9rsAS+g5FBiqgUf{*vBUBqTpKF;/[&WIAPuS-&v3!Y'bMl{[:5sVL3om7'O4'(V#:\#VOO&<s}Yd|<P@jM%O5lHs^SYfaCDDwVcE8~cETL0YIEd@._PQ~w\fAT7Kiywq|+#]N">(A0bU-lDM#ETYa-h}ep<),
                                                  Jul 22, 2024 12:35:37.608552933 CEST1236INData Raw: c3 e9 0b b5 94 79 f6 cd ab db ef 95 d6 d1 32 bc 03 27 b0 a7 67 bb 67 5c 5f 47 4a 97 f1 f7 fc 80 a5 3d 5e cb d2 21 fd 16 4d f6 ed 94 f2 d0 41 ec b6 8d 9b cb af 44 4b 5e 3f 92 fc ae 08 db 64 a5 1d 86 78 29 a2 a9 c5 2d c1 7a 36 38 e0 81 84 1a 34 f5
                                                  Data Ascii: y2'gg\_GJ=^!MADK^?dx)-z684R|YSgynUf1qbEFO?'[a`bF\rsZL0q\vgrP:ZbPw^l^|Vov^'D0\mJh*I{X14
                                                  Jul 22, 2024 12:35:37.608572960 CEST1236INData Raw: e3 09 b7 93 e7 ef 55 87 a5 e2 4a 0e 55 3c 50 4f 28 65 ca 9a de 34 88 d5 59 ab cd 64 54 2a 94 93 b6 b8 c7 f1 34 a6 fe 9a 9e 58 e1 5b 68 04 08 88 1d 07 7a 22 8c f4 8b 1a 37 f4 2d 18 02 f7 c9 7a e3 8d 30 e6 e5 c6 72 4a b5 33 12 97 f2 9b 9f 3d 2b 49
                                                  Data Ascii: UJU<PO(e4YdT*4X[hz"7-z0rJ3=+I:QrVjeAU|0e r.-nFs%U@_G~W}E^ns]W6.Jg4)Kk~9"4{i#W}_&L'HNOp
                                                  Jul 22, 2024 12:35:37.608603954 CEST672INData Raw: a2 40 45 ad 3e 10 cc d4 22 b8 18 aa b5 83 15 5b 5f 79 62 da f6 64 de 89 40 91 c6 e3 e6 3c 48 f6 f2 37 d0 b4 a2 87 ed 8b 72 11 f9 fa 1d 84 ca dd 63 7c e6 56 65 74 e8 c3 ce 0a 52 78 3d f5 2c 69 ad 82 46 5f 21 19 b5 ed d3 bf 7e 98 76 8d 6a 94 b7 ed
                                                  Data Ascii: @E>"[_ybd@<H7rc|VetRx=,iF_!~vj5s,yL/[g{QosVz%{A|PSeC)PYzSZ/]E?kINr|Pg!\2-;@&Lb<maS
                                                  Jul 22, 2024 12:35:37.608619928 CEST1236INData Raw: 1f 5f 95 40 e0 2f 2f b3 58 36 a8 5f 26 2b c1 d7 d8 86 95 ec 9b 23 f0 6b a3 48 55 63 47 ab 98 a2 7c a9 9d 44 46 9a cb 72 d4 ab 80 27 62 e2 20 b8 23 fe ab f6 c3 e1 79 ff 0e d6 3c ae d6 7b e4 a2 37 6f 8b fd 67 76 72 8f 8e e1 72 fa 02 77 a5 81 f5 71
                                                  Data Ascii: _@//X6_&+#kHUcG|DFr'b #y<{7ogvrrwq&PsTo=D8?^7(Xg@1~;sJa\o%PX=$cvb7fS:."$qC!QFmfWCW#H]WNsiz %Na)
                                                  Jul 22, 2024 12:35:37.608655930 CEST1236INData Raw: 67 d8 a1 30 25 3f 02 55 01 20 6a 51 4c 25 98 eb 97 f9 7e 66 ee d7 b1 f9 f9 c8 52 7e e9 cc 8c e0 85 81 9e 75 92 0d 4f 55 71 18 6b 3b 1f c1 38 42 6b c9 86 6d cb de b0 bc b5 62 17 da 81 40 69 af 0f ae 34 73 51 45 5a 4f 43 9b dc 83 af 7b a1 89 68 fd
                                                  Data Ascii: g0%?U jQL%~fR~uOUqk;8Bkmb@i4sQEZOC{h'VuuDyznvDn(&J;Px=Uc05;VT7!X<lA"}#&7qB(m5-r#N)4z7Axi)8r
                                                  Jul 22, 2024 12:35:37.608791113 CEST1236INData Raw: 4c 5f 22 a6 8e 97 9a b0 ae 42 00 ee 93 fe be c4 67 bd a1 03 61 4e 84 cb a0 67 6a e2 91 dc 77 40 da 04 53 1c 7e 5e 16 ac 6c 1f ad 21 43 29 ae 3c b5 6d 41 17 ce 99 37 75 7e 83 67 64 da 98 5f 52 48 92 39 2f a2 7b 79 5a a9 1c 84 29 a1 75 fe 35 2d ea
                                                  Data Ascii: L_"BgaNgjw@S~^l!C)<mA7u~gd_RH9/{yZ)u5-U|1.rwx#x{LOmV>y)YT+h"j^mf}xmk{KE[.ntTv#odHsfIu4@/=i ,Dm4%,],>A3
                                                  Jul 22, 2024 12:35:37.608824015 CEST1236INData Raw: 75 6b 9d 8e 72 bf 44 65 cd 9c 9a 81 c2 f5 91 b3 95 bd 7b f5 9b de 51 be c3 87 77 77 67 95 16 8e 08 8e 1a 8e 6e c8 38 25 3e bd 63 08 bf 5a 34 ee d4 84 0d 42 59 77 2e 68 0a cb 58 92 56 1e 99 7e 84 53 66 25 79 5a d7 07 7c 54 81 63 e7 ae b9 a1 c5 26
                                                  Data Ascii: ukrDe{Qwwgn8%>cZ4BYw.hXV~Sf%yZ|Tc&=0q5WKl\<U9$DW`+R ]m-68j5a.|sOB~1zc[ugQ>Tv~Fa&<pX caENsE0aUC3WE4e
                                                  Jul 22, 2024 12:35:37.608856916 CEST1236INData Raw: f9 3e cc a5 15 56 a3 fe af c3 ae f4 bf 6c 0a 0a b9 c0 08 ad a0 b3 98 77 db d1 2a a8 8c 8b 5c 92 11 d5 ff b8 b8 3d fa 21 dd 30 57 52 0f 90 76 97 46 49 f3 b0 f5 1b b1 d7 21 08 dd d8 77 eb 88 74 07 5c 0f f6 4f 41 ea 5c 09 37 2b b0 f3 16 f6 1c 9c 0d
                                                  Data Ascii: >Vlw*\=!0WRvFI!wt\OA\7+y;#+KsF14:FD[Re e#Hd5I.*p{o.H'*|a2iZ.Yp?X=[I\V~^{z7F: G5C*w 0sB=
                                                  Jul 22, 2024 12:35:37.608891010 CEST552INData Raw: b1 86 60 62 c7 ed 7f be af 7b 96 5f 3d 9d 9d 0b 56 26 89 40 3d 3d 97 72 1b ff ea ff 35 46 a1 b9 be f8 fb 17 02 f9 23 5a 8c 2f 75 73 1d 7f e5 15 20 69 d1 52 03 6b f3 fa 6b 65 c5 b8 c6 cd 06 e9 35 8a c7 49 1e 7f 22 66 29 5b 8c 7b b9 3b fa e7 df 0d
                                                  Data Ascii: `b{_=V&@==r5F#Z/us iRkke5I"f)[{;5j0F7$v4Jo4c+;J|#0,N9Mu'l^DF+iL4\WB>To*+hiZa;;-c.T12=ZLXZbdBNRy
                                                  Jul 22, 2024 12:35:37.613928080 CEST1236INData Raw: 1d 91 a7 27 8a 36 6b f3 5e 86 22 70 d1 d2 9b 08 03 2c 5a d5 0d b5 24 ba 57 06 e9 82 13 06 b8 76 cd 11 85 df 30 60 c7 4a 68 fc 62 33 d3 a3 33 4a 36 3d a8 67 bb a3 56 33 7d 3d 9a 83 2c 2e ab 79 ba 0d fb 01 11 b8 6d 84 ce cd 88 2e 7d f5 4f 3e 3e d1
                                                  Data Ascii: '6k^"p,Z$Wv0`Jhb33J6=gV3}=,.ym.}O>><'wK\U}&El?<tl%}v%HSA*gH(vqd00Dan~Jlax_K9#+Rfl?uhLO{


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  114192.168.2.450220104.19.208.15280940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:35:38.679183960 CEST89OUTGET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Jul 22, 2024 12:35:38.977971077 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:35:38 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 17770
                                                  Connection: keep-alive
                                                  ETag: "770472110"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 468
                                                  Expires: Mon, 22 Jul 2024 14:35:38 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c90038b718d0-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 [TRUNCATED]
                                                  Data Ascii: PK:=AX7\0DrActiveFeatures.txt+@sjp#K1;/-[[ABexq)7 7:^gK !ibUVsO$v7|e\W'ZdveU*oR>%w$-;Q4Tf$+T$&Q?9#"6>0o@j(*i)H"B1`=&0I8CR"ycM7g\@8xE4S|Iyy7~%W?7!JhrfdB^OQ"IDG!o+^6VY6<wNNPP2\?EY^j>i[p`L_sXq>#~nY>LO9rsAS+g5FBiqgUf{*vBUBqTpKF;/[&WIAPuS-&v3!Y'bMl{[:5sVL3om7'O4'(V#:\#VOO&<s}Yd|<P@jM%O5lHs^SYfaCDDwVcE8~cETL0YIEd@._PQ~w\fAT7Kiywq|+#]N">(A0bU-lDM#ETYa-h}ep<),
                                                  Jul 22, 2024 12:35:38.978024006 CEST1236INData Raw: c3 e9 0b b5 94 79 f6 cd ab db ef 95 d6 d1 32 bc 03 27 b0 a7 67 bb 67 5c 5f 47 4a 97 f1 f7 fc 80 a5 3d 5e cb d2 21 fd 16 4d f6 ed 94 f2 d0 41 ec b6 8d 9b cb af 44 4b 5e 3f 92 fc ae 08 db 64 a5 1d 86 78 29 a2 a9 c5 2d c1 7a 36 38 e0 81 84 1a 34 f5
                                                  Data Ascii: y2'gg\_GJ=^!MADK^?dx)-z684R|YSgynUf1qbEFO?'[a`bF\rsZL0q\vgrP:ZbPw^l^|Vov^'D0\mJh*I{X14
                                                  Jul 22, 2024 12:35:38.978035927 CEST1236INData Raw: e3 09 b7 93 e7 ef 55 87 a5 e2 4a 0e 55 3c 50 4f 28 65 ca 9a de 34 88 d5 59 ab cd 64 54 2a 94 93 b6 b8 c7 f1 34 a6 fe 9a 9e 58 e1 5b 68 04 08 88 1d 07 7a 22 8c f4 8b 1a 37 f4 2d 18 02 f7 c9 7a e3 8d 30 e6 e5 c6 72 4a b5 33 12 97 f2 9b 9f 3d 2b 49
                                                  Data Ascii: UJU<PO(e4YdT*4X[hz"7-z0rJ3=+I:QrVjeAU|0e r.-nFs%U@_G~W}E^ns]W6.Jg4)Kk~9"4{i#W}_&L'HNOp
                                                  Jul 22, 2024 12:35:38.978188038 CEST1236INData Raw: a2 40 45 ad 3e 10 cc d4 22 b8 18 aa b5 83 15 5b 5f 79 62 da f6 64 de 89 40 91 c6 e3 e6 3c 48 f6 f2 37 d0 b4 a2 87 ed 8b 72 11 f9 fa 1d 84 ca dd 63 7c e6 56 65 74 e8 c3 ce 0a 52 78 3d f5 2c 69 ad 82 46 5f 21 19 b5 ed d3 bf 7e 98 76 8d 6a 94 b7 ed
                                                  Data Ascii: @E>"[_ybd@<H7rc|VetRx=,iF_!~vj5s,yL/[g{QosVz%{A|PSeC)PYzSZ/]E?kINr|Pg!\2-;@&Lb<maS
                                                  Jul 22, 2024 12:35:38.978199959 CEST896INData Raw: ef ec e3 a3 78 02 50 1e 6e 18 3a c8 ef 40 01 47 df 2f 67 75 81 ee e7 ed 5c 86 a7 cd ff 50 b9 61 08 00 fa a5 b9 0e 2f 50 8f 87 fd 80 44 ec bf 7d 28 a2 50 86 c4 d0 81 34 04 f9 9d 19 90 5d 6c c8 6f a3 82 62 5f 8a 77 97 ae e6 15 32 ec 5b 3c d5 d1 50
                                                  Data Ascii: xPn:@G/gu\Pa/PD}(P4]lob_w2[<Pz|<gzX],af!:$uMs)m74Tf8Q0Ee@>i~p#D'uma{4q-x.{W)x,0Fm'*wTn
                                                  Jul 22, 2024 12:35:38.978212118 CEST1236INData Raw: 34 7a 37 eb 41 78 0e 69 ee 11 1c f5 8d 29 8d ef b3 38 72 f5 f7 cc fb 36 a3 c2 33 d4 82 c1 58 75 70 0c 5f 55 99 f6 e2 74 8f d1 5e 0b e5 76 62 a3 7a f8 a5 65 a6 ea 05 07 b9 eb 1e 5f bd 75 b6 c2 cc 94 6a a2 22 b3 d0 66 95 e4 94 13 d8 c8 ec e4 19 65
                                                  Data Ascii: 4z7Axi)8r63Xup_Ut^vbze_uj"feJ\<2FU[eLEcRkpa:wczZ;Q,T8[e?9`zhz&T*yQ4#'f+qT^Kk2}3cbN*B128SiC'wA0S
                                                  Jul 22, 2024 12:35:38.978223085 CEST1236INData Raw: 34 25 2c e5 9d 5d ed b5 e1 2c a7 3e 41 d6 a0 33 a8 93 ff c5 15 81 3d ce 94 01 98 a4 ff 99 54 e9 36 32 86 38 39 e8 14 27 87 a9 a8 9f f0 c1 3b 3a a6 4c fd 4a cf 51 44 77 61 5c 29 51 4a 98 3b 05 86 8d 76 04 df a6 3d d8 93 02 c0 90 00 e2 f0 b2 d1 83
                                                  Data Ascii: 4%,],>A3=T6289';:LJQDwa\)QJ;v=5i6we/YIa]ge:8J9a-HFpRD:}]8@4FG`t3b3Aci,JJ<G!:c`u,,g/h9FrxuuH?
                                                  Jul 22, 2024 12:35:38.978234053 CEST1236INData Raw: d0 f6 cb d1 b3 61 55 fa a4 43 33 57 d3 0e 45 b7 ed 34 65 50 30 eb db fd 21 57 25 e2 b9 5d 8b 01 56 d6 0f a7 e6 e8 ca 4b 1d 77 ed 37 d5 75 0f 3a 55 77 60 b3 3d 6e 16 26 b9 f0 de 11 f8 a3 6c 90 d4 5c dc 72 5c 30 6b 99 58 be 4c 30 6e 29 14 76 6e e0
                                                  Data Ascii: aUC3WE4eP0!W%]VKw7u:Uw`=n&l\r\0kXL0n)vneEw6h,{>VoJ[,"W2F##bl'h~T1&Cs_e-VYo[*r/zrC3{|Bt93CQ>E
                                                  Jul 22, 2024 12:35:38.979285955 CEST1236INData Raw: cb 2a 77 20 e5 30 06 0d 12 0f ce a0 a1 e4 a2 73 cb 42 3d 7a 87 cf 2b 4b a6 8c ef a7 33 77 c3 87 56 b0 a8 7d 61 53 08 eb 29 e8 42 6c 83 f3 55 44 60 61 ad b4 90 25 b4 10 8c 7a 04 31 2d f5 10 2f 61 7b 61 5a 40 a5 05 22 ef f9 09 3b 41 f7 73 57 a0 b1
                                                  Data Ascii: *w 0sB=z+K3wV}aS)BlUD`a%z1-/a{aZ@";AsW_DL[hArN~+;6]._#idF B;}+DIKv={k5G7>UPg-`N(w4!*@1?3@$Ji._r?aa_U
                                                  Jul 22, 2024 12:35:38.979302883 CEST1236INData Raw: b9 f2 d3 4c dc 58 95 5a 62 64 42 4e ba 0c 03 cb 52 79 d5 8d a2 fc 69 62 5b a7 46 45 a4 a7 8c 82 b3 e4 ed 76 ff b0 2e 3d 4b 87 33 1d 13 36 41 23 3a ef 4f 7f 83 bc 01 18 d8 ce ac 1b 15 fa ca d4 3b df c7 93 23 1b 4d 6a c4 4a 8a 3f fa 4e 10 f1 37 1a
                                                  Data Ascii: LXZbdBNRyib[FEv.=K36A#:O;#MjJ?N7k]^0huT [^o}r{498Q`JN<,R*je7Ij+{bZwziN}jN\qEcC\Esonti
                                                  Jul 22, 2024 12:35:38.984460115 CEST1236INData Raw: a4 07 67 23 06 91 b8 3a ff 7a c9 ec ef ba 9a 45 66 97 b6 21 25 5a 77 c7 6b a3 ff 3d c6 36 5e f1 64 1e 03 a2 d8 24 fa 3f 2e 85 88 e2 83 61 22 d8 68 dc ea fc f5 5a 9b 1a 4c 91 e3 d0 a5 6a 88 4d 6c 1c ed e6 b0 3a 61 f8 b0 5d e4 8b 4a cb 21 60 77 f2
                                                  Data Ascii: g#:zEf!%Zwk=6^d$?.a"hZLjMl:a]J!`wVRDwa*|bM#lx8aE%~~xLx)o_*[8lY)z(x~z-$Tg:$BD@uEHq\=*,LH+


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  115192.168.2.450222104.19.208.15280940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:35:38.679342031 CEST105OUTGET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Jul 22, 2024 12:35:38.981471062 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:35:38 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 9891
                                                  Connection: keep-alive
                                                  ETag: "3914547665"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 165
                                                  Expires: Mon, 22 Jul 2024 14:35:38 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c9003ca74350-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d [TRUNCATED]
                                                  Data Ascii: PKIX6%FeatureActions.txtBPZ&KE9(0p<a}9g<D)9k@4y'!=~Zk`1J2[)_,{FF?q;fL*=1ZI->m%>`ml,sWITPu*;Pxxhgl$M]I}ogZL5?BZLxukU1P4mW-Ntf?I-/!w90/^%X-.0(mVPn]=cr_A$<BWye2bK{jOdxZv@[NLDU|_1Sp~Paq>})$qH7,hm)Ias<TWu$?Ey@Xu@5*UJLja0v^Q (O}k+fwvfzbhFE<plLWZI*.4#,X`=beVW)W*;Q,'x>Jq _T<ea&wo/RM2`rXFEc:A97A4FT0@wuJIBd5Bhw}oE@N=Z$)6@sXru%eIg5ruA:81&"e_'Be
                                                  Jul 22, 2024 12:35:38.981483936 CEST1236INData Raw: aa 27 91 1f 4b c3 11 60 77 a1 43 f9 f7 10 07 63 36 80 1a 86 ad 48 a7 d3 8f 6f 01 ae 9e 9c 3f a2 79 6e 3b 81 f2 7e 33 72 dc 17 7b 3c b2 f2 80 9b 26 a0 a9 76 69 9d e2 6e 9e 4d 47 96 36 9b c5 b5 27 68 b5 b4 84 34 1c 56 23 a3 50 e1 9f 24 02 89 9a 6e
                                                  Data Ascii: 'K`wCc6Ho?yn;~3r{<&vinMG6'h4V#P$n/Kt'<4oOa"xGTVBfE<eG#Bw{#@mc]os}uE6@e`^](9A,NjbNYnOF\8p"CLFk
                                                  Jul 22, 2024 12:35:38.981496096 CEST1236INData Raw: fd ac 50 d8 52 44 ee 8b 8f d4 d8 b2 84 d1 cb d6 f7 f8 05 a5 aa 41 48 05 36 3c 93 56 87 e3 e6 2f 47 40 72 47 91 28 bd 1e de c7 43 06 15 aa c9 07 7f 4b 86 10 6b 1f 41 44 6f 91 db 30 a2 f9 46 11 1a 4b 58 16 a1 31 d1 5e b4 59 ca fc 47 fc bc 25 05 70
                                                  Data Ascii: PRDAH6<V/G@rG(CKkADo0FKX1^YG%p8P*rH|idu{"PBv`DWG&O*rD:V4#{>51Zy4U-&SSIgFkZpYN~L-6Fed~ex>3
                                                  Jul 22, 2024 12:35:38.981515884 CEST1236INData Raw: 88 a8 b4 43 f7 18 27 39 99 b5 09 5b b0 21 e4 89 cd dc d8 80 8f ba 2c 76 5f 49 78 e0 a0 e6 a4 e8 61 8a 0a 7d 07 ae 7f 5b db 69 5b ab 4d 22 92 db 0e dc 5e ef db 36 83 5e 63 58 81 45 75 40 0c 8a 74 59 c3 e4 31 78 2a c9 f9 39 82 db c7 d7 e1 67 09 f5
                                                  Data Ascii: C'9[!,v_Ixa}[i[M"^6^cXEu@tY1x*9g&LIY+5kR@v<a.{G`#|<rPgAn><AhcF1NG_d~JFS}=l-z%Q\)Zm?)^afu
                                                  Jul 22, 2024 12:35:38.981527090 CEST1236INData Raw: 51 a2 95 4e ba 4b 5c 16 c5 a5 51 be 5a 39 45 dd 17 61 63 b5 65 bb 34 9f 6d 7c 76 0b e7 cf 8a 28 b1 32 a3 4c 94 f3 9c 2d 3a d8 05 c3 70 d8 b9 9e ea 5e e2 8b aa 76 16 1e 66 9d 5b 09 8d b4 bd 0c df a4 f1 57 38 11 41 42 5a 8f 27 30 7a 45 dd 2c af 7e
                                                  Data Ascii: QNK\QZ9Eace4m|v(2L-:p^vf[W8ABZ'0zE,~iY~^UiH-E`79_ue_f!t,f-X9^y0jgsotF8rUFX3\"T5p3WJBORFv
                                                  Jul 22, 2024 12:35:38.981539011 CEST1120INData Raw: ad 53 b8 3f 1e d4 8d 8b fb 22 dd 51 13 da db 37 c1 6d 8a c5 7d 9b 47 42 3f 8e c9 f0 52 59 f2 14 2a 9e 75 2e 6a 2e 7b 93 ce 8d 7f 03 7e d5 5c fc 25 45 10 44 72 a8 87 1c d2 e8 6e 79 f4 3a 12 2f 87 97 f4 7d 88 08 2a 70 f8 25 43 fc 4b 2d f3 25 a3 5d
                                                  Data Ascii: S?"Q7m}GB?RY*u.j.{~\%EDrny:/}*p%CK-%]F?TSkSG-^Bgv[1K+k9v&plE0P8t}BnUJXhBDBlfbG7Fsq3BI{?3>n
                                                  Jul 22, 2024 12:35:38.981549978 CEST1236INData Raw: 0f ed bf 5b 41 ea e0 78 5c be 81 17 59 35 8b 49 8c 70 b0 8f f0 58 1a 25 5d 0c 15 83 da 39 3b 1d 0b 72 1a cb 82 c8 db e2 06 66 bb 47 b1 f1 87 3d 67 99 5f 38 7a 26 ee 61 9c e0 46 9b 1e 2f d0 1a 9e 65 1b 2b b0 6f e9 a0 dd c3 70 98 4c c4 b1 8a 17 09
                                                  Data Ascii: [Ax\Y5IpX%]9;rfG=g_8z&aF/e+opLeh?pylw:\6qd54D51\E'D7* O8et\0f0R1($>oP[@eY801O*iT2@#l0*z<F4a/dUF5iAzDS
                                                  Jul 22, 2024 12:35:38.981564045 CEST1236INData Raw: 86 8e 12 10 30 02 1c a7 35 8f 12 04 ff 2a 2e 52 e8 77 ea 4f 30 6a 59 14 65 84 1f 7a 24 8b 1f 7d 2e 35 aa b8 06 ce 26 68 d3 35 35 0c cb 78 b6 b2 42 71 7f 6e 21 e1 b1 cf c6 7c 01 19 fd 82 46 d7 ad 91 87 e0 0c a1 8f 79 8d 01 2f 30 92 2b 7c 74 a4 ee
                                                  Data Ascii: 05*.RwO0jYez$}.5&h55xBqn!|Fy/0+|t>=!t]Z-+^j9byd3S3(=caOu#1mu/X#^F+gqu_;Sv_HO=[Ipy`9|
                                                  Jul 22, 2024 12:35:38.981579065 CEST500INData Raw: 20 d7 a4 60 f6 a6 cc 9b 6f a8 33 96 16 f4 ea f4 c9 98 6f 73 2d 22 c3 5b 3b 5c d2 ce d3 8d 05 79 ec 9f 69 d6 fa d6 d9 d1 f1 55 ca 9a ed 8f fb 59 93 69 fd 8e 64 fa a6 b5 36 99 76 6b 74 68 cd 54 0d 7c 47 cb 9d 38 3c 46 a2 83 87 37 80 86 9a e6 86 05
                                                  Data Ascii: `o3os-"[;\yiUYid6vkthT|G8<F7zaJ%)u?7gAjbpp1%P5T"sA"-_jd:t#2D4('ik?72GN@w.o[C4PcJ3 [mrE&r8U,%,u
                                                  Jul 22, 2024 12:35:39.017368078 CEST105OUTGET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Jul 22, 2024 12:35:39.143812895 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:35:39 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 9891
                                                  Connection: keep-alive
                                                  ETag: "3914547665"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 166
                                                  Expires: Mon, 22 Jul 2024 14:35:39 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c9012d204350-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d [TRUNCATED]
                                                  Data Ascii: PKIX6%FeatureActions.txtBPZ&KE9(0p<a}9g<D)9k@4y'!=~Zk`1J2[)_,{FF?q;fL*=1ZI->m%>`ml,sWITPu*;Pxxhgl$M]I}ogZL5?BZLxukU1P4mW-Ntf?I-/!w90/^%X-.0(mVPn]=cr_A$<BWye2bK{jOdxZv@[NLDU|_1Sp~Paq>})$qH7,hm)Ias<TWu$?Ey@Xu@5*UJLja0v^Q (O}k+fwvfzbhFE<plLWZI*.4#,X`=beVW)W*;Q,'x>Jq _T<ea&wo/RM2`rXFEc:A97A4FT0@wuJIBd5Bhw}oE@N=Z$)6@sXru%eIg5ruA:81&"e_'Be
                                                  Jul 22, 2024 12:35:39.143850088 CEST1236INData Raw: aa 27 91 1f 4b c3 11 60 77 a1 43 f9 f7 10 07 63 36 80 1a 86 ad 48 a7 d3 8f 6f 01 ae 9e 9c 3f a2 79 6e 3b 81 f2 7e 33 72 dc 17 7b 3c b2 f2 80 9b 26 a0 a9 76 69 9d e2 6e 9e 4d 47 96 36 9b c5 b5 27 68 b5 b4 84 34 1c 56 23 a3 50 e1 9f 24 02 89 9a 6e
                                                  Data Ascii: 'K`wCc6Ho?yn;~3r{<&vinMG6'h4V#P$n/Kt'<4oOa"xGTVBfE<eG#Bw{#@mc]os}uE6@e`^](9A,NjbNYnOF\8p"CLFk
                                                  Jul 22, 2024 12:35:39.143866062 CEST1236INData Raw: fd ac 50 d8 52 44 ee 8b 8f d4 d8 b2 84 d1 cb d6 f7 f8 05 a5 aa 41 48 05 36 3c 93 56 87 e3 e6 2f 47 40 72 47 91 28 bd 1e de c7 43 06 15 aa c9 07 7f 4b 86 10 6b 1f 41 44 6f 91 db 30 a2 f9 46 11 1a 4b 58 16 a1 31 d1 5e b4 59 ca fc 47 fc bc 25 05 70
                                                  Data Ascii: PRDAH6<V/G@rG(CKkADo0FKX1^YG%p8P*rH|idu{"PBv`DWG&O*rD:V4#{>51Zy4U-&SSIgFkZpYN~L-6Fed~ex>3


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  116192.168.2.450227104.19.208.15280984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:35:39.177632093 CEST113OUTGET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Connection: Keep-Alive
                                                  Jul 22, 2024 12:35:39.707201004 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:35:39 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 17770
                                                  Connection: keep-alive
                                                  ETag: "770472110"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 469
                                                  Expires: Mon, 22 Jul 2024 14:35:39 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c904cb0d0f84-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 [TRUNCATED]
                                                  Data Ascii: PK:=AX7\0DrActiveFeatures.txt+@sjp#K1;/-[[ABexq)7 7:^gK !ibUVsO$v7|e\W'ZdveU*oR>%w$-;Q4Tf$+T$&Q?9#"6>0o@j(*i)H"B1`=&0I8CR"ycM7g\@8xE4S|Iyy7~%W?7!JhrfdB^OQ"IDG!o+^6VY6<wNNPP2\?EY^j>i[p`L_sXq>#~nY>LO9rsAS+g5FBiqgUf{*vBUBqTpKF;/[&WIAPuS-&v3!Y'bMl{[:5sVL3om7'O4'(V#:\#VOO&<s}Yd|<P@jM%O5lHs^SYfaCDDwVcE8~cETL0YIEd@._PQ~w\fAT7Kiywq|+#]N">(A0bU-lDM#ETYa-h}ep<),
                                                  Jul 22, 2024 12:35:39.707391024 CEST1236INData Raw: c3 e9 0b b5 94 79 f6 cd ab db ef 95 d6 d1 32 bc 03 27 b0 a7 67 bb 67 5c 5f 47 4a 97 f1 f7 fc 80 a5 3d 5e cb d2 21 fd 16 4d f6 ed 94 f2 d0 41 ec b6 8d 9b cb af 44 4b 5e 3f 92 fc ae 08 db 64 a5 1d 86 78 29 a2 a9 c5 2d c1 7a 36 38 e0 81 84 1a 34 f5
                                                  Data Ascii: y2'gg\_GJ=^!MADK^?dx)-z684R|YSgynUf1qbEFO?'[a`bF\rsZL0q\vgrP:ZbPw^l^|Vov^'D0\mJh*I{X14
                                                  Jul 22, 2024 12:35:39.707410097 CEST1236INData Raw: e3 09 b7 93 e7 ef 55 87 a5 e2 4a 0e 55 3c 50 4f 28 65 ca 9a de 34 88 d5 59 ab cd 64 54 2a 94 93 b6 b8 c7 f1 34 a6 fe 9a 9e 58 e1 5b 68 04 08 88 1d 07 7a 22 8c f4 8b 1a 37 f4 2d 18 02 f7 c9 7a e3 8d 30 e6 e5 c6 72 4a b5 33 12 97 f2 9b 9f 3d 2b 49
                                                  Data Ascii: UJU<PO(e4YdT*4X[hz"7-z0rJ3=+I:QrVjeAU|0e r.-nFs%U@_G~W}E^ns]W6.Jg4)Kk~9"4{i#W}_&L'HNOp
                                                  Jul 22, 2024 12:35:39.707423925 CEST1236INData Raw: a2 40 45 ad 3e 10 cc d4 22 b8 18 aa b5 83 15 5b 5f 79 62 da f6 64 de 89 40 91 c6 e3 e6 3c 48 f6 f2 37 d0 b4 a2 87 ed 8b 72 11 f9 fa 1d 84 ca dd 63 7c e6 56 65 74 e8 c3 ce 0a 52 78 3d f5 2c 69 ad 82 46 5f 21 19 b5 ed d3 bf 7e 98 76 8d 6a 94 b7 ed
                                                  Data Ascii: @E>"[_ybd@<H7rc|VetRx=,iF_!~vj5s,yL/[g{QosVz%{A|PSeC)PYzSZ/]E?kINr|Pg!\2-;@&Lb<maS
                                                  Jul 22, 2024 12:35:39.707437992 CEST1236INData Raw: ef ec e3 a3 78 02 50 1e 6e 18 3a c8 ef 40 01 47 df 2f 67 75 81 ee e7 ed 5c 86 a7 cd ff 50 b9 61 08 00 fa a5 b9 0e 2f 50 8f 87 fd 80 44 ec bf 7d 28 a2 50 86 c4 d0 81 34 04 f9 9d 19 90 5d 6c c8 6f a3 82 62 5f 8a 77 97 ae e6 15 32 ec 5b 3c d5 d1 50
                                                  Data Ascii: xPn:@G/gu\Pa/PD}(P4]lob_w2[<Pz|<gzX],af!:$uMs)m74Tf8Q0Ee@>i~p#D'uma{4q-x.{W)x,0Fm'*wTn
                                                  Jul 22, 2024 12:35:39.707451105 CEST1236INData Raw: ea fe e8 9b 44 1e 62 80 9f 85 5d b4 ed 54 9a 62 26 5d f9 5f e9 66 31 79 1a ec 5d eb 3b 42 de 2a 12 2f 99 5a 51 ad 2c 4e fc b2 cd 25 8a df 0b d7 07 24 1e 16 60 15 f2 23 fe 84 ec 28 ca cb ea 25 a1 6f 30 22 39 cc 4f eb 80 ec b0 87 73 03 c9 e2 6f cb
                                                  Data Ascii: Db]Tb&]_f1y];B*/ZQ,N%$`#(%o0"9OsosUN^m9N)&8))QK}b9"@T~yu?V7j7y)vJ_EEW58X+:CP~T,{/s" a*=_lJ
                                                  Jul 22, 2024 12:35:39.707464933 CEST1236INData Raw: c6 ac fb 85 2b c7 a3 2f 2f d9 73 66 a6 d5 b3 dc bc 4c 89 64 2f f9 a1 b7 40 bf dd 84 b3 f4 0d 92 fa d2 49 45 fc 27 f8 14 9d 3f bd 02 3a c4 6a 3c 68 f4 ec 55 d8 20 1b ea 58 1f 15 63 0c 4e fc 76 39 e9 cc 71 40 69 5b b9 5b c5 4e 6d 50 82 e3 2b 3d 15
                                                  Data Ascii: +//sfLd/@IE'?:j<hU XcNv9q@i[[NmP+=127ZS$rHxh7[m15'1Z91 #%|^s\obPTPUO:$9pgLNTKqmc_xE]uUW\&6Ijo
                                                  Jul 22, 2024 12:35:39.707674026 CEST1236INData Raw: e7 41 3d ce 7d 33 4d 0f 6d da 2d 57 cd 6d 7c 72 20 41 5f e2 85 cb 48 2a 2c 1b 25 2d ea 0b 8c 30 58 68 ec 5b 67 54 17 0b 09 36 f0 a1 5f 55 d0 81 77 eb 76 58 90 be 59 9e ba 3f be 84 2b 42 29 6f 5c df c6 42 5f 49 8a 9f 97 26 07 55 9d da 50 6a e6 dc
                                                  Data Ascii: A=}3Mm-Wm|r A_H*,%-0Xh[gT6_UwvXY?+B)o\B_I&UPj?n,\_%N&gFx!7^"*w/:=\-?2$(<9#oPa7Z+iIU1B($k!XdI<#7s(,\~1~@SfHTn
                                                  Jul 22, 2024 12:35:39.707685947 CEST1236INData Raw: 20 19 6a 5f 78 89 c4 93 e5 38 5a 6e de 37 da e2 c6 06 b0 e8 f5 8e ec 2a 4d 52 53 7c c0 ce f1 b1 9d 84 d3 91 ba fc 29 13 39 6d 22 59 ca f4 90 ba 24 c3 b5 86 27 17 f3 8a b2 8c 0f d9 b9 6d 97 6d 9b 96 f5 eb e7 ae 0b 71 31 03 84 41 72 7d a7 8d f4 99
                                                  Data Ascii: j_x8Zn7*MRS|)9m"Y$'mmq1Ar}sWC@T^n2I%j+r|kpjq%<OjYSO)o+`qK18oLXG#F?sTds%>qWY2qf[n XR`
                                                  Jul 22, 2024 12:35:39.707698107 CEST1236INData Raw: d1 d2 9b 08 03 2c 5a d5 0d b5 24 ba 57 06 e9 82 13 06 b8 76 cd 11 85 df 30 60 c7 4a 68 fc 62 33 d3 a3 33 4a 36 3d a8 67 bb a3 56 33 7d 3d 9a 83 2c 2e ab 79 ba 0d fb 01 11 b8 6d 84 ce cd 88 2e 7d f5 4f 3e 3e d1 e4 3c 13 83 fa 27 77 82 c7 e2 d9 4b
                                                  Data Ascii: ,Z$Wv0`Jhb33J6=gV3}=,.ym.}O>><'wK\U}&El?<tl%}v%HSA*gH(vqd00Dan~Jlax_K9#+Rfl?uhLO{.FLRS
                                                  Jul 22, 2024 12:35:39.712366104 CEST1236INData Raw: 12 42 b8 dd e5 1f 9e 6b 33 d0 27 64 66 67 09 75 13 4e 4f e9 2f 56 c0 a1 26 a6 e7 0f 48 59 99 5e 9a 7b ee 13 0a e1 b2 7e 95 bf 06 41 45 43 c3 c5 43 45 37 b4 fd 4d f1 ee 9a 9c 98 53 15 42 01 8c fa ef a5 44 d0 97 33 99 81 2a 36 6b 2c 46 c1 0c 71 2f
                                                  Data Ascii: Bk3'dfguNO/V&HY^{~AECCE7MSBD3*6k,Fq/D:-E|OylOR-BS)2,o(P.Ibk@1F] 9X&;/<MZ5 `CLg`h*EH=|EZpoC/j{1,u;


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  117192.168.2.450237104.19.208.15280940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:35:40.526063919 CEST89OUTGET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Jul 22, 2024 12:35:41.035666943 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:35:40 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 17770
                                                  Connection: keep-alive
                                                  ETag: "770472110"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 470
                                                  Expires: Mon, 22 Jul 2024 14:35:40 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c90d0b1d4252-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 [TRUNCATED]
                                                  Data Ascii: PK:=AX7\0DrActiveFeatures.txt+@sjp#K1;/-[[ABexq)7 7:^gK !ibUVsO$v7|e\W'ZdveU*oR>%w$-;Q4Tf$+T$&Q?9#"6>0o@j(*i)H"B1`=&0I8CR"ycM7g\@8xE4S|Iyy7~%W?7!JhrfdB^OQ"IDG!o+^6VY6<wNNPP2\?EY^j>i[p`L_sXq>#~nY>LO9rsAS+g5FBiqgUf{*vBUBqTpKF;/[&WIAPuS-&v3!Y'bMl{[:5sVL3om7'O4'(V#:\#VOO&<s}Yd|<P@jM%O5lHs^SYfaCDDwVcE8~cETL0YIEd@._PQ~w\fAT7Kiywq|+#]N">(A0bU-lDM#ETYa-h}ep<),
                                                  Jul 22, 2024 12:35:41.035706043 CEST1236INData Raw: c3 e9 0b b5 94 79 f6 cd ab db ef 95 d6 d1 32 bc 03 27 b0 a7 67 bb 67 5c 5f 47 4a 97 f1 f7 fc 80 a5 3d 5e cb d2 21 fd 16 4d f6 ed 94 f2 d0 41 ec b6 8d 9b cb af 44 4b 5e 3f 92 fc ae 08 db 64 a5 1d 86 78 29 a2 a9 c5 2d c1 7a 36 38 e0 81 84 1a 34 f5
                                                  Data Ascii: y2'gg\_GJ=^!MADK^?dx)-z684R|YSgynUf1qbEFO?'[a`bF\rsZL0q\vgrP:ZbPw^l^|Vov^'D0\mJh*I{X14
                                                  Jul 22, 2024 12:35:41.035717964 CEST1236INData Raw: e3 09 b7 93 e7 ef 55 87 a5 e2 4a 0e 55 3c 50 4f 28 65 ca 9a de 34 88 d5 59 ab cd 64 54 2a 94 93 b6 b8 c7 f1 34 a6 fe 9a 9e 58 e1 5b 68 04 08 88 1d 07 7a 22 8c f4 8b 1a 37 f4 2d 18 02 f7 c9 7a e3 8d 30 e6 e5 c6 72 4a b5 33 12 97 f2 9b 9f 3d 2b 49
                                                  Data Ascii: UJU<PO(e4YdT*4X[hz"7-z0rJ3=+I:QrVjeAU|0e r.-nFs%U@_G~W}E^ns]W6.Jg4)Kk~9"4{i#W}_&L'HNOp
                                                  Jul 22, 2024 12:35:41.035850048 CEST1236INData Raw: a2 40 45 ad 3e 10 cc d4 22 b8 18 aa b5 83 15 5b 5f 79 62 da f6 64 de 89 40 91 c6 e3 e6 3c 48 f6 f2 37 d0 b4 a2 87 ed 8b 72 11 f9 fa 1d 84 ca dd 63 7c e6 56 65 74 e8 c3 ce 0a 52 78 3d f5 2c 69 ad 82 46 5f 21 19 b5 ed d3 bf 7e 98 76 8d 6a 94 b7 ed
                                                  Data Ascii: @E>"[_ybd@<H7rc|VetRx=,iF_!~vj5s,yL/[g{QosVz%{A|PSeC)PYzSZ/]E?kINr|Pg!\2-;@&Lb<maS
                                                  Jul 22, 2024 12:35:41.035861015 CEST1236INData Raw: ef ec e3 a3 78 02 50 1e 6e 18 3a c8 ef 40 01 47 df 2f 67 75 81 ee e7 ed 5c 86 a7 cd ff 50 b9 61 08 00 fa a5 b9 0e 2f 50 8f 87 fd 80 44 ec bf 7d 28 a2 50 86 c4 d0 81 34 04 f9 9d 19 90 5d 6c c8 6f a3 82 62 5f 8a 77 97 ae e6 15 32 ec 5b 3c d5 d1 50
                                                  Data Ascii: xPn:@G/gu\Pa/PD}(P4]lob_w2[<Pz|<gzX],af!:$uMs)m74Tf8Q0Ee@>i~p#D'uma{4q-x.{W)x,0Fm'*wTn
                                                  Jul 22, 2024 12:35:41.035871983 CEST1236INData Raw: ea fe e8 9b 44 1e 62 80 9f 85 5d b4 ed 54 9a 62 26 5d f9 5f e9 66 31 79 1a ec 5d eb 3b 42 de 2a 12 2f 99 5a 51 ad 2c 4e fc b2 cd 25 8a df 0b d7 07 24 1e 16 60 15 f2 23 fe 84 ec 28 ca cb ea 25 a1 6f 30 22 39 cc 4f eb 80 ec b0 87 73 03 c9 e2 6f cb
                                                  Data Ascii: Db]Tb&]_f1y];B*/ZQ,N%$`#(%o0"9OsosUN^m9N)&8))QK}b9"@T~yu?V7j7y)vJ_EEW58X+:CP~T,{/s" a*=_lJ
                                                  Jul 22, 2024 12:35:41.035938025 CEST1236INData Raw: c6 ac fb 85 2b c7 a3 2f 2f d9 73 66 a6 d5 b3 dc bc 4c 89 64 2f f9 a1 b7 40 bf dd 84 b3 f4 0d 92 fa d2 49 45 fc 27 f8 14 9d 3f bd 02 3a c4 6a 3c 68 f4 ec 55 d8 20 1b ea 58 1f 15 63 0c 4e fc 76 39 e9 cc 71 40 69 5b b9 5b c5 4e 6d 50 82 e3 2b 3d 15
                                                  Data Ascii: +//sfLd/@IE'?:j<hU XcNv9q@i[[NmP+=127ZS$rHxh7[m15'1Z91 #%|^s\obPTPUO:$9pgLNTKqmc_xE]uUW\&6Ijo
                                                  Jul 22, 2024 12:35:41.036051989 CEST1236INData Raw: e7 41 3d ce 7d 33 4d 0f 6d da 2d 57 cd 6d 7c 72 20 41 5f e2 85 cb 48 2a 2c 1b 25 2d ea 0b 8c 30 58 68 ec 5b 67 54 17 0b 09 36 f0 a1 5f 55 d0 81 77 eb 76 58 90 be 59 9e ba 3f be 84 2b 42 29 6f 5c df c6 42 5f 49 8a 9f 97 26 07 55 9d da 50 6a e6 dc
                                                  Data Ascii: A=}3Mm-Wm|r A_H*,%-0Xh[gT6_UwvXY?+B)o\B_I&UPj?n,\_%N&gFx!7^"*w/:=\-?2$(<9#oPa7Z+iIU1B($k!XdI<#7s(,\~1~@SfHTn
                                                  Jul 22, 2024 12:35:41.036067963 CEST1236INData Raw: 20 19 6a 5f 78 89 c4 93 e5 38 5a 6e de 37 da e2 c6 06 b0 e8 f5 8e ec 2a 4d 52 53 7c c0 ce f1 b1 9d 84 d3 91 ba fc 29 13 39 6d 22 59 ca f4 90 ba 24 c3 b5 86 27 17 f3 8a b2 8c 0f d9 b9 6d 97 6d 9b 96 f5 eb e7 ae 0b 71 31 03 84 41 72 7d a7 8d f4 99
                                                  Data Ascii: j_x8Zn7*MRS|)9m"Y$'mmq1Ar}sWC@T^n2I%j+r|kpjq%<OjYSO)o+`qK18oLXG#F?sTds%>qWY2qf[n XR`
                                                  Jul 22, 2024 12:35:41.036082983 CEST1236INData Raw: d1 d2 9b 08 03 2c 5a d5 0d b5 24 ba 57 06 e9 82 13 06 b8 76 cd 11 85 df 30 60 c7 4a 68 fc 62 33 d3 a3 33 4a 36 3d a8 67 bb a3 56 33 7d 3d 9a 83 2c 2e ab 79 ba 0d fb 01 11 b8 6d 84 ce cd 88 2e 7d f5 4f 3e 3e d1 e4 3c 13 83 fa 27 77 82 c7 e2 d9 4b
                                                  Data Ascii: ,Z$Wv0`Jhb33J6=gV3}=,.ym.}O>><'wK\U}&El?<tl%}v%HSA*gH(vqd00Dan~Jlax_K9#+Rfl?uhLO{.FLRS
                                                  Jul 22, 2024 12:35:41.041105986 CEST1236INData Raw: 12 42 b8 dd e5 1f 9e 6b 33 d0 27 64 66 67 09 75 13 4e 4f e9 2f 56 c0 a1 26 a6 e7 0f 48 59 99 5e 9a 7b ee 13 0a e1 b2 7e 95 bf 06 41 45 43 c3 c5 43 45 37 b4 fd 4d f1 ee 9a 9c 98 53 15 42 01 8c fa ef a5 44 d0 97 33 99 81 2a 36 6b 2c 46 c1 0c 71 2f
                                                  Data Ascii: Bk3'dfguNO/V&HY^{~AECCE7MSBD3*6k,Fq/D:-E|OylOR-BS)2,o(P.Ibk@1F] 9X&;/<MZ5 `CLg`h*EH=|EZpoC/j{1,u;


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  118192.168.2.450244104.19.208.15280984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:35:42.560508013 CEST113OUTGET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Connection: Keep-Alive
                                                  Jul 22, 2024 12:35:43.047930956 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:35:43 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 17770
                                                  Connection: keep-alive
                                                  ETag: "770472110"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 472
                                                  Expires: Mon, 22 Jul 2024 14:35:43 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c919ad0f4367-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 [TRUNCATED]
                                                  Data Ascii: PK:=AX7\0DrActiveFeatures.txt+@sjp#K1;/-[[ABexq)7 7:^gK !ibUVsO$v7|e\W'ZdveU*oR>%w$-;Q4Tf$+T$&Q?9#"6>0o@j(*i)H"B1`=&0I8CR"ycM7g\@8xE4S|Iyy7~%W?7!JhrfdB^OQ"IDG!o+^6VY6<wNNPP2\?EY^j>i[p`L_sXq>#~nY>LO9rsAS+g5FBiqgUf{*vBUBqTpKF;/[&WIAPuS-&v3!Y'bMl{[:5sVL3om7'O4'(V#:\#VOO&<s}Yd|<P@jM%O5lHs^SYfaCDDwVcE8~cETL0YIEd@._PQ~w\fAT7Kiywq|+#]N">(A0bU-lDM#ETYa-h}ep<),
                                                  Jul 22, 2024 12:35:43.047950029 CEST1236INData Raw: c3 e9 0b b5 94 79 f6 cd ab db ef 95 d6 d1 32 bc 03 27 b0 a7 67 bb 67 5c 5f 47 4a 97 f1 f7 fc 80 a5 3d 5e cb d2 21 fd 16 4d f6 ed 94 f2 d0 41 ec b6 8d 9b cb af 44 4b 5e 3f 92 fc ae 08 db 64 a5 1d 86 78 29 a2 a9 c5 2d c1 7a 36 38 e0 81 84 1a 34 f5
                                                  Data Ascii: y2'gg\_GJ=^!MADK^?dx)-z684R|YSgynUf1qbEFO?'[a`bF\rsZL0q\vgrP:ZbPw^l^|Vov^'D0\mJh*I{X14
                                                  Jul 22, 2024 12:35:43.047971010 CEST1236INData Raw: e3 09 b7 93 e7 ef 55 87 a5 e2 4a 0e 55 3c 50 4f 28 65 ca 9a de 34 88 d5 59 ab cd 64 54 2a 94 93 b6 b8 c7 f1 34 a6 fe 9a 9e 58 e1 5b 68 04 08 88 1d 07 7a 22 8c f4 8b 1a 37 f4 2d 18 02 f7 c9 7a e3 8d 30 e6 e5 c6 72 4a b5 33 12 97 f2 9b 9f 3d 2b 49
                                                  Data Ascii: UJU<PO(e4YdT*4X[hz"7-z0rJ3=+I:QrVjeAU|0e r.-nFs%U@_G~W}E^ns]W6.Jg4)Kk~9"4{i#W}_&L'HNOp
                                                  Jul 22, 2024 12:35:43.047981977 CEST1236INData Raw: a2 40 45 ad 3e 10 cc d4 22 b8 18 aa b5 83 15 5b 5f 79 62 da f6 64 de 89 40 91 c6 e3 e6 3c 48 f6 f2 37 d0 b4 a2 87 ed 8b 72 11 f9 fa 1d 84 ca dd 63 7c e6 56 65 74 e8 c3 ce 0a 52 78 3d f5 2c 69 ad 82 46 5f 21 19 b5 ed d3 bf 7e 98 76 8d 6a 94 b7 ed
                                                  Data Ascii: @E>"[_ybd@<H7rc|VetRx=,iF_!~vj5s,yL/[g{QosVz%{A|PSeC)PYzSZ/]E?kINr|Pg!\2-;@&Lb<maS
                                                  Jul 22, 2024 12:35:43.047993898 CEST1236INData Raw: ef ec e3 a3 78 02 50 1e 6e 18 3a c8 ef 40 01 47 df 2f 67 75 81 ee e7 ed 5c 86 a7 cd ff 50 b9 61 08 00 fa a5 b9 0e 2f 50 8f 87 fd 80 44 ec bf 7d 28 a2 50 86 c4 d0 81 34 04 f9 9d 19 90 5d 6c c8 6f a3 82 62 5f 8a 77 97 ae e6 15 32 ec 5b 3c d5 d1 50
                                                  Data Ascii: xPn:@G/gu\Pa/PD}(P4]lob_w2[<Pz|<gzX],af!:$uMs)m74Tf8Q0Ee@>i~p#D'uma{4q-x.{W)x,0Fm'*wTn
                                                  Jul 22, 2024 12:35:43.048005104 CEST1236INData Raw: ea fe e8 9b 44 1e 62 80 9f 85 5d b4 ed 54 9a 62 26 5d f9 5f e9 66 31 79 1a ec 5d eb 3b 42 de 2a 12 2f 99 5a 51 ad 2c 4e fc b2 cd 25 8a df 0b d7 07 24 1e 16 60 15 f2 23 fe 84 ec 28 ca cb ea 25 a1 6f 30 22 39 cc 4f eb 80 ec b0 87 73 03 c9 e2 6f cb
                                                  Data Ascii: Db]Tb&]_f1y];B*/ZQ,N%$`#(%o0"9OsosUN^m9N)&8))QK}b9"@T~yu?V7j7y)vJ_EEW58X+:CP~T,{/s" a*=_lJ
                                                  Jul 22, 2024 12:35:43.048017025 CEST1236INData Raw: c6 ac fb 85 2b c7 a3 2f 2f d9 73 66 a6 d5 b3 dc bc 4c 89 64 2f f9 a1 b7 40 bf dd 84 b3 f4 0d 92 fa d2 49 45 fc 27 f8 14 9d 3f bd 02 3a c4 6a 3c 68 f4 ec 55 d8 20 1b ea 58 1f 15 63 0c 4e fc 76 39 e9 cc 71 40 69 5b b9 5b c5 4e 6d 50 82 e3 2b 3d 15
                                                  Data Ascii: +//sfLd/@IE'?:j<hU XcNv9q@i[[NmP+=127ZS$rHxh7[m15'1Z91 #%|^s\obPTPUO:$9pgLNTKqmc_xE]uUW\&6Ijo
                                                  Jul 22, 2024 12:35:43.048235893 CEST1236INData Raw: e7 41 3d ce 7d 33 4d 0f 6d da 2d 57 cd 6d 7c 72 20 41 5f e2 85 cb 48 2a 2c 1b 25 2d ea 0b 8c 30 58 68 ec 5b 67 54 17 0b 09 36 f0 a1 5f 55 d0 81 77 eb 76 58 90 be 59 9e ba 3f be 84 2b 42 29 6f 5c df c6 42 5f 49 8a 9f 97 26 07 55 9d da 50 6a e6 dc
                                                  Data Ascii: A=}3Mm-Wm|r A_H*,%-0Xh[gT6_UwvXY?+B)o\B_I&UPj?n,\_%N&gFx!7^"*w/:=\-?2$(<9#oPa7Z+iIU1B($k!XdI<#7s(,\~1~@SfHTn
                                                  Jul 22, 2024 12:35:43.048316956 CEST1236INData Raw: 20 19 6a 5f 78 89 c4 93 e5 38 5a 6e de 37 da e2 c6 06 b0 e8 f5 8e ec 2a 4d 52 53 7c c0 ce f1 b1 9d 84 d3 91 ba fc 29 13 39 6d 22 59 ca f4 90 ba 24 c3 b5 86 27 17 f3 8a b2 8c 0f d9 b9 6d 97 6d 9b 96 f5 eb e7 ae 0b 71 31 03 84 41 72 7d a7 8d f4 99
                                                  Data Ascii: j_x8Zn7*MRS|)9m"Y$'mmq1Ar}sWC@T^n2I%j+r|kpjq%<OjYSO)o+`qK18oLXG#F?sTds%>qWY2qf[n XR`
                                                  Jul 22, 2024 12:35:43.048330069 CEST1236INData Raw: d1 d2 9b 08 03 2c 5a d5 0d b5 24 ba 57 06 e9 82 13 06 b8 76 cd 11 85 df 30 60 c7 4a 68 fc 62 33 d3 a3 33 4a 36 3d a8 67 bb a3 56 33 7d 3d 9a 83 2c 2e ab 79 ba 0d fb 01 11 b8 6d 84 ce cd 88 2e 7d f5 4f 3e 3e d1 e4 3c 13 83 fa 27 77 82 c7 e2 d9 4b
                                                  Data Ascii: ,Z$Wv0`Jhb33J6=gV3}=,.ym.}O>><'wK\U}&El?<tl%}v%HSA*gH(vqd00Dan~Jlax_K9#+Rfl?uhLO{.FLRS
                                                  Jul 22, 2024 12:35:43.058423996 CEST1236INData Raw: 12 42 b8 dd e5 1f 9e 6b 33 d0 27 64 66 67 09 75 13 4e 4f e9 2f 56 c0 a1 26 a6 e7 0f 48 59 99 5e 9a 7b ee 13 0a e1 b2 7e 95 bf 06 41 45 43 c3 c5 43 45 37 b4 fd 4d f1 ee 9a 9c 98 53 15 42 01 8c fa ef a5 44 d0 97 33 99 81 2a 36 6b 2c 46 c1 0c 71 2f
                                                  Data Ascii: Bk3'dfguNO/V&HY^{~AECCE7MSBD3*6k,Fq/D:-E|OylOR-BS)2,o(P.Ibk@1F] 9X&;/<MZ5 `CLg`h*EH=|EZpoC/j{1,u;


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  119192.168.2.450250104.19.208.15280940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:35:44.092530966 CEST89OUTGET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Jul 22, 2024 12:35:44.566349983 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:35:44 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 17770
                                                  Connection: keep-alive
                                                  ETag: "770472110"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 474
                                                  Expires: Mon, 22 Jul 2024 14:35:44 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c92328f37c90-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 [TRUNCATED]
                                                  Data Ascii: PK:=AX7\0DrActiveFeatures.txt+@sjp#K1;/-[[ABexq)7 7:^gK !ibUVsO$v7|e\W'ZdveU*oR>%w$-;Q4Tf$+T$&Q?9#"6>0o@j(*i)H"B1`=&0I8CR"ycM7g\@8xE4S|Iyy7~%W?7!JhrfdB^OQ"IDG!o+^6VY6<wNNPP2\?EY^j>i[p`L_sXq>#~nY>LO9rsAS+g5FBiqgUf{*vBUBqTpKF;/[&WIAPuS-&v3!Y'bMl{[:5sVL3om7'O4'(V#:\#VOO&<s}Yd|<P@jM%O5lHs^SYfaCDDwVcE8~cETL0YIEd@._PQ~w\fAT7Kiywq|+#]N">(A0bU-lDM#ETYa-h}ep<),
                                                  Jul 22, 2024 12:35:44.566370964 CEST1236INData Raw: c3 e9 0b b5 94 79 f6 cd ab db ef 95 d6 d1 32 bc 03 27 b0 a7 67 bb 67 5c 5f 47 4a 97 f1 f7 fc 80 a5 3d 5e cb d2 21 fd 16 4d f6 ed 94 f2 d0 41 ec b6 8d 9b cb af 44 4b 5e 3f 92 fc ae 08 db 64 a5 1d 86 78 29 a2 a9 c5 2d c1 7a 36 38 e0 81 84 1a 34 f5
                                                  Data Ascii: y2'gg\_GJ=^!MADK^?dx)-z684R|YSgynUf1qbEFO?'[a`bF\rsZL0q\vgrP:ZbPw^l^|Vov^'D0\mJh*I{X14
                                                  Jul 22, 2024 12:35:44.566384077 CEST1236INData Raw: e3 09 b7 93 e7 ef 55 87 a5 e2 4a 0e 55 3c 50 4f 28 65 ca 9a de 34 88 d5 59 ab cd 64 54 2a 94 93 b6 b8 c7 f1 34 a6 fe 9a 9e 58 e1 5b 68 04 08 88 1d 07 7a 22 8c f4 8b 1a 37 f4 2d 18 02 f7 c9 7a e3 8d 30 e6 e5 c6 72 4a b5 33 12 97 f2 9b 9f 3d 2b 49
                                                  Data Ascii: UJU<PO(e4YdT*4X[hz"7-z0rJ3=+I:QrVjeAU|0e r.-nFs%U@_G~W}E^ns]W6.Jg4)Kk~9"4{i#W}_&L'HNOp
                                                  Jul 22, 2024 12:35:44.566468954 CEST1236INData Raw: a2 40 45 ad 3e 10 cc d4 22 b8 18 aa b5 83 15 5b 5f 79 62 da f6 64 de 89 40 91 c6 e3 e6 3c 48 f6 f2 37 d0 b4 a2 87 ed 8b 72 11 f9 fa 1d 84 ca dd 63 7c e6 56 65 74 e8 c3 ce 0a 52 78 3d f5 2c 69 ad 82 46 5f 21 19 b5 ed d3 bf 7e 98 76 8d 6a 94 b7 ed
                                                  Data Ascii: @E>"[_ybd@<H7rc|VetRx=,iF_!~vj5s,yL/[g{QosVz%{A|PSeC)PYzSZ/]E?kINr|Pg!\2-;@&Lb<maS
                                                  Jul 22, 2024 12:35:44.566481113 CEST1236INData Raw: ef ec e3 a3 78 02 50 1e 6e 18 3a c8 ef 40 01 47 df 2f 67 75 81 ee e7 ed 5c 86 a7 cd ff 50 b9 61 08 00 fa a5 b9 0e 2f 50 8f 87 fd 80 44 ec bf 7d 28 a2 50 86 c4 d0 81 34 04 f9 9d 19 90 5d 6c c8 6f a3 82 62 5f 8a 77 97 ae e6 15 32 ec 5b 3c d5 d1 50
                                                  Data Ascii: xPn:@G/gu\Pa/PD}(P4]lob_w2[<Pz|<gzX],af!:$uMs)m74Tf8Q0Ee@>i~p#D'uma{4q-x.{W)x,0Fm'*wTn
                                                  Jul 22, 2024 12:35:44.566493034 CEST1236INData Raw: ea fe e8 9b 44 1e 62 80 9f 85 5d b4 ed 54 9a 62 26 5d f9 5f e9 66 31 79 1a ec 5d eb 3b 42 de 2a 12 2f 99 5a 51 ad 2c 4e fc b2 cd 25 8a df 0b d7 07 24 1e 16 60 15 f2 23 fe 84 ec 28 ca cb ea 25 a1 6f 30 22 39 cc 4f eb 80 ec b0 87 73 03 c9 e2 6f cb
                                                  Data Ascii: Db]Tb&]_f1y];B*/ZQ,N%$`#(%o0"9OsosUN^m9N)&8))QK}b9"@T~yu?V7j7y)vJ_EEW58X+:CP~T,{/s" a*=_lJ
                                                  Jul 22, 2024 12:35:44.566507101 CEST1236INData Raw: c6 ac fb 85 2b c7 a3 2f 2f d9 73 66 a6 d5 b3 dc bc 4c 89 64 2f f9 a1 b7 40 bf dd 84 b3 f4 0d 92 fa d2 49 45 fc 27 f8 14 9d 3f bd 02 3a c4 6a 3c 68 f4 ec 55 d8 20 1b ea 58 1f 15 63 0c 4e fc 76 39 e9 cc 71 40 69 5b b9 5b c5 4e 6d 50 82 e3 2b 3d 15
                                                  Data Ascii: +//sfLd/@IE'?:j<hU XcNv9q@i[[NmP+=127ZS$rHxh7[m15'1Z91 #%|^s\obPTPUO:$9pgLNTKqmc_xE]uUW\&6Ijo
                                                  Jul 22, 2024 12:35:44.566690922 CEST1236INData Raw: e7 41 3d ce 7d 33 4d 0f 6d da 2d 57 cd 6d 7c 72 20 41 5f e2 85 cb 48 2a 2c 1b 25 2d ea 0b 8c 30 58 68 ec 5b 67 54 17 0b 09 36 f0 a1 5f 55 d0 81 77 eb 76 58 90 be 59 9e ba 3f be 84 2b 42 29 6f 5c df c6 42 5f 49 8a 9f 97 26 07 55 9d da 50 6a e6 dc
                                                  Data Ascii: A=}3Mm-Wm|r A_H*,%-0Xh[gT6_UwvXY?+B)o\B_I&UPj?n,\_%N&gFx!7^"*w/:=\-?2$(<9#oPa7Z+iIU1B($k!XdI<#7s(,\~1~@SfHTn
                                                  Jul 22, 2024 12:35:44.566701889 CEST1236INData Raw: 20 19 6a 5f 78 89 c4 93 e5 38 5a 6e de 37 da e2 c6 06 b0 e8 f5 8e ec 2a 4d 52 53 7c c0 ce f1 b1 9d 84 d3 91 ba fc 29 13 39 6d 22 59 ca f4 90 ba 24 c3 b5 86 27 17 f3 8a b2 8c 0f d9 b9 6d 97 6d 9b 96 f5 eb e7 ae 0b 71 31 03 84 41 72 7d a7 8d f4 99
                                                  Data Ascii: j_x8Zn7*MRS|)9m"Y$'mmq1Ar}sWC@T^n2I%j+r|kpjq%<OjYSO)o+`qK18oLXG#F?sTds%>qWY2qf[n XR`
                                                  Jul 22, 2024 12:35:44.566713095 CEST1236INData Raw: d1 d2 9b 08 03 2c 5a d5 0d b5 24 ba 57 06 e9 82 13 06 b8 76 cd 11 85 df 30 60 c7 4a 68 fc 62 33 d3 a3 33 4a 36 3d a8 67 bb a3 56 33 7d 3d 9a 83 2c 2e ab 79 ba 0d fb 01 11 b8 6d 84 ce cd 88 2e 7d f5 4f 3e 3e d1 e4 3c 13 83 fa 27 77 82 c7 e2 d9 4b
                                                  Data Ascii: ,Z$Wv0`Jhb33J6=gV3}=,.ym.}O>><'wK\U}&El?<tl%}v%HSA*gH(vqd00Dan~Jlax_K9#+Rfl?uhLO{.FLRS
                                                  Jul 22, 2024 12:35:44.574390888 CEST1236INData Raw: 12 42 b8 dd e5 1f 9e 6b 33 d0 27 64 66 67 09 75 13 4e 4f e9 2f 56 c0 a1 26 a6 e7 0f 48 59 99 5e 9a 7b ee 13 0a e1 b2 7e 95 bf 06 41 45 43 c3 c5 43 45 37 b4 fd 4d f1 ee 9a 9c 98 53 15 42 01 8c fa ef a5 44 d0 97 33 99 81 2a 36 6b 2c 46 c1 0c 71 2f
                                                  Data Ascii: Bk3'dfguNO/V&HY^{~AECCE7MSBD3*6k,Fq/D:-E|OylOR-BS)2,o(P.Ibk@1F] 9X&;/<MZ5 `CLg`h*EH=|EZpoC/j{1,u;


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  120192.168.2.450251104.19.208.15280940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:35:44.154117107 CEST105OUTGET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Jul 22, 2024 12:35:44.641964912 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:35:44 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 9891
                                                  Connection: keep-alive
                                                  ETag: "3914547665"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 171
                                                  Expires: Mon, 22 Jul 2024 14:35:44 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c9239de80c9e-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d [TRUNCATED]
                                                  Data Ascii: PKIX6%FeatureActions.txtBPZ&KE9(0p<a}9g<D)9k@4y'!=~Zk`1J2[)_,{FF?q;fL*=1ZI->m%>`ml,sWITPu*;Pxxhgl$M]I}ogZL5?BZLxukU1P4mW-Ntf?I-/!w90/^%X-.0(mVPn]=cr_A$<BWye2bK{jOdxZv@[NLDU|_1Sp~Paq>})$qH7,hm)Ias<TWu$?Ey@Xu@5*UJLja0v^Q (O}k+fwvfzbhFE<plLWZI*.4#,X`=beVW)W*;Q,'x>Jq _T<ea&wo/RM2`rXFEc:A97A4FT0@wuJIBd5Bhw}oE@N=Z$)6@sXru%eIg5ruA:81&"e_'Be
                                                  Jul 22, 2024 12:35:44.642031908 CEST1236INData Raw: aa 27 91 1f 4b c3 11 60 77 a1 43 f9 f7 10 07 63 36 80 1a 86 ad 48 a7 d3 8f 6f 01 ae 9e 9c 3f a2 79 6e 3b 81 f2 7e 33 72 dc 17 7b 3c b2 f2 80 9b 26 a0 a9 76 69 9d e2 6e 9e 4d 47 96 36 9b c5 b5 27 68 b5 b4 84 34 1c 56 23 a3 50 e1 9f 24 02 89 9a 6e
                                                  Data Ascii: 'K`wCc6Ho?yn;~3r{<&vinMG6'h4V#P$n/Kt'<4oOa"xGTVBfE<eG#Bw{#@mc]os}uE6@e`^](9A,NjbNYnOF\8p"CLFk
                                                  Jul 22, 2024 12:35:44.642072916 CEST1236INData Raw: fd ac 50 d8 52 44 ee 8b 8f d4 d8 b2 84 d1 cb d6 f7 f8 05 a5 aa 41 48 05 36 3c 93 56 87 e3 e6 2f 47 40 72 47 91 28 bd 1e de c7 43 06 15 aa c9 07 7f 4b 86 10 6b 1f 41 44 6f 91 db 30 a2 f9 46 11 1a 4b 58 16 a1 31 d1 5e b4 59 ca fc 47 fc bc 25 05 70
                                                  Data Ascii: PRDAH6<V/G@rG(CKkADo0FKX1^YG%p8P*rH|idu{"PBv`DWG&O*rD:V4#{>51Zy4U-&SSIgFkZpYN~L-6Fed~ex>3
                                                  Jul 22, 2024 12:35:44.642174959 CEST1236INData Raw: 88 a8 b4 43 f7 18 27 39 99 b5 09 5b b0 21 e4 89 cd dc d8 80 8f ba 2c 76 5f 49 78 e0 a0 e6 a4 e8 61 8a 0a 7d 07 ae 7f 5b db 69 5b ab 4d 22 92 db 0e dc 5e ef db 36 83 5e 63 58 81 45 75 40 0c 8a 74 59 c3 e4 31 78 2a c9 f9 39 82 db c7 d7 e1 67 09 f5
                                                  Data Ascii: C'9[!,v_Ixa}[i[M"^6^cXEu@tY1x*9g&LIY+5kR@v<a.{G`#|<rPgAn><AhcF1NG_d~JFS}=l-z%Q\)Zm?)^afu
                                                  Jul 22, 2024 12:35:44.642209053 CEST1236INData Raw: 51 a2 95 4e ba 4b 5c 16 c5 a5 51 be 5a 39 45 dd 17 61 63 b5 65 bb 34 9f 6d 7c 76 0b e7 cf 8a 28 b1 32 a3 4c 94 f3 9c 2d 3a d8 05 c3 70 d8 b9 9e ea 5e e2 8b aa 76 16 1e 66 9d 5b 09 8d b4 bd 0c df a4 f1 57 38 11 41 42 5a 8f 27 30 7a 45 dd 2c af 7e
                                                  Data Ascii: QNK\QZ9Eace4m|v(2L-:p^vf[W8ABZ'0zE,~iY~^UiH-E`79_ue_f!t,f-X9^y0jgsotF8rUFX3\"T5p3WJBORFv
                                                  Jul 22, 2024 12:35:44.642245054 CEST1236INData Raw: ad 53 b8 3f 1e d4 8d 8b fb 22 dd 51 13 da db 37 c1 6d 8a c5 7d 9b 47 42 3f 8e c9 f0 52 59 f2 14 2a 9e 75 2e 6a 2e 7b 93 ce 8d 7f 03 7e d5 5c fc 25 45 10 44 72 a8 87 1c d2 e8 6e 79 f4 3a 12 2f 87 97 f4 7d 88 08 2a 70 f8 25 43 fc 4b 2d f3 25 a3 5d
                                                  Data Ascii: S?"Q7m}GB?RY*u.j.{~\%EDrny:/}*p%CK-%]F?TSkSG-^Bgv[1K+k9v&plE0P8t}BnUJXhBDBlfbG7Fsq3BI{?3>n
                                                  Jul 22, 2024 12:35:44.642281055 CEST1236INData Raw: 98 44 c0 9d 35 87 31 5c f2 45 f9 c7 ef 27 c4 f0 44 cb 1d 0f 1c d1 37 2a fd 7f 20 4f 38 65 99 02 a1 9a ea fd 15 94 74 5c 15 e4 8a 30 a5 11 66 30 df 52 31 9c c6 28 24 8c 3e 6f 18 50 ce cd 5b 40 65 9a 59 06 f5 bf 1e 38 1f 30 99 1f 31 4f 2a 69 da 0b
                                                  Data Ascii: D51\E'D7* O8et\0f0R1($>oP[@eY801O*iT2@#l0*z<F4a/dUF5iAzDScUSK:;{qQ.29h}w$/SZ24d2%h@"IT*w;W<-f.7p=ei ^C\aP`RyHaC!
                                                  Jul 22, 2024 12:35:44.642539978 CEST1236INData Raw: 39 ba ca 62 79 64 b1 96 fc a3 e4 33 18 bf f2 b3 53 33 28 3d 94 63 da fc df 9a ab 61 96 4f fd 8f 75 23 dd b5 d3 bd b5 31 ab e5 e1 6d de 8b 88 11 1d 05 ed 75 9d 2f 58 00 23 9c b7 5e 9c be d2 46 a0 2b 67 71 a6 f8 75 c0 5f 80 c9 c6 7f 3b c9 9d 1b 53
                                                  Data Ascii: 9byd3S3(=caOu#1mu/X#^F+gqu_;Sv_HO=[Ipy`9|;!&uEv@~q+"`T].@ON/,V]Bn`;LGQNL0j*\x8j8cpo;Y|1x[
                                                  Jul 22, 2024 12:35:44.642573118 CEST384INData Raw: e7 b8 35 15 54 a9 22 01 ba 8d 73 41 22 2d 5f 1c e5 c1 6a 64 1c 3a 02 da 84 ef c5 74 bd 9f 23 d9 32 44 34 28 27 d7 07 95 69 6b 95 3f 18 37 32 d0 a9 81 eb a5 e0 47 f9 bd 0e ce d3 e3 4e d2 40 77 fe 00 a1 df bb a6 9f 2e ba ee eb a2 f0 8c 0d bc fe f1
                                                  Data Ascii: 5T"sA"-_jd:t#2D4('ik?72GN@w.o[C4PcJ3 [mrE&r8U,%,uzs(q7r%Hr1]>D!M#C7xJW/5oZ~Wr4gB6SE^C8LT_4'8rC&:<uMz


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  121192.168.2.450255104.19.208.15280940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:35:45.072680950 CEST105OUTGET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Jul 22, 2024 12:35:45.875556946 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:35:45 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 9891
                                                  Connection: keep-alive
                                                  ETag: "3914547665"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 172
                                                  Expires: Mon, 22 Jul 2024 14:35:45 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c92b4ed90cb2-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d [TRUNCATED]
                                                  Data Ascii: PKIX6%FeatureActions.txtBPZ&KE9(0p<a}9g<D)9k@4y'!=~Zk`1J2[)_,{FF?q;fL*=1ZI->m%>`ml,sWITPu*;Pxxhgl$M]I}ogZL5?BZLxukU1P4mW-Ntf?I-/!w90/^%X-.0(mVPn]=cr_A$<BWye2bK{jOdxZv@[NLDU|_1Sp~Paq>})$qH7,hm)Ias<TWu$?Ey@Xu@5*UJLja0v^Q (O}k+fwvfzbhFE<plLWZI*.4#,X`=beVW)W*;Q,'x>Jq _T<ea&wo/RM2`rXFEc:A97A4FT0@wuJIBd5Bhw}oE@N=Z$)6@sXru%eIg5ruA:81&"e_'Be
                                                  Jul 22, 2024 12:35:45.875575066 CEST1236INData Raw: aa 27 91 1f 4b c3 11 60 77 a1 43 f9 f7 10 07 63 36 80 1a 86 ad 48 a7 d3 8f 6f 01 ae 9e 9c 3f a2 79 6e 3b 81 f2 7e 33 72 dc 17 7b 3c b2 f2 80 9b 26 a0 a9 76 69 9d e2 6e 9e 4d 47 96 36 9b c5 b5 27 68 b5 b4 84 34 1c 56 23 a3 50 e1 9f 24 02 89 9a 6e
                                                  Data Ascii: 'K`wCc6Ho?yn;~3r{<&vinMG6'h4V#P$n/Kt'<4oOa"xGTVBfE<eG#Bw{#@mc]os}uE6@e`^](9A,NjbNYnOF\8p"CLFk
                                                  Jul 22, 2024 12:35:45.875586987 CEST1236INData Raw: fd ac 50 d8 52 44 ee 8b 8f d4 d8 b2 84 d1 cb d6 f7 f8 05 a5 aa 41 48 05 36 3c 93 56 87 e3 e6 2f 47 40 72 47 91 28 bd 1e de c7 43 06 15 aa c9 07 7f 4b 86 10 6b 1f 41 44 6f 91 db 30 a2 f9 46 11 1a 4b 58 16 a1 31 d1 5e b4 59 ca fc 47 fc bc 25 05 70
                                                  Data Ascii: PRDAH6<V/G@rG(CKkADo0FKX1^YG%p8P*rH|idu{"PBv`DWG&O*rD:V4#{>51Zy4U-&SSIgFkZpYN~L-6Fed~ex>3
                                                  Jul 22, 2024 12:35:45.875673056 CEST1236INData Raw: 88 a8 b4 43 f7 18 27 39 99 b5 09 5b b0 21 e4 89 cd dc d8 80 8f ba 2c 76 5f 49 78 e0 a0 e6 a4 e8 61 8a 0a 7d 07 ae 7f 5b db 69 5b ab 4d 22 92 db 0e dc 5e ef db 36 83 5e 63 58 81 45 75 40 0c 8a 74 59 c3 e4 31 78 2a c9 f9 39 82 db c7 d7 e1 67 09 f5
                                                  Data Ascii: C'9[!,v_Ixa}[i[M"^6^cXEu@tY1x*9g&LIY+5kR@v<a.{G`#|<rPgAn><AhcF1NG_d~JFS}=l-z%Q\)Zm?)^afu
                                                  Jul 22, 2024 12:35:45.875684977 CEST1236INData Raw: 51 a2 95 4e ba 4b 5c 16 c5 a5 51 be 5a 39 45 dd 17 61 63 b5 65 bb 34 9f 6d 7c 76 0b e7 cf 8a 28 b1 32 a3 4c 94 f3 9c 2d 3a d8 05 c3 70 d8 b9 9e ea 5e e2 8b aa 76 16 1e 66 9d 5b 09 8d b4 bd 0c df a4 f1 57 38 11 41 42 5a 8f 27 30 7a 45 dd 2c af 7e
                                                  Data Ascii: QNK\QZ9Eace4m|v(2L-:p^vf[W8ABZ'0zE,~iY~^UiH-E`79_ue_f!t,f-X9^y0jgsotF8rUFX3\"T5p3WJBORFv
                                                  Jul 22, 2024 12:35:45.875694990 CEST1236INData Raw: ad 53 b8 3f 1e d4 8d 8b fb 22 dd 51 13 da db 37 c1 6d 8a c5 7d 9b 47 42 3f 8e c9 f0 52 59 f2 14 2a 9e 75 2e 6a 2e 7b 93 ce 8d 7f 03 7e d5 5c fc 25 45 10 44 72 a8 87 1c d2 e8 6e 79 f4 3a 12 2f 87 97 f4 7d 88 08 2a 70 f8 25 43 fc 4b 2d f3 25 a3 5d
                                                  Data Ascii: S?"Q7m}GB?RY*u.j.{~\%EDrny:/}*p%CK-%]F?TSkSG-^Bgv[1K+k9v&plE0P8t}BnUJXhBDBlfbG7Fsq3BI{?3>n
                                                  Jul 22, 2024 12:35:45.875705004 CEST1236INData Raw: 98 44 c0 9d 35 87 31 5c f2 45 f9 c7 ef 27 c4 f0 44 cb 1d 0f 1c d1 37 2a fd 7f 20 4f 38 65 99 02 a1 9a ea fd 15 94 74 5c 15 e4 8a 30 a5 11 66 30 df 52 31 9c c6 28 24 8c 3e 6f 18 50 ce cd 5b 40 65 9a 59 06 f5 bf 1e 38 1f 30 99 1f 31 4f 2a 69 da 0b
                                                  Data Ascii: D51\E'D7* O8et\0f0R1($>oP[@eY801O*iT2@#l0*z<F4a/dUF5iAzDScUSK:;{qQ.29h}w$/SZ24d2%h@"IT*w;W<-f.7p=ei ^C\aP`RyHaC!
                                                  Jul 22, 2024 12:35:45.875715017 CEST1236INData Raw: 39 ba ca 62 79 64 b1 96 fc a3 e4 33 18 bf f2 b3 53 33 28 3d 94 63 da fc df 9a ab 61 96 4f fd 8f 75 23 dd b5 d3 bd b5 31 ab e5 e1 6d de 8b 88 11 1d 05 ed 75 9d 2f 58 00 23 9c b7 5e 9c be d2 46 a0 2b 67 71 a6 f8 75 c0 5f 80 c9 c6 7f 3b c9 9d 1b 53
                                                  Data Ascii: 9byd3S3(=caOu#1mu/X#^F+gqu_;Sv_HO=[Ipy`9|;!&uEv@~q+"`T].@ON/,V]Bn`;LGQNL0j*\x8j8cpo;Y|1x[
                                                  Jul 22, 2024 12:35:45.875725985 CEST384INData Raw: e7 b8 35 15 54 a9 22 01 ba 8d 73 41 22 2d 5f 1c e5 c1 6a 64 1c 3a 02 da 84 ef c5 74 bd 9f 23 d9 32 44 34 28 27 d7 07 95 69 6b 95 3f 18 37 32 d0 a9 81 eb a5 e0 47 f9 bd 0e ce d3 e3 4e d2 40 77 fe 00 a1 df bb a6 9f 2e ba ee eb a2 f0 8c 0d bc fe f1
                                                  Data Ascii: 5T"sA"-_jd:t#2D4('ik?72GN@w.o[C4PcJ3 [mrE&r8U,%,uzs(q7r%Hr1]>D!M#C7xJW/5oZ~Wr4gB6SE^C8LT_4'8rC&:<uMz


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  122192.168.2.450263104.19.208.15280940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:35:47.047854900 CEST89OUTGET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Jul 22, 2024 12:35:47.543818951 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:35:47 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 17770
                                                  Connection: keep-alive
                                                  ETag: "770472110"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 477
                                                  Expires: Mon, 22 Jul 2024 14:35:47 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c935ae1041d9-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 [TRUNCATED]
                                                  Data Ascii: PK:=AX7\0DrActiveFeatures.txt+@sjp#K1;/-[[ABexq)7 7:^gK !ibUVsO$v7|e\W'ZdveU*oR>%w$-;Q4Tf$+T$&Q?9#"6>0o@j(*i)H"B1`=&0I8CR"ycM7g\@8xE4S|Iyy7~%W?7!JhrfdB^OQ"IDG!o+^6VY6<wNNPP2\?EY^j>i[p`L_sXq>#~nY>LO9rsAS+g5FBiqgUf{*vBUBqTpKF;/[&WIAPuS-&v3!Y'bMl{[:5sVL3om7'O4'(V#:\#VOO&<s}Yd|<P@jM%O5lHs^SYfaCDDwVcE8~cETL0YIEd@._PQ~w\fAT7Kiywq|+#]N">(A0bU-lDM#ETYa-h}ep<),
                                                  Jul 22, 2024 12:35:47.544276953 CEST1236INData Raw: c3 e9 0b b5 94 79 f6 cd ab db ef 95 d6 d1 32 bc 03 27 b0 a7 67 bb 67 5c 5f 47 4a 97 f1 f7 fc 80 a5 3d 5e cb d2 21 fd 16 4d f6 ed 94 f2 d0 41 ec b6 8d 9b cb af 44 4b 5e 3f 92 fc ae 08 db 64 a5 1d 86 78 29 a2 a9 c5 2d c1 7a 36 38 e0 81 84 1a 34 f5
                                                  Data Ascii: y2'gg\_GJ=^!MADK^?dx)-z684R|YSgynUf1qbEFO?'[a`bF\rsZL0q\vgrP:ZbPw^l^|Vov^'D0\mJh*I{X14
                                                  Jul 22, 2024 12:35:47.544312000 CEST1236INData Raw: e3 09 b7 93 e7 ef 55 87 a5 e2 4a 0e 55 3c 50 4f 28 65 ca 9a de 34 88 d5 59 ab cd 64 54 2a 94 93 b6 b8 c7 f1 34 a6 fe 9a 9e 58 e1 5b 68 04 08 88 1d 07 7a 22 8c f4 8b 1a 37 f4 2d 18 02 f7 c9 7a e3 8d 30 e6 e5 c6 72 4a b5 33 12 97 f2 9b 9f 3d 2b 49
                                                  Data Ascii: UJU<PO(e4YdT*4X[hz"7-z0rJ3=+I:QrVjeAU|0e r.-nFs%U@_G~W}E^ns]W6.Jg4)Kk~9"4{i#W}_&L'HNOp
                                                  Jul 22, 2024 12:35:47.544346094 CEST1236INData Raw: a2 40 45 ad 3e 10 cc d4 22 b8 18 aa b5 83 15 5b 5f 79 62 da f6 64 de 89 40 91 c6 e3 e6 3c 48 f6 f2 37 d0 b4 a2 87 ed 8b 72 11 f9 fa 1d 84 ca dd 63 7c e6 56 65 74 e8 c3 ce 0a 52 78 3d f5 2c 69 ad 82 46 5f 21 19 b5 ed d3 bf 7e 98 76 8d 6a 94 b7 ed
                                                  Data Ascii: @E>"[_ybd@<H7rc|VetRx=,iF_!~vj5s,yL/[g{QosVz%{A|PSeC)PYzSZ/]E?kINr|Pg!\2-;@&Lb<maS
                                                  Jul 22, 2024 12:35:47.544377089 CEST1236INData Raw: ef ec e3 a3 78 02 50 1e 6e 18 3a c8 ef 40 01 47 df 2f 67 75 81 ee e7 ed 5c 86 a7 cd ff 50 b9 61 08 00 fa a5 b9 0e 2f 50 8f 87 fd 80 44 ec bf 7d 28 a2 50 86 c4 d0 81 34 04 f9 9d 19 90 5d 6c c8 6f a3 82 62 5f 8a 77 97 ae e6 15 32 ec 5b 3c d5 d1 50
                                                  Data Ascii: xPn:@G/gu\Pa/PD}(P4]lob_w2[<Pz|<gzX],af!:$uMs)m74Tf8Q0Ee@>i~p#D'uma{4q-x.{W)x,0Fm'*wTn
                                                  Jul 22, 2024 12:35:47.544441938 CEST1236INData Raw: ea fe e8 9b 44 1e 62 80 9f 85 5d b4 ed 54 9a 62 26 5d f9 5f e9 66 31 79 1a ec 5d eb 3b 42 de 2a 12 2f 99 5a 51 ad 2c 4e fc b2 cd 25 8a df 0b d7 07 24 1e 16 60 15 f2 23 fe 84 ec 28 ca cb ea 25 a1 6f 30 22 39 cc 4f eb 80 ec b0 87 73 03 c9 e2 6f cb
                                                  Data Ascii: Db]Tb&]_f1y];B*/ZQ,N%$`#(%o0"9OsosUN^m9N)&8))QK}b9"@T~yu?V7j7y)vJ_EEW58X+:CP~T,{/s" a*=_lJ
                                                  Jul 22, 2024 12:35:47.544476986 CEST1236INData Raw: c6 ac fb 85 2b c7 a3 2f 2f d9 73 66 a6 d5 b3 dc bc 4c 89 64 2f f9 a1 b7 40 bf dd 84 b3 f4 0d 92 fa d2 49 45 fc 27 f8 14 9d 3f bd 02 3a c4 6a 3c 68 f4 ec 55 d8 20 1b ea 58 1f 15 63 0c 4e fc 76 39 e9 cc 71 40 69 5b b9 5b c5 4e 6d 50 82 e3 2b 3d 15
                                                  Data Ascii: +//sfLd/@IE'?:j<hU XcNv9q@i[[NmP+=127ZS$rHxh7[m15'1Z91 #%|^s\obPTPUO:$9pgLNTKqmc_xE]uUW\&6Ijo
                                                  Jul 22, 2024 12:35:47.544533968 CEST1236INData Raw: e7 41 3d ce 7d 33 4d 0f 6d da 2d 57 cd 6d 7c 72 20 41 5f e2 85 cb 48 2a 2c 1b 25 2d ea 0b 8c 30 58 68 ec 5b 67 54 17 0b 09 36 f0 a1 5f 55 d0 81 77 eb 76 58 90 be 59 9e ba 3f be 84 2b 42 29 6f 5c df c6 42 5f 49 8a 9f 97 26 07 55 9d da 50 6a e6 dc
                                                  Data Ascii: A=}3Mm-Wm|r A_H*,%-0Xh[gT6_UwvXY?+B)o\B_I&UPj?n,\_%N&gFx!7^"*w/:=\-?2$(<9#oPa7Z+iIU1B($k!XdI<#7s(,\~1~@SfHTn
                                                  Jul 22, 2024 12:35:47.544568062 CEST1236INData Raw: 20 19 6a 5f 78 89 c4 93 e5 38 5a 6e de 37 da e2 c6 06 b0 e8 f5 8e ec 2a 4d 52 53 7c c0 ce f1 b1 9d 84 d3 91 ba fc 29 13 39 6d 22 59 ca f4 90 ba 24 c3 b5 86 27 17 f3 8a b2 8c 0f d9 b9 6d 97 6d 9b 96 f5 eb e7 ae 0b 71 31 03 84 41 72 7d a7 8d f4 99
                                                  Data Ascii: j_x8Zn7*MRS|)9m"Y$'mmq1Ar}sWC@T^n2I%j+r|kpjq%<OjYSO)o+`qK18oLXG#F?sTds%>qWY2qf[n XR`
                                                  Jul 22, 2024 12:35:47.544620037 CEST1236INData Raw: d1 d2 9b 08 03 2c 5a d5 0d b5 24 ba 57 06 e9 82 13 06 b8 76 cd 11 85 df 30 60 c7 4a 68 fc 62 33 d3 a3 33 4a 36 3d a8 67 bb a3 56 33 7d 3d 9a 83 2c 2e ab 79 ba 0d fb 01 11 b8 6d 84 ce cd 88 2e 7d f5 4f 3e 3e d1 e4 3c 13 83 fa 27 77 82 c7 e2 d9 4b
                                                  Data Ascii: ,Z$Wv0`Jhb33J6=gV3}=,.ym.}O>><'wK\U}&El?<tl%}v%HSA*gH(vqd00Dan~Jlax_K9#+Rfl?uhLO{.FLRS
                                                  Jul 22, 2024 12:35:47.554893970 CEST1236INData Raw: 12 42 b8 dd e5 1f 9e 6b 33 d0 27 64 66 67 09 75 13 4e 4f e9 2f 56 c0 a1 26 a6 e7 0f 48 59 99 5e 9a 7b ee 13 0a e1 b2 7e 95 bf 06 41 45 43 c3 c5 43 45 37 b4 fd 4d f1 ee 9a 9c 98 53 15 42 01 8c fa ef a5 44 d0 97 33 99 81 2a 36 6b 2c 46 c1 0c 71 2f
                                                  Data Ascii: Bk3'dfguNO/V&HY^{~AECCE7MSBD3*6k,Fq/D:-E|OylOR-BS)2,o(P.Ibk@1F] 9X&;/<MZ5 `CLg`h*EH=|EZpoC/j{1,u;


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  123192.168.2.450282104.19.208.15280940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:35:51.856389046 CEST105OUTGET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Jul 22, 2024 12:35:52.336467981 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:35:52 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 9891
                                                  Connection: keep-alive
                                                  ETag: "3914547665"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 179
                                                  Expires: Mon, 22 Jul 2024 14:35:52 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c953bbff7c87-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d [TRUNCATED]
                                                  Data Ascii: PKIX6%FeatureActions.txtBPZ&KE9(0p<a}9g<D)9k@4y'!=~Zk`1J2[)_,{FF?q;fL*=1ZI->m%>`ml,sWITPu*;Pxxhgl$M]I}ogZL5?BZLxukU1P4mW-Ntf?I-/!w90/^%X-.0(mVPn]=cr_A$<BWye2bK{jOdxZv@[NLDU|_1Sp~Paq>})$qH7,hm)Ias<TWu$?Ey@Xu@5*UJLja0v^Q (O}k+fwvfzbhFE<plLWZI*.4#,X`=beVW)W*;Q,'x>Jq _T<ea&wo/RM2`rXFEc:A97A4FT0@wuJIBd5Bhw}oE@N=Z$)6@sXru%eIg5ruA:81&"e_'Be
                                                  Jul 22, 2024 12:35:52.336514950 CEST1236INData Raw: aa 27 91 1f 4b c3 11 60 77 a1 43 f9 f7 10 07 63 36 80 1a 86 ad 48 a7 d3 8f 6f 01 ae 9e 9c 3f a2 79 6e 3b 81 f2 7e 33 72 dc 17 7b 3c b2 f2 80 9b 26 a0 a9 76 69 9d e2 6e 9e 4d 47 96 36 9b c5 b5 27 68 b5 b4 84 34 1c 56 23 a3 50 e1 9f 24 02 89 9a 6e
                                                  Data Ascii: 'K`wCc6Ho?yn;~3r{<&vinMG6'h4V#P$n/Kt'<4oOa"xGTVBfE<eG#Bw{#@mc]os}uE6@e`^](9A,NjbNYnOF\8p"CLFk
                                                  Jul 22, 2024 12:35:52.336532116 CEST1236INData Raw: fd ac 50 d8 52 44 ee 8b 8f d4 d8 b2 84 d1 cb d6 f7 f8 05 a5 aa 41 48 05 36 3c 93 56 87 e3 e6 2f 47 40 72 47 91 28 bd 1e de c7 43 06 15 aa c9 07 7f 4b 86 10 6b 1f 41 44 6f 91 db 30 a2 f9 46 11 1a 4b 58 16 a1 31 d1 5e b4 59 ca fc 47 fc bc 25 05 70
                                                  Data Ascii: PRDAH6<V/G@rG(CKkADo0FKX1^YG%p8P*rH|idu{"PBv`DWG&O*rD:V4#{>51Zy4U-&SSIgFkZpYN~L-6Fed~ex>3
                                                  Jul 22, 2024 12:35:52.336658001 CEST1236INData Raw: 88 a8 b4 43 f7 18 27 39 99 b5 09 5b b0 21 e4 89 cd dc d8 80 8f ba 2c 76 5f 49 78 e0 a0 e6 a4 e8 61 8a 0a 7d 07 ae 7f 5b db 69 5b ab 4d 22 92 db 0e dc 5e ef db 36 83 5e 63 58 81 45 75 40 0c 8a 74 59 c3 e4 31 78 2a c9 f9 39 82 db c7 d7 e1 67 09 f5
                                                  Data Ascii: C'9[!,v_Ixa}[i[M"^6^cXEu@tY1x*9g&LIY+5kR@v<a.{G`#|<rPgAn><AhcF1NG_d~JFS}=l-z%Q\)Zm?)^afu
                                                  Jul 22, 2024 12:35:52.336673021 CEST1236INData Raw: 51 a2 95 4e ba 4b 5c 16 c5 a5 51 be 5a 39 45 dd 17 61 63 b5 65 bb 34 9f 6d 7c 76 0b e7 cf 8a 28 b1 32 a3 4c 94 f3 9c 2d 3a d8 05 c3 70 d8 b9 9e ea 5e e2 8b aa 76 16 1e 66 9d 5b 09 8d b4 bd 0c df a4 f1 57 38 11 41 42 5a 8f 27 30 7a 45 dd 2c af 7e
                                                  Data Ascii: QNK\QZ9Eace4m|v(2L-:p^vf[W8ABZ'0zE,~iY~^UiH-E`79_ue_f!t,f-X9^y0jgsotF8rUFX3\"T5p3WJBORFv
                                                  Jul 22, 2024 12:35:52.336688042 CEST1236INData Raw: ad 53 b8 3f 1e d4 8d 8b fb 22 dd 51 13 da db 37 c1 6d 8a c5 7d 9b 47 42 3f 8e c9 f0 52 59 f2 14 2a 9e 75 2e 6a 2e 7b 93 ce 8d 7f 03 7e d5 5c fc 25 45 10 44 72 a8 87 1c d2 e8 6e 79 f4 3a 12 2f 87 97 f4 7d 88 08 2a 70 f8 25 43 fc 4b 2d f3 25 a3 5d
                                                  Data Ascii: S?"Q7m}GB?RY*u.j.{~\%EDrny:/}*p%CK-%]F?TSkSG-^Bgv[1K+k9v&plE0P8t}BnUJXhBDBlfbG7Fsq3BI{?3>n
                                                  Jul 22, 2024 12:35:52.336704969 CEST1236INData Raw: 98 44 c0 9d 35 87 31 5c f2 45 f9 c7 ef 27 c4 f0 44 cb 1d 0f 1c d1 37 2a fd 7f 20 4f 38 65 99 02 a1 9a ea fd 15 94 74 5c 15 e4 8a 30 a5 11 66 30 df 52 31 9c c6 28 24 8c 3e 6f 18 50 ce cd 5b 40 65 9a 59 06 f5 bf 1e 38 1f 30 99 1f 31 4f 2a 69 da 0b
                                                  Data Ascii: D51\E'D7* O8et\0f0R1($>oP[@eY801O*iT2@#l0*z<F4a/dUF5iAzDScUSK:;{qQ.29h}w$/SZ24d2%h@"IT*w;W<-f.7p=ei ^C\aP`RyHaC!
                                                  Jul 22, 2024 12:35:52.336924076 CEST1236INData Raw: 39 ba ca 62 79 64 b1 96 fc a3 e4 33 18 bf f2 b3 53 33 28 3d 94 63 da fc df 9a ab 61 96 4f fd 8f 75 23 dd b5 d3 bd b5 31 ab e5 e1 6d de 8b 88 11 1d 05 ed 75 9d 2f 58 00 23 9c b7 5e 9c be d2 46 a0 2b 67 71 a6 f8 75 c0 5f 80 c9 c6 7f 3b c9 9d 1b 53
                                                  Data Ascii: 9byd3S3(=caOu#1mu/X#^F+gqu_;Sv_HO=[Ipy`9|;!&uEv@~q+"`T].@ON/,V]Bn`;LGQNL0j*\x8j8cpo;Y|1x[
                                                  Jul 22, 2024 12:35:52.336939096 CEST384INData Raw: e7 b8 35 15 54 a9 22 01 ba 8d 73 41 22 2d 5f 1c e5 c1 6a 64 1c 3a 02 da 84 ef c5 74 bd 9f 23 d9 32 44 34 28 27 d7 07 95 69 6b 95 3f 18 37 32 d0 a9 81 eb a5 e0 47 f9 bd 0e ce d3 e3 4e d2 40 77 fe 00 a1 df bb a6 9f 2e ba ee eb a2 f0 8c 0d bc fe f1
                                                  Data Ascii: 5T"sA"-_jd:t#2D4('ik?72GN@w.o[C4PcJ3 [mrE&r8U,%,uzs(q7r%Hr1]>D!M#C7xJW/5oZ~Wr4gB6SE^C8LT_4'8rC&:<uMz


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  124192.168.2.450283104.19.208.15280940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:35:52.660017014 CEST89OUTGET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Jul 22, 2024 12:35:52.773158073 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:35:52 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 17770
                                                  Connection: keep-alive
                                                  ETag: "770472110"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 482
                                                  Expires: Mon, 22 Jul 2024 14:35:52 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c9567a3b42a7-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 [TRUNCATED]
                                                  Data Ascii: PK:=AX7\0DrActiveFeatures.txt+@sjp#K1;/-[[ABexq)7 7:^gK !ibUVsO$v7|e\W'ZdveU*oR>%w$-;Q4Tf$+T$&Q?9#"6>0o@j(*i)H"B1`=&0I8CR"ycM7g\@8xE4S|Iyy7~%W?7!JhrfdB^OQ"IDG!o+^6VY6<wNNPP2\?EY^j>i[p`L_sXq>#~nY>LO9rsAS+g5FBiqgUf{*vBUBqTpKF;/[&WIAPuS-&v3!Y'bMl{[:5sVL3om7'O4'(V#:\#VOO&<s}Yd|<P@jM%O5lHs^SYfaCDDwVcE8~cETL0YIEd@._PQ~w\fAT7Kiywq|+#]N">(A0bU-lDM#ETYa-h}ep<),
                                                  Jul 22, 2024 12:35:52.773289919 CEST224INData Raw: c3 e9 0b b5 94 79 f6 cd ab db ef 95 d6 d1 32 bc 03 27 b0 a7 67 bb 67 5c 5f 47 4a 97 f1 f7 fc 80 a5 3d 5e cb d2 21 fd 16 4d f6 ed 94 f2 d0 41 ec b6 8d 9b cb af 44 4b 5e 3f 92 fc ae 08 db 64 a5 1d 86 78 29 a2 a9 c5 2d c1 7a 36 38 e0 81 84 1a 34 f5
                                                  Data Ascii: y2'gg\_GJ=^!MADK^?dx)-z684R|YSgynUf1qbEFO?'[a`bF\rsZL0q\vgrP:ZbPw^l^|Vov^'D0\mJ
                                                  Jul 22, 2024 12:35:52.773303986 CEST1236INData Raw: f5 d4 68 16 04 e9 da da 2a be b7 49 7b 58 31 f7 34 85 b1 a4 07 cc 22 41 cf 29 fe ef b6 ed 73 9e 33 db f2 de 67 08 80 87 c0 59 70 b7 3a a9 89 30 db 90 f2 7a ac d0 f9 13 06 39 ba ad 08 8e 8c 3d 34 b6 f7 51 cc 64 50 0a 4c cb 1c 11 70 9b bc dc e4 c7
                                                  Data Ascii: h*I{X14"A)s3gYp:0z9=4QdPLplngh'G|6t4U .Q|Hz^6HeLg1|BK@IO[EU4+(+B31l!c*c-:O6^-#9/Exk#
                                                  Jul 22, 2024 12:35:52.773389101 CEST1236INData Raw: 57 7d 88 bf 5f ac 0a 26 4c db d8 27 e5 c6 48 c7 4e 4f 70 d7 40 39 1e 4c 3d e5 95 51 3c 84 56 4a 31 88 69 36 00 05 b7 67 c2 0e e1 9f 28 42 4b 4c 42 c8 00 f9 cb 15 30 90 ff 8f fd 64 a2 fa 91 4f 39 90 d0 52 32 2c 3f d8 ef ab 3f c7 3e bf 20 2a e2 60
                                                  Data Ascii: W}_&L'HNOp@9L=Q<VJ1i6g(BKLB0dO9R2,??> *`H^VfknSSOX9m3y<*Imx/nbIMY<9a<1t3KV6\JqnJ6l8}FwF8q;2.
                                                  Jul 22, 2024 12:35:52.773403883 CEST1236INData Raw: 3b 40 26 c1 4c 94 62 06 3c 6d 86 61 1e 10 c4 b7 a3 f4 53 63 fc a5 99 7a 1f f5 f5 32 0e 04 59 da ed 79 80 52 10 ac 7f 78 79 f2 b8 79 4d 82 f3 7e d8 db a6 19 9f dd 60 d6 e2 23 fb fa 3b 3a 21 03 a4 03 5a e0 f4 6f b0 49 e3 59 10 46 c9 bb 91 d9 44 7f
                                                  Data Ascii: ;@&Lb<maScz2YyRxyyM~`#;:!ZoIYFDVW\n3Vij @*$W|fb3eUTaW1vmL{b24So)[N/qoCM:$+AYBwMnp:(6
                                                  Jul 22, 2024 12:35:52.773420095 CEST672INData Raw: a1 46 99 6d 1f 27 8c f1 da 2a 00 ee 77 d7 f7 bc 0a 54 6e a1 6c ae 9d ec 99 3e 1c 4b 6f 6f 00 36 68 48 54 f6 c3 cb af 59 c7 84 5b b4 a7 27 60 9e 25 de 8d 4b 6b 7e db ca 98 e7 ac e8 2d 89 23 e6 56 7d 19 76 4d 3f 64 75 4c 29 e0 04 de 36 55 4c 1b ba
                                                  Data Ascii: Fm'*wTnl>Koo6hHTY['`%Kk~-#V}vM?duL)6ULIvUm9GAu#7&~@X%%[I*pw y{B/J=(y7<zQ.+km} Q}guHZ1$Bw-!xOsb
                                                  Jul 22, 2024 12:35:52.773623943 CEST1236INData Raw: 34 7a 37 eb 41 78 0e 69 ee 11 1c f5 8d 29 8d ef b3 38 72 f5 f7 cc fb 36 a3 c2 33 d4 82 c1 58 75 70 0c 5f 55 99 f6 e2 74 8f d1 5e 0b e5 76 62 a3 7a f8 a5 65 a6 ea 05 07 b9 eb 1e 5f bd 75 b6 c2 cc 94 6a a2 22 b3 d0 66 95 e4 94 13 d8 c8 ec e4 19 65
                                                  Data Ascii: 4z7Axi)8r63Xup_Ut^vbze_uj"feJ\<2FU[eLEcRkpa:wczZ;Q,T8[e?9`zhz&T*yQ4#'f+qT^Kk2}3cbN*B128SiC'wA0S
                                                  Jul 22, 2024 12:35:52.773638964 CEST1236INData Raw: 34 25 2c e5 9d 5d ed b5 e1 2c a7 3e 41 d6 a0 33 a8 93 ff c5 15 81 3d ce 94 01 98 a4 ff 99 54 e9 36 32 86 38 39 e8 14 27 87 a9 a8 9f f0 c1 3b 3a a6 4c fd 4a cf 51 44 77 61 5c 29 51 4a 98 3b 05 86 8d 76 04 df a6 3d d8 93 02 c0 90 00 e2 f0 b2 d1 83
                                                  Data Ascii: 4%,],>A3=T6289';:LJQDwa\)QJ;v=5i6we/YIa]ge:8J9a-HFpRD:}]8@4FG`t3b3Aci,JJ<G!:c`u,,g/h9FrxuuH?
                                                  Jul 22, 2024 12:35:52.773653984 CEST1236INData Raw: d0 f6 cb d1 b3 61 55 fa a4 43 33 57 d3 0e 45 b7 ed 34 65 50 30 eb db fd 21 57 25 e2 b9 5d 8b 01 56 d6 0f a7 e6 e8 ca 4b 1d 77 ed 37 d5 75 0f 3a 55 77 60 b3 3d 6e 16 26 b9 f0 de 11 f8 a3 6c 90 d4 5c dc 72 5c 30 6b 99 58 be 4c 30 6e 29 14 76 6e e0
                                                  Data Ascii: aUC3WE4eP0!W%]VKw7u:Uw`=n&l\r\0kXL0n)vneEw6h,{>VoJ[,"W2F##bl'h~T1&Cs_e-VYo[*r/zrC3{|Bt93CQ>E
                                                  Jul 22, 2024 12:35:52.773669958 CEST1236INData Raw: cb 2a 77 20 e5 30 06 0d 12 0f ce a0 a1 e4 a2 73 cb 42 3d 7a 87 cf 2b 4b a6 8c ef a7 33 77 c3 87 56 b0 a8 7d 61 53 08 eb 29 e8 42 6c 83 f3 55 44 60 61 ad b4 90 25 b4 10 8c 7a 04 31 2d f5 10 2f 61 7b 61 5a 40 a5 05 22 ef f9 09 3b 41 f7 73 57 a0 b1
                                                  Data Ascii: *w 0sB=z+K3wV}aS)BlUD`a%z1-/a{aZ@";AsW_DL[hArN~+;6]._#idF B;}+DIKv={k5G7>UPg-`N(w4!*@1?3@$Ji._r?aa_U
                                                  Jul 22, 2024 12:35:52.778944969 CEST1236INData Raw: b9 f2 d3 4c dc 58 95 5a 62 64 42 4e ba 0c 03 cb 52 79 d5 8d a2 fc 69 62 5b a7 46 45 a4 a7 8c 82 b3 e4 ed 76 ff b0 2e 3d 4b 87 33 1d 13 36 41 23 3a ef 4f 7f 83 bc 01 18 d8 ce ac 1b 15 fa ca d4 3b df c7 93 23 1b 4d 6a c4 4a 8a 3f fa 4e 10 f1 37 1a
                                                  Data Ascii: LXZbdBNRyib[FEv.=K36A#:O;#MjJ?N7k]^0huT [^o}r{498Q`JN<,R*je7Ij+{bZwziN}jN\qEcC\Esonti


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  125192.168.2.450290104.19.208.15280940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:35:53.311326027 CEST89OUTGET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Jul 22, 2024 12:35:54.804461002 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:35:54 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 17770
                                                  Connection: keep-alive
                                                  ETag: "770472110"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 484
                                                  Expires: Mon, 22 Jul 2024 14:35:54 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c9632df14372-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 [TRUNCATED]
                                                  Data Ascii: PK:=AX7\0DrActiveFeatures.txt+@sjp#K1;/-[[ABexq)7 7:^gK !ibUVsO$v7|e\W'ZdveU*oR>%w$-;Q4Tf$+T$&Q?9#"6>0o@j(*i)H"B1`=&0I8CR"ycM7g\@8xE4S|Iyy7~%W?7!JhrfdB^OQ"IDG!o+^6VY6<wNNPP2\?EY^j>i[p`L_sXq>#~nY>LO9rsAS+g5FBiqgUf{*vBUBqTpKF;/[&WIAPuS-&v3!Y'bMl{[:5sVL3om7'O4'(V#:\#VOO&<s}Yd|<P@jM%O5lHs^SYfaCDDwVcE8~cETL0YIEd@._PQ~w\fAT7Kiywq|+#]N">(A0bU-lDM#ETYa-h}ep<),
                                                  Jul 22, 2024 12:35:54.805015087 CEST224INData Raw: c3 e9 0b b5 94 79 f6 cd ab db ef 95 d6 d1 32 bc 03 27 b0 a7 67 bb 67 5c 5f 47 4a 97 f1 f7 fc 80 a5 3d 5e cb d2 21 fd 16 4d f6 ed 94 f2 d0 41 ec b6 8d 9b cb af 44 4b 5e 3f 92 fc ae 08 db 64 a5 1d 86 78 29 a2 a9 c5 2d c1 7a 36 38 e0 81 84 1a 34 f5
                                                  Data Ascii: y2'gg\_GJ=^!MADK^?dx)-z684R|YSgynUf1qbEFO?'[a`bF\rsZL0q\vgrP:ZbPw^l^|Vov^'D0\mJ
                                                  Jul 22, 2024 12:35:54.805047989 CEST1236INData Raw: f5 d4 68 16 04 e9 da da 2a be b7 49 7b 58 31 f7 34 85 b1 a4 07 cc 22 41 cf 29 fe ef b6 ed 73 9e 33 db f2 de 67 08 80 87 c0 59 70 b7 3a a9 89 30 db 90 f2 7a ac d0 f9 13 06 39 ba ad 08 8e 8c 3d 34 b6 f7 51 cc 64 50 0a 4c cb 1c 11 70 9b bc dc e4 c7
                                                  Data Ascii: h*I{X14"A)s3gYp:0z9=4QdPLplngh'G|6t4U .Q|Hz^6HeLg1|BK@IO[EU4+(+B31l!c*c-:O6^-#9/Exk#
                                                  Jul 22, 2024 12:35:54.806343079 CEST1236INData Raw: 57 7d 88 bf 5f ac 0a 26 4c db d8 27 e5 c6 48 c7 4e 4f 70 d7 40 39 1e 4c 3d e5 95 51 3c 84 56 4a 31 88 69 36 00 05 b7 67 c2 0e e1 9f 28 42 4b 4c 42 c8 00 f9 cb 15 30 90 ff 8f fd 64 a2 fa 91 4f 39 90 d0 52 32 2c 3f d8 ef ab 3f c7 3e bf 20 2a e2 60
                                                  Data Ascii: W}_&L'HNOp@9L=Q<VJ1i6g(BKLB0dO9R2,??> *`H^VfknSSOX9m3y<*Imx/nbIMY<9a<1t3KV6\JqnJ6l8}FwF8q;2.
                                                  Jul 22, 2024 12:35:54.806376934 CEST1236INData Raw: 3b 40 26 c1 4c 94 62 06 3c 6d 86 61 1e 10 c4 b7 a3 f4 53 63 fc a5 99 7a 1f f5 f5 32 0e 04 59 da ed 79 80 52 10 ac 7f 78 79 f2 b8 79 4d 82 f3 7e d8 db a6 19 9f dd 60 d6 e2 23 fb fa 3b 3a 21 03 a4 03 5a e0 f4 6f b0 49 e3 59 10 46 c9 bb 91 d9 44 7f
                                                  Data Ascii: ;@&Lb<maScz2YyRxyyM~`#;:!ZoIYFDVW\n3Vij @*$W|fb3eUTaW1vmL{b24So)[N/qoCM:$+AYBwMnp:(6
                                                  Jul 22, 2024 12:35:54.808676004 CEST1236INData Raw: a1 46 99 6d 1f 27 8c f1 da 2a 00 ee 77 d7 f7 bc 0a 54 6e a1 6c ae 9d ec 99 3e 1c 4b 6f 6f 00 36 68 48 54 f6 c3 cb af 59 c7 84 5b b4 a7 27 60 9e 25 de 8d 4b 6b 7e db ca 98 e7 ac e8 2d 89 23 e6 56 7d 19 76 4d 3f 64 75 4c 29 e0 04 de 36 55 4c 1b ba
                                                  Data Ascii: Fm'*wTnl>Koo6hHTY['`%Kk~-#V}vM?duL)6ULIvUm9GAu#7&~@X%%[I*pw y{B/J=(y7<zQ.+km} Q}guHZ1$Bw-!xOsb
                                                  Jul 22, 2024 12:35:54.808712006 CEST1236INData Raw: 73 de 22 ab 20 cc 61 2a 3d 5f 8b 6c d8 b6 dd b5 ab f4 4a 86 63 0c 73 8c 15 e2 87 bb 54 5f 60 54 01 08 9e 33 b3 ad 38 3c 0d 94 fb 2a 66 af 06 83 e7 5b aa 49 c8 1f 1c c1 c4 7f 53 9d ba 82 f2 d4 21 64 46 fa 09 32 7c 69 f3 12 9c 6d 4c cb 53 ad 70 b9
                                                  Data Ascii: s" a*=_lJcsT_`T38<*f[IS!dF2|imLSpQu{8/P}/08OfVK^? Dt0.<8ElzqGs5mPM{1&q[&nV^Ic
                                                  Jul 22, 2024 12:35:54.810643911 CEST1236INData Raw: f1 7f 57 88 f3 5c 26 36 49 6a 6f 89 06 a3 b0 a8 9c 15 c1 c9 f1 6d b6 7c e6 e5 b2 76 86 e1 65 d5 06 1a 26 99 9b e7 46 d8 5c ba fc 05 82 66 3d cb 34 7b 41 05 76 ea 3d 7c b0 09 21 d6 ac a6 7a e1 37 56 91 bc 44 8d 55 cd ca ae 53 c7 ae 5d 17 86 78 59
                                                  Data Ascii: W\&6Ijom|ve&F\f=4{Av=|!z7VDUS]xYC~D{E/%$n/.!/W6n$!+#Ctvi(kRU;1PRbbHGSBS8__3h!FZ6%aZ8cp/](y
                                                  Jul 22, 2024 12:35:54.810678959 CEST1236INData Raw: 2c 5c 7e 31 7e 9c 06 40 a5 99 53 66 8a cf 48 54 b2 e3 6e ab 82 1a 0f a1 02 1e 47 b6 e3 ea 1a 70 19 12 1f 13 2e a2 e4 a9 32 1f 97 86 0d 51 8e 49 60 52 84 22 03 db 7a 6d 5d f1 8d fe e7 55 dd 46 8b 81 f6 6c 86 fb bd 0f 16 99 18 a1 78 7f 9f 39 f8 93
                                                  Data Ascii: ,\~1~@SfHTnGp.2QI`R"zm]UFlx9!I!6}l<"?&TH]VEICxR[?_9egyCS`uj5Qh>Tr),b2]:jb)u NkKL+!/,V ~rhtp67
                                                  Jul 22, 2024 12:35:54.812846899 CEST1236INData Raw: 84 07 c1 f3 5b 18 6e 20 58 ca d2 99 52 1c 99 12 0c 18 60 11 e6 42 28 fc c6 00 29 c3 f6 c2 9b a0 62 02 64 08 bf 3c f4 30 69 a7 02 1d 59 ce 2a bd ff 89 4e 7f ca d6 d7 11 39 00 67 46 7f e7 94 4f 02 99 e7 45 e5 f6 26 19 40 1b 4a 8f 33 71 7a dd 61 46
                                                  Data Ascii: [n XR`B()bd<0iY*N9gFOE&@J3qzaF7?c?*Fz.n4!o\^SB{Khe4YI;m!4!E7|DYxG-p^Ex|-7`W+eNyo)>B{M}d7+!b
                                                  Jul 22, 2024 12:35:54.812922001 CEST1236INData Raw: d9 f1 0d f2 cd 8b 7f f7 b6 98 c7 c1 2e 46 4c 04 e1 52 53 e8 31 ab f3 fd 1e 50 ae ac e4 a8 8c 7d 9f c2 dc 2c 9b 36 53 33 93 96 4b a3 f9 25 dc 96 6a 20 3c 9f 19 2e 65 dc 6d 56 82 93 8b 90 02 e9 05 20 b3 a1 bb aa 82 24 88 80 b4 43 4a 75 4a ab 0a 5e
                                                  Data Ascii: .FLRS1P},6S3K%j <.emV $CJuJ^G82;is9fF/jvr<`U+WGSgw3(ur}F]}dXJ4frDt]{^IE6!GSa$owdu~JB<|=j^o


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  126192.168.2.450291104.16.149.13080984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:35:54.973251104 CEST179OUTPOST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 239
                                                  Connection: Keep-Alive
                                                  Jul 22, 2024 12:35:54.978365898 CEST239OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","CurrentSearch":"Google","CurrentHomepage":"about:home","LanguageIso2":"en-GB","IP":null,"CreateDate":0}}
                                                  Jul 22, 2024 12:35:55.206794024 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:35:55 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c964eb7d447a-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  127192.168.2.450301104.19.208.15280940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:35:55.853151083 CEST113OUTGET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Connection: Keep-Alive
                                                  Jul 22, 2024 12:35:57.662966013 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:35:57 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 17770
                                                  Connection: keep-alive
                                                  ETag: "770472110"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 487
                                                  Expires: Mon, 22 Jul 2024 14:35:57 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c9750ed01801-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 [TRUNCATED]
                                                  Data Ascii: PK:=AX7\0DrActiveFeatures.txt+@sjp#K1;/-[[ABexq)7 7:^gK !ibUVsO$v7|e\W'ZdveU*oR>%w$-;Q4Tf$+T$&Q?9#"6>0o@j(*i)H"B1`=&0I8CR"ycM7g\@8xE4S|Iyy7~%W?7!JhrfdB^OQ"IDG!o+^6VY6<wNNPP2\?EY^j>i[p`L_sXq>#~nY>LO9rsAS+g5FBiqgUf{*vBUBqTpKF;/[&WIAPuS-&v3!Y'bMl{[:5sVL3om7'O4'(V#:\#VOO&<s}Yd|<P@jM%O5lHs^SYfaCDDwVcE8~cETL0YIEd@._PQ~w\fAT7Kiywq|+#]N">(A0bU-lDM#ETYa-h}ep<),
                                                  Jul 22, 2024 12:35:57.663394928 CEST1236INData Raw: c3 e9 0b b5 94 79 f6 cd ab db ef 95 d6 d1 32 bc 03 27 b0 a7 67 bb 67 5c 5f 47 4a 97 f1 f7 fc 80 a5 3d 5e cb d2 21 fd 16 4d f6 ed 94 f2 d0 41 ec b6 8d 9b cb af 44 4b 5e 3f 92 fc ae 08 db 64 a5 1d 86 78 29 a2 a9 c5 2d c1 7a 36 38 e0 81 84 1a 34 f5
                                                  Data Ascii: y2'gg\_GJ=^!MADK^?dx)-z684R|YSgynUf1qbEFO?'[a`bF\rsZL0q\vgrP:ZbPw^l^|Vov^'D0\mJh*I{X14
                                                  Jul 22, 2024 12:35:57.663414955 CEST1236INData Raw: e3 09 b7 93 e7 ef 55 87 a5 e2 4a 0e 55 3c 50 4f 28 65 ca 9a de 34 88 d5 59 ab cd 64 54 2a 94 93 b6 b8 c7 f1 34 a6 fe 9a 9e 58 e1 5b 68 04 08 88 1d 07 7a 22 8c f4 8b 1a 37 f4 2d 18 02 f7 c9 7a e3 8d 30 e6 e5 c6 72 4a b5 33 12 97 f2 9b 9f 3d 2b 49
                                                  Data Ascii: UJU<PO(e4YdT*4X[hz"7-z0rJ3=+I:QrVjeAU|0e r.-nFs%U@_G~W}E^ns]W6.Jg4)Kk~9"4{i#W}_&L'HNOp
                                                  Jul 22, 2024 12:35:57.664952040 CEST1236INData Raw: a2 40 45 ad 3e 10 cc d4 22 b8 18 aa b5 83 15 5b 5f 79 62 da f6 64 de 89 40 91 c6 e3 e6 3c 48 f6 f2 37 d0 b4 a2 87 ed 8b 72 11 f9 fa 1d 84 ca dd 63 7c e6 56 65 74 e8 c3 ce 0a 52 78 3d f5 2c 69 ad 82 46 5f 21 19 b5 ed d3 bf 7e 98 76 8d 6a 94 b7 ed
                                                  Data Ascii: @E>"[_ybd@<H7rc|VetRx=,iF_!~vj5s,yL/[g{QosVz%{A|PSeC)PYzSZ/]E?kINr|Pg!\2-;@&Lb<maS
                                                  Jul 22, 2024 12:35:57.664966106 CEST1236INData Raw: ef ec e3 a3 78 02 50 1e 6e 18 3a c8 ef 40 01 47 df 2f 67 75 81 ee e7 ed 5c 86 a7 cd ff 50 b9 61 08 00 fa a5 b9 0e 2f 50 8f 87 fd 80 44 ec bf 7d 28 a2 50 86 c4 d0 81 34 04 f9 9d 19 90 5d 6c c8 6f a3 82 62 5f 8a 77 97 ae e6 15 32 ec 5b 3c d5 d1 50
                                                  Data Ascii: xPn:@G/gu\Pa/PD}(P4]lob_w2[<Pz|<gzX],af!:$uMs)m74Tf8Q0Ee@>i~p#D'uma{4q-x.{W)x,0Fm'*wTn
                                                  Jul 22, 2024 12:35:57.666677952 CEST1236INData Raw: ea fe e8 9b 44 1e 62 80 9f 85 5d b4 ed 54 9a 62 26 5d f9 5f e9 66 31 79 1a ec 5d eb 3b 42 de 2a 12 2f 99 5a 51 ad 2c 4e fc b2 cd 25 8a df 0b d7 07 24 1e 16 60 15 f2 23 fe 84 ec 28 ca cb ea 25 a1 6f 30 22 39 cc 4f eb 80 ec b0 87 73 03 c9 e2 6f cb
                                                  Data Ascii: Db]Tb&]_f1y];B*/ZQ,N%$`#(%o0"9OsosUN^m9N)&8))QK}b9"@T~yu?V7j7y)vJ_EEW58X+:CP~T,{/s" a*=_lJ
                                                  Jul 22, 2024 12:35:57.666691065 CEST1236INData Raw: c6 ac fb 85 2b c7 a3 2f 2f d9 73 66 a6 d5 b3 dc bc 4c 89 64 2f f9 a1 b7 40 bf dd 84 b3 f4 0d 92 fa d2 49 45 fc 27 f8 14 9d 3f bd 02 3a c4 6a 3c 68 f4 ec 55 d8 20 1b ea 58 1f 15 63 0c 4e fc 76 39 e9 cc 71 40 69 5b b9 5b c5 4e 6d 50 82 e3 2b 3d 15
                                                  Data Ascii: +//sfLd/@IE'?:j<hU XcNv9q@i[[NmP+=127ZS$rHxh7[m15'1Z91 #%|^s\obPTPUO:$9pgLNTKqmc_xE]uUW\&6Ijo
                                                  Jul 22, 2024 12:35:57.668414116 CEST1236INData Raw: e7 41 3d ce 7d 33 4d 0f 6d da 2d 57 cd 6d 7c 72 20 41 5f e2 85 cb 48 2a 2c 1b 25 2d ea 0b 8c 30 58 68 ec 5b 67 54 17 0b 09 36 f0 a1 5f 55 d0 81 77 eb 76 58 90 be 59 9e ba 3f be 84 2b 42 29 6f 5c df c6 42 5f 49 8a 9f 97 26 07 55 9d da 50 6a e6 dc
                                                  Data Ascii: A=}3Mm-Wm|r A_H*,%-0Xh[gT6_UwvXY?+B)o\B_I&UPj?n,\_%N&gFx!7^"*w/:=\-?2$(<9#oPa7Z+iIU1B($k!XdI<#7s(,\~1~@SfHTn
                                                  Jul 22, 2024 12:35:57.668428898 CEST1236INData Raw: 20 19 6a 5f 78 89 c4 93 e5 38 5a 6e de 37 da e2 c6 06 b0 e8 f5 8e ec 2a 4d 52 53 7c c0 ce f1 b1 9d 84 d3 91 ba fc 29 13 39 6d 22 59 ca f4 90 ba 24 c3 b5 86 27 17 f3 8a b2 8c 0f d9 b9 6d 97 6d 9b 96 f5 eb e7 ae 0b 71 31 03 84 41 72 7d a7 8d f4 99
                                                  Data Ascii: j_x8Zn7*MRS|)9m"Y$'mmq1Ar}sWC@T^n2I%j+r|kpjq%<OjYSO)o+`qK18oLXG#F?sTds%>qWY2qf[n XR`
                                                  Jul 22, 2024 12:35:57.670152903 CEST1236INData Raw: d1 d2 9b 08 03 2c 5a d5 0d b5 24 ba 57 06 e9 82 13 06 b8 76 cd 11 85 df 30 60 c7 4a 68 fc 62 33 d3 a3 33 4a 36 3d a8 67 bb a3 56 33 7d 3d 9a 83 2c 2e ab 79 ba 0d fb 01 11 b8 6d 84 ce cd 88 2e 7d f5 4f 3e 3e d1 e4 3c 13 83 fa 27 77 82 c7 e2 d9 4b
                                                  Data Ascii: ,Z$Wv0`Jhb33J6=gV3}=,.ym.}O>><'wK\U}&El?<tl%}v%HSA*gH(vqd00Dan~Jlax_K9#+Rfl?uhLO{.FLRS
                                                  Jul 22, 2024 12:35:57.670212030 CEST1236INData Raw: 12 42 b8 dd e5 1f 9e 6b 33 d0 27 64 66 67 09 75 13 4e 4f e9 2f 56 c0 a1 26 a6 e7 0f 48 59 99 5e 9a 7b ee 13 0a e1 b2 7e 95 bf 06 41 45 43 c3 c5 43 45 37 b4 fd 4d f1 ee 9a 9c 98 53 15 42 01 8c fa ef a5 44 d0 97 33 99 81 2a 36 6b 2c 46 c1 0c 71 2f
                                                  Data Ascii: Bk3'dfguNO/V&HY^{~AECCE7MSBD3*6k,Fq/D:-E|OylOR-BS)2,o(P.Ibk@1F] 9X&;/<MZ5 `CLg`h*EH=|EZpoC/j{1,u;


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  128192.168.2.450311104.19.208.15280940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:35:58.595279932 CEST89OUTGET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Jul 22, 2024 12:35:59.235825062 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:35:59 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 17770
                                                  Connection: keep-alive
                                                  ETag: "770472110"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 489
                                                  Expires: Mon, 22 Jul 2024 14:35:59 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c97dcbc641c3-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 [TRUNCATED]
                                                  Data Ascii: PK:=AX7\0DrActiveFeatures.txt+@sjp#K1;/-[[ABexq)7 7:^gK !ibUVsO$v7|e\W'ZdveU*oR>%w$-;Q4Tf$+T$&Q?9#"6>0o@j(*i)H"B1`=&0I8CR"ycM7g\@8xE4S|Iyy7~%W?7!JhrfdB^OQ"IDG!o+^6VY6<wNNPP2\?EY^j>i[p`L_sXq>#~nY>LO9rsAS+g5FBiqgUf{*vBUBqTpKF;/[&WIAPuS-&v3!Y'bMl{[:5sVL3om7'O4'(V#:\#VOO&<s}Yd|<P@jM%O5lHs^SYfaCDDwVcE8~cETL0YIEd@._PQ~w\fAT7Kiywq|+#]N">(A0bU-lDM#ETYa-h}ep<),
                                                  Jul 22, 2024 12:35:59.236440897 CEST1236INData Raw: c3 e9 0b b5 94 79 f6 cd ab db ef 95 d6 d1 32 bc 03 27 b0 a7 67 bb 67 5c 5f 47 4a 97 f1 f7 fc 80 a5 3d 5e cb d2 21 fd 16 4d f6 ed 94 f2 d0 41 ec b6 8d 9b cb af 44 4b 5e 3f 92 fc ae 08 db 64 a5 1d 86 78 29 a2 a9 c5 2d c1 7a 36 38 e0 81 84 1a 34 f5
                                                  Data Ascii: y2'gg\_GJ=^!MADK^?dx)-z684R|YSgynUf1qbEFO?'[a`bF\rsZL0q\vgrP:ZbPw^l^|Vov^'D0\mJh*I{X14
                                                  Jul 22, 2024 12:35:59.236457109 CEST1236INData Raw: e3 09 b7 93 e7 ef 55 87 a5 e2 4a 0e 55 3c 50 4f 28 65 ca 9a de 34 88 d5 59 ab cd 64 54 2a 94 93 b6 b8 c7 f1 34 a6 fe 9a 9e 58 e1 5b 68 04 08 88 1d 07 7a 22 8c f4 8b 1a 37 f4 2d 18 02 f7 c9 7a e3 8d 30 e6 e5 c6 72 4a b5 33 12 97 f2 9b 9f 3d 2b 49
                                                  Data Ascii: UJU<PO(e4YdT*4X[hz"7-z0rJ3=+I:QrVjeAU|0e r.-nFs%U@_G~W}E^ns]W6.Jg4)Kk~9"4{i#W}_&L'HNOp
                                                  Jul 22, 2024 12:35:59.237626076 CEST1236INData Raw: a2 40 45 ad 3e 10 cc d4 22 b8 18 aa b5 83 15 5b 5f 79 62 da f6 64 de 89 40 91 c6 e3 e6 3c 48 f6 f2 37 d0 b4 a2 87 ed 8b 72 11 f9 fa 1d 84 ca dd 63 7c e6 56 65 74 e8 c3 ce 0a 52 78 3d f5 2c 69 ad 82 46 5f 21 19 b5 ed d3 bf 7e 98 76 8d 6a 94 b7 ed
                                                  Data Ascii: @E>"[_ybd@<H7rc|VetRx=,iF_!~vj5s,yL/[g{QosVz%{A|PSeC)PYzSZ/]E?kINr|Pg!\2-;@&Lb<maS
                                                  Jul 22, 2024 12:35:59.237641096 CEST1236INData Raw: ef ec e3 a3 78 02 50 1e 6e 18 3a c8 ef 40 01 47 df 2f 67 75 81 ee e7 ed 5c 86 a7 cd ff 50 b9 61 08 00 fa a5 b9 0e 2f 50 8f 87 fd 80 44 ec bf 7d 28 a2 50 86 c4 d0 81 34 04 f9 9d 19 90 5d 6c c8 6f a3 82 62 5f 8a 77 97 ae e6 15 32 ec 5b 3c d5 d1 50
                                                  Data Ascii: xPn:@G/gu\Pa/PD}(P4]lob_w2[<Pz|<gzX],af!:$uMs)m74Tf8Q0Ee@>i~p#D'uma{4q-x.{W)x,0Fm'*wTn
                                                  Jul 22, 2024 12:35:59.239085913 CEST1236INData Raw: ea fe e8 9b 44 1e 62 80 9f 85 5d b4 ed 54 9a 62 26 5d f9 5f e9 66 31 79 1a ec 5d eb 3b 42 de 2a 12 2f 99 5a 51 ad 2c 4e fc b2 cd 25 8a df 0b d7 07 24 1e 16 60 15 f2 23 fe 84 ec 28 ca cb ea 25 a1 6f 30 22 39 cc 4f eb 80 ec b0 87 73 03 c9 e2 6f cb
                                                  Data Ascii: Db]Tb&]_f1y];B*/ZQ,N%$`#(%o0"9OsosUN^m9N)&8))QK}b9"@T~yu?V7j7y)vJ_EEW58X+:CP~T,{/s" a*=_lJ
                                                  Jul 22, 2024 12:35:59.239100933 CEST1236INData Raw: c6 ac fb 85 2b c7 a3 2f 2f d9 73 66 a6 d5 b3 dc bc 4c 89 64 2f f9 a1 b7 40 bf dd 84 b3 f4 0d 92 fa d2 49 45 fc 27 f8 14 9d 3f bd 02 3a c4 6a 3c 68 f4 ec 55 d8 20 1b ea 58 1f 15 63 0c 4e fc 76 39 e9 cc 71 40 69 5b b9 5b c5 4e 6d 50 82 e3 2b 3d 15
                                                  Data Ascii: +//sfLd/@IE'?:j<hU XcNv9q@i[[NmP+=127ZS$rHxh7[m15'1Z91 #%|^s\obPTPUO:$9pgLNTKqmc_xE]uUW\&6Ijo
                                                  Jul 22, 2024 12:35:59.239325047 CEST1236INData Raw: e7 41 3d ce 7d 33 4d 0f 6d da 2d 57 cd 6d 7c 72 20 41 5f e2 85 cb 48 2a 2c 1b 25 2d ea 0b 8c 30 58 68 ec 5b 67 54 17 0b 09 36 f0 a1 5f 55 d0 81 77 eb 76 58 90 be 59 9e ba 3f be 84 2b 42 29 6f 5c df c6 42 5f 49 8a 9f 97 26 07 55 9d da 50 6a e6 dc
                                                  Data Ascii: A=}3Mm-Wm|r A_H*,%-0Xh[gT6_UwvXY?+B)o\B_I&UPj?n,\_%N&gFx!7^"*w/:=\-?2$(<9#oPa7Z+iIU1B($k!XdI<#7s(,\~1~@SfHTn
                                                  Jul 22, 2024 12:35:59.239336967 CEST1236INData Raw: 20 19 6a 5f 78 89 c4 93 e5 38 5a 6e de 37 da e2 c6 06 b0 e8 f5 8e ec 2a 4d 52 53 7c c0 ce f1 b1 9d 84 d3 91 ba fc 29 13 39 6d 22 59 ca f4 90 ba 24 c3 b5 86 27 17 f3 8a b2 8c 0f d9 b9 6d 97 6d 9b 96 f5 eb e7 ae 0b 71 31 03 84 41 72 7d a7 8d f4 99
                                                  Data Ascii: j_x8Zn7*MRS|)9m"Y$'mmq1Ar}sWC@T^n2I%j+r|kpjq%<OjYSO)o+`qK18oLXG#F?sTds%>qWY2qf[n XR`
                                                  Jul 22, 2024 12:35:59.240174055 CEST1236INData Raw: d1 d2 9b 08 03 2c 5a d5 0d b5 24 ba 57 06 e9 82 13 06 b8 76 cd 11 85 df 30 60 c7 4a 68 fc 62 33 d3 a3 33 4a 36 3d a8 67 bb a3 56 33 7d 3d 9a 83 2c 2e ab 79 ba 0d fb 01 11 b8 6d 84 ce cd 88 2e 7d f5 4f 3e 3e d1 e4 3c 13 83 fa 27 77 82 c7 e2 d9 4b
                                                  Data Ascii: ,Z$Wv0`Jhb33J6=gV3}=,.ym.}O>><'wK\U}&El?<tl%}v%HSA*gH(vqd00Dan~Jlax_K9#+Rfl?uhLO{.FLRS
                                                  Jul 22, 2024 12:35:59.240190029 CEST1236INData Raw: 12 42 b8 dd e5 1f 9e 6b 33 d0 27 64 66 67 09 75 13 4e 4f e9 2f 56 c0 a1 26 a6 e7 0f 48 59 99 5e 9a 7b ee 13 0a e1 b2 7e 95 bf 06 41 45 43 c3 c5 43 45 37 b4 fd 4d f1 ee 9a 9c 98 53 15 42 01 8c fa ef a5 44 d0 97 33 99 81 2a 36 6b 2c 46 c1 0c 71 2f
                                                  Data Ascii: Bk3'dfguNO/V&HY^{~AECCE7MSBD3*6k,Fq/D:-E|OylOR-BS)2,o(P.Ibk@1F] 9X&;/<MZ5 `CLg`h*EH=|EZpoC/j{1,u;


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  129192.168.2.450315104.19.208.15280940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:35:59.241121054 CEST105OUTGET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Jul 22, 2024 12:35:59.885993958 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:35:59 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 9891
                                                  Connection: keep-alive
                                                  ETag: "3914547665"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 186
                                                  Expires: Mon, 22 Jul 2024 14:35:59 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c981fc514205-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d [TRUNCATED]
                                                  Data Ascii: PKIX6%FeatureActions.txtBPZ&KE9(0p<a}9g<D)9k@4y'!=~Zk`1J2[)_,{FF?q;fL*=1ZI->m%>`ml,sWITPu*;Pxxhgl$M]I}ogZL5?BZLxukU1P4mW-Ntf?I-/!w90/^%X-.0(mVPn]=cr_A$<BWye2bK{jOdxZv@[NLDU|_1Sp~Paq>})$qH7,hm)Ias<TWu$?Ey@Xu@5*UJLja0v^Q (O}k+fwvfzbhFE<plLWZI*.4#,X`=beVW)W*;Q,'x>Jq _T<ea&wo/RM2`rXFEc:A97A4FT0@wuJIBd5Bhw}oE@N=Z$)6@sXru%eIg5ruA:81&"e_'Be
                                                  Jul 22, 2024 12:35:59.886784077 CEST1236INData Raw: aa 27 91 1f 4b c3 11 60 77 a1 43 f9 f7 10 07 63 36 80 1a 86 ad 48 a7 d3 8f 6f 01 ae 9e 9c 3f a2 79 6e 3b 81 f2 7e 33 72 dc 17 7b 3c b2 f2 80 9b 26 a0 a9 76 69 9d e2 6e 9e 4d 47 96 36 9b c5 b5 27 68 b5 b4 84 34 1c 56 23 a3 50 e1 9f 24 02 89 9a 6e
                                                  Data Ascii: 'K`wCc6Ho?yn;~3r{<&vinMG6'h4V#P$n/Kt'<4oOa"xGTVBfE<eG#Bw{#@mc]os}uE6@e`^](9A,NjbNYnOF\8p"CLFk
                                                  Jul 22, 2024 12:35:59.886797905 CEST1236INData Raw: fd ac 50 d8 52 44 ee 8b 8f d4 d8 b2 84 d1 cb d6 f7 f8 05 a5 aa 41 48 05 36 3c 93 56 87 e3 e6 2f 47 40 72 47 91 28 bd 1e de c7 43 06 15 aa c9 07 7f 4b 86 10 6b 1f 41 44 6f 91 db 30 a2 f9 46 11 1a 4b 58 16 a1 31 d1 5e b4 59 ca fc 47 fc bc 25 05 70
                                                  Data Ascii: PRDAH6<V/G@rG(CKkADo0FKX1^YG%p8P*rH|idu{"PBv`DWG&O*rD:V4#{>51Zy4U-&SSIgFkZpYN~L-6Fed~ex>3
                                                  Jul 22, 2024 12:35:59.887813091 CEST1236INData Raw: 88 a8 b4 43 f7 18 27 39 99 b5 09 5b b0 21 e4 89 cd dc d8 80 8f ba 2c 76 5f 49 78 e0 a0 e6 a4 e8 61 8a 0a 7d 07 ae 7f 5b db 69 5b ab 4d 22 92 db 0e dc 5e ef db 36 83 5e 63 58 81 45 75 40 0c 8a 74 59 c3 e4 31 78 2a c9 f9 39 82 db c7 d7 e1 67 09 f5
                                                  Data Ascii: C'9[!,v_Ixa}[i[M"^6^cXEu@tY1x*9g&LIY+5kR@v<a.{G`#|<rPgAn><AhcF1NG_d~JFS}=l-z%Q\)Zm?)^afu
                                                  Jul 22, 2024 12:35:59.887829065 CEST1236INData Raw: 51 a2 95 4e ba 4b 5c 16 c5 a5 51 be 5a 39 45 dd 17 61 63 b5 65 bb 34 9f 6d 7c 76 0b e7 cf 8a 28 b1 32 a3 4c 94 f3 9c 2d 3a d8 05 c3 70 d8 b9 9e ea 5e e2 8b aa 76 16 1e 66 9d 5b 09 8d b4 bd 0c df a4 f1 57 38 11 41 42 5a 8f 27 30 7a 45 dd 2c af 7e
                                                  Data Ascii: QNK\QZ9Eace4m|v(2L-:p^vf[W8ABZ'0zE,~iY~^UiH-E`79_ue_f!t,f-X9^y0jgsotF8rUFX3\"T5p3WJBORFv
                                                  Jul 22, 2024 12:35:59.887840033 CEST1236INData Raw: ad 53 b8 3f 1e d4 8d 8b fb 22 dd 51 13 da db 37 c1 6d 8a c5 7d 9b 47 42 3f 8e c9 f0 52 59 f2 14 2a 9e 75 2e 6a 2e 7b 93 ce 8d 7f 03 7e d5 5c fc 25 45 10 44 72 a8 87 1c d2 e8 6e 79 f4 3a 12 2f 87 97 f4 7d 88 08 2a 70 f8 25 43 fc 4b 2d f3 25 a3 5d
                                                  Data Ascii: S?"Q7m}GB?RY*u.j.{~\%EDrny:/}*p%CK-%]F?TSkSG-^Bgv[1K+k9v&plE0P8t}BnUJXhBDBlfbG7Fsq3BI{?3>n
                                                  Jul 22, 2024 12:35:59.888684034 CEST1236INData Raw: 98 44 c0 9d 35 87 31 5c f2 45 f9 c7 ef 27 c4 f0 44 cb 1d 0f 1c d1 37 2a fd 7f 20 4f 38 65 99 02 a1 9a ea fd 15 94 74 5c 15 e4 8a 30 a5 11 66 30 df 52 31 9c c6 28 24 8c 3e 6f 18 50 ce cd 5b 40 65 9a 59 06 f5 bf 1e 38 1f 30 99 1f 31 4f 2a 69 da 0b
                                                  Data Ascii: D51\E'D7* O8et\0f0R1($>oP[@eY801O*iT2@#l0*z<F4a/dUF5iAzDScUSK:;{qQ.29h}w$/SZ24d2%h@"IT*w;W<-f.7p=ei ^C\aP`RyHaC!
                                                  Jul 22, 2024 12:35:59.888700008 CEST1236INData Raw: 39 ba ca 62 79 64 b1 96 fc a3 e4 33 18 bf f2 b3 53 33 28 3d 94 63 da fc df 9a ab 61 96 4f fd 8f 75 23 dd b5 d3 bd b5 31 ab e5 e1 6d de 8b 88 11 1d 05 ed 75 9d 2f 58 00 23 9c b7 5e 9c be d2 46 a0 2b 67 71 a6 f8 75 c0 5f 80 c9 c6 7f 3b c9 9d 1b 53
                                                  Data Ascii: 9byd3S3(=caOu#1mu/X#^F+gqu_;Sv_HO=[Ipy`9|;!&uEv@~q+"`T].@ON/,V]Bn`;LGQNL0j*\x8j8cpo;Y|1x[
                                                  Jul 22, 2024 12:35:59.889533997 CEST384INData Raw: e7 b8 35 15 54 a9 22 01 ba 8d 73 41 22 2d 5f 1c e5 c1 6a 64 1c 3a 02 da 84 ef c5 74 bd 9f 23 d9 32 44 34 28 27 d7 07 95 69 6b 95 3f 18 37 32 d0 a9 81 eb a5 e0 47 f9 bd 0e ce d3 e3 4e d2 40 77 fe 00 a1 df bb a6 9f 2e ba ee eb a2 f0 8c 0d bc fe f1
                                                  Data Ascii: 5T"sA"-_jd:t#2D4('ik?72GN@w.o[C4PcJ3 [mrE&r8U,%,uzs(q7r%Hr1]>D!M#C7xJW/5oZ~Wr4gB6SE^C8LT_4'8rC&:<uMz
                                                  Jul 22, 2024 12:35:59.892735004 CEST384INData Raw: e7 b8 35 15 54 a9 22 01 ba 8d 73 41 22 2d 5f 1c e5 c1 6a 64 1c 3a 02 da 84 ef c5 74 bd 9f 23 d9 32 44 34 28 27 d7 07 95 69 6b 95 3f 18 37 32 d0 a9 81 eb a5 e0 47 f9 bd 0e ce d3 e3 4e d2 40 77 fe 00 a1 df bb a6 9f 2e ba ee eb a2 f0 8c 0d bc fe f1
                                                  Data Ascii: 5T"sA"-_jd:t#2D4('ik?72GN@w.o[C4PcJ3 [mrE&r8U,%,uzs(q7r%Hr1]>D!M#C7xJW/5oZ~Wr4gB6SE^C8LT_4'8rC&:<uMz


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  130192.168.2.450316104.16.149.13080940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:35:59.389286041 CEST179OUTPOST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 239
                                                  Connection: Keep-Alive
                                                  Jul 22, 2024 12:35:59.394320011 CEST239OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","CurrentSearch":"Google","CurrentHomepage":"about:home","LanguageIso2":"en-GB","IP":null,"CreateDate":0}}
                                                  Jul 22, 2024 12:35:59.893471956 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:35:59 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c982bf8c43c7-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  131192.168.2.450325104.19.208.15280984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:36:02.202579975 CEST129OUTGET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Connection: Keep-Alive
                                                  Jul 22, 2024 12:36:02.751586914 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:36:02 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 9891
                                                  Connection: keep-alive
                                                  ETag: "3914547665"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 189
                                                  Expires: Mon, 22 Jul 2024 14:36:02 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c994de9241f9-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d [TRUNCATED]
                                                  Data Ascii: PKIX6%FeatureActions.txtBPZ&KE9(0p<a}9g<D)9k@4y'!=~Zk`1J2[)_,{FF?q;fL*=1ZI->m%>`ml,sWITPu*;Pxxhgl$M]I}ogZL5?BZLxukU1P4mW-Ntf?I-/!w90/^%X-.0(mVPn]=cr_A$<BWye2bK{jOdxZv@[NLDU|_1Sp~Paq>})$qH7,hm)Ias<TWu$?Ey@Xu@5*UJLja0v^Q (O}k+fwvfzbhFE<plLWZI*.4#,X`=beVW)W*;Q,'x>Jq _T<ea&wo/RM2`rXFEc:A97A4FT0@wuJIBd5Bhw}oE@N=Z$)6@sXru%eIg5ruA:81&"e_'Be
                                                  Jul 22, 2024 12:36:02.751779079 CEST1236INData Raw: aa 27 91 1f 4b c3 11 60 77 a1 43 f9 f7 10 07 63 36 80 1a 86 ad 48 a7 d3 8f 6f 01 ae 9e 9c 3f a2 79 6e 3b 81 f2 7e 33 72 dc 17 7b 3c b2 f2 80 9b 26 a0 a9 76 69 9d e2 6e 9e 4d 47 96 36 9b c5 b5 27 68 b5 b4 84 34 1c 56 23 a3 50 e1 9f 24 02 89 9a 6e
                                                  Data Ascii: 'K`wCc6Ho?yn;~3r{<&vinMG6'h4V#P$n/Kt'<4oOa"xGTVBfE<eG#Bw{#@mc]os}uE6@e`^](9A,NjbNYnOF\8p"CLFk
                                                  Jul 22, 2024 12:36:02.751813889 CEST1236INData Raw: fd ac 50 d8 52 44 ee 8b 8f d4 d8 b2 84 d1 cb d6 f7 f8 05 a5 aa 41 48 05 36 3c 93 56 87 e3 e6 2f 47 40 72 47 91 28 bd 1e de c7 43 06 15 aa c9 07 7f 4b 86 10 6b 1f 41 44 6f 91 db 30 a2 f9 46 11 1a 4b 58 16 a1 31 d1 5e b4 59 ca fc 47 fc bc 25 05 70
                                                  Data Ascii: PRDAH6<V/G@rG(CKkADo0FKX1^YG%p8P*rH|idu{"PBv`DWG&O*rD:V4#{>51Zy4U-&SSIgFkZpYN~L-6Fed~ex>3
                                                  Jul 22, 2024 12:36:02.752456903 CEST1236INData Raw: 88 a8 b4 43 f7 18 27 39 99 b5 09 5b b0 21 e4 89 cd dc d8 80 8f ba 2c 76 5f 49 78 e0 a0 e6 a4 e8 61 8a 0a 7d 07 ae 7f 5b db 69 5b ab 4d 22 92 db 0e dc 5e ef db 36 83 5e 63 58 81 45 75 40 0c 8a 74 59 c3 e4 31 78 2a c9 f9 39 82 db c7 d7 e1 67 09 f5
                                                  Data Ascii: C'9[!,v_Ixa}[i[M"^6^cXEu@tY1x*9g&LIY+5kR@v<a.{G`#|<rPgAn><AhcF1NG_d~JFS}=l-z%Q\)Zm?)^afu
                                                  Jul 22, 2024 12:36:02.752521038 CEST1236INData Raw: 51 a2 95 4e ba 4b 5c 16 c5 a5 51 be 5a 39 45 dd 17 61 63 b5 65 bb 34 9f 6d 7c 76 0b e7 cf 8a 28 b1 32 a3 4c 94 f3 9c 2d 3a d8 05 c3 70 d8 b9 9e ea 5e e2 8b aa 76 16 1e 66 9d 5b 09 8d b4 bd 0c df a4 f1 57 38 11 41 42 5a 8f 27 30 7a 45 dd 2c af 7e
                                                  Data Ascii: QNK\QZ9Eace4m|v(2L-:p^vf[W8ABZ'0zE,~iY~^UiH-E`79_ue_f!t,f-X9^y0jgsotF8rUFX3\"T5p3WJBORFv
                                                  Jul 22, 2024 12:36:02.753237009 CEST1236INData Raw: ad 53 b8 3f 1e d4 8d 8b fb 22 dd 51 13 da db 37 c1 6d 8a c5 7d 9b 47 42 3f 8e c9 f0 52 59 f2 14 2a 9e 75 2e 6a 2e 7b 93 ce 8d 7f 03 7e d5 5c fc 25 45 10 44 72 a8 87 1c d2 e8 6e 79 f4 3a 12 2f 87 97 f4 7d 88 08 2a 70 f8 25 43 fc 4b 2d f3 25 a3 5d
                                                  Data Ascii: S?"Q7m}GB?RY*u.j.{~\%EDrny:/}*p%CK-%]F?TSkSG-^Bgv[1K+k9v&plE0P8t}BnUJXhBDBlfbG7Fsq3BI{?3>n
                                                  Jul 22, 2024 12:36:02.753272057 CEST1236INData Raw: 98 44 c0 9d 35 87 31 5c f2 45 f9 c7 ef 27 c4 f0 44 cb 1d 0f 1c d1 37 2a fd 7f 20 4f 38 65 99 02 a1 9a ea fd 15 94 74 5c 15 e4 8a 30 a5 11 66 30 df 52 31 9c c6 28 24 8c 3e 6f 18 50 ce cd 5b 40 65 9a 59 06 f5 bf 1e 38 1f 30 99 1f 31 4f 2a 69 da 0b
                                                  Data Ascii: D51\E'D7* O8et\0f0R1($>oP[@eY801O*iT2@#l0*z<F4a/dUF5iAzDScUSK:;{qQ.29h}w$/SZ24d2%h@"IT*w;W<-f.7p=ei ^C\aP`RyHaC!
                                                  Jul 22, 2024 12:36:02.753305912 CEST1236INData Raw: 39 ba ca 62 79 64 b1 96 fc a3 e4 33 18 bf f2 b3 53 33 28 3d 94 63 da fc df 9a ab 61 96 4f fd 8f 75 23 dd b5 d3 bd b5 31 ab e5 e1 6d de 8b 88 11 1d 05 ed 75 9d 2f 58 00 23 9c b7 5e 9c be d2 46 a0 2b 67 71 a6 f8 75 c0 5f 80 c9 c6 7f 3b c9 9d 1b 53
                                                  Data Ascii: 9byd3S3(=caOu#1mu/X#^F+gqu_;Sv_HO=[Ipy`9|;!&uEv@~q+"`T].@ON/,V]Bn`;LGQNL0j*\x8j8cpo;Y|1x[
                                                  Jul 22, 2024 12:36:02.753339052 CEST384INData Raw: e7 b8 35 15 54 a9 22 01 ba 8d 73 41 22 2d 5f 1c e5 c1 6a 64 1c 3a 02 da 84 ef c5 74 bd 9f 23 d9 32 44 34 28 27 d7 07 95 69 6b 95 3f 18 37 32 d0 a9 81 eb a5 e0 47 f9 bd 0e ce d3 e3 4e d2 40 77 fe 00 a1 df bb a6 9f 2e ba ee eb a2 f0 8c 0d bc fe f1
                                                  Data Ascii: 5T"sA"-_jd:t#2D4('ik?72GN@w.o[C4PcJ3 [mrE&r8U,%,uzs(q7r%Hr1]>D!M#C7xJW/5oZ~Wr4gB6SE^C8LT_4'8rC&:<uMz


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  132192.168.2.450331104.19.208.15280984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:36:03.694459915 CEST129OUTGET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Connection: Keep-Alive
                                                  Jul 22, 2024 12:36:04.181823015 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:36:04 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 9891
                                                  Connection: keep-alive
                                                  ETag: "3914547665"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 191
                                                  Expires: Mon, 22 Jul 2024 14:36:04 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c99dbaa07c78-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d [TRUNCATED]
                                                  Data Ascii: PKIX6%FeatureActions.txtBPZ&KE9(0p<a}9g<D)9k@4y'!=~Zk`1J2[)_,{FF?q;fL*=1ZI->m%>`ml,sWITPu*;Pxxhgl$M]I}ogZL5?BZLxukU1P4mW-Ntf?I-/!w90/^%X-.0(mVPn]=cr_A$<BWye2bK{jOdxZv@[NLDU|_1Sp~Paq>})$qH7,hm)Ias<TWu$?Ey@Xu@5*UJLja0v^Q (O}k+fwvfzbhFE<plLWZI*.4#,X`=beVW)W*;Q,'x>Jq _T<ea&wo/RM2`rXFEc:A97A4FT0@wuJIBd5Bhw}oE@N=Z$)6@sXru%eIg5ruA:81&"e_'Be
                                                  Jul 22, 2024 12:36:04.182187080 CEST1236INData Raw: aa 27 91 1f 4b c3 11 60 77 a1 43 f9 f7 10 07 63 36 80 1a 86 ad 48 a7 d3 8f 6f 01 ae 9e 9c 3f a2 79 6e 3b 81 f2 7e 33 72 dc 17 7b 3c b2 f2 80 9b 26 a0 a9 76 69 9d e2 6e 9e 4d 47 96 36 9b c5 b5 27 68 b5 b4 84 34 1c 56 23 a3 50 e1 9f 24 02 89 9a 6e
                                                  Data Ascii: 'K`wCc6Ho?yn;~3r{<&vinMG6'h4V#P$n/Kt'<4oOa"xGTVBfE<eG#Bw{#@mc]os}uE6@e`^](9A,NjbNYnOF\8p"CLFk
                                                  Jul 22, 2024 12:36:04.182200909 CEST1236INData Raw: fd ac 50 d8 52 44 ee 8b 8f d4 d8 b2 84 d1 cb d6 f7 f8 05 a5 aa 41 48 05 36 3c 93 56 87 e3 e6 2f 47 40 72 47 91 28 bd 1e de c7 43 06 15 aa c9 07 7f 4b 86 10 6b 1f 41 44 6f 91 db 30 a2 f9 46 11 1a 4b 58 16 a1 31 d1 5e b4 59 ca fc 47 fc bc 25 05 70
                                                  Data Ascii: PRDAH6<V/G@rG(CKkADo0FKX1^YG%p8P*rH|idu{"PBv`DWG&O*rD:V4#{>51Zy4U-&SSIgFkZpYN~L-6Fed~ex>3
                                                  Jul 22, 2024 12:36:04.182712078 CEST1236INData Raw: 88 a8 b4 43 f7 18 27 39 99 b5 09 5b b0 21 e4 89 cd dc d8 80 8f ba 2c 76 5f 49 78 e0 a0 e6 a4 e8 61 8a 0a 7d 07 ae 7f 5b db 69 5b ab 4d 22 92 db 0e dc 5e ef db 36 83 5e 63 58 81 45 75 40 0c 8a 74 59 c3 e4 31 78 2a c9 f9 39 82 db c7 d7 e1 67 09 f5
                                                  Data Ascii: C'9[!,v_Ixa}[i[M"^6^cXEu@tY1x*9g&LIY+5kR@v<a.{G`#|<rPgAn><AhcF1NG_d~JFS}=l-z%Q\)Zm?)^afu
                                                  Jul 22, 2024 12:36:04.182725906 CEST1236INData Raw: 51 a2 95 4e ba 4b 5c 16 c5 a5 51 be 5a 39 45 dd 17 61 63 b5 65 bb 34 9f 6d 7c 76 0b e7 cf 8a 28 b1 32 a3 4c 94 f3 9c 2d 3a d8 05 c3 70 d8 b9 9e ea 5e e2 8b aa 76 16 1e 66 9d 5b 09 8d b4 bd 0c df a4 f1 57 38 11 41 42 5a 8f 27 30 7a 45 dd 2c af 7e
                                                  Data Ascii: QNK\QZ9Eace4m|v(2L-:p^vf[W8ABZ'0zE,~iY~^UiH-E`79_ue_f!t,f-X9^y0jgsotF8rUFX3\"T5p3WJBORFv
                                                  Jul 22, 2024 12:36:04.183465958 CEST1236INData Raw: ad 53 b8 3f 1e d4 8d 8b fb 22 dd 51 13 da db 37 c1 6d 8a c5 7d 9b 47 42 3f 8e c9 f0 52 59 f2 14 2a 9e 75 2e 6a 2e 7b 93 ce 8d 7f 03 7e d5 5c fc 25 45 10 44 72 a8 87 1c d2 e8 6e 79 f4 3a 12 2f 87 97 f4 7d 88 08 2a 70 f8 25 43 fc 4b 2d f3 25 a3 5d
                                                  Data Ascii: S?"Q7m}GB?RY*u.j.{~\%EDrny:/}*p%CK-%]F?TSkSG-^Bgv[1K+k9v&plE0P8t}BnUJXhBDBlfbG7Fsq3BI{?3>n
                                                  Jul 22, 2024 12:36:04.183485985 CEST1236INData Raw: 98 44 c0 9d 35 87 31 5c f2 45 f9 c7 ef 27 c4 f0 44 cb 1d 0f 1c d1 37 2a fd 7f 20 4f 38 65 99 02 a1 9a ea fd 15 94 74 5c 15 e4 8a 30 a5 11 66 30 df 52 31 9c c6 28 24 8c 3e 6f 18 50 ce cd 5b 40 65 9a 59 06 f5 bf 1e 38 1f 30 99 1f 31 4f 2a 69 da 0b
                                                  Data Ascii: D51\E'D7* O8et\0f0R1($>oP[@eY801O*iT2@#l0*z<F4a/dUF5iAzDScUSK:;{qQ.29h}w$/SZ24d2%h@"IT*w;W<-f.7p=ei ^C\aP`RyHaC!
                                                  Jul 22, 2024 12:36:04.184187889 CEST1236INData Raw: 39 ba ca 62 79 64 b1 96 fc a3 e4 33 18 bf f2 b3 53 33 28 3d 94 63 da fc df 9a ab 61 96 4f fd 8f 75 23 dd b5 d3 bd b5 31 ab e5 e1 6d de 8b 88 11 1d 05 ed 75 9d 2f 58 00 23 9c b7 5e 9c be d2 46 a0 2b 67 71 a6 f8 75 c0 5f 80 c9 c6 7f 3b c9 9d 1b 53
                                                  Data Ascii: 9byd3S3(=caOu#1mu/X#^F+gqu_;Sv_HO=[Ipy`9|;!&uEv@~q+"`T].@ON/,V]Bn`;LGQNL0j*\x8j8cpo;Y|1x[
                                                  Jul 22, 2024 12:36:04.184201002 CEST384INData Raw: e7 b8 35 15 54 a9 22 01 ba 8d 73 41 22 2d 5f 1c e5 c1 6a 64 1c 3a 02 da 84 ef c5 74 bd 9f 23 d9 32 44 34 28 27 d7 07 95 69 6b 95 3f 18 37 32 d0 a9 81 eb a5 e0 47 f9 bd 0e ce d3 e3 4e d2 40 77 fe 00 a1 df bb a6 9f 2e ba ee eb a2 f0 8c 0d bc fe f1
                                                  Data Ascii: 5T"sA"-_jd:t#2D4('ik?72GN@w.o[C4PcJ3 [mrE&r8U,%,uzs(q7r%Hr1]>D!M#C7xJW/5oZ~Wr4gB6SE^C8LT_4'8rC&:<uMz


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  133192.168.2.450332104.19.208.15280984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:36:03.768580914 CEST113OUTGET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Connection: Keep-Alive
                                                  Jul 22, 2024 12:36:04.263917923 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:36:04 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 17770
                                                  Connection: keep-alive
                                                  ETag: "770472110"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 494
                                                  Expires: Mon, 22 Jul 2024 14:36:04 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c99e2a924396-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 [TRUNCATED]
                                                  Data Ascii: PK:=AX7\0DrActiveFeatures.txt+@sjp#K1;/-[[ABexq)7 7:^gK !ibUVsO$v7|e\W'ZdveU*oR>%w$-;Q4Tf$+T$&Q?9#"6>0o@j(*i)H"B1`=&0I8CR"ycM7g\@8xE4S|Iyy7~%W?7!JhrfdB^OQ"IDG!o+^6VY6<wNNPP2\?EY^j>i[p`L_sXq>#~nY>LO9rsAS+g5FBiqgUf{*vBUBqTpKF;/[&WIAPuS-&v3!Y'bMl{[:5sVL3om7'O4'(V#:\#VOO&<s}Yd|<P@jM%O5lHs^SYfaCDDwVcE8~cETL0YIEd@._PQ~w\fAT7Kiywq|+#]N">(A0bU-lDM#ETYa-h}ep<),
                                                  Jul 22, 2024 12:36:04.264075994 CEST1236INData Raw: c3 e9 0b b5 94 79 f6 cd ab db ef 95 d6 d1 32 bc 03 27 b0 a7 67 bb 67 5c 5f 47 4a 97 f1 f7 fc 80 a5 3d 5e cb d2 21 fd 16 4d f6 ed 94 f2 d0 41 ec b6 8d 9b cb af 44 4b 5e 3f 92 fc ae 08 db 64 a5 1d 86 78 29 a2 a9 c5 2d c1 7a 36 38 e0 81 84 1a 34 f5
                                                  Data Ascii: y2'gg\_GJ=^!MADK^?dx)-z684R|YSgynUf1qbEFO?'[a`bF\rsZL0q\vgrP:ZbPw^l^|Vov^'D0\mJh*I{X14
                                                  Jul 22, 2024 12:36:04.264091015 CEST1236INData Raw: e3 09 b7 93 e7 ef 55 87 a5 e2 4a 0e 55 3c 50 4f 28 65 ca 9a de 34 88 d5 59 ab cd 64 54 2a 94 93 b6 b8 c7 f1 34 a6 fe 9a 9e 58 e1 5b 68 04 08 88 1d 07 7a 22 8c f4 8b 1a 37 f4 2d 18 02 f7 c9 7a e3 8d 30 e6 e5 c6 72 4a b5 33 12 97 f2 9b 9f 3d 2b 49
                                                  Data Ascii: UJU<PO(e4YdT*4X[hz"7-z0rJ3=+I:QrVjeAU|0e r.-nFs%U@_G~W}E^ns]W6.Jg4)Kk~9"4{i#W}_&L'HNOp
                                                  Jul 22, 2024 12:36:04.264744043 CEST1236INData Raw: a2 40 45 ad 3e 10 cc d4 22 b8 18 aa b5 83 15 5b 5f 79 62 da f6 64 de 89 40 91 c6 e3 e6 3c 48 f6 f2 37 d0 b4 a2 87 ed 8b 72 11 f9 fa 1d 84 ca dd 63 7c e6 56 65 74 e8 c3 ce 0a 52 78 3d f5 2c 69 ad 82 46 5f 21 19 b5 ed d3 bf 7e 98 76 8d 6a 94 b7 ed
                                                  Data Ascii: @E>"[_ybd@<H7rc|VetRx=,iF_!~vj5s,yL/[g{QosVz%{A|PSeC)PYzSZ/]E?kINr|Pg!\2-;@&Lb<maS
                                                  Jul 22, 2024 12:36:04.264756918 CEST1236INData Raw: ef ec e3 a3 78 02 50 1e 6e 18 3a c8 ef 40 01 47 df 2f 67 75 81 ee e7 ed 5c 86 a7 cd ff 50 b9 61 08 00 fa a5 b9 0e 2f 50 8f 87 fd 80 44 ec bf 7d 28 a2 50 86 c4 d0 81 34 04 f9 9d 19 90 5d 6c c8 6f a3 82 62 5f 8a 77 97 ae e6 15 32 ec 5b 3c d5 d1 50
                                                  Data Ascii: xPn:@G/gu\Pa/PD}(P4]lob_w2[<Pz|<gzX],af!:$uMs)m74Tf8Q0Ee@>i~p#D'uma{4q-x.{W)x,0Fm'*wTn
                                                  Jul 22, 2024 12:36:04.266161919 CEST1236INData Raw: ea fe e8 9b 44 1e 62 80 9f 85 5d b4 ed 54 9a 62 26 5d f9 5f e9 66 31 79 1a ec 5d eb 3b 42 de 2a 12 2f 99 5a 51 ad 2c 4e fc b2 cd 25 8a df 0b d7 07 24 1e 16 60 15 f2 23 fe 84 ec 28 ca cb ea 25 a1 6f 30 22 39 cc 4f eb 80 ec b0 87 73 03 c9 e2 6f cb
                                                  Data Ascii: Db]Tb&]_f1y];B*/ZQ,N%$`#(%o0"9OsosUN^m9N)&8))QK}b9"@T~yu?V7j7y)vJ_EEW58X+:CP~T,{/s" a*=_lJ
                                                  Jul 22, 2024 12:36:04.266194105 CEST1236INData Raw: c6 ac fb 85 2b c7 a3 2f 2f d9 73 66 a6 d5 b3 dc bc 4c 89 64 2f f9 a1 b7 40 bf dd 84 b3 f4 0d 92 fa d2 49 45 fc 27 f8 14 9d 3f bd 02 3a c4 6a 3c 68 f4 ec 55 d8 20 1b ea 58 1f 15 63 0c 4e fc 76 39 e9 cc 71 40 69 5b b9 5b c5 4e 6d 50 82 e3 2b 3d 15
                                                  Data Ascii: +//sfLd/@IE'?:j<hU XcNv9q@i[[NmP+=127ZS$rHxh7[m15'1Z91 #%|^s\obPTPUO:$9pgLNTKqmc_xE]uUW\&6Ijo
                                                  Jul 22, 2024 12:36:04.266235113 CEST1236INData Raw: e7 41 3d ce 7d 33 4d 0f 6d da 2d 57 cd 6d 7c 72 20 41 5f e2 85 cb 48 2a 2c 1b 25 2d ea 0b 8c 30 58 68 ec 5b 67 54 17 0b 09 36 f0 a1 5f 55 d0 81 77 eb 76 58 90 be 59 9e ba 3f be 84 2b 42 29 6f 5c df c6 42 5f 49 8a 9f 97 26 07 55 9d da 50 6a e6 dc
                                                  Data Ascii: A=}3Mm-Wm|r A_H*,%-0Xh[gT6_UwvXY?+B)o\B_I&UPj?n,\_%N&gFx!7^"*w/:=\-?2$(<9#oPa7Z+iIU1B($k!XdI<#7s(,\~1~@SfHTn
                                                  Jul 22, 2024 12:36:04.266253948 CEST1236INData Raw: 20 19 6a 5f 78 89 c4 93 e5 38 5a 6e de 37 da e2 c6 06 b0 e8 f5 8e ec 2a 4d 52 53 7c c0 ce f1 b1 9d 84 d3 91 ba fc 29 13 39 6d 22 59 ca f4 90 ba 24 c3 b5 86 27 17 f3 8a b2 8c 0f d9 b9 6d 97 6d 9b 96 f5 eb e7 ae 0b 71 31 03 84 41 72 7d a7 8d f4 99
                                                  Data Ascii: j_x8Zn7*MRS|)9m"Y$'mmq1Ar}sWC@T^n2I%j+r|kpjq%<OjYSO)o+`qK18oLXG#F?sTds%>qWY2qf[n XR`
                                                  Jul 22, 2024 12:36:04.267005920 CEST1236INData Raw: d1 d2 9b 08 03 2c 5a d5 0d b5 24 ba 57 06 e9 82 13 06 b8 76 cd 11 85 df 30 60 c7 4a 68 fc 62 33 d3 a3 33 4a 36 3d a8 67 bb a3 56 33 7d 3d 9a 83 2c 2e ab 79 ba 0d fb 01 11 b8 6d 84 ce cd 88 2e 7d f5 4f 3e 3e d1 e4 3c 13 83 fa 27 77 82 c7 e2 d9 4b
                                                  Data Ascii: ,Z$Wv0`Jhb33J6=gV3}=,.ym.}O>><'wK\U}&El?<tl%}v%HSA*gH(vqd00Dan~Jlax_K9#+Rfl?uhLO{.FLRS
                                                  Jul 22, 2024 12:36:04.269037008 CEST1236INData Raw: 12 42 b8 dd e5 1f 9e 6b 33 d0 27 64 66 67 09 75 13 4e 4f e9 2f 56 c0 a1 26 a6 e7 0f 48 59 99 5e 9a 7b ee 13 0a e1 b2 7e 95 bf 06 41 45 43 c3 c5 43 45 37 b4 fd 4d f1 ee 9a 9c 98 53 15 42 01 8c fa ef a5 44 d0 97 33 99 81 2a 36 6b 2c 46 c1 0c 71 2f
                                                  Data Ascii: Bk3'dfguNO/V&HY^{~AECCE7MSBD3*6k,Fq/D:-E|OylOR-BS)2,o(P.Ibk@1F] 9X&;/<MZ5 `CLg`h*EH=|EZpoC/j{1,u;


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  134192.168.2.450334104.16.149.13080984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:36:03.794306040 CEST179OUTPOST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 239
                                                  Connection: Keep-Alive
                                                  Jul 22, 2024 12:36:03.799673080 CEST239OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","CurrentSearch":"Google","CurrentHomepage":"about:home","LanguageIso2":"en-GB","IP":null,"CreateDate":0}}
                                                  Jul 22, 2024 12:36:04.288356066 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:36:04 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c99e3e5343c4-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  135192.168.2.450335104.16.149.13080984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:36:04.012456894 CEST179OUTPOST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 239
                                                  Connection: Keep-Alive
                                                  Jul 22, 2024 12:36:04.017462015 CEST239OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","CurrentSearch":"Google","CurrentHomepage":"about:home","LanguageIso2":"en-GB","IP":null,"CreateDate":0}}
                                                  Jul 22, 2024 12:36:04.572572947 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:36:04 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c99ffb6742ce-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  136192.168.2.450337104.19.208.15280984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:36:04.611850023 CEST113OUTGET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Connection: Keep-Alive
                                                  Jul 22, 2024 12:36:05.445276976 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:36:05 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 17770
                                                  Connection: keep-alive
                                                  ETag: "770472110"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 495
                                                  Expires: Mon, 22 Jul 2024 14:36:05 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c9a5ae444382-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 [TRUNCATED]
                                                  Data Ascii: PK:=AX7\0DrActiveFeatures.txt+@sjp#K1;/-[[ABexq)7 7:^gK !ibUVsO$v7|e\W'ZdveU*oR>%w$-;Q4Tf$+T$&Q?9#"6>0o@j(*i)H"B1`=&0I8CR"ycM7g\@8xE4S|Iyy7~%W?7!JhrfdB^OQ"IDG!o+^6VY6<wNNPP2\?EY^j>i[p`L_sXq>#~nY>LO9rsAS+g5FBiqgUf{*vBUBqTpKF;/[&WIAPuS-&v3!Y'bMl{[:5sVL3om7'O4'(V#:\#VOO&<s}Yd|<P@jM%O5lHs^SYfaCDDwVcE8~cETL0YIEd@._PQ~w\fAT7Kiywq|+#]N">(A0bU-lDM#ETYa-h}ep<),
                                                  Jul 22, 2024 12:36:05.445801020 CEST1236INData Raw: c3 e9 0b b5 94 79 f6 cd ab db ef 95 d6 d1 32 bc 03 27 b0 a7 67 bb 67 5c 5f 47 4a 97 f1 f7 fc 80 a5 3d 5e cb d2 21 fd 16 4d f6 ed 94 f2 d0 41 ec b6 8d 9b cb af 44 4b 5e 3f 92 fc ae 08 db 64 a5 1d 86 78 29 a2 a9 c5 2d c1 7a 36 38 e0 81 84 1a 34 f5
                                                  Data Ascii: y2'gg\_GJ=^!MADK^?dx)-z684R|YSgynUf1qbEFO?'[a`bF\rsZL0q\vgrP:ZbPw^l^|Vov^'D0\mJh*I{X14
                                                  Jul 22, 2024 12:36:05.445813894 CEST1236INData Raw: e3 09 b7 93 e7 ef 55 87 a5 e2 4a 0e 55 3c 50 4f 28 65 ca 9a de 34 88 d5 59 ab cd 64 54 2a 94 93 b6 b8 c7 f1 34 a6 fe 9a 9e 58 e1 5b 68 04 08 88 1d 07 7a 22 8c f4 8b 1a 37 f4 2d 18 02 f7 c9 7a e3 8d 30 e6 e5 c6 72 4a b5 33 12 97 f2 9b 9f 3d 2b 49
                                                  Data Ascii: UJU<PO(e4YdT*4X[hz"7-z0rJ3=+I:QrVjeAU|0e r.-nFs%U@_G~W}E^ns]W6.Jg4)Kk~9"4{i#W}_&L'HNOp
                                                  Jul 22, 2024 12:36:05.447738886 CEST1236INData Raw: a2 40 45 ad 3e 10 cc d4 22 b8 18 aa b5 83 15 5b 5f 79 62 da f6 64 de 89 40 91 c6 e3 e6 3c 48 f6 f2 37 d0 b4 a2 87 ed 8b 72 11 f9 fa 1d 84 ca dd 63 7c e6 56 65 74 e8 c3 ce 0a 52 78 3d f5 2c 69 ad 82 46 5f 21 19 b5 ed d3 bf 7e 98 76 8d 6a 94 b7 ed
                                                  Data Ascii: @E>"[_ybd@<H7rc|VetRx=,iF_!~vj5s,yL/[g{QosVz%{A|PSeC)PYzSZ/]E?kINr|Pg!\2-;@&Lb<maS
                                                  Jul 22, 2024 12:36:05.447751999 CEST1236INData Raw: ef ec e3 a3 78 02 50 1e 6e 18 3a c8 ef 40 01 47 df 2f 67 75 81 ee e7 ed 5c 86 a7 cd ff 50 b9 61 08 00 fa a5 b9 0e 2f 50 8f 87 fd 80 44 ec bf 7d 28 a2 50 86 c4 d0 81 34 04 f9 9d 19 90 5d 6c c8 6f a3 82 62 5f 8a 77 97 ae e6 15 32 ec 5b 3c d5 d1 50
                                                  Data Ascii: xPn:@G/gu\Pa/PD}(P4]lob_w2[<Pz|<gzX],af!:$uMs)m74Tf8Q0Ee@>i~p#D'uma{4q-x.{W)x,0Fm'*wTn
                                                  Jul 22, 2024 12:36:05.449986935 CEST1236INData Raw: ea fe e8 9b 44 1e 62 80 9f 85 5d b4 ed 54 9a 62 26 5d f9 5f e9 66 31 79 1a ec 5d eb 3b 42 de 2a 12 2f 99 5a 51 ad 2c 4e fc b2 cd 25 8a df 0b d7 07 24 1e 16 60 15 f2 23 fe 84 ec 28 ca cb ea 25 a1 6f 30 22 39 cc 4f eb 80 ec b0 87 73 03 c9 e2 6f cb
                                                  Data Ascii: Db]Tb&]_f1y];B*/ZQ,N%$`#(%o0"9OsosUN^m9N)&8))QK}b9"@T~yu?V7j7y)vJ_EEW58X+:CP~T,{/s" a*=_lJ
                                                  Jul 22, 2024 12:36:05.450000048 CEST1236INData Raw: c6 ac fb 85 2b c7 a3 2f 2f d9 73 66 a6 d5 b3 dc bc 4c 89 64 2f f9 a1 b7 40 bf dd 84 b3 f4 0d 92 fa d2 49 45 fc 27 f8 14 9d 3f bd 02 3a c4 6a 3c 68 f4 ec 55 d8 20 1b ea 58 1f 15 63 0c 4e fc 76 39 e9 cc 71 40 69 5b b9 5b c5 4e 6d 50 82 e3 2b 3d 15
                                                  Data Ascii: +//sfLd/@IE'?:j<hU XcNv9q@i[[NmP+=127ZS$rHxh7[m15'1Z91 #%|^s\obPTPUO:$9pgLNTKqmc_xE]uUW\&6Ijo
                                                  Jul 22, 2024 12:36:05.452543020 CEST1236INData Raw: e7 41 3d ce 7d 33 4d 0f 6d da 2d 57 cd 6d 7c 72 20 41 5f e2 85 cb 48 2a 2c 1b 25 2d ea 0b 8c 30 58 68 ec 5b 67 54 17 0b 09 36 f0 a1 5f 55 d0 81 77 eb 76 58 90 be 59 9e ba 3f be 84 2b 42 29 6f 5c df c6 42 5f 49 8a 9f 97 26 07 55 9d da 50 6a e6 dc
                                                  Data Ascii: A=}3Mm-Wm|r A_H*,%-0Xh[gT6_UwvXY?+B)o\B_I&UPj?n,\_%N&gFx!7^"*w/:=\-?2$(<9#oPa7Z+iIU1B($k!XdI<#7s(,\~1~@SfHTn
                                                  Jul 22, 2024 12:36:05.452554941 CEST1236INData Raw: 20 19 6a 5f 78 89 c4 93 e5 38 5a 6e de 37 da e2 c6 06 b0 e8 f5 8e ec 2a 4d 52 53 7c c0 ce f1 b1 9d 84 d3 91 ba fc 29 13 39 6d 22 59 ca f4 90 ba 24 c3 b5 86 27 17 f3 8a b2 8c 0f d9 b9 6d 97 6d 9b 96 f5 eb e7 ae 0b 71 31 03 84 41 72 7d a7 8d f4 99
                                                  Data Ascii: j_x8Zn7*MRS|)9m"Y$'mmq1Ar}sWC@T^n2I%j+r|kpjq%<OjYSO)o+`qK18oLXG#F?sTds%>qWY2qf[n XR`
                                                  Jul 22, 2024 12:36:05.454258919 CEST1236INData Raw: d1 d2 9b 08 03 2c 5a d5 0d b5 24 ba 57 06 e9 82 13 06 b8 76 cd 11 85 df 30 60 c7 4a 68 fc 62 33 d3 a3 33 4a 36 3d a8 67 bb a3 56 33 7d 3d 9a 83 2c 2e ab 79 ba 0d fb 01 11 b8 6d 84 ce cd 88 2e 7d f5 4f 3e 3e d1 e4 3c 13 83 fa 27 77 82 c7 e2 d9 4b
                                                  Data Ascii: ,Z$Wv0`Jhb33J6=gV3}=,.ym.}O>><'wK\U}&El?<tl%}v%HSA*gH(vqd00Dan~Jlax_K9#+Rfl?uhLO{.FLRS
                                                  Jul 22, 2024 12:36:05.454272032 CEST1236INData Raw: 12 42 b8 dd e5 1f 9e 6b 33 d0 27 64 66 67 09 75 13 4e 4f e9 2f 56 c0 a1 26 a6 e7 0f 48 59 99 5e 9a 7b ee 13 0a e1 b2 7e 95 bf 06 41 45 43 c3 c5 43 45 37 b4 fd 4d f1 ee 9a 9c 98 53 15 42 01 8c fa ef a5 44 d0 97 33 99 81 2a 36 6b 2c 46 c1 0c 71 2f
                                                  Data Ascii: Bk3'dfguNO/V&HY^{~AECCE7MSBD3*6k,Fq/D:-E|OylOR-BS)2,o(P.Ibk@1F] 9X&;/<MZ5 `CLg`h*EH=|EZpoC/j{1,u;
                                                  Jul 22, 2024 12:36:05.638078928 CEST89OUTGET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Jul 22, 2024 12:36:05.741658926 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:36:05 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 17770
                                                  Connection: keep-alive
                                                  ETag: "770472110"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 495
                                                  Expires: Mon, 22 Jul 2024 14:36:05 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c9a78f9f4382-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 [TRUNCATED]
                                                  Data Ascii: PK:=AX7\0DrActiveFeatures.txt+@sjp#K1;/-[[ABexq)7 7:^gK !ibUVsO$v7|e\W'ZdveU*oR>%w$-;Q4Tf$+T$&Q?9#"6>0o@j(*i)H"B1`=&0I8CR"ycM7g\@8xE4S|Iyy7~%W?7!JhrfdB^OQ"IDG!o+^6VY6<wNNPP2\?EY^j>i[p`L_sXq>#~nY>LO9rsAS+g5FBiqgUf{*vBUBqTpKF;/[&WIAPuS-&v3!Y'bMl{[:5sVL3om7'O4'(V#:\#VOO&<s}Yd|<P@jM%O5lHs^SYfaCDDwVcE8~cETL0YIEd@._PQ~w\fAT7Kiywq|+#]N">(A0bU-lDM#ETYa-h}ep<),
                                                  Jul 22, 2024 12:36:05.848983049 CEST105OUTGET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Jul 22, 2024 12:36:05.956059933 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:36:05 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 9891
                                                  Connection: keep-alive
                                                  ETag: "3914547665"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 192
                                                  Expires: Mon, 22 Jul 2024 14:36:05 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c9a8d8544382-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d [TRUNCATED]
                                                  Data Ascii: PKIX6%FeatureActions.txtBPZ&KE9(0p<a}9g<D)9k@4y'!=~Zk`1J2[)_,{FF?q;fL*=1ZI->m%>`ml,sWITPu*;Pxxhgl$M]I}ogZL5?BZLxukU1P4mW-Ntf?I-/!w90/^%X-.0(mVPn]=cr_A$<BWye2bK{jOdxZv@[NLDU|_1Sp~Paq>})$qH7,hm)Ias<TWu$?Ey@Xu@5*UJLja0v^Q (O}k+fwvfzbhFE<plLWZI*.4#,X`=beVW)W*;Q,'x>Jq _T<ea&wo/RM2`rXFEc:A97A4FT0@wuJIBd5Bhw}oE@N=Z$)6@sXru%eIg5ruA:81&"e_'Be


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  137192.168.2.450346104.19.208.15280984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:36:05.923197031 CEST89OUTGET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Jul 22, 2024 12:36:06.680654049 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:36:06 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 17770
                                                  Connection: keep-alive
                                                  ETag: "770472110"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 496
                                                  Expires: Mon, 22 Jul 2024 14:36:06 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c9ad5ab08c42-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 [TRUNCATED]
                                                  Data Ascii: PK:=AX7\0DrActiveFeatures.txt+@sjp#K1;/-[[ABexq)7 7:^gK !ibUVsO$v7|e\W'ZdveU*oR>%w$-;Q4Tf$+T$&Q?9#"6>0o@j(*i)H"B1`=&0I8CR"ycM7g\@8xE4S|Iyy7~%W?7!JhrfdB^OQ"IDG!o+^6VY6<wNNPP2\?EY^j>i[p`L_sXq>#~nY>LO9rsAS+g5FBiqgUf{*vBUBqTpKF;/[&WIAPuS-&v3!Y'bMl{[:5sVL3om7'O4'(V#:\#VOO&<s}Yd|<P@jM%O5lHs^SYfaCDDwVcE8~cETL0YIEd@._PQ~w\fAT7Kiywq|+#]N">(A0bU-lDM#ETYa-h}ep<),
                                                  Jul 22, 2024 12:36:06.681030989 CEST1236INData Raw: c3 e9 0b b5 94 79 f6 cd ab db ef 95 d6 d1 32 bc 03 27 b0 a7 67 bb 67 5c 5f 47 4a 97 f1 f7 fc 80 a5 3d 5e cb d2 21 fd 16 4d f6 ed 94 f2 d0 41 ec b6 8d 9b cb af 44 4b 5e 3f 92 fc ae 08 db 64 a5 1d 86 78 29 a2 a9 c5 2d c1 7a 36 38 e0 81 84 1a 34 f5
                                                  Data Ascii: y2'gg\_GJ=^!MADK^?dx)-z684R|YSgynUf1qbEFO?'[a`bF\rsZL0q\vgrP:ZbPw^l^|Vov^'D0\mJh*I{X14
                                                  Jul 22, 2024 12:36:06.681070089 CEST1236INData Raw: e3 09 b7 93 e7 ef 55 87 a5 e2 4a 0e 55 3c 50 4f 28 65 ca 9a de 34 88 d5 59 ab cd 64 54 2a 94 93 b6 b8 c7 f1 34 a6 fe 9a 9e 58 e1 5b 68 04 08 88 1d 07 7a 22 8c f4 8b 1a 37 f4 2d 18 02 f7 c9 7a e3 8d 30 e6 e5 c6 72 4a b5 33 12 97 f2 9b 9f 3d 2b 49
                                                  Data Ascii: UJU<PO(e4YdT*4X[hz"7-z0rJ3=+I:QrVjeAU|0e r.-nFs%U@_G~W}E^ns]W6.Jg4)Kk~9"4{i#W}_&L'HNOp
                                                  Jul 22, 2024 12:36:06.686034918 CEST1236INData Raw: a2 40 45 ad 3e 10 cc d4 22 b8 18 aa b5 83 15 5b 5f 79 62 da f6 64 de 89 40 91 c6 e3 e6 3c 48 f6 f2 37 d0 b4 a2 87 ed 8b 72 11 f9 fa 1d 84 ca dd 63 7c e6 56 65 74 e8 c3 ce 0a 52 78 3d f5 2c 69 ad 82 46 5f 21 19 b5 ed d3 bf 7e 98 76 8d 6a 94 b7 ed
                                                  Data Ascii: @E>"[_ybd@<H7rc|VetRx=,iF_!~vj5s,yL/[g{QosVz%{A|PSeC)PYzSZ/]E?kINr|Pg!\2-;@&Lb<maS
                                                  Jul 22, 2024 12:36:06.686070919 CEST1236INData Raw: ef ec e3 a3 78 02 50 1e 6e 18 3a c8 ef 40 01 47 df 2f 67 75 81 ee e7 ed 5c 86 a7 cd ff 50 b9 61 08 00 fa a5 b9 0e 2f 50 8f 87 fd 80 44 ec bf 7d 28 a2 50 86 c4 d0 81 34 04 f9 9d 19 90 5d 6c c8 6f a3 82 62 5f 8a 77 97 ae e6 15 32 ec 5b 3c d5 d1 50
                                                  Data Ascii: xPn:@G/gu\Pa/PD}(P4]lob_w2[<Pz|<gzX],af!:$uMs)m74Tf8Q0Ee@>i~p#D'uma{4q-x.{W)x,0Fm'*wTn
                                                  Jul 22, 2024 12:36:06.686105967 CEST1236INData Raw: ea fe e8 9b 44 1e 62 80 9f 85 5d b4 ed 54 9a 62 26 5d f9 5f e9 66 31 79 1a ec 5d eb 3b 42 de 2a 12 2f 99 5a 51 ad 2c 4e fc b2 cd 25 8a df 0b d7 07 24 1e 16 60 15 f2 23 fe 84 ec 28 ca cb ea 25 a1 6f 30 22 39 cc 4f eb 80 ec b0 87 73 03 c9 e2 6f cb
                                                  Data Ascii: Db]Tb&]_f1y];B*/ZQ,N%$`#(%o0"9OsosUN^m9N)&8))QK}b9"@T~yu?V7j7y)vJ_EEW58X+:CP~T,{/s" a*=_lJ
                                                  Jul 22, 2024 12:36:06.686139107 CEST1236INData Raw: c6 ac fb 85 2b c7 a3 2f 2f d9 73 66 a6 d5 b3 dc bc 4c 89 64 2f f9 a1 b7 40 bf dd 84 b3 f4 0d 92 fa d2 49 45 fc 27 f8 14 9d 3f bd 02 3a c4 6a 3c 68 f4 ec 55 d8 20 1b ea 58 1f 15 63 0c 4e fc 76 39 e9 cc 71 40 69 5b b9 5b c5 4e 6d 50 82 e3 2b 3d 15
                                                  Data Ascii: +//sfLd/@IE'?:j<hU XcNv9q@i[[NmP+=127ZS$rHxh7[m15'1Z91 #%|^s\obPTPUO:$9pgLNTKqmc_xE]uUW\&6Ijo
                                                  Jul 22, 2024 12:36:06.690728903 CEST1236INData Raw: e7 41 3d ce 7d 33 4d 0f 6d da 2d 57 cd 6d 7c 72 20 41 5f e2 85 cb 48 2a 2c 1b 25 2d ea 0b 8c 30 58 68 ec 5b 67 54 17 0b 09 36 f0 a1 5f 55 d0 81 77 eb 76 58 90 be 59 9e ba 3f be 84 2b 42 29 6f 5c df c6 42 5f 49 8a 9f 97 26 07 55 9d da 50 6a e6 dc
                                                  Data Ascii: A=}3Mm-Wm|r A_H*,%-0Xh[gT6_UwvXY?+B)o\B_I&UPj?n,\_%N&gFx!7^"*w/:=\-?2$(<9#oPa7Z+iIU1B($k!XdI<#7s(,\~1~@SfHTn
                                                  Jul 22, 2024 12:36:06.690764904 CEST1236INData Raw: 20 19 6a 5f 78 89 c4 93 e5 38 5a 6e de 37 da e2 c6 06 b0 e8 f5 8e ec 2a 4d 52 53 7c c0 ce f1 b1 9d 84 d3 91 ba fc 29 13 39 6d 22 59 ca f4 90 ba 24 c3 b5 86 27 17 f3 8a b2 8c 0f d9 b9 6d 97 6d 9b 96 f5 eb e7 ae 0b 71 31 03 84 41 72 7d a7 8d f4 99
                                                  Data Ascii: j_x8Zn7*MRS|)9m"Y$'mmq1Ar}sWC@T^n2I%j+r|kpjq%<OjYSO)o+`qK18oLXG#F?sTds%>qWY2qf[n XR`
                                                  Jul 22, 2024 12:36:06.691457033 CEST1236INData Raw: d1 d2 9b 08 03 2c 5a d5 0d b5 24 ba 57 06 e9 82 13 06 b8 76 cd 11 85 df 30 60 c7 4a 68 fc 62 33 d3 a3 33 4a 36 3d a8 67 bb a3 56 33 7d 3d 9a 83 2c 2e ab 79 ba 0d fb 01 11 b8 6d 84 ce cd 88 2e 7d f5 4f 3e 3e d1 e4 3c 13 83 fa 27 77 82 c7 e2 d9 4b
                                                  Data Ascii: ,Z$Wv0`Jhb33J6=gV3}=,.ym.}O>><'wK\U}&El?<tl%}v%HSA*gH(vqd00Dan~Jlax_K9#+Rfl?uhLO{.FLRS
                                                  Jul 22, 2024 12:36:06.693003893 CEST1236INData Raw: 12 42 b8 dd e5 1f 9e 6b 33 d0 27 64 66 67 09 75 13 4e 4f e9 2f 56 c0 a1 26 a6 e7 0f 48 59 99 5e 9a 7b ee 13 0a e1 b2 7e 95 bf 06 41 45 43 c3 c5 43 45 37 b4 fd 4d f1 ee 9a 9c 98 53 15 42 01 8c fa ef a5 44 d0 97 33 99 81 2a 36 6b 2c 46 c1 0c 71 2f
                                                  Data Ascii: Bk3'dfguNO/V&HY^{~AECCE7MSBD3*6k,Fq/D:-E|OylOR-BS)2,o(P.Ibk@1F] 9X&;/<MZ5 `CLg`h*EH=|EZpoC/j{1,u;


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  138192.168.2.450348104.16.149.13080984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:36:06.184269905 CEST155OUTPOST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 239
                                                  Jul 22, 2024 12:36:06.194216967 CEST239OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","CurrentSearch":"Google","CurrentHomepage":"about:home","LanguageIso2":"en-GB","IP":null,"CreateDate":0}}
                                                  Jul 22, 2024 12:36:06.693980932 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:36:06 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c9ad38b83308-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0
                                                  Jul 22, 2024 12:36:06.747591019 CEST155OUTPOST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 239
                                                  Jul 22, 2024 12:36:06.753619909 CEST239OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","CurrentSearch":"Google","CurrentHomepage":"about:home","LanguageIso2":"en-GB","IP":null,"CreateDate":0}}
                                                  Jul 22, 2024 12:36:06.877041101 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:36:06 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c9ae79363308-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  139192.168.2.450350104.19.208.15280984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:36:06.386327982 CEST105OUTGET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Jul 22, 2024 12:36:06.855753899 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:36:06 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 9891
                                                  Connection: keep-alive
                                                  ETag: "3914547665"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 193
                                                  Expires: Mon, 22 Jul 2024 14:36:06 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c9ae7f5943bd-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d [TRUNCATED]
                                                  Data Ascii: PKIX6%FeatureActions.txtBPZ&KE9(0p<a}9g<D)9k@4y'!=~Zk`1J2[)_,{FF?q;fL*=1ZI->m%>`ml,sWITPu*;Pxxhgl$M]I}ogZL5?BZLxukU1P4mW-Ntf?I-/!w90/^%X-.0(mVPn]=cr_A$<BWye2bK{jOdxZv@[NLDU|_1Sp~Paq>})$qH7,hm)Ias<TWu$?Ey@Xu@5*UJLja0v^Q (O}k+fwvfzbhFE<plLWZI*.4#,X`=beVW)W*;Q,'x>Jq _T<ea&wo/RM2`rXFEc:A97A4FT0@wuJIBd5Bhw}oE@N=Z$)6@sXru%eIg5ruA:81&"e_'Be
                                                  Jul 22, 2024 12:36:06.855768919 CEST1236INData Raw: aa 27 91 1f 4b c3 11 60 77 a1 43 f9 f7 10 07 63 36 80 1a 86 ad 48 a7 d3 8f 6f 01 ae 9e 9c 3f a2 79 6e 3b 81 f2 7e 33 72 dc 17 7b 3c b2 f2 80 9b 26 a0 a9 76 69 9d e2 6e 9e 4d 47 96 36 9b c5 b5 27 68 b5 b4 84 34 1c 56 23 a3 50 e1 9f 24 02 89 9a 6e
                                                  Data Ascii: 'K`wCc6Ho?yn;~3r{<&vinMG6'h4V#P$n/Kt'<4oOa"xGTVBfE<eG#Bw{#@mc]os}uE6@e`^](9A,NjbNYnOF\8p"CLFk
                                                  Jul 22, 2024 12:36:06.857238054 CEST1236INData Raw: fd ac 50 d8 52 44 ee 8b 8f d4 d8 b2 84 d1 cb d6 f7 f8 05 a5 aa 41 48 05 36 3c 93 56 87 e3 e6 2f 47 40 72 47 91 28 bd 1e de c7 43 06 15 aa c9 07 7f 4b 86 10 6b 1f 41 44 6f 91 db 30 a2 f9 46 11 1a 4b 58 16 a1 31 d1 5e b4 59 ca fc 47 fc bc 25 05 70
                                                  Data Ascii: PRDAH6<V/G@rG(CKkADo0FKX1^YG%p8P*rH|idu{"PBv`DWG&O*rD:V4#{>51Zy4U-&SSIgFkZpYN~L-6Fed~ex>3
                                                  Jul 22, 2024 12:36:06.857249975 CEST1236INData Raw: 88 a8 b4 43 f7 18 27 39 99 b5 09 5b b0 21 e4 89 cd dc d8 80 8f ba 2c 76 5f 49 78 e0 a0 e6 a4 e8 61 8a 0a 7d 07 ae 7f 5b db 69 5b ab 4d 22 92 db 0e dc 5e ef db 36 83 5e 63 58 81 45 75 40 0c 8a 74 59 c3 e4 31 78 2a c9 f9 39 82 db c7 d7 e1 67 09 f5
                                                  Data Ascii: C'9[!,v_Ixa}[i[M"^6^cXEu@tY1x*9g&LIY+5kR@v<a.{G`#|<rPgAn><AhcF1NG_d~JFS}=l-z%Q\)Zm?)^afu
                                                  Jul 22, 2024 12:36:06.858788967 CEST1236INData Raw: 51 a2 95 4e ba 4b 5c 16 c5 a5 51 be 5a 39 45 dd 17 61 63 b5 65 bb 34 9f 6d 7c 76 0b e7 cf 8a 28 b1 32 a3 4c 94 f3 9c 2d 3a d8 05 c3 70 d8 b9 9e ea 5e e2 8b aa 76 16 1e 66 9d 5b 09 8d b4 bd 0c df a4 f1 57 38 11 41 42 5a 8f 27 30 7a 45 dd 2c af 7e
                                                  Data Ascii: QNK\QZ9Eace4m|v(2L-:p^vf[W8ABZ'0zE,~iY~^UiH-E`79_ue_f!t,f-X9^y0jgsotF8rUFX3\"T5p3WJBORFv
                                                  Jul 22, 2024 12:36:06.858799934 CEST1236INData Raw: ad 53 b8 3f 1e d4 8d 8b fb 22 dd 51 13 da db 37 c1 6d 8a c5 7d 9b 47 42 3f 8e c9 f0 52 59 f2 14 2a 9e 75 2e 6a 2e 7b 93 ce 8d 7f 03 7e d5 5c fc 25 45 10 44 72 a8 87 1c d2 e8 6e 79 f4 3a 12 2f 87 97 f4 7d 88 08 2a 70 f8 25 43 fc 4b 2d f3 25 a3 5d
                                                  Data Ascii: S?"Q7m}GB?RY*u.j.{~\%EDrny:/}*p%CK-%]F?TSkSG-^Bgv[1K+k9v&plE0P8t}BnUJXhBDBlfbG7Fsq3BI{?3>n
                                                  Jul 22, 2024 12:36:06.860330105 CEST1236INData Raw: 98 44 c0 9d 35 87 31 5c f2 45 f9 c7 ef 27 c4 f0 44 cb 1d 0f 1c d1 37 2a fd 7f 20 4f 38 65 99 02 a1 9a ea fd 15 94 74 5c 15 e4 8a 30 a5 11 66 30 df 52 31 9c c6 28 24 8c 3e 6f 18 50 ce cd 5b 40 65 9a 59 06 f5 bf 1e 38 1f 30 99 1f 31 4f 2a 69 da 0b
                                                  Data Ascii: D51\E'D7* O8et\0f0R1($>oP[@eY801O*iT2@#l0*z<F4a/dUF5iAzDScUSK:;{qQ.29h}w$/SZ24d2%h@"IT*w;W<-f.7p=ei ^C\aP`RyHaC!
                                                  Jul 22, 2024 12:36:06.860342026 CEST1236INData Raw: 39 ba ca 62 79 64 b1 96 fc a3 e4 33 18 bf f2 b3 53 33 28 3d 94 63 da fc df 9a ab 61 96 4f fd 8f 75 23 dd b5 d3 bd b5 31 ab e5 e1 6d de 8b 88 11 1d 05 ed 75 9d 2f 58 00 23 9c b7 5e 9c be d2 46 a0 2b 67 71 a6 f8 75 c0 5f 80 c9 c6 7f 3b c9 9d 1b 53
                                                  Data Ascii: 9byd3S3(=caOu#1mu/X#^F+gqu_;Sv_HO=[Ipy`9|;!&uEv@~q+"`T].@ON/,V]Bn`;LGQNL0j*\x8j8cpo;Y|1x[
                                                  Jul 22, 2024 12:36:06.860352993 CEST384INData Raw: e7 b8 35 15 54 a9 22 01 ba 8d 73 41 22 2d 5f 1c e5 c1 6a 64 1c 3a 02 da 84 ef c5 74 bd 9f 23 d9 32 44 34 28 27 d7 07 95 69 6b 95 3f 18 37 32 d0 a9 81 eb a5 e0 47 f9 bd 0e ce d3 e3 4e d2 40 77 fe 00 a1 df bb a6 9f 2e ba ee eb a2 f0 8c 0d bc fe f1
                                                  Data Ascii: 5T"sA"-_jd:t#2D4('ik?72GN@w.o[C4PcJ3 [mrE&r8U,%,uzs(q7r%Hr1]>D!M#C7xJW/5oZ~Wr4gB6SE^C8LT_4'8rC&:<uMz


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  140192.168.2.450353104.16.149.13080984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:36:06.414321899 CEST155OUTPOST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 239
                                                  Jul 22, 2024 12:36:06.419331074 CEST239OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","CurrentSearch":"Google","CurrentHomepage":"about:home","LanguageIso2":"en-GB","IP":null,"CreateDate":0}}
                                                  Jul 22, 2024 12:36:06.919313908 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:36:06 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c9aeb98d7ce7-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  141192.168.2.450356104.19.208.15280984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:36:07.007565022 CEST113OUTGET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Connection: Keep-Alive
                                                  Jul 22, 2024 12:36:07.474505901 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:36:07 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 17770
                                                  Connection: keep-alive
                                                  ETag: "770472110"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 497
                                                  Expires: Mon, 22 Jul 2024 14:36:07 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c9b25e8d4373-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 [TRUNCATED]
                                                  Data Ascii: PK:=AX7\0DrActiveFeatures.txt+@sjp#K1;/-[[ABexq)7 7:^gK !ibUVsO$v7|e\W'ZdveU*oR>%w$-;Q4Tf$+T$&Q?9#"6>0o@j(*i)H"B1`=&0I8CR"ycM7g\@8xE4S|Iyy7~%W?7!JhrfdB^OQ"IDG!o+^6VY6<wNNPP2\?EY^j>i[p`L_sXq>#~nY>LO9rsAS+g5FBiqgUf{*vBUBqTpKF;/[&WIAPuS-&v3!Y'bMl{[:5sVL3om7'O4'(V#:\#VOO&<s}Yd|<P@jM%O5lHs^SYfaCDDwVcE8~cETL0YIEd@._PQ~w\fAT7Kiywq|+#]N">(A0bU-lDM#ETYa-h}ep<),
                                                  Jul 22, 2024 12:36:07.474872112 CEST1236INData Raw: c3 e9 0b b5 94 79 f6 cd ab db ef 95 d6 d1 32 bc 03 27 b0 a7 67 bb 67 5c 5f 47 4a 97 f1 f7 fc 80 a5 3d 5e cb d2 21 fd 16 4d f6 ed 94 f2 d0 41 ec b6 8d 9b cb af 44 4b 5e 3f 92 fc ae 08 db 64 a5 1d 86 78 29 a2 a9 c5 2d c1 7a 36 38 e0 81 84 1a 34 f5
                                                  Data Ascii: y2'gg\_GJ=^!MADK^?dx)-z684R|YSgynUf1qbEFO?'[a`bF\rsZL0q\vgrP:ZbPw^l^|Vov^'D0\mJh*I{X14
                                                  Jul 22, 2024 12:36:07.474885941 CEST1236INData Raw: e3 09 b7 93 e7 ef 55 87 a5 e2 4a 0e 55 3c 50 4f 28 65 ca 9a de 34 88 d5 59 ab cd 64 54 2a 94 93 b6 b8 c7 f1 34 a6 fe 9a 9e 58 e1 5b 68 04 08 88 1d 07 7a 22 8c f4 8b 1a 37 f4 2d 18 02 f7 c9 7a e3 8d 30 e6 e5 c6 72 4a b5 33 12 97 f2 9b 9f 3d 2b 49
                                                  Data Ascii: UJU<PO(e4YdT*4X[hz"7-z0rJ3=+I:QrVjeAU|0e r.-nFs%U@_G~W}E^ns]W6.Jg4)Kk~9"4{i#W}_&L'HNOp
                                                  Jul 22, 2024 12:36:07.476135015 CEST1236INData Raw: a2 40 45 ad 3e 10 cc d4 22 b8 18 aa b5 83 15 5b 5f 79 62 da f6 64 de 89 40 91 c6 e3 e6 3c 48 f6 f2 37 d0 b4 a2 87 ed 8b 72 11 f9 fa 1d 84 ca dd 63 7c e6 56 65 74 e8 c3 ce 0a 52 78 3d f5 2c 69 ad 82 46 5f 21 19 b5 ed d3 bf 7e 98 76 8d 6a 94 b7 ed
                                                  Data Ascii: @E>"[_ybd@<H7rc|VetRx=,iF_!~vj5s,yL/[g{QosVz%{A|PSeC)PYzSZ/]E?kINr|Pg!\2-;@&Lb<maS
                                                  Jul 22, 2024 12:36:07.476154089 CEST1236INData Raw: ef ec e3 a3 78 02 50 1e 6e 18 3a c8 ef 40 01 47 df 2f 67 75 81 ee e7 ed 5c 86 a7 cd ff 50 b9 61 08 00 fa a5 b9 0e 2f 50 8f 87 fd 80 44 ec bf 7d 28 a2 50 86 c4 d0 81 34 04 f9 9d 19 90 5d 6c c8 6f a3 82 62 5f 8a 77 97 ae e6 15 32 ec 5b 3c d5 d1 50
                                                  Data Ascii: xPn:@G/gu\Pa/PD}(P4]lob_w2[<Pz|<gzX],af!:$uMs)m74Tf8Q0Ee@>i~p#D'uma{4q-x.{W)x,0Fm'*wTn
                                                  Jul 22, 2024 12:36:07.477406025 CEST1236INData Raw: ea fe e8 9b 44 1e 62 80 9f 85 5d b4 ed 54 9a 62 26 5d f9 5f e9 66 31 79 1a ec 5d eb 3b 42 de 2a 12 2f 99 5a 51 ad 2c 4e fc b2 cd 25 8a df 0b d7 07 24 1e 16 60 15 f2 23 fe 84 ec 28 ca cb ea 25 a1 6f 30 22 39 cc 4f eb 80 ec b0 87 73 03 c9 e2 6f cb
                                                  Data Ascii: Db]Tb&]_f1y];B*/ZQ,N%$`#(%o0"9OsosUN^m9N)&8))QK}b9"@T~yu?V7j7y)vJ_EEW58X+:CP~T,{/s" a*=_lJ
                                                  Jul 22, 2024 12:36:07.477420092 CEST776INData Raw: c6 ac fb 85 2b c7 a3 2f 2f d9 73 66 a6 d5 b3 dc bc 4c 89 64 2f f9 a1 b7 40 bf dd 84 b3 f4 0d 92 fa d2 49 45 fc 27 f8 14 9d 3f bd 02 3a c4 6a 3c 68 f4 ec 55 d8 20 1b ea 58 1f 15 63 0c 4e fc 76 39 e9 cc 71 40 69 5b b9 5b c5 4e 6d 50 82 e3 2b 3d 15
                                                  Data Ascii: +//sfLd/@IE'?:j<hU XcNv9q@i[[NmP+=127ZS$rHxh7[m15'1Z91 #%|^s\obPTPUO:$9pgLNTKqmc_xE]uUW\&6Ijo
                                                  Jul 22, 2024 12:36:07.478602886 CEST1236INData Raw: d8 55 39 07 81 24 01 07 44 95 57 e7 60 2b d2 a5 bd 52 20 06 5d 6d 80 a3 f0 2d 04 be f6 c4 36 f1 38 a7 eb 6a 35 61 be 2e 7c 73 13 4f 8d 09 88 42 b0 bd 85 7e 1c 31 f2 7a d1 7f a9 63 dd 5b 75 a3 67 d4 de b1 93 51 3e b1 c5 0d 54 c8 76 fd 9b 11 7e 11
                                                  Data Ascii: U9$DW`+R ]m-68j5a.|sOB~1zc[ugQ>Tv~Fa&<pX caENsE0aUC3WE4eP0!W%]VKw7u:Uw`=n&l\r\0kXL0n)vneEw6h,{>Vo
                                                  Jul 22, 2024 12:36:07.478620052 CEST1236INData Raw: e7 b7 5b 52 84 a3 65 20 65 10 bf a4 cf 1e 23 cf 87 ab 48 1a 64 35 a1 c4 c9 49 17 07 2e 2a b5 70 13 92 00 da b1 7b 6f cb 09 2e 48 8a 27 c7 e5 2a 7c 61 32 06 ef 8d ef 69 86 b1 a5 5a cf 14 e3 2e be 59 f3 70 3f 58 1f f9 19 c3 e4 d6 3d d0 5b 49 5c 56
                                                  Data Ascii: [Re e#Hd5I.*p{o.H'*|a2iZ.Yp?X=[I\V~^{z7F: G5C*w 0sB=z+K3wV}aS)BlUD`a%z1-/a{aZ@";AsW_DL[hArN~+;6]._
                                                  Jul 22, 2024 12:36:07.478631973 CEST1236INData Raw: 18 76 dd 0b 34 ab e4 4a 6f f1 34 d1 63 c7 18 e9 2b a2 3b 4a 7c 23 0f 05 ff 30 bf 2c 4e b5 39 8b 92 8a 8a b6 4d 75 f8 02 27 6c 5e b0 df 44 bd 46 0b 0d 9a 2b 69 4c cf 34 03 5c 57 42 3e a3 89 54 04 6f 2a 2b 68 02 69 ad c5 d9 c8 9b 5a 61 a1 3b 90 0a
                                                  Data Ascii: v4Jo4c+;J|#0,N9Mu'l^DF+iL4\WB>To*+hiZa;;-c.T12=ZLXZbdBNRyib[FEv.=K36A#:O;#MjJ?N7k]^0huT [^o}
                                                  Jul 22, 2024 12:36:07.481553078 CEST1236INData Raw: b8 b3 f7 91 1f 9d 29 cb f6 de b0 17 73 f0 26 f7 4b 69 cd 63 ec 41 5d 59 62 41 b8 60 3e 59 3c dd 80 84 98 78 c8 c6 f1 43 62 44 9e 73 2d ca 48 10 af 3a 9a 06 4a ab 30 bb 10 e4 53 db 19 2b 39 c0 86 cd 79 20 1a 1e 93 96 68 8b 8b 89 11 98 38 0e cc 2e
                                                  Data Ascii: )s&KicA]YbA`>Y<xCbDs-H:J0S+9y h8.7BmJPl/T5(^,Ke}g#:zEf!%Zwk=6^d$?.a"hZLjMl:a]J!`wVRDwa*|bM#lx
                                                  Jul 22, 2024 12:36:07.657715082 CEST89OUTGET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Jul 22, 2024 12:36:07.761995077 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:36:07 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 17770
                                                  Connection: keep-alive
                                                  ETag: "770472110"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 497
                                                  Expires: Mon, 22 Jul 2024 14:36:07 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c9b42fe84373-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 [TRUNCATED]
                                                  Data Ascii: PK:=AX7\0DrActiveFeatures.txt+@sjp#K1;/-[[ABexq)7 7:^gK !ibUVsO$v7|e\W'ZdveU*oR>%w$-;Q4Tf$+T$&Q?9#"6>0o@j(*i)H"B1`=&0I8CR"ycM7g\@8xE4S|Iyy7~%W?7!JhrfdB^OQ"IDG!o+^6VY6<wNNPP2\?EY^j>i[p`L_sXq>#~nY>LO9rsAS+g5FBiqgUf{*vBUBqTpKF;/[&WIAPuS-&v3!Y'bMl{[:5sVL3om7'O4'(V#:\#VOO&<s}Yd|<P@jM%O5lHs^SYfaCDDwVcE8~cETL0YIEd@._PQ~w\fAT7Kiywq|+#]N">(A0bU-lDM#ETYa-h}ep<),


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  142192.168.2.450360104.16.149.13080984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:36:07.421691895 CEST155OUTPOST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 239
                                                  Jul 22, 2024 12:36:07.426743984 CEST239OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","CurrentSearch":"Google","CurrentHomepage":"about:home","LanguageIso2":"en-GB","IP":null,"CreateDate":0}}
                                                  Jul 22, 2024 12:36:07.935792923 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:36:07 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c9b4fe164235-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0
                                                  Jul 22, 2024 12:36:08.005490065 CEST155OUTPOST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 239
                                                  Jul 22, 2024 12:36:08.010413885 CEST239OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","CurrentSearch":"Google","CurrentHomepage":"about:home","LanguageIso2":"en-GB","IP":null,"CreateDate":0}}
                                                  Jul 22, 2024 12:36:08.182120085 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:36:08 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c9b65f1e4235-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0
                                                  Jul 22, 2024 12:36:08.190103054 CEST155OUTPOST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 239
                                                  Jul 22, 2024 12:36:08.195537090 CEST239OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","CurrentSearch":"Google","CurrentHomepage":"about:home","LanguageIso2":"en-GB","IP":null,"CreateDate":0}}
                                                  Jul 22, 2024 12:36:08.594408989 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:36:08 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c9b798004235-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0
                                                  Jul 22, 2024 12:36:08.606654882 CEST155OUTPOST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 239
                                                  Jul 22, 2024 12:36:08.611552954 CEST239OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","CurrentSearch":"Google","CurrentHomepage":"about:home","LanguageIso2":"en-GB","IP":null,"CreateDate":0}}
                                                  Jul 22, 2024 12:36:08.768096924 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:36:08 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c9ba19a54235-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0
                                                  Jul 22, 2024 12:36:08.902491093 CEST155OUTPOST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 239
                                                  Jul 22, 2024 12:36:08.908323050 CEST239OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","CurrentSearch":"Google","CurrentHomepage":"about:home","LanguageIso2":"en-GB","IP":null,"CreateDate":0}}
                                                  Jul 22, 2024 12:36:09.030929089 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:36:08 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c9bbfb7e4235-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0
                                                  Jul 22, 2024 12:36:09.125521898 CEST155OUTPOST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 239
                                                  Jul 22, 2024 12:36:09.130918980 CEST239OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","CurrentSearch":"Google","CurrentHomepage":"about:home","LanguageIso2":"en-GB","IP":null,"CreateDate":0}}
                                                  Jul 22, 2024 12:36:09.331686974 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:36:09 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c9bd5c7c4235-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  143192.168.2.450361104.19.208.15280984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:36:07.422466993 CEST129OUTGET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Connection: Keep-Alive
                                                  Jul 22, 2024 12:36:07.890578032 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:36:07 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 9891
                                                  Connection: keep-alive
                                                  ETag: "3914547665"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 194
                                                  Expires: Mon, 22 Jul 2024 14:36:07 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c9b4ffad4294-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d [TRUNCATED]
                                                  Data Ascii: PKIX6%FeatureActions.txtBPZ&KE9(0p<a}9g<D)9k@4y'!=~Zk`1J2[)_,{FF?q;fL*=1ZI->m%>`ml,sWITPu*;Pxxhgl$M]I}ogZL5?BZLxukU1P4mW-Ntf?I-/!w90/^%X-.0(mVPn]=cr_A$<BWye2bK{jOdxZv@[NLDU|_1Sp~Paq>})$qH7,hm)Ias<TWu$?Ey@Xu@5*UJLja0v^Q (O}k+fwvfzbhFE<plLWZI*.4#,X`=beVW)W*;Q,'x>Jq _T<ea&wo/RM2`rXFEc:A97A4FT0@wuJIBd5Bhw}oE@N=Z$)6@sXru%eIg5ruA:81&"e_'Be
                                                  Jul 22, 2024 12:36:07.890774965 CEST1236INData Raw: aa 27 91 1f 4b c3 11 60 77 a1 43 f9 f7 10 07 63 36 80 1a 86 ad 48 a7 d3 8f 6f 01 ae 9e 9c 3f a2 79 6e 3b 81 f2 7e 33 72 dc 17 7b 3c b2 f2 80 9b 26 a0 a9 76 69 9d e2 6e 9e 4d 47 96 36 9b c5 b5 27 68 b5 b4 84 34 1c 56 23 a3 50 e1 9f 24 02 89 9a 6e
                                                  Data Ascii: 'K`wCc6Ho?yn;~3r{<&vinMG6'h4V#P$n/Kt'<4oOa"xGTVBfE<eG#Bw{#@mc]os}uE6@e`^](9A,NjbNYnOF\8p"CLFk
                                                  Jul 22, 2024 12:36:07.890789032 CEST1236INData Raw: fd ac 50 d8 52 44 ee 8b 8f d4 d8 b2 84 d1 cb d6 f7 f8 05 a5 aa 41 48 05 36 3c 93 56 87 e3 e6 2f 47 40 72 47 91 28 bd 1e de c7 43 06 15 aa c9 07 7f 4b 86 10 6b 1f 41 44 6f 91 db 30 a2 f9 46 11 1a 4b 58 16 a1 31 d1 5e b4 59 ca fc 47 fc bc 25 05 70
                                                  Data Ascii: PRDAH6<V/G@rG(CKkADo0FKX1^YG%p8P*rH|idu{"PBv`DWG&O*rD:V4#{>51Zy4U-&SSIgFkZpYN~L-6Fed~ex>3
                                                  Jul 22, 2024 12:36:07.892081022 CEST1236INData Raw: 88 a8 b4 43 f7 18 27 39 99 b5 09 5b b0 21 e4 89 cd dc d8 80 8f ba 2c 76 5f 49 78 e0 a0 e6 a4 e8 61 8a 0a 7d 07 ae 7f 5b db 69 5b ab 4d 22 92 db 0e dc 5e ef db 36 83 5e 63 58 81 45 75 40 0c 8a 74 59 c3 e4 31 78 2a c9 f9 39 82 db c7 d7 e1 67 09 f5
                                                  Data Ascii: C'9[!,v_Ixa}[i[M"^6^cXEu@tY1x*9g&LIY+5kR@v<a.{G`#|<rPgAn><AhcF1NG_d~JFS}=l-z%Q\)Zm?)^afu
                                                  Jul 22, 2024 12:36:07.892093897 CEST1236INData Raw: 51 a2 95 4e ba 4b 5c 16 c5 a5 51 be 5a 39 45 dd 17 61 63 b5 65 bb 34 9f 6d 7c 76 0b e7 cf 8a 28 b1 32 a3 4c 94 f3 9c 2d 3a d8 05 c3 70 d8 b9 9e ea 5e e2 8b aa 76 16 1e 66 9d 5b 09 8d b4 bd 0c df a4 f1 57 38 11 41 42 5a 8f 27 30 7a 45 dd 2c af 7e
                                                  Data Ascii: QNK\QZ9Eace4m|v(2L-:p^vf[W8ABZ'0zE,~iY~^UiH-E`79_ue_f!t,f-X9^y0jgsotF8rUFX3\"T5p3WJBORFv
                                                  Jul 22, 2024 12:36:07.893596888 CEST1236INData Raw: ad 53 b8 3f 1e d4 8d 8b fb 22 dd 51 13 da db 37 c1 6d 8a c5 7d 9b 47 42 3f 8e c9 f0 52 59 f2 14 2a 9e 75 2e 6a 2e 7b 93 ce 8d 7f 03 7e d5 5c fc 25 45 10 44 72 a8 87 1c d2 e8 6e 79 f4 3a 12 2f 87 97 f4 7d 88 08 2a 70 f8 25 43 fc 4b 2d f3 25 a3 5d
                                                  Data Ascii: S?"Q7m}GB?RY*u.j.{~\%EDrny:/}*p%CK-%]F?TSkSG-^Bgv[1K+k9v&plE0P8t}BnUJXhBDBlfbG7Fsq3BI{?3>n
                                                  Jul 22, 2024 12:36:07.893611908 CEST1236INData Raw: 98 44 c0 9d 35 87 31 5c f2 45 f9 c7 ef 27 c4 f0 44 cb 1d 0f 1c d1 37 2a fd 7f 20 4f 38 65 99 02 a1 9a ea fd 15 94 74 5c 15 e4 8a 30 a5 11 66 30 df 52 31 9c c6 28 24 8c 3e 6f 18 50 ce cd 5b 40 65 9a 59 06 f5 bf 1e 38 1f 30 99 1f 31 4f 2a 69 da 0b
                                                  Data Ascii: D51\E'D7* O8et\0f0R1($>oP[@eY801O*iT2@#l0*z<F4a/dUF5iAzDScUSK:;{qQ.29h}w$/SZ24d2%h@"IT*w;W<-f.7p=ei ^C\aP`RyHaC!
                                                  Jul 22, 2024 12:36:07.894947052 CEST1236INData Raw: 39 ba ca 62 79 64 b1 96 fc a3 e4 33 18 bf f2 b3 53 33 28 3d 94 63 da fc df 9a ab 61 96 4f fd 8f 75 23 dd b5 d3 bd b5 31 ab e5 e1 6d de 8b 88 11 1d 05 ed 75 9d 2f 58 00 23 9c b7 5e 9c be d2 46 a0 2b 67 71 a6 f8 75 c0 5f 80 c9 c6 7f 3b c9 9d 1b 53
                                                  Data Ascii: 9byd3S3(=caOu#1mu/X#^F+gqu_;Sv_HO=[Ipy`9|;!&uEv@~q+"`T].@ON/,V]Bn`;LGQNL0j*\x8j8cpo;Y|1x[
                                                  Jul 22, 2024 12:36:07.894962072 CEST384INData Raw: e7 b8 35 15 54 a9 22 01 ba 8d 73 41 22 2d 5f 1c e5 c1 6a 64 1c 3a 02 da 84 ef c5 74 bd 9f 23 d9 32 44 34 28 27 d7 07 95 69 6b 95 3f 18 37 32 d0 a9 81 eb a5 e0 47 f9 bd 0e ce d3 e3 4e d2 40 77 fe 00 a1 df bb a6 9f 2e ba ee eb a2 f0 8c 0d bc fe f1
                                                  Data Ascii: 5T"sA"-_jd:t#2D4('ik?72GN@w.o[C4PcJ3 [mrE&r8U,%,uzs(q7r%Hr1]>D!M#C7xJW/5oZ~Wr4gB6SE^C8LT_4'8rC&:<uMz


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  144192.168.2.450364104.16.149.13080984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:36:07.663044930 CEST155OUTPOST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 239
                                                  Jul 22, 2024 12:36:07.676902056 CEST239OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","CurrentSearch":"Google","CurrentHomepage":"about:home","LanguageIso2":"en-GB","IP":null,"CreateDate":0}}
                                                  Jul 22, 2024 12:36:08.238990068 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:36:08 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c9b6ac8c7ca2-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0
                                                  Jul 22, 2024 12:36:08.241933107 CEST155OUTPOST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 239
                                                  Jul 22, 2024 12:36:08.247410059 CEST239OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","CurrentSearch":"Google","CurrentHomepage":"about:home","LanguageIso2":"en-GB","IP":null,"CreateDate":0}}
                                                  Jul 22, 2024 12:36:08.595272064 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:36:08 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c9b7fdb67ca2-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0
                                                  Jul 22, 2024 12:36:08.606837988 CEST155OUTPOST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 239
                                                  Jul 22, 2024 12:36:08.611824036 CEST239OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","CurrentSearch":"Google","CurrentHomepage":"about:home","LanguageIso2":"en-GB","IP":null,"CreateDate":0}}
                                                  Jul 22, 2024 12:36:08.797763109 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:36:08 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c9ba1f1d7ca2-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  145192.168.2.450371104.16.149.13080984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:36:08.997148037 CEST155OUTPOST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 239
                                                  Jul 22, 2024 12:36:09.001928091 CEST239OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","CurrentSearch":"Google","CurrentHomepage":"about:home","LanguageIso2":"en-GB","IP":null,"CreateDate":0}}


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  146192.168.2.450379104.19.208.15280984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:36:09.468100071 CEST129OUTGET /notifications/download/rt/postrun/prod/v1/FeatureActions.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Connection: Keep-Alive
                                                  Jul 22, 2024 12:36:09.936480045 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:36:09 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 9891
                                                  Connection: keep-alive
                                                  ETag: "3914547665"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 196
                                                  Expires: Mon, 22 Jul 2024 14:36:09 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c9c1b999435b-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 ab 49 9a 58 36 05 95 82 f9 25 00 00 95 d3 03 00 12 00 00 00 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 74 78 74 42 86 e3 50 5a 1b 0d e0 26 da 0d b9 4b a8 e4 a6 b2 45 39 87 02 b4 28 30 cc 70 d8 a2 c7 0b 87 a6 9a 3c 61 7d d4 39 e1 d2 be ab dd 67 1e 3c e4 ac 44 87 29 39 84 e1 ae be 6b 40 34 79 e5 cb 27 21 b4 93 bc e5 9a 3d 7e bd 5a 6b 60 31 4a 12 a1 ee ed 13 c4 92 32 1c 5b 92 ed bc 29 fb 5f d4 93 de d7 2c d5 7b 46 46 3f 10 71 ec c2 02 3b d4 66 4c a9 2a 0f d6 f6 3d bc db 88 31 ff b5 b5 97 8a b8 5a b0 49 f0 c5 ee 0e ff 2d 3e 07 6d 8f ce 0d 25 f3 3e 60 e8 93 c4 6d 0c cb e9 b3 fa 88 08 e4 6c a2 2c cc 9a 73 88 a3 aa 85 57 e7 49 cf 97 04 54 50 fb 97 75 2a 82 3b af cb 86 d1 92 a8 f1 50 85 f1 a1 0a 78 78 92 68 16 c2 67 10 6c 24 ba 16 4d a2 5d 49 7f 7d e4 f8 ae b6 92 95 80 95 d7 f4 6f 92 bd 67 d0 c5 c9 d9 be ea 82 fc 5a 96 4c df db 35 b1 c2 3f c3 9c 42 82 04 5a 4c de c9 78 10 b6 75 12 0d eb 94 6b 55 a5 31 19 50 1e d7 34 e8 6d e4 bf 57 85 c2 f1 06 2d 4e 74 66 0b 3f bd d6 8c 49 2d [TRUNCATED]
                                                  Data Ascii: PKIX6%FeatureActions.txtBPZ&KE9(0p<a}9g<D)9k@4y'!=~Zk`1J2[)_,{FF?q;fL*=1ZI->m%>`ml,sWITPu*;Pxxhgl$M]I}ogZL5?BZLxukU1P4mW-Ntf?I-/!w90/^%X-.0(mVPn]=cr_A$<BWye2bK{jOdxZv@[NLDU|_1Sp~Paq>})$qH7,hm)Ias<TWu$?Ey@Xu@5*UJLja0v^Q (O}k+fwvfzbhFE<plLWZI*.4#,X`=beVW)W*;Q,'x>Jq _T<ea&wo/RM2`rXFEc:A97A4FT0@wuJIBd5Bhw}oE@N=Z$)6@sXru%eIg5ruA:81&"e_'Be
                                                  Jul 22, 2024 12:36:09.936743021 CEST1236INData Raw: aa 27 91 1f 4b c3 11 60 77 a1 43 f9 f7 10 07 63 36 80 1a 86 ad 48 a7 d3 8f 6f 01 ae 9e 9c 3f a2 79 6e 3b 81 f2 7e 33 72 dc 17 7b 3c b2 f2 80 9b 26 a0 a9 76 69 9d e2 6e 9e 4d 47 96 36 9b c5 b5 27 68 b5 b4 84 34 1c 56 23 a3 50 e1 9f 24 02 89 9a 6e
                                                  Data Ascii: 'K`wCc6Ho?yn;~3r{<&vinMG6'h4V#P$n/Kt'<4oOa"xGTVBfE<eG#Bw{#@mc]os}uE6@e`^](9A,NjbNYnOF\8p"CLFk
                                                  Jul 22, 2024 12:36:09.936755896 CEST1236INData Raw: fd ac 50 d8 52 44 ee 8b 8f d4 d8 b2 84 d1 cb d6 f7 f8 05 a5 aa 41 48 05 36 3c 93 56 87 e3 e6 2f 47 40 72 47 91 28 bd 1e de c7 43 06 15 aa c9 07 7f 4b 86 10 6b 1f 41 44 6f 91 db 30 a2 f9 46 11 1a 4b 58 16 a1 31 d1 5e b4 59 ca fc 47 fc bc 25 05 70
                                                  Data Ascii: PRDAH6<V/G@rG(CKkADo0FKX1^YG%p8P*rH|idu{"PBv`DWG&O*rD:V4#{>51Zy4U-&SSIgFkZpYN~L-6Fed~ex>3
                                                  Jul 22, 2024 12:36:09.938186884 CEST1236INData Raw: 88 a8 b4 43 f7 18 27 39 99 b5 09 5b b0 21 e4 89 cd dc d8 80 8f ba 2c 76 5f 49 78 e0 a0 e6 a4 e8 61 8a 0a 7d 07 ae 7f 5b db 69 5b ab 4d 22 92 db 0e dc 5e ef db 36 83 5e 63 58 81 45 75 40 0c 8a 74 59 c3 e4 31 78 2a c9 f9 39 82 db c7 d7 e1 67 09 f5
                                                  Data Ascii: C'9[!,v_Ixa}[i[M"^6^cXEu@tY1x*9g&LIY+5kR@v<a.{G`#|<rPgAn><AhcF1NG_d~JFS}=l-z%Q\)Zm?)^afu
                                                  Jul 22, 2024 12:36:09.938199043 CEST896INData Raw: 51 a2 95 4e ba 4b 5c 16 c5 a5 51 be 5a 39 45 dd 17 61 63 b5 65 bb 34 9f 6d 7c 76 0b e7 cf 8a 28 b1 32 a3 4c 94 f3 9c 2d 3a d8 05 c3 70 d8 b9 9e ea 5e e2 8b aa 76 16 1e 66 9d 5b 09 8d b4 bd 0c df a4 f1 57 38 11 41 42 5a 8f 27 30 7a 45 dd 2c af 7e
                                                  Data Ascii: QNK\QZ9Eace4m|v(2L-:p^vf[W8ABZ'0zE,~iY~^UiH-E`79_ue_f!t,f-X9^y0jgsotF8rUFX3\"T5p3WJBORFv
                                                  Jul 22, 2024 12:36:09.939882994 CEST1236INData Raw: bc 5e 81 ad 46 6a d0 63 0d 41 be a4 de b8 31 e0 21 25 58 ea b3 25 c9 f7 8c bb e3 18 c4 69 7b e3 6c 79 3e fd 14 b5 c2 58 8e ea 74 8a b6 eb 41 66 11 f6 3e db 62 04 f3 22 0e 4f 2b 6a 32 39 13 97 9b 2c 68 2d 38 b4 7b 27 43 20 10 b5 52 04 20 31 2a f3
                                                  Data Ascii: ^FjcA1!%X%i{ly>XtAf>b"O+j29,h-8{'C R 1*1hM8CEI~0#}A\(|p1kvAmstyDFP$P*$P.jC`=DTTHNGg\;KW>D~r$x?Z[
                                                  Jul 22, 2024 12:36:09.939896107 CEST1236INData Raw: 89 0d 76 0a e6 48 8d 45 92 93 4f e7 93 58 75 cf f7 81 86 5f 44 76 37 00 04 c6 e9 fe 40 be e0 39 61 b2 8c 1d f6 19 2c 6d 96 f7 db 0e fa ff 45 37 6e 70 45 59 b9 9a 61 0d 4a bc 2b f2 ec c5 68 02 5c 60 49 a2 bc cd 94 1f 1c 26 37 83 7c 75 64 4b 69 59
                                                  Data Ascii: vHEOXu_Dv7@9a,mE7npEYaJ+h\`I&7|udKiY+n"=2g/jtkl^u.,R^vaWgZRO7Y_*;~1rV<fu&``LhV-Lrfg6F[g.C#2Z8ihbD[Ax\Y5Ip
                                                  Jul 22, 2024 12:36:09.942769051 CEST1236INData Raw: ae 42 42 91 80 96 c7 fd f6 91 4a 4c 72 4b 06 83 67 dd 55 16 cf 17 19 d1 19 f1 bd 43 c6 62 e1 60 12 06 86 6f e2 ab 52 99 67 c3 a7 e3 b1 1f 23 bf ea b7 94 7b dd c4 0f 96 d3 de d9 75 24 b3 4b 82 47 2a 30 86 0b 5b 46 d7 a3 31 8f 23 3e f1 81 a2 23 bf
                                                  Data Ascii: BBJLrKgUCb`oRg#{u$KG*0[F1#>#>!kH|$1YfAYsWmaP[R>fv4{V2b;;hv'?,*$L*7N'=a6WV"hrM05*.Rw
                                                  Jul 22, 2024 12:36:09.942783117 CEST724INData Raw: e9 1c 73 e5 20 e7 31 75 a2 25 9b c1 70 c9 76 13 8f 23 0a 22 53 51 aa c7 dd b8 02 a2 99 bb 64 c9 8a 24 e9 53 03 24 93 21 6b b5 d6 55 ec 6e b7 07 bb 66 5e c6 52 ed 6e 47 5c f3 76 c0 88 a9 62 c2 26 25 36 35 b8 f3 56 b4 a2 58 a0 12 56 07 40 9e 1d 1e
                                                  Data Ascii: s 1u%pv#"SQd$S$!kUnf^RnG\vb&%65VXV@ha;aOiM3+EtU{o$oFh^Y;kO^NBaH(EP'k7xt2llN$\,,<Yb*mQ#ulU:E,C `o3o


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  147192.168.2.450380104.19.208.15280984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:36:09.468612909 CEST113OUTGET /notifications/download/rt/ActiveFeatures.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Connection: Keep-Alive
                                                  Jul 22, 2024 12:36:09.942831993 CEST1236INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:36:09 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 17770
                                                  Connection: keep-alive
                                                  ETag: "770472110"
                                                  Last-Modified: Tue, 11 Jun 2024 17:24:23 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 499
                                                  Expires: Mon, 22 Jul 2024 14:36:09 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c9c1ba3a8c8a-EWR
                                                  Data Raw: 50 4b 03 04 14 00 01 00 08 00 3a 3d 41 58 37 5c 92 30 c0 44 00 00 72 cc 04 00 12 00 00 00 41 63 74 69 76 65 46 65 61 74 75 72 65 73 2e 74 78 74 a0 9b 2b 93 83 40 fc 73 6a 70 bb 23 a6 14 85 19 db 7f 9e 92 13 c4 c9 4b 31 fb 85 fc 04 d8 12 02 3b 04 ac 2f 2d a7 ef 1b ac a6 c7 02 06 b4 5b a6 5b 13 0e 41 d0 84 42 9e c4 12 82 c4 65 78 71 e8 aa bd c0 29 37 0e 92 20 37 3a 5e 80 b9 ea 89 67 13 4b 20 f3 b5 94 21 69 16 62 55 a7 56 c8 73 d6 98 fb 8e 87 4f 24 76 37 7c 65 5c b2 1b 8e b9 80 ec 57 ff e0 e4 27 f3 f8 a6 5a fd 64 76 65 55 2a 6f f6 52 a0 08 3e a0 25 15 8b a9 77 8c c3 ec 24 f2 2d 3b af 9d 9b 51 9b 18 ac bc 34 19 54 96 8c 06 fa 06 ee c4 66 24 01 2b 54 a6 24 df 26 9d 51 3f 39 c3 e6 99 06 23 22 f6 36 3e fd a1 dd d3 fd e7 0c c4 ee 30 c1 10 eb 15 6f 83 40 da df 9f 6a f9 28 cc 2a 69 29 08 48 22 1d 42 8d 0c 31 60 e4 3d a8 cd 26 30 96 ac 49 38 43 c3 52 9f a5 ce 22 79 e3 be 0a 9e 01 63 4d 37 97 67 e4 fb 80 e3 09 fa be ab d9 9e 5c 40 05 91 01 0d 38 db e2 06 78 94 45 0d 03 34 8b 82 1d 53 dc 7c 49 81 9f 81 18 1d 79 [TRUNCATED]
                                                  Data Ascii: PK:=AX7\0DrActiveFeatures.txt+@sjp#K1;/-[[ABexq)7 7:^gK !ibUVsO$v7|e\W'ZdveU*oR>%w$-;Q4Tf$+T$&Q?9#"6>0o@j(*i)H"B1`=&0I8CR"ycM7g\@8xE4S|Iyy7~%W?7!JhrfdB^OQ"IDG!o+^6VY6<wNNPP2\?EY^j>i[p`L_sXq>#~nY>LO9rsAS+g5FBiqgUf{*vBUBqTpKF;/[&WIAPuS-&v3!Y'bMl{[:5sVL3om7'O4'(V#:\#VOO&<s}Yd|<P@jM%O5lHs^SYfaCDDwVcE8~cETL0YIEd@._PQ~w\fAT7Kiywq|+#]N">(A0bU-lDM#ETYa-h}ep<),
                                                  Jul 22, 2024 12:36:09.942845106 CEST1236INData Raw: c3 e9 0b b5 94 79 f6 cd ab db ef 95 d6 d1 32 bc 03 27 b0 a7 67 bb 67 5c 5f 47 4a 97 f1 f7 fc 80 a5 3d 5e cb d2 21 fd 16 4d f6 ed 94 f2 d0 41 ec b6 8d 9b cb af 44 4b 5e 3f 92 fc ae 08 db 64 a5 1d 86 78 29 a2 a9 c5 2d c1 7a 36 38 e0 81 84 1a 34 f5
                                                  Data Ascii: y2'gg\_GJ=^!MADK^?dx)-z684R|YSgynUf1qbEFO?'[a`bF\rsZL0q\vgrP:ZbPw^l^|Vov^'D0\mJh*I{X14
                                                  Jul 22, 2024 12:36:09.943280935 CEST1236INData Raw: e3 09 b7 93 e7 ef 55 87 a5 e2 4a 0e 55 3c 50 4f 28 65 ca 9a de 34 88 d5 59 ab cd 64 54 2a 94 93 b6 b8 c7 f1 34 a6 fe 9a 9e 58 e1 5b 68 04 08 88 1d 07 7a 22 8c f4 8b 1a 37 f4 2d 18 02 f7 c9 7a e3 8d 30 e6 e5 c6 72 4a b5 33 12 97 f2 9b 9f 3d 2b 49
                                                  Data Ascii: UJU<PO(e4YdT*4X[hz"7-z0rJ3=+I:QrVjeAU|0e r.-nFs%U@_G~W}E^ns]W6.Jg4)Kk~9"4{i#W}_&L'HNOp
                                                  Jul 22, 2024 12:36:09.943295002 CEST1236INData Raw: a2 40 45 ad 3e 10 cc d4 22 b8 18 aa b5 83 15 5b 5f 79 62 da f6 64 de 89 40 91 c6 e3 e6 3c 48 f6 f2 37 d0 b4 a2 87 ed 8b 72 11 f9 fa 1d 84 ca dd 63 7c e6 56 65 74 e8 c3 ce 0a 52 78 3d f5 2c 69 ad 82 46 5f 21 19 b5 ed d3 bf 7e 98 76 8d 6a 94 b7 ed
                                                  Data Ascii: @E>"[_ybd@<H7rc|VetRx=,iF_!~vj5s,yL/[g{QosVz%{A|PSeC)PYzSZ/]E?kINr|Pg!\2-;@&Lb<maS
                                                  Jul 22, 2024 12:36:09.944540977 CEST1236INData Raw: ef ec e3 a3 78 02 50 1e 6e 18 3a c8 ef 40 01 47 df 2f 67 75 81 ee e7 ed 5c 86 a7 cd ff 50 b9 61 08 00 fa a5 b9 0e 2f 50 8f 87 fd 80 44 ec bf 7d 28 a2 50 86 c4 d0 81 34 04 f9 9d 19 90 5d 6c c8 6f a3 82 62 5f 8a 77 97 ae e6 15 32 ec 5b 3c d5 d1 50
                                                  Data Ascii: xPn:@G/gu\Pa/PD}(P4]lob_w2[<Pz|<gzX],af!:$uMs)m74Tf8Q0Ee@>i~p#D'uma{4q-x.{W)x,0Fm'*wTn
                                                  Jul 22, 2024 12:36:09.944552898 CEST1236INData Raw: ea fe e8 9b 44 1e 62 80 9f 85 5d b4 ed 54 9a 62 26 5d f9 5f e9 66 31 79 1a ec 5d eb 3b 42 de 2a 12 2f 99 5a 51 ad 2c 4e fc b2 cd 25 8a df 0b d7 07 24 1e 16 60 15 f2 23 fe 84 ec 28 ca cb ea 25 a1 6f 30 22 39 cc 4f eb 80 ec b0 87 73 03 c9 e2 6f cb
                                                  Data Ascii: Db]Tb&]_f1y];B*/ZQ,N%$`#(%o0"9OsosUN^m9N)&8))QK}b9"@T~yu?V7j7y)vJ_EEW58X+:CP~T,{/s" a*=_lJ
                                                  Jul 22, 2024 12:36:09.945926905 CEST1236INData Raw: c6 ac fb 85 2b c7 a3 2f 2f d9 73 66 a6 d5 b3 dc bc 4c 89 64 2f f9 a1 b7 40 bf dd 84 b3 f4 0d 92 fa d2 49 45 fc 27 f8 14 9d 3f bd 02 3a c4 6a 3c 68 f4 ec 55 d8 20 1b ea 58 1f 15 63 0c 4e fc 76 39 e9 cc 71 40 69 5b b9 5b c5 4e 6d 50 82 e3 2b 3d 15
                                                  Data Ascii: +//sfLd/@IE'?:j<hU XcNv9q@i[[NmP+=127ZS$rHxh7[m15'1Z91 #%|^s\obPTPUO:$9pgLNTKqmc_xE]uUW\&6Ijo
                                                  Jul 22, 2024 12:36:09.945940018 CEST1236INData Raw: e7 41 3d ce 7d 33 4d 0f 6d da 2d 57 cd 6d 7c 72 20 41 5f e2 85 cb 48 2a 2c 1b 25 2d ea 0b 8c 30 58 68 ec 5b 67 54 17 0b 09 36 f0 a1 5f 55 d0 81 77 eb 76 58 90 be 59 9e ba 3f be 84 2b 42 29 6f 5c df c6 42 5f 49 8a 9f 97 26 07 55 9d da 50 6a e6 dc
                                                  Data Ascii: A=}3Mm-Wm|r A_H*,%-0Xh[gT6_UwvXY?+B)o\B_I&UPj?n,\_%N&gFx!7^"*w/:=\-?2$(<9#oPa7Z+iIU1B($k!XdI<#7s(,\~1~@SfHTn
                                                  Jul 22, 2024 12:36:09.947571039 CEST1236INData Raw: 20 19 6a 5f 78 89 c4 93 e5 38 5a 6e de 37 da e2 c6 06 b0 e8 f5 8e ec 2a 4d 52 53 7c c0 ce f1 b1 9d 84 d3 91 ba fc 29 13 39 6d 22 59 ca f4 90 ba 24 c3 b5 86 27 17 f3 8a b2 8c 0f d9 b9 6d 97 6d 9b 96 f5 eb e7 ae 0b 71 31 03 84 41 72 7d a7 8d f4 99
                                                  Data Ascii: j_x8Zn7*MRS|)9m"Y$'mmq1Ar}sWC@T^n2I%j+r|kpjq%<OjYSO)o+`qK18oLXG#F?sTds%>qWY2qf[n XR`
                                                  Jul 22, 2024 12:36:09.947587013 CEST1236INData Raw: d1 d2 9b 08 03 2c 5a d5 0d b5 24 ba 57 06 e9 82 13 06 b8 76 cd 11 85 df 30 60 c7 4a 68 fc 62 33 d3 a3 33 4a 36 3d a8 67 bb a3 56 33 7d 3d 9a 83 2c 2e ab 79 ba 0d fb 01 11 b8 6d 84 ce cd 88 2e 7d f5 4f 3e 3e d1 e4 3c 13 83 fa 27 77 82 c7 e2 d9 4b
                                                  Data Ascii: ,Z$Wv0`Jhb33J6=gV3}=,.ym.}O>><'wK\U}&El?<tl%}v%HSA*gH(vqd00Dan~Jlax_K9#+Rfl?uhLO{.FLRS
                                                  Jul 22, 2024 12:36:09.948759079 CEST1236INData Raw: 12 42 b8 dd e5 1f 9e 6b 33 d0 27 64 66 67 09 75 13 4e 4f e9 2f 56 c0 a1 26 a6 e7 0f 48 59 99 5e 9a 7b ee 13 0a e1 b2 7e 95 bf 06 41 45 43 c3 c5 43 45 37 b4 fd 4d f1 ee 9a 9c 98 53 15 42 01 8c fa ef a5 44 d0 97 33 99 81 2a 36 6b 2c 46 c1 0c 71 2f
                                                  Data Ascii: Bk3'dfguNO/V&HY^{~AECCE7MSBD3*6k,Fq/D:-E|OylOR-BS)2,o(P.Ibk@1F] 9X&;/<MZ5 `CLg`h*EH=|EZpoC/j{1,u;


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  148192.168.2.450381104.16.149.13080984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:36:10.117185116 CEST155OUTPOST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 239
                                                  Jul 22, 2024 12:36:10.143028975 CEST239OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","CurrentSearch":"Google","CurrentHomepage":"about:home","LanguageIso2":"en-GB","IP":null,"CreateDate":0}}
                                                  Jul 22, 2024 12:36:10.623591900 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:36:10 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c9c5dc751768-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0
                                                  Jul 22, 2024 12:36:10.647053003 CEST155OUTPOST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 239
                                                  Jul 22, 2024 12:36:10.652102947 CEST239OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","CurrentSearch":"Google","CurrentHomepage":"about:home","LanguageIso2":"en-GB","IP":null,"CreateDate":0}}
                                                  Jul 22, 2024 12:36:11.176179886 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:36:10 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c9c6dcee1768-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0
                                                  Jul 22, 2024 12:36:11.180860043 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:36:10 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c9c6dcee1768-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0
                                                  Jul 22, 2024 12:36:11.183516026 CEST155OUTPOST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 239
                                                  Jul 22, 2024 12:36:11.191996098 CEST239OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","CurrentSearch":"Google","CurrentHomepage":"about:home","LanguageIso2":"en-GB","IP":null,"CreateDate":0}}
                                                  Jul 22, 2024 12:36:11.395596981 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:36:11 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c9ca3ed21768-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  149192.168.2.450384104.16.149.13080984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  Jul 22, 2024 12:36:10.275295973 CEST155OUTPOST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 239
                                                  Jul 22, 2024 12:36:10.280708075 CEST239OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","CurrentSearch":"Google","CurrentHomepage":"about:home","LanguageIso2":"en-GB","IP":null,"CreateDate":0}}
                                                  Jul 22, 2024 12:36:11.175529957 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:36:10 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c9c6cd981881-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0
                                                  Jul 22, 2024 12:36:11.180277109 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:36:10 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c9c6cd981881-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0
                                                  Jul 22, 2024 12:36:11.180854082 CEST155OUTPOST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 239
                                                  Jul 22, 2024 12:36:11.188117981 CEST239OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65
                                                  Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Version":"9.1.0.993","CurrentSearch":"Google","CurrentHomepage":"about:home","LanguageIso2":"en-GB","IP":null,"CreateDate":0}}
                                                  Jul 22, 2024 12:36:11.314595938 CEST524INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:36:11 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: keep-alive
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c9ca3f2d1881-EWR
                                                  Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a 30 0d 0a 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}0


                                                  HTTPS Proxied Packets

                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  0192.168.2.44973349.12.121.474436844C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:33:01 UTC158OUTGET /offer.php?v=1&c=2021a HTTP/1.1
                                                  User-Agent: NSIS_Inetc (Mozilla)
                                                  Host: offers.filezilla-project.org
                                                  Connection: Keep-Alive
                                                  Cache-Control: no-cache
                                                  2024-07-22 10:33:01 UTC409INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:33:01 GMT
                                                  Server: Apache
                                                  Cache-Control: no-store, must-revalidate
                                                  Strict-Transport-Security: max-age=315360000; includeSubDomains; preload
                                                  Upgrade: h2
                                                  Connection: Upgrade, close
                                                  Vary: Accept-Encoding
                                                  X-Content-Type-Options: nosniff
                                                  X-XSS-Protection: 1; mode=block
                                                  X-Frame-Options: deny
                                                  Transfer-Encoding: chunked
                                                  Content-Type: text/html; charset=UTF-8
                                                  2024-07-22 10:33:01 UTC7654INData Raw: 31 64 64 39 0d 0a 75 72 6c 0a 68 74 74 70 73 3a 2f 2f 6f 66 66 65 72 73 2e 66 69 6c 65 7a 69 6c 6c 61 2d 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 67 65 74 2e 70 68 70 3f 6f 66 66 65 72 3d 32 30 32 31 61 0a 66 69 6c 65 6e 61 6d 65 0a 57 63 49 6e 73 74 61 6c 6c 65 72 2e 65 78 65 0a 61 72 67 73 0a 2d 2d 73 69 6c 65 6e 74 20 2d 2d 70 61 72 74 6e 65 72 3d 46 5a 32 31 30 34 32 37 20 2d 2d 73 65 61 72 63 68 65 6e 62 6c 0a 73 6b 69 70 72 65 67 0a 48 4b 4c 4d 0a 53 4f 46 54 57 41 52 45 5c 4c 61 76 61 73 6f 66 74 5c 57 65 62 20 43 6f 6d 70 61 6e 69 6f 6e 0a 49 6e 73 74 61 6c 6c 65 64 0a 73 6b 69 70 72 65 67 0a 48 4b 43 55 0a 53 4f 46 54 57 41 52 45 5c 4c 61 76 61 73 6f 66 74 5c 57 65 62 20 43 6f 6d 70 61 6e 69 6f 6e 0a 49 6e 73 74 61 6c 6c 65 64 0a 63 6f 6e 74 72 6f 6c
                                                  Data Ascii: 1dd9urlhttps://offers.filezilla-project.org/get.php?offer=2021afilenameWcInstaller.exeargs--silent --partner=FZ210427 --searchenblskipregHKLMSOFTWARE\Lavasoft\Web CompanionInstalledskipregHKCUSOFTWARE\Lavasoft\Web CompanionInstalledcontrol


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  1192.168.2.44973549.12.121.474436844C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:33:12 UTC156OUTGET /get.php?offer=2021a HTTP/1.1
                                                  User-Agent: NSIS_Inetc (Mozilla)
                                                  Host: offers.filezilla-project.org
                                                  Connection: Keep-Alive
                                                  Cache-Control: no-cache
                                                  2024-07-22 10:33:12 UTC409INHTTP/1.1 302 Found
                                                  Date: Mon, 22 Jul 2024 10:33:12 GMT
                                                  Server: Apache
                                                  Strict-Transport-Security: max-age=315360000; includeSubDomains; preload
                                                  Upgrade: h2
                                                  Connection: Upgrade, close
                                                  Location: https://webcompanion.com/nano_download.php?partner=FZ210427
                                                  X-Content-Type-Options: nosniff
                                                  X-XSS-Protection: 1; mode=block
                                                  X-Frame-Options: deny
                                                  Content-Length: 0
                                                  Content-Type: text/html; charset=UTF-8


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  2192.168.2.449738104.19.159.2244436844C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:33:13 UTC159OUTGET /nano_download.php?partner=FZ210427 HTTP/1.1
                                                  User-Agent: NSIS_Inetc (Mozilla)
                                                  Connection: Keep-Alive
                                                  Cache-Control: no-cache
                                                  Host: webcompanion.com
                                                  2024-07-22 10:33:13 UTC495INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:33:13 GMT
                                                  Content-Type: application/octet-stream
                                                  Content-Length: 565920
                                                  Connection: close
                                                  X-Powered-By: PHP/7.2.34
                                                  Expires: Mon, 22 Jul 2024 10:38:13 GMT
                                                  Cache-Control: public, max-age=300
                                                  Pragma: public
                                                  Content-Disposition: attachment; filename=WcInstaller.exe
                                                  Content-Transfer-Encoding: binary
                                                  CF-Cache-Status: EXPIRED
                                                  Last-Modified: Mon, 22 Jul 2024 03:38:57 GMT
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c570cc9c78e7-EWR
                                                  2024-07-22 10:33:13 UTC874INData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 1e 1d 57 9d 7f 73 04 9d 7f 73 04 9d 7f 73 04 1e 63 7d 04 84 7f 73 04 ab 59 79 04 dd 7f 73 04 13 77 2c 04 9c 7f 73 04 9d 7f 72 04 2f 7f 73 04 1e 77 2e 04 94 7f 73 04 ab 59 78 04 d0 7f 73 04 f2 09 d9 04 9a 7f 73 04 f2 09 ed 04 9c 7f 73 04 5a 79 75 04 9c 7f 73 04 52 69 63 68 9d 7f 73 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 ce 88 ac 4d 00 00 00
                                                  Data Ascii: MZ@!L!This program cannot be run in DOS mode.$Wsssc}sYysw,sr/sw.sYxsssZyusRichsPELM
                                                  2024-07-22 10:33:13 UTC1369INData Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e9 00 00 00 00 c6 05 64 00 42 00 3b c6 05 78 00 42 00 3b c3 55 8b ec 81 ec 34 01 00 00 8b 45 08 53 56 57 a3 64 31 42 00 e8 4e 0a 00 00 6a 03 33 db 5f 8d 8d 68 ff ff ff 57 a2 68 31 42 00 89 9d 68 ff ff ff 89 9d 6c ff ff ff 89 9d 70 ff ff ff e8 38 11 00 00 57 8d 4d e4 89 5d e4 89 5d e8 89 5d ec e8 26 11 00 00 57 8d
                                                  Data Ascii: dB;xB;U4ESVWd1BNj3_hWh1Bhlp8WM]]]&W
                                                  2024-07-22 10:33:13 UTC1369INData Raw: ff 35 60 00 42 00 8d 8d 74 ff ff ff e8 fb 3d 00 00 84 c0 75 19 38 5d 0b 75 0c ba 34 01 42 00 33 c9 e8 d7 f9 00 00 6a 01 5b e9 0a 05 00 00 6a 1c e8 45 25 00 00 8b f0 59 3b f3 74 13 8d 4e 08 89 5e 04 e8 20 0a 00 00 c7 06 30 b3 41 00 eb 02 33 f6 3b f3 74 06 8b 06 56 ff 50 04 8b ce e8 69 6a 00 00 85 c0 74 11 ba 0c 01 42 00 33 c9 e8 8b f9 00 00 e9 03 01 00 00 8d 85 78 ff ff ff 8d 8d 48 ff ff ff 50 e8 ca 07 00 00 57 8d 4d d8 88 5d ff 89 5d d8 89 5d dc 89 5d e0 e8 2c 0c 00 00 8d 45 d8 8d 55 9c 50 8d 45 ff 50 8d 85 48 ff ff ff ff b5 38 ff ff ff 8b ce 50 e8 7e 19 00 00 3b c3 74 74 38 5d 0b 75 67 83 f8 01 74 05 38 5d ff 74 28 6a 08 8d 8d 20 ff ff ff 5a e8 30 49 00 00 50 8d 4d d8 e8 05 08 00 00 ff b5 20 ff ff ff e8 ae 24 00 00 59 b8 05 40 00 80 3d 04 40 00 80 74 2e
                                                  Data Ascii: 5`Bt=u8]u4B3j[jE%Y;tN^ 0A3;tVPijtB3xHPWM]]]],EUPEPH8P~;tt8]ugt8]t(j Z0IPM $Y@=@t.
                                                  2024-07-22 10:33:13 UTC1369INData Raw: ff ff ff e8 3f 20 00 00 83 c4 0c ff 75 a8 e8 34 20 00 00 ff 75 9c e8 2c 20 00 00 ff 75 90 e8 24 20 00 00 ff 75 b4 e8 1c 20 00 00 ff 75 e4 e8 14 20 00 00 ff b5 68 ff ff ff e8 09 20 00 00 83 c4 18 8b c3 5f 5e 5b c9 c2 10 00 51 83 64 24 00 00 56 8b f1 6a 00 e8 18 23 00 00 8b c6 5e 59 c3 55 8b ec 81 ec 94 00 00 00 8d 85 6c ff ff ff c7 85 6c ff ff ff 94 00 00 00 50 ff 15 98 b0 41 00 85 c0 74 0e 83 bd 7c ff ff ff 02 75 05 6a 01 58 c9 c3 33 c0 c9 c3 56 8b 74 24 08 ff 4e 04 8b 46 04 75 14 85 f6 74 0e 8b ce e8 0d 00 00 00 56 e8 94 1f 00 00 59 33 c0 5e c2 04 00 b8 84 8e 41 00 e8 44 1c 01 00 51 56 8d 71 08 89 75 f0 c7 06 44 b3 41 00 83 65 fc 00 8b ce e8 50 28 00 00 83 4d fc ff 8b ce e8 1c 28 00 00 8b 4d f4 5e 64 89 0d 00 00 00 00 c9 c3 b8 98 8e 41 00 e8 09 1c 01 00
                                                  Data Ascii: ? u4 u, u$ u u h _^[Qd$Vj#^YUllPAt|ujX3Vt$NFutVY3^ADQVquDAeP(M(M^dA
                                                  2024-07-22 10:33:13 UTC1369INData Raw: 0c 30 85 c9 89 4d fc 74 0e e8 2c 01 00 00 ff 75 fc e8 d8 1a 00 00 59 83 c6 04 ff 4d 08 75 dd 5e ff 75 0c 8b cb 57 e8 f7 24 00 00 5f 5b c9 c2 08 00 55 8b ec 51 53 8b d9 8b 4d 0c 57 8b 7d 08 8b 43 08 03 cf 3b c8 7e 05 2b c7 89 45 0c 8b 45 0c 85 c0 7e 2d 56 8b f7 c1 e6 02 89 45 08 8b 43 0c 8b 0c 30 85 c9 89 4d fc 74 0e e8 78 01 00 00 ff 75 fc e8 77 1a 00 00 59 83 c6 04 ff 4d 08 75 dd 5e ff 75 0c 8b cb 57 e8 96 24 00 00 5f 5b c9 c2 08 00 56 8b f1 e8 14 00 00 00 f6 44 24 08 01 74 07 56 e8 47 1a 00 00 59 8b c6 5e c2 04 00 b8 ac 8e 41 00 e8 f7 16 01 00 51 56 8b f1 89 75 f0 c7 06 44 b3 41 00 83 65 fc 00 e8 06 23 00 00 83 4d fc ff 8b ce e8 d2 22 00 00 8b 4d f4 5e 64 89 0d 00 00 00 00 c9 c3 56 8b f1 e8 14 00 00 00 f6 44 24 08 01 74 07 56 e8 f3 19 00 00 59 8b c6 5e
                                                  Data Ascii: 0Mt,uYMu^uW$_[UQSMW}C;~+EE~-VEC0MtxuwYMu^uW$_[VD$tVGY^AQVuDAe#M"M^dVD$tVY^
                                                  2024-07-22 10:33:13 UTC1369INData Raw: ff 08 0f 9e c0 48 83 e0 0c 83 c0 04 8d 14 30 3b d3 7d 04 2b de 8b c3 03 f8 57 e8 6e ff ff ff 5f 5e 5b c2 04 00 53 56 8b 5c 24 0c 57 8b f9 8b 37 66 8b 16 8b 0b e8 66 15 00 00 85 c0 7c 0d 66 83 3e 00 74 07 46 46 66 8b 16 eb e8 2b 37 8b cf d1 fe 56 6a 00 e8 e4 fe ff ff 5f 5e 5b c2 04 00 53 8b d9 56 57 8b 3b 33 f6 66 8b 17 66 85 d2 74 39 8b 44 24 10 8b 08 e8 25 15 00 00 85 c0 7c 08 85 f6 75 06 8b f7 eb 02 33 f6 47 47 66 8b 17 66 85 d2 75 dd 85 f6 74 12 2b 33 8b 43 04 8b cb d1 fe 2b c6 50 56 e8 94 fe ff ff 5f 5e 5b c2 04 00 53 56 8b f1 57 8b 7c 24 10 8b 46 04 39 07 7e 02 89 07 8b 5c 24 14 8b ce 53 e8 46 fc ff ff 8b 07 8b 0e 8b d0 69 d2 ff ff ff 7f 03 56 04 8d 54 12 02 52 8d 14 41 03 c3 52 8d 04 41 50 e8 92 11 01 00 83 c4 0c 5f 5e 5b c2 08 00 b8 44 8f 41 00 e8
                                                  Data Ascii: H0;}+Wn_^[SV\$W7ff|f>tFFf+7Vj_^[SVW;3fft9D$%|u3GGffut+3C+PV_^[SVW|$F9~\$SFiVTRARAP_^[DA
                                                  2024-07-22 10:33:13 UTC1369INData Raw: fc 04 e8 01 1b 00 00 39 5d cc 75 0c 89 7d c4 c6 45 fc 05 e9 f3 00 00 00 8d 45 e8 8d 4d 9c 50 e8 cb f2 ff ff 38 5e 40 c6 45 fc 06 75 08 8d 4d c4 e8 f5 18 00 00 39 5d cc 74 10 38 5d 0b 75 0b 8d 45 c4 8b ce 50 e8 36 fd ff ff 8d 45 9c 8d 56 10 50 8d 4d b8 e8 b5 fb ff ff 38 5e 40 c6 45 fc 07 74 42 83 c6 28 8d 45 b8 50 8b ce e8 18 f3 ff ff 38 5d 0b 8b 0e 74 07 e8 0c 1f 00 00 eb 0b ff 75 0c 33 d2 53 e8 58 1e 00 00 ff 75 b8 e8 ab 0f 00 00 ff 75 9c e8 a3 0f 00 00 59 89 7d c4 59 c6 45 fc 08 eb 6c 8d 8d 7c ff ff ff e8 c7 f1 ff ff ff 75 b8 8d 8d 54 ff ff ff c6 45 fc 09 e8 38 2b 00 00 84 c0 0f 84 83 00 00 00 8b 4d b8 e8 31 21 00 00 84 c0 75 77 ff 35 80 02 42 00 8d 8e e4 00 00 00 e8 43 f2 ff ff ff b5 7c ff ff ff e8 4b 0f 00 00 ff 75 b8 e8 43 0f 00 00 ff 75 9c e8 3b 0f
                                                  Data Ascii: 9]u}EEMP8^@EuM9]t8]uEP6EVPM8^@EtB(EP8]tu3SXuuY}YEl|uTE8+M1!uw5BC|KuCu;
                                                  2024-07-22 10:33:13 UTC1369INData Raw: 00 00 00 8b 45 88 c7 80 d8 00 00 00 01 00 00 00 89 5d 0c 8d 85 6c ff ff ff ba ca 32 40 00 50 8d 4d 0c c6 45 fc 02 e8 45 00 01 00 8b f0 3b f3 74 0d 8d 4d 0c e8 f7 ff 00 00 e9 a1 00 00 00 6a 03 8d 4d e8 89 5d e8 89 5d ec 89 5d f0 e8 bc f1 ff ff 6a 45 8d 4d dc 5a c6 45 fc 03 e8 f1 2e 00 00 50 8d 4d e8 c6 45 fc 04 e8 c2 ed ff ff c6 45 fc 03 ff 75 dc e8 6a 0a 00 00 59 8d 45 0c 8b 4d 88 50 8d 45 e8 50 e8 7c 00 00 00 ff 75 e8 e8 51 0a 00 00 59 88 5d fc 8d 4d 0c e8 92 ff 00 00 eb 0b 8d 8d 6c ff ff ff e8 d1 00 00 00 8b 75 14 8d 45 d0 50 8b ce e8 76 ed ff ff 39 5e 04 75 10 8b 45 88 8b ce 05 e4 00 00 00 50 e8 61 ed ff ff 8b 45 88 8b 4d 10 8b 75 cc 8a 80 e0 00 00 00 88 01 83 4d fc ff 8d 8d 6c ff ff ff e8 05 04 00 00 8b 4d f4 8b c6 5f 5e 5b 64 89 0d 00 00 00 00 c9 c2
                                                  Data Ascii: E]l2@PMEE;tMjM]]]jEMZE.PMEEujYEMPEP|uQY]MluEPv9^uEPaEMuMlM_^[d
                                                  2024-07-22 10:33:13 UTC1369INData Raw: f1 57 33 ff c7 06 d4 b3 41 00 c7 46 04 c8 b3 41 00 89 7e 08 89 75 f0 89 7e 0c 8d 4e 10 6a 03 89 7d fc 89 39 89 79 04 89 79 08 e8 85 ec ff ff 8d 4e 1c 6a 03 c6 45 fc 01 89 39 89 79 04 89 79 08 e8 6f ec ff ff 8d 4e 28 6a 03 c6 45 fc 02 89 39 89 79 04 89 79 08 e8 59 ec ff ff 89 7e 4c 8d 4e 50 6a 03 c6 45 fc 04 89 39 89 79 04 89 79 08 e8 40 ec ff ff 8d 4e 68 c6 45 fc 05 e8 36 00 00 00 8d 8e e4 00 00 00 6a 03 c6 45 fc 06 89 39 89 79 04 89 79 08 e8 1b ec ff ff 8b 4d f4 c7 06 a4 b3 41 00 c7 46 04 98 b3 41 00 8b c6 5f 5e 64 89 0d 00 00 00 00 c9 c3 b8 b5 91 41 00 e8 8b 01 01 00 51 51 53 56 8b f1 33 db 57 89 75 ec 89 5e 04 c7 06 24 b4 41 00 8d 4e 0c 89 5e 08 6a 03 89 5d fc 89 19 89 59 04 89 59 08 e8 c7 eb ff ff 8d 7e 3c 89 5e 30 89 1f 8d 4e 40 c6 45 fc 02 e8 72 00
                                                  Data Ascii: W3AFA~u~Nj}9yyNjE9yyoN(jE9yyY~LNPjE9yy@NhE6jE9yyMAFA_^dAQQSV3Wu^$AN^j]YY~<^0N@Er
                                                  2024-07-22 10:33:13 UTC1369INData Raw: 5f 5e 5b 66 83 20 00 c9 c2 08 00 55 8b ec ff 75 08 e8 ed 01 01 00 85 c0 59 75 14 8a 45 0b 68 68 c6 41 00 88 45 0b 8d 45 0b 50 e8 ac 00 01 00 5d c3 ff 74 24 04 e8 03 03 01 00 59 c3 56 66 8b 31 8b c1 66 3b f2 74 0c 66 85 f6 74 0d 40 40 66 8b 30 eb ef 2b c1 5e d1 f8 c3 83 c8 ff 5e c3 55 8b ec 51 51 53 33 db 66 3b cb 56 66 89 4d fe 75 05 66 33 c0 eb 66 0f b7 c1 50 ff 15 d4 b1 41 00 8b f0 3b f3 75 53 ff 15 b0 b0 41 00 83 f8 78 75 48 53 53 8d 45 f8 6a 04 50 8d 45 fe 6a 01 50 53 53 ff 15 ac b0 41 00 8b f0 3b f3 74 26 83 fe 04 7f 21 8d 45 f8 88 5c 35 f8 50 ff 15 d8 b1 41 00 8d 45 fe 6a 01 50 8d 45 f8 56 50 53 53 ff 15 a8 b0 41 00 66 8b 45 fe eb 03 66 8b c6 5e 5b c9 c3 56 66 8b 01 66 8b 32 41 41 42 42 66 3b c6 72 09 77 0c 66 85 c0 74 0c eb e8 83 c8 ff 5e c3 6a 01
                                                  Data Ascii: _^[f UuYuEhhAEEP]t$YVf1f;tft@@f0+^^UQQS3f;VfMuf3fPA;uSAxuHSSEjPEjPSSA;t&!E\5PAEjPEVPSSAfEf^[Vff2AABBf;rwft^j


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  3192.168.2.449745104.19.208.1524435436C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:33:38 UTC123OUTGET /notifications/download/rt/dci/latest/Webprotection.zip HTTP/1.1
                                                  Host: rt.webcompanion.com
                                                  Connection: Keep-Alive
                                                  2024-07-22 10:33:38 UTC380INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:33:38 GMT
                                                  Content-Type: application/zip
                                                  Content-Length: 18692270
                                                  Connection: close
                                                  ETag: "3775219355"
                                                  Last-Modified: Mon, 17 Jun 2024 14:26:00 GMT
                                                  CF-Cache-Status: HIT
                                                  Age: 231
                                                  Expires: Mon, 22 Jul 2024 14:33:38 GMT
                                                  Cache-Control: public, max-age=14400
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c611ae641a48-EWR
                                                  2024-07-22 10:33:38 UTC989INData Raw: 50 4b 03 04 14 00 00 00 00 00 08 36 47 58 00 00 00 00 00 00 00 00 00 00 00 00 06 00 00 00 57 69 6e 33 32 2f 50 4b 03 04 14 00 00 00 08 00 40 61 ca 46 4b b4 d3 61 33 19 00 00 60 2f 00 00 28 00 00 00 57 69 6e 33 32 2f 61 70 69 2d 6d 73 2d 77 69 6e 2d 63 6f 72 65 2d 63 6f 6e 73 6f 6c 65 2d 6c 31 2d 31 2d 30 2e 64 6c 6c ed 1a 07 54 53 49 f0 a7 50 12 40 04 a4 0a 18 10 a4 26 fc 84 22 58 90 2e ca 51 43 51 8a 10 42 80 08 24 98 84 22 a2 90 e8 81 e2 89 78 28 8a 15 94 13 ac 88 9e 15 3c 8a 58 50 11 6c a8 48 11 b0 21 58 68 d6 53 6e 7f e8 a8 77 f7 de dd bd 2b ef 36 6f fe fe 99 9d 9d 3f 3b 3b 3b 3b bb 2f ce be 19 10 06 82 20 2c 80 fe 7e 08 3a 05 6a a4 58 0d d6 bf 56 6a 01 4c 98 72 66 02 f4 23 ae 5a e3 14 ea 9b 6a 0d cf 70 26 97 10 cd 61 87 71 68 51 04 3a 8d c5 62 f3 08
                                                  Data Ascii: PK6GXWin32/PK@aFKa3`/(Win32/api-ms-win-core-console-l1-1-0.dllTSIP@&"X.QCQB$"x(<XPlH!XhSnw+6o?;;;;/ ,~:jXVjLrf#Zjp&aqhQ:b
                                                  2024-07-22 10:33:38 UTC1369INData Raw: a1 6c 67 20 89 0e e4 b2 21 2e 80 50 f0 0d 82 90 9b 03 b8 91 27 0d 50 98 e0 8d 05 78 1d 81 d5 50 c3 df b6 03 c0 15 f6 65 02 de 11 2e 08 b2 06 38 13 e8 cb 10 4a 43 f4 8e 81 82 c1 9b 1d d0 e6 1b d0 be 08 9a 32 4a 8e 37 00 0e 90 34 d2 9f 0c 34 27 09 01 79 23 43 c6 d0 74 21 4e 80 74 81 ac 70 40 41 5a 4c 01 c5 0c 00 05 22 02 a0 00 2e 73 48 4f d8 df 0c ec 17 28 a1 6d 78 42 d9 2c 30 8a c8 51 a3 a6 09 f5 e3 0a f5 e3 0e 6a 87 94 64 20 17 05 34 64 00 0b 23 3d 10 3b 44 03 7b 21 23 0c 03 df 45 f2 ce 7d 40 8b df 6f 33 12 68 b1 06 92 22 41 3d 22 85 2b c4 10 eb 21 da c5 82 67 08 e0 84 20 4b a1 de ae 83 9c c8 4c 23 5a 0c d9 09 c1 7e 5d ff c5 90 36 e8 ef 26 d4 2c 04 50 e9 a0 ed d7 e7 fa 30 d0 c4 47 f8 a5 10 40 89 03 74 84 e2 0a e4 23 9a 0d 8c 03 f1 37 64 16 97 0a bf c5 00
                                                  Data Ascii: lg !.P'PxPe.8JC2J744'y#Ct!Ntp@AZL".sHO(mxB,0Qjd 4d#=;D{!#E}@o3h"A="+!g KL#Z~]6&,P0G@t#7d
                                                  2024-07-22 10:33:38 UTC1369INData Raw: 65 12 4f bc de ec e7 74 c9 e0 66 66 1e 25 ef 25 ea ee fa 2a 86 61 d9 ad 17 4d 0e cd ee 3b de 3a ae a4 96 96 3a 97 ac 5c f0 f2 52 03 45 fe 3c 35 bd b8 d6 12 84 c1 3b 20 0c 96 0e 84 41 3c 4d 2c d6 5b 18 fd c4 3f 8b 7e ab ff 92 b8 42 81 e1 81 b8 a2 37 d2 ee c1 06 57 7a b6 60 7e 99 a1 4c 3a 8d c7 20 58 c7 f0 c2 d9 e0 5c b0 14 89 80 b0 30 02 82 40 48 b6 20 9b 9b 90 4d 28 20 02 52 cc 06 50 53 04 fd a7 04 ea df 0a 8b 8d 92 c5 bb 1f 92 70 6d 4f ce bf c9 62 96 40 1a 67 99 c6 c6 2f 0f 61 af 78 26 bf 10 5d 59 7c 9e b0 ea de 9b 1b 6b 7b cc 8f 1c c8 3b 44 4c 0c 5e 2a d2 df 36 7f 0e d6 94 10 dd 56 f9 24 e2 c1 f6 32 b3 98 f6 34 72 e3 ba e8 47 0d d3 8f f3 1c b2 74 fd 52 83 a6 1a 96 36 cc fd 21 ec 8d bb ce 4e 4e 87 d8 de aa d3 ea 33 a9 a6 89 8f 6e 76 ea 9c 4e 55 fd 74 ba
                                                  Data Ascii: eOtff%%*aM;::\RE<5; A<M,[?~B7Wz`~L: X\0@H M( RPSpmOb@g/ax&]Y|k{;DL^*6V$24rGtR6!NN3nvNUt
                                                  2024-07-22 10:33:38 UTC1369INData Raw: 9a 33 e9 1c 36 71 5d ef 94 d3 9a 9a 58 45 d1 19 87 a6 6e d5 39 d0 16 7a a9 d3 57 65 ff 65 41 69 88 57 e2 e6 c7 5d ad f4 da 29 8c 9e c9 25 2d e7 ef 43 f8 42 d6 ae 6c db 07 a8 3c b8 b1 e1 c4 ea f5 5e d6 95 7e 8f 1f 46 1f 49 23 c2 75 0d ed fa bd e6 75 ef 9a 95 38 1a 85 5c d9 f9 fa 9a 0f 6f d7 67 b7 59 4f f6 78 92 2b 90 73 86 05 72 f3 86 8d 8e c1 a0 c8 02 39 0b 40 33 1d 73 36 94 9b 06 48 9a 68 14 e6 f3 b3 a1 00 35 5b 54 62 68 92 27 82 e3 a1 00 65 08 6c ab 0b 1a b4 80 b3 0f 8a 5e b5 10 8f 41 7d e1 70 b8 a9 3a b4 ab f8 c7 f9 77 cb e7 04 1d 6c 3a d5 2d b5 f5 f8 79 dd 40 a9 ba bd ca 6b 36 28 c8 bf 17 89 45 8b 7a 85 0b 3a 6e 94 2a c9 01 7f 35 85 cd 60 63 32 6c 0a 7e 24 18 36 f7 85 c5 c0 07 92 d1 a8 de 1c fe e9 3c fe 09 98 7f ec 2f 59 54 e3 92 7a 1d 58 7b 00 55 67
                                                  Data Ascii: 36q]XEn9zWeeAiW])%-CBl<^~FI#uu8\ogYOx+sr9@3s6Hh5[Tbh'el^A}p:wl:-y@k6(Ez:n*5`c2l~$6</YTzX{Ug
                                                  2024-07-22 10:33:38 UTC1369INData Raw: c3 1d db c7 6e a9 2e ad 2d ef 28 a5 7a 61 93 58 8b 2d 9a a5 a7 76 7f 6b 63 6f ea 19 3d f1 3b ff 7b 62 3b a0 7a 91 e7 5b 4d 9b 9f 6d aa ec 12 15 47 dd 30 3e b8 fc 22 b8 92 f3 0a e7 3f 4b d5 88 ae b7 e8 55 25 f5 df 5a 76 b7 6e fd d1 4b da 26 56 b6 b4 fb eb 29 f4 7b 72 2a be 69 8b a4 67 1c 62 27 dc e9 89 5c 5b f3 b1 e9 dd db cb 09 ba 9c 69 61 cf 92 ef cc 56 c1 b9 be 99 5d 57 ba b3 b2 a3 d5 6d d2 4b 85 44 0d f1 58 e3 09 f6 da 39 46 72 7d 95 d2 4c 51 fd 2d 8a bd 0f 2f 52 a3 51 71 a9 ee 1a a9 86 8d 11 fb 2a 23 37 9a 41 51 ea 87 dc 0b f7 26 f8 71 d2 65 ee a7 68 85 49 a0 14 93 82 35 cf 5b 5f b0 b2 51 68 f6 38 53 65 19 71 45 74 c6 3a 7c dc 6a bc fb b1 56 e3 16 53 c7 6e e3 43 b9 57 12 b7 e4 c7 e5 a7 3b f7 39 4e e1 bc 5e 23 11 3d 73 68 a3 9a 0c 2c a2 38 6a 5b 7a fa
                                                  Data Ascii: n.-(zaX-vkco=;{b;z[MmG0>"?KU%ZvnK&V){r*igb'\[iaV]WmKDX9Fr}LQ-/RQq*#7AQ&qehI5[_Qh8SeqEt:|jVSnCW;9N^#=sh,8j[z
                                                  2024-07-22 10:33:38 UTC1369INData Raw: 5c 78 7f f2 8e f5 df 3d bd 80 fd 74 78 87 d7 a5 d4 d0 c6 00 b1 20 ce 8d eb 05 2b 71 6f 35 cb 60 f2 49 ec dd bd cf ae f5 0b 96 15 d6 07 16 4c 34 f5 3f 4c 49 6e f5 29 13 c9 7e d8 1e 55 48 4c 24 67 e2 c3 31 36 0d be cf ea b5 25 49 dc 47 29 70 03 96 c4 cf df 41 4f 5b 05 cc f5 0b 50 4b 03 04 14 00 00 00 08 00 40 61 ca 46 a4 b7 1d 40 7c 18 00 00 60 2d 00 00 29 00 00 00 57 69 6e 33 32 2f 61 70 69 2d 6d 73 2d 77 69 6e 2d 63 6f 72 65 2d 64 61 74 65 74 69 6d 65 2d 6c 31 2d 31 2d 30 2e 64 6c 6c ed 1a 09 38 94 5b f4 9f c5 d8 a9 64 2b cb 28 12 1a fe 19 7b 91 ec ca 92 35 84 18 63 64 6c a3 99 11 49 31 53 11 af 85 57 29 a4 88 42 0b d1 62 2d a5 48 59 d2 2e af 10 49 49 8b 1e 79 5a 78 f7 1f 94 bc d7 7b ef fb de 7b df 5b af ef cc fd cf b9 e7 9e 7b ee bd e7 9e 73 ee fd d8 ae
                                                  Data Ascii: \x=tx +qo5`IL4?LIn)~UHL$g16%IG)pAO[PK@aF@|`-)Win32/api-ms-win-core-datetime-l1-1-0.dll8[d+({5cdlI1SW)Bb-HY.IIyZx{{[{s
                                                  2024-07-22 10:33:38 UTC1369INData Raw: 7e 21 f4 50 3f a2 1c 2c 83 50 04 c4 c4 6d 69 14 06 9d 49 f7 67 e1 4d e9 8c 30 3a 83 cc a2 81 1e ea f0 02 a4 1d 23 a6 f4 b9 dd 95 16 ea 47 8f 60 e2 ed 19 74 bf 70 0a c2 86 b7 37 35 c6 93 60 22 11 96 93 14 26 6a c1 ba 30 91 04 6b 02 c2 4a 80 6a 13 e1 4f 28 1c f6 a7 68 39 0b 96 1a d3 72 fa 4f b4 84 39 a8 39 93 d7 0a 6c 01 86 83 12 05 db 8d 12 40 73 50 28 68 b7 d1 6c 35 3e 93 be d3 a4 be 1d 3d 6b 53 aa 03 b5 da 1d ce 68 3c d8 61 9c fb 66 a3 7d fd 92 13 55 05 fb 76 25 69 54 f2 ab 6e 48 3f d7 b1 e2 07 e9 f6 f0 7b 25 ca 7b bc ef e8 6c ca e9 95 cb 28 51 22 63 3d 37 af 58 bb 78 c6 59 03 cb e9 cc e4 69 1b f3 1d 66 d8 b7 1f 1b ec 50 dc 7f 79 6e ed fd fe 55 f8 9c 6a 95 d1 84 94 25 85 29 fa 1e f2 d7 50 e1 39 e8 bb d6 b1 fe 74 d5 37 f5 39 dd 45 3b 16 df db ea c4 db 66
                                                  Data Ascii: ~!P?,PmiIgM0:#G`tp75`"&j0kJjO(h9rO99l@sP(hl5>=kSh<af}Uv%iTnH?{%{l(Q"c=7XxYifPynUj%)P9t79E;f
                                                  2024-07-22 10:33:38 UTC1369INData Raw: 23 e0 b4 7e ea 8c b8 ae 0e bc 47 22 fb cf 75 48 c0 7c 81 f1 02 9b 45 9c 11 4c 00 ce 96 a4 c9 f5 77 2b 27 f9 3b 24 a3 59 36 c9 df 2d fe 25 7f f7 d9 d9 7d 45 36 eb 27 ae 0d 2c e0 cc 0f d1 6b 1c 0e af ab 0e 2d 7e a5 bf b8 d2 c0 51 34 54 cd 68 9a 18 73 24 2f a0 d9 ea 88 96 6d 62 0a cf bc 97 44 8b 24 f2 ba bb a3 7a ea e6 41 03 17 ba e7 97 b6 ca ee 4c fc 8e ff de ac 2b 36 02 3a fe 81 db fa 66 df c3 26 e5 49 49 e6 a4 97 75 2e 21 e9 ac bd 7c 71 65 6d d5 63 ec 85 5e 89 5b c7 2f 05 bc f2 3d fe d0 39 d8 1e 76 3b f2 3c 7a 64 77 ae dd 8e 81 be e8 38 a6 6b b5 a3 02 53 6b e5 f7 d9 89 2b ea b0 ad bc fc 2f 7e f8 a6 ab 69 60 e3 8e 82 d7 6f 05 13 f9 de 1b 5d 95 65 c4 38 95 3e 3f 4f e9 e8 32 24 52 4f b2 bb df 1c 6f 94 c8 39 68 98 57 94 5e 6d d2 9c b4 d9 db 59 76 34 a1 b7 5c
                                                  Data Ascii: #~G"uH|ELw+';$Y6-%}E6',k-~Q4Ths$/mbD$zAL+6:f&IIu.!|qemc^[/=9v;<zdw8kSk+/~i`o]e8>?O2$ROo9hW^mYv4\
                                                  2024-07-22 10:33:38 UTC1369INData Raw: ed c5 cb 47 bc 6e 90 c5 42 e7 d7 ce 1a 8e 8b ad 68 27 7f b0 b8 a8 2c ab b8 7a 06 63 96 42 62 a1 b5 5f 82 bd 6f 91 d7 c7 08 79 c3 d7 ae e1 c7 cf 25 9a d8 2e 71 b8 21 ba 1f b7 78 75 cc a0 ff 05 4c 8a d9 c6 57 cd d6 1f 43 bb d3 ae 15 e5 bd 89 52 15 20 be 6e b5 c3 25 9f dd ca a7 fd 34 52 e6 e4 b3 d4 46 83 1e 0d b3 f2 dc 81 07 7e e7 72 50 17 f1 fc bb 22 1b 3f 54 5e b8 6a e6 b5 4a 62 3f 8a 67 f9 1c db 89 74 ef 09 58 91 ce 5f 4c f7 ee 50 16 7a 26 12 93 be 37 5d 1f 6d 31 bb 46 33 60 e5 96 10 97 ff d3 bd 2f d2 3d 76 26 a2 34 1e 99 26 7b 0f cc fe 16 66 ef fc b4 3e ea 18 98 cd 86 0d 27 46 43 a3 24 88 5f 1d cd de 7a a9 86 1f 9d c2 d4 30 b5 77 d2 f0 a3 fa 93 c3 83 59 ea 01 ac 10 78 c9 a7 ee 68 58 4b 8e 84 97 9d f4 36 eb 0d de 1e e9 a0 46 22 e4 3a 80 21 af cc c8 0b 21
                                                  Data Ascii: GnBh',zcBb_oy%.q!xuLWCR n%4RF~rP"?T^jJb?gtX_LPz&7]m1F3`/=v&4&{f>'FC$_z0wYxhXK6F":!!
                                                  2024-07-22 10:33:38 UTC1369INData Raw: 34 c8 8d c8 11 97 28 fd 6e 15 5f da 95 93 67 25 69 2d 23 28 c1 97 eb 42 24 17 f5 8b 88 57 67 2e 3d 83 35 6d 74 6d 98 93 74 33 a2 72 9f 5d 44 e9 ed d6 3b b2 31 2f 1d 09 7d 3e aa 6a 96 df 16 5d 7a 2e 15 37 7c c7 a2 e6 a8 10 b3 39 b4 cb 29 8b 83 59 07 73 d0 64 ee 7d bb 2b eb 1f 7c 41 38 a4 24 00 e6 c0 8f e3 51 13 c1 a0 67 81 ed 15 87 b2 37 53 fc 53 bd 86 28 ca 15 26 79 97 0e c7 fa 24 bd 3b 5e 97 c9 ae 86 d9 55 39 ec 4a 98 5d f6 d7 cc d2 ce d9 89 3b 4b 6d 5d 0b 1d 82 29 d1 1c 26 68 6b 6b 99 12 d5 60 95 b1 59 ce f9 72 96 78 27 7a 38 83 42 c5 db 92 99 2c d0 db 34 98 4e 09 9a 6c c9 3c 3c 10 9a 07 ba 2f 55 97 01 cf 91 12 9d b8 fe c1 30 49 8f a8 b9 f2 13 41 6b 9c 00 47 80 24 eb d3 5d 13 8b 22 6a 80 33 24 30 2e 00 c9 68 05 c0 0f 1a ad e0 84 06 59 28 48 c3 c0 b7 74
                                                  Data Ascii: 4(n_g%i-#(B$Wg.=5mtmt3r]D;1/}>j]z.7|9)Ysd}+|A8$Qg7SS(&y$;^U9J];Km])&hkk`Yrx'z8B,4Nl<</U0IAkG$]"j3$0.hY(Ht


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  4192.168.2.449749104.16.148.1304435436C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:00 UTC86OUTGET /api/v2/url/blacklist HTTP/1.1
                                                  Host: acs.lavasoft.com
                                                  Connection: Keep-Alive
                                                  2024-07-22 10:34:01 UTC324INHTTP/1.1 301 Moved Permanently
                                                  Date: Mon, 22 Jul 2024 10:34:00 GMT
                                                  Content-Length: 0
                                                  Connection: close
                                                  Cache-Control: public
                                                  Cache-Control: max-age=86400
                                                  Location: https://acscdn.lavasoft.com/urlblacklist.json
                                                  api-supported-versions: 2.0
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c6984b0c7274-EWR


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  5192.168.2.449750104.16.149.1304435436C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:01 UTC86OUTGET /urlblacklist.json HTTP/1.1
                                                  Host: acscdn.lavasoft.com
                                                  Connection: Keep-Alive
                                                  2024-07-22 10:34:01 UTC385INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:01 GMT
                                                  Content-Type: application/json
                                                  Content-Length: 201625
                                                  Connection: close
                                                  Last-Modified: Wed, 15 Nov 2023 13:57:17 GMT
                                                  ETag: "6554ce3d-31399"
                                                  CF-Cache-Status: HIT
                                                  Age: 62158
                                                  Expires: Tue, 23 Jul 2024 06:34:01 GMT
                                                  Cache-Control: public, max-age=72000
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c6a129dd5e68-EWR
                                                  2024-07-22 10:34:01 UTC984INData Raw: 5b 22 6c 61 69 7a 68 65 6e 67 73 6c 74 2e 63 6e 22 2c 22 6d 79 74 6f 6f 6c 7a 2e 6e 65 74 22 2c 22 70 72 6f 74 65 63 74 32 34 37 2e 6f 6e 6c 69 6e 65 22 2c 22 78 78 6c 61 73 74 2e 63 6f 6d 22 2c 22 77 6f 72 6c 64 73 61 6e 61 6c 79 74 69 63 73 2e 63 6f 6d 22 2c 22 73 6b 69 6c 6c 74 72 61 6e 73 66 6f 72 6d 2e 63 6f 2e 69 6e 22 2c 22 6c 65 6c 61 65 72 2e 63 6f 6d 22 2c 22 6a 70 6f 70 73 69 6e 67 6c 65 73 2e 65 75 22 2c 22 72 69 73 71 75 65 67 61 6c 6b 78 2e 63 6f 6d 22 2c 22 73 76 65 74 76 79 68 6f 64 2e 73 6b 22 2c 22 6d 6f 76 69 65 63 72 75 6d 62 73 2e 6e 65 74 22 2c 22 70 68 72 61 62 75 2e 67 6f 2e 74 68 22 2c 22 6f 6e 6c 79 69 6e 64 69 61 6e 78 2e 63 63 22 2c 22 69 6b 69 73 73 2e 6f 6e 6c 69 6e 65 22 2c 22 75 72 65 77 73 61 77 61 6e 69 2e 61 75 74 6f 73
                                                  Data Ascii: ["laizhengslt.cn","mytoolz.net","protect247.online","xxlast.com","worldsanalytics.com","skilltransform.co.in","lelaer.com","jpopsingles.eu","risquegalkx.com","svetvyhod.sk","moviecrumbs.net","phrabu.go.th","onlyindianx.cc","ikiss.online","urewsawani.autos
                                                  2024-07-22 10:34:01 UTC1369INData Raw: 6b 61 74 6d 6f 76 69 65 68 64 2e 6d 6f 76 22 2c 22 62 6c 75 65 67 61 73 6c 61 6d 70 2e 6f 72 67 22 2c 22 64 72 61 67 67 65 64 6c 69 6e 65 2e 6f 72 67 22 2c 22 67 68 35 79 73 33 67 72 79 35 64 35 33 32 2e 78 79 7a 22 2c 22 6b 61 61 6d 75 75 2e 6f 72 67 22 2c 22 73 61 6f 6d 61 32 32 30 2e 78 79 7a 22 2c 22 6c 69 76 65 74 76 33 36 35 2e 6d 65 22 2c 22 70 69 73 69 2e 70 69 63 73 22 2c 22 76 61 6c 75 65 2d 6c 69 66 65 2e 78 79 7a 22 2c 22 72 69 64 6f 6d 6f 76 69 65 73 2e 74 76 22 2c 22 70 68 69 6c 77 69 6e 2e 70 68 22 2c 22 61 64 6d 69 72 61 6c 73 68 69 70 70 69 6e 67 2e 63 6f 6d 22 2c 22 66 72 65 65 74 6f 6f 6c 6f 6e 6c 69 6e 65 2e 63 6f 6d 22 2c 22 76 69 74 61 6c 61 6d 73 65 65 2e 63 6f 6d 22 2c 22 6f 72 69 67 6c 6e 61 6c 64 61 74 65 2e 63 6f 6d 22 2c 22 72
                                                  Data Ascii: katmoviehd.mov","bluegaslamp.org","draggedline.org","gh5ys3gry5d532.xyz","kaamuu.org","saoma220.xyz","livetv365.me","pisi.pics","value-life.xyz","ridomovies.tv","philwin.ph","admiralshipping.com","freetoolonline.com","vitalamsee.com","origlnaldate.com","r
                                                  2024-07-22 10:34:01 UTC1369INData Raw: 79 2e 63 6f 6d 22 2c 22 61 69 73 68 6f 72 74 2e 74 6f 70 22 2c 22 70 72 6f 6d 6c 61 7a 65 72 2e 72 75 22 2c 22 6c 65 66 74 62 69 6c 6c 2e 74 6f 70 22 2c 22 75 70 73 63 61 72 72 69 61 67 65 70 61 79 6d 65 6e 74 2e 63 6f 6d 22 2c 22 69 6e 76 65 73 74 6c 69 65 2e 63 6f 6d 22 2c 22 74 35 2d 77 69 6b 69 2e 64 65 22 2c 22 66 72 65 65 73 6f 66 74 72 75 73 2e 72 75 22 2c 22 70 61 70 73 74 72 65 61 6d 2e 63 6c 75 62 22 2c 22 77 6f 72 6c 64 6e 65 77 73 2d 32 34 2e 63 6f 6d 22 2c 22 65 6e 73 74 72 65 61 6d 2e 74 6f 70 22 2c 22 73 6f 72 63 65 72 65 72 6f 66 74 65 61 2e 63 6f 6d 22 2c 22 6d 79 63 6c 69 63 6b 2d 32 2e 63 6f 6d 22 2c 22 6c 65 6c 69 65 7a 6f 72 67 67 72 6f 65 70 2e 6e 6c 22 2c 22 6d 75 61 74 68 65 6e 67 61 79 2e 63 6f 6d 22 2c 22 78 6e 2d 2d 38 30 61 63
                                                  Data Ascii: y.com","aishort.top","promlazer.ru","leftbill.top","upscarriagepayment.com","investlie.com","t5-wiki.de","freesoftrus.ru","papstream.club","worldnews-24.com","enstream.top","sorcereroftea.com","myclick-2.com","leliezorggroep.nl","muathengay.com","xn--80ac
                                                  2024-07-22 10:34:01 UTC1369INData Raw: 64 65 2e 6c 69 66 65 22 2c 22 67 30 66 2e 63 6e 22 2c 22 65 73 75 6e 32 31 2e 63 6e 22 2c 22 62 61 6f 66 65 6e 67 6a 69 68 75 6f 2e 63 6f 6d 22 2c 22 6b 65 79 67 65 6e 73 2e 70 72 6f 22 2c 22 63 68 61 72 6d 61 6e 74 65 73 76 6f 69 73 69 6e 65 73 6d 75 72 65 73 2e 63 6f 6d 22 2c 22 76 69 61 74 72 69 73 2d 65 2d 63 68 61 6e 6e 65 6c 2e 63 6f 6d 22 2c 22 73 68 6f 72 74 6c 79 61 6d 75 73 65 6d 65 6e 74 2e 63 6f 6d 22 2c 22 32 31 39 32 39 2e 72 75 22 2c 22 67 65 74 6d 61 63 6b 65 65 70 65 72 73 6f 66 74 70 72 6f 2e 78 79 7a 22 2c 22 74 68 65 73 79 6e 74 68 65 73 69 73 2e 61 70 70 22 2c 22 63 75 74 69 6c 6e 6b 73 2e 63 6f 6d 22 2c 22 61 75 74 6f 62 69 6b 65 72 73 2e 78 79 7a 22 2c 22 70 69 72 61 74 65 2d 70 72 6f 78 79 2e 74 6f 70 22 2c 22 34 35 2e 31 34 38 2e
                                                  Data Ascii: de.life","g0f.cn","esun21.cn","baofengjihuo.com","keygens.pro","charmantesvoisinesmures.com","viatris-e-channel.com","shortlyamusement.com","21929.ru","getmackeepersoftpro.xyz","thesynthesis.app","cutilnks.com","autobikers.xyz","pirate-proxy.top","45.148.
                                                  2024-07-22 10:34:01 UTC1369INData Raw: 79 77 70 6a 6b 2e 63 6f 6d 22 2c 22 73 79 6c 76 69 6e 61 6e 6f 72 72 65 79 2e 63 6f 6d 22 2c 22 6c 6f 6e 38 38 2e 74 6f 70 22 2c 22 76 6c 61 65 6b 61 6e 2e 6b 7a 22 2c 22 73 75 70 74 72 61 66 2e 63 6f 6d 22 2c 22 67 65 74 66 6c 69 6b 2e 63 6f 6d 22 2c 22 63 6f 6f 6c 74 72 6b 2e 78 79 7a 22 2c 22 66 6c 69 72 74 74 6f 6d 65 2e 63 6f 6d 22 2c 22 6d 61 73 61 63 2e 73 62 73 22 2c 22 6e 61 69 6c 6d 61 67 61 7a 69 6e 65 2e 6f 6e 6c 69 6e 65 22 2c 22 72 6f 76 32 2e 6e 65 74 22 2c 22 63 61 73 74 6c 65 63 61 70 69 74 61 6c 2e 76 63 22 2c 22 6d 6f 62 69 6c 65 74 6f 72 72 65 6e 74 2e 69 6e 66 6f 22 2c 22 63 77 62 74 69 2e 63 6f 6d 2e 62 72 22 2c 22 70 6f 73 61 64 61 6c 61 72 6f 62 6c 65 64 61 2e 63 6f 6d 22 2c 22 61 6c 6c 75 72 69 6e 67 67 61 6c 67 2e 63 6f 6d 22 2c
                                                  Data Ascii: ywpjk.com","sylvinanorrey.com","lon88.top","vlaekan.kz","suptraf.com","getflik.com","cooltrk.xyz","flirttome.com","masac.sbs","nailmagazine.online","rov2.net","castlecapital.vc","mobiletorrent.info","cwbti.com.br","posadalarobleda.com","alluringgalg.com",
                                                  2024-07-22 10:34:01 UTC1369INData Raw: 2c 22 74 6f 72 69 6f 6c 75 6f 72 2e 63 6f 6d 22 2c 22 63 72 61 63 6b 73 75 72 6c 2e 63 6f 6d 22 2c 22 70 72 79 76 69 74 61 6e 6e 79 61 2e 74 6f 70 22 2c 22 63 68 61 6e 67 62 65 65 72 2e 73 69 74 65 22 2c 22 61 64 6f 6e 73 6f 6e 6c 79 64 2e 78 79 7a 22 2c 22 74 68 65 6d 65 6e 63 6f 64 65 2e 63 6f 6d 22 2c 22 70 65 72 61 74 75 72 61 6e 70 65 64 69 61 2e 69 64 22 2c 22 74 65 6c 75 74 6f 70 69 65 7a 2e 63 6c 75 62 22 2c 22 76 73 67 7a 64 64 6a 2e 63 6f 6d 22 2c 22 61 64 61 70 61 2d 67 72 6f 75 70 2e 63 6f 6d 22 2c 22 73 68 65 65 74 2d 6d 75 73 69 63 2e 78 79 7a 22 2c 22 72 6f 63 6b 68 61 74 74 65 72 2e 63 6f 6d 22 2c 22 63 6f 6e 73 63 69 6f 75 73 6e 65 73 73 71 75 61 69 6e 74 2e 63 6f 6d 22 2c 22 76 61 6c 6c 65 73 76 69 73 69 6f 2e 63 61 74 22 2c 22 63 73 69
                                                  Data Ascii: ,"torioluor.com","cracksurl.com","pryvitannya.top","changbeer.site","adonsonlyd.xyz","themencode.com","peraturanpedia.id","telutopiez.club","vsgzddj.com","adapa-group.com","sheet-music.xyz","rockhatter.com","consciousnessquaint.com","vallesvisio.cat","csi
                                                  2024-07-22 10:34:01 UTC1369INData Raw: 2e 63 6f 6d 2e 75 61 22 2c 22 63 61 6d 61 64 6d 69 6e 2e 72 75 22 2c 22 6a 75 62 74 31 32 2e 78 79 7a 22 2c 22 72 6b 6e 2e 67 6f 76 2e 72 75 22 2c 22 31 32 33 6d 6f 76 69 65 2e 6c 74 64 22 2c 22 64 73 32 2e 63 6c 75 62 22 2c 22 79 6f 6d 73 74 2e 6f 72 67 22 2c 22 73 75 69 62 65 2e 65 64 75 2e 63 6e 22 2c 22 38 78 62 65 74 33 30 30 2e 63 6f 6d 22 2c 22 61 70 70 6c 65 69 64 78 79 2e 74 6f 70 22 2c 22 62 69 6f 6c 61 62 73 68 6f 70 32 34 2e 63 6f 6d 22 2c 22 6d 79 66 69 6c 65 73 74 6f 72 65 2e 63 6f 6d 22 2c 22 6f 72 6b 6c 69 6e 6b 2e 63 6f 6d 22 2c 22 65 78 70 6c 6f 72 72 2e 6e 65 74 22 2c 22 67 6f 74 72 61 63 6b 72 65 64 69 72 65 63 74 2e 63 6f 6d 22 2c 22 6a 61 76 69 65 72 64 65 6c 61 73 65 6e 2e 63 6f 6d 22 2c 22 62 72 69 61 6e 73 73 63 6c 75 62 2e 63 63
                                                  Data Ascii: .com.ua","camadmin.ru","jubt12.xyz","rkn.gov.ru","123movie.ltd","ds2.club","yomst.org","suibe.edu.cn","8xbet300.com","appleidxy.top","biolabshop24.com","myfilestore.com","orklink.com","explorr.net","gotrackredirect.com","javierdelasen.com","brianssclub.cc
                                                  2024-07-22 10:34:01 UTC1369INData Raw: 2c 22 64 69 73 63 6c 6f 73 65 70 72 6f 67 72 61 6d 77 65 64 6e 65 73 64 61 79 2e 63 6f 6d 22 2c 22 6b 69 6e 6f 6e 65 77 73 2e 70 72 6f 22 2c 22 6f 68 6e 79 64 65 6c 69 67 68 74 66 75 6c 64 61 74 65 73 2e 6c 69 66 65 22 2c 22 62 6f 6b 65 70 69 64 2e 62 6f 6e 64 22 2c 22 62 6f 72 69 73 2e 64 65 22 2c 22 6d 75 6e 64 6f 63 69 6e 65 6d 61 74 6f 67 72 61 66 69 63 6f 2e 6e 65 74 22 2c 22 62 65 74 61 63 65 6e 74 61 75 72 69 2e 74 6f 70 22 2c 22 6f 6d 67 6e 6f 74 65 2e 6e 65 74 6c 69 66 79 2e 61 70 70 22 2c 22 67 72 6f 77 6e 75 70 67 61 6c 6f 72 65 2e 6c 69 66 65 22 2c 22 69 6d 70 6f 73 73 69 62 6c 65 6f 66 66 65 72 73 2e 63 6f 6d 22 2c 22 76 6b 73 74 72 65 61 6d 2e 74 6f 70 22 2c 22 68 6f 74 70 72 6f 6d 6f 74 69 6f 6e 73 2e 6f 6e 6c 69 6e 65 22 2c 22 69 6f 2e 6b
                                                  Data Ascii: ,"discloseprogramwednesday.com","kinonews.pro","ohnydelightfuldates.life","bokepid.bond","boris.de","mundocinematografico.net","betacentauri.top","omgnote.netlify.app","grownupgalore.life","impossibleoffers.com","vkstream.top","hotpromotions.online","io.k
                                                  2024-07-22 10:34:01 UTC1369INData Raw: 2e 69 74 22 2c 22 6f 6f 72 63 61 73 65 6c 6c 73 2e 63 6f 6d 22 2c 22 6f 6e 65 64 61 73 68 2e 6e 65 74 22 2c 22 74 70 61 73 2e 72 75 22 2c 22 74 65 6e 69 38 35 73 74 61 62 30 31 64 2e 63 6f 6d 22 2c 22 74 68 6f 73 65 63 61 6e 64 79 2e 63 6f 6d 22 2c 22 6e 69 6c 6b 6e 61 72 66 2e 78 79 7a 22 2c 22 72 65 69 66 65 66 72 61 75 65 6e 2e 63 6f 6d 22 2c 22 72 6f 73 65 33 33 2e 74 6f 70 22 2c 22 73 74 6f 6e 65 61 67 65 70 65 64 69 61 2e 63 6f 6d 22 2c 22 6d 79 70 72 69 76 61 74 65 2e 70 69 63 73 22 2c 22 73 6e 61 70 78 2e 69 6e 66 6f 22 2c 22 67 74 61 75 74 6f 63 6c 69 63 6b 65 72 2e 63 6f 6d 22 2c 22 66 6d 6f 76 69 65 7a 2e 69 6e 66 6f 22 2c 22 63 6f 6d 65 73 68 6f 70 69 6e 67 2e 74 6f 6b 79 6f 22 2c 22 70 65 6c 69 73 78 70 6f 72 6e 6f 2e 6e 65 74 22 2c 22 63 68
                                                  Data Ascii: .it","oorcasells.com","onedash.net","tpas.ru","teni85stab01d.com","thosecandy.com","nilknarf.xyz","reifefrauen.com","rose33.top","stoneagepedia.com","myprivate.pics","snapx.info","gtautoclicker.com","fmoviez.info","comeshoping.tokyo","pelisxporno.net","ch
                                                  2024-07-22 10:34:01 UTC1369INData Raw: 70 74 34 72 75 73 2e 72 75 22 2c 22 6c 69 76 65 64 73 6b 61 74 65 72 61 69 73 69 6e 2e 63 6f 6d 22 2c 22 61 79 65 6a 6f 6d 65 72 2e 74 6f 70 22 2c 22 6e 6a 69 32 30 2e 78 79 7a 22 2c 22 67 61 6c 61 78 79 62 79 63 6f 69 6e 2e 63 6f 6d 22 2c 22 65 73 74 61 69 6c 6f 66 61 73 68 69 6f 6e 2e 63 6f 6d 22 2c 22 61 72 63 68 65 75 72 6f 70 65 2e 69 6e 66 6f 22 2c 22 65 7a 63 67 6f 6a 61 61 6d 67 2e 63 6f 6d 22 2c 22 68 2d 67 65 6e 2e 78 79 7a 22 2c 22 78 6e 2d 2d 39 30 61 61 76 6d 66 69 37 62 31 64 2e 78 79 7a 22 2c 22 6c 69 62 72 6f 73 72 65 63 6f 6d 65 6e 64 61 64 6f 73 73 2e 63 6f 6d 22 2c 22 75 74 69 6c 69 74 79 70 72 65 73 65 6e 74 2e 63 6f 6d 22 2c 22 74 68 65 67 61 6d 65 70 6c 61 79 2e 6c 69 66 65 22 2c 22 61 69 36 38 36 38 2e 74 6f 70 22 2c 22 78 79 63 6c
                                                  Data Ascii: pt4rus.ru","livedskateraisin.com","ayejomer.top","nji20.xyz","galaxybycoin.com","estailofashion.com","archeurope.info","ezcgojaamg.com","h-gen.xyz","xn--90aavmfi7b1d.xyz","librosrecomendadoss.com","utilitypresent.com","thegameplay.life","ai6868.top","xycl


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  6192.168.2.449751104.16.148.1304435436C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:04 UTC71OUTGET /api/v2/url/permanentwhitelist HTTP/1.1
                                                  Host: acs.lavasoft.com
                                                  2024-07-22 10:34:04 UTC333INHTTP/1.1 301 Moved Permanently
                                                  Date: Mon, 22 Jul 2024 10:34:04 GMT
                                                  Content-Length: 0
                                                  Connection: close
                                                  Cache-Control: public
                                                  Cache-Control: max-age=86400
                                                  Location: https://acscdn.lavasoft.com/permanentUrlWhitelist.json
                                                  api-supported-versions: 2.0
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c6b30e738cdc-EWR


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  7192.168.2.449752104.16.149.1304435436C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:05 UTC71OUTGET /permanentUrlWhitelist.json HTTP/1.1
                                                  Host: acscdn.lavasoft.com
                                                  2024-07-22 10:34:05 UTC383INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:05 GMT
                                                  Content-Type: application/json
                                                  Content-Length: 16065
                                                  Connection: close
                                                  Last-Modified: Wed, 15 Nov 2023 13:57:17 GMT
                                                  ETag: "6554ce3d-3ec1"
                                                  CF-Cache-Status: HIT
                                                  Age: 37764
                                                  Expires: Tue, 23 Jul 2024 06:34:05 GMT
                                                  Cache-Control: public, max-age=72000
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c6b7ae06426b-EWR
                                                  2024-07-22 10:34:05 UTC986INData Raw: 5b 22 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 22 2c 20 22 69 6e 73 74 61 67 72 61 6d 2e 63 6f 6d 22 2c 20 22 74 77 69 74 74 65 72 2e 63 6f 6d 22 2c 20 22 67 6f 6f 67 6c 65 2e 63 6f 6d 22 2c 20 22 77 6f 72 64 70 72 65 73 73 2e 6f 72 67 22 2c 20 22 79 6f 75 74 75 62 65 2e 63 6f 6d 22 2c 20 22 6c 69 6e 6b 65 64 69 6e 2e 63 6f 6d 22 2c 20 22 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 22 2c 20 22 70 69 6e 74 65 72 65 73 74 2e 63 6f 6d 22 2c 20 22 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 22 2c 20 22 61 70 70 6c 65 2e 63 6f 6d 22 2c 20 22 61 64 61 77 61 72 65 2e 63 6f 6d 22 2c 20 22 61 76 61 6e 71 75 65 73 74 2e 63 6f 6d 22 2c 20 22 77 65 62 63 6f 6d 70 61 6e 69 6f 6e 2e 63 6f 6d 22 2c 20 22 73 6f 64 61 70 64 66 2e 63 6f 6d 22 2c 20 22 69 6e 70 69 78 69 6f 2e 63 6f 6d
                                                  Data Ascii: ["facebook.com", "instagram.com", "twitter.com", "google.com", "wordpress.org", "youtube.com", "linkedin.com", "cloudflare.com", "pinterest.com", "microsoft.com", "apple.com", "adaware.com", "avanquest.com", "webcompanion.com", "sodapdf.com", "inpixio.com
                                                  2024-07-22 10:34:05 UTC1369INData Raw: 20 22 6e 65 74 77 6f 72 6b 73 6f 6c 75 74 69 6f 6e 73 2e 63 6f 6d 22 2c 20 22 61 6d 61 7a 6f 6e 2e 63 6f 6d 22 2c 20 22 73 68 6f 70 69 66 79 2e 63 6f 6d 22 2c 20 22 64 61 6e 2e 63 6f 6d 22 2c 20 22 62 69 74 2e 6c 79 22 2c 20 22 62 6c 6f 67 73 70 6f 74 2e 63 6f 6d 22 2c 20 22 66 69 6c 65 73 75 73 72 2e 63 6f 6d 22 2c 20 22 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 22 2c 20 22 73 74 61 74 63 6f 75 6e 74 65 72 2e 63 6f 6d 22 2c 20 22 74 75 6d 62 6c 72 2e 63 6f 6d 22 2c 20 22 79 61 6e 64 65 78 2e 72 75 22 2c 20 22 77 61 2e 6d 65 22 2c 20 22 63 70 61 6e 65 6c 2e 6e 65 74 22 2c 20 22 63 70 61 6e 65 6c 2e 63 6f 6d 22 2c 20 22 6a 69 6d 64 6f 2e 63 6f 6d 22 2c 20 22 70 61 79 70 61 6c 2e 63 6f 6d 22 2c 20 22 77 33 2e 6f 72 67 22 2c 20 22 62 6c 75 65 68 6f 73 74 2e 63 6f 6d
                                                  Data Ascii: "networksolutions.com", "amazon.com", "shopify.com", "dan.com", "bit.ly", "blogspot.com", "filesusr.com", "mozilla.org", "statcounter.com", "tumblr.com", "yandex.ru", "wa.me", "cpanel.net", "cpanel.com", "jimdo.com", "paypal.com", "w3.org", "bluehost.com
                                                  2024-07-22 10:34:05 UTC1369INData Raw: 31 61 6e 64 31 2d 65 64 69 74 6f 72 2e 63 6f 6d 22 2c 20 22 6e 67 69 6e 78 2e 6f 72 67 22 2c 20 22 74 72 69 70 61 64 76 69 73 6f 72 2e 63 6f 6d 22 2c 20 22 6d 61 69 6c 63 68 69 6d 70 2e 63 6f 6d 22 2c 20 22 74 72 61 64 65 69 6e 64 69 61 2e 63 6f 6d 22 2c 20 22 77 70 65 6e 67 69 6e 65 2e 63 6f 6d 22 2c 20 22 74 72 75 73 74 70 69 6c 6f 74 2e 63 6f 6d 22 2c 20 22 68 61 74 65 6e 61 2e 6e 65 2e 6a 70 22 2c 20 22 6d 79 73 68 6f 70 69 66 79 2e 63 6f 6d 22 2c 20 22 6f 70 65 6e 73 74 72 65 65 74 6d 61 70 2e 6f 72 67 22 2c 20 22 65 74 73 79 2e 63 6f 6d 22 2c 20 22 69 73 73 75 75 2e 63 6f 6d 22 2c 20 22 74 68 65 6d 65 69 73 6c 65 2e 63 6f 6d 22 2c 20 22 62 65 68 61 6e 63 65 2e 6e 65 74 22 2c 20 22 6e 67 69 6e 78 2e 63 6f 6d 22 2c 20 22 6f 6b 2e 72 75 22 2c 20 22 65
                                                  Data Ascii: 1and1-editor.com", "nginx.org", "tripadvisor.com", "mailchimp.com", "tradeindia.com", "wpengine.com", "trustpilot.com", "hatena.ne.jp", "myshopify.com", "openstreetmap.org", "etsy.com", "issuu.com", "themeisle.com", "behance.net", "nginx.com", "ok.ru", "e
                                                  2024-07-22 10:34:05 UTC1369INData Raw: 73 68 6f 70 2e 63 6f 6d 22 2c 20 22 6d 61 69 6c 63 68 69 2e 6d 70 22 2c 20 22 73 71 75 61 72 65 75 70 2e 63 6f 6d 22 2c 20 22 62 69 67 63 6f 6d 6d 65 72 63 65 2e 63 6f 6d 22 2c 20 22 77 69 6b 69 6d 65 64 69 61 2e 6f 72 67 22 2c 20 22 73 74 72 69 70 65 2e 63 6f 6d 22 2c 20 22 70 61 74 72 65 6f 6e 2e 63 6f 6d 22 2c 20 22 73 6b 79 70 65 2e 63 6f 6d 22 2c 20 22 73 74 75 6d 62 6c 65 75 70 6f 6e 2e 63 6f 6d 22 2c 20 22 73 69 74 65 67 72 6f 75 6e 64 2e 63 6f 6d 22 2c 20 22 74 69 6e 79 75 72 6c 2e 63 6f 6d 22 2c 20 22 6c 69 76 65 63 68 61 74 69 6e 63 2e 63 6f 6d 22 2c 20 22 70 61 79 70 61 6c 2e 6d 65 22 2c 20 22 66 62 2e 6d 65 22 2c 20 22 62 69 6e 67 2e 63 6f 6d 22 2c 20 22 63 61 6c 65 6e 64 6c 79 2e 63 6f 6d 22 2c 20 22 74 65 61 6d 76 69 65 77 65 72 2e 63 6f 6d
                                                  Data Ascii: shop.com", "mailchi.mp", "squareup.com", "bigcommerce.com", "wikimedia.org", "stripe.com", "patreon.com", "skype.com", "stumbleupon.com", "siteground.com", "tinyurl.com", "livechatinc.com", "paypal.me", "fb.me", "bing.com", "calendly.com", "teamviewer.com
                                                  2024-07-22 10:34:05 UTC1369INData Raw: 65 61 64 73 2e 63 6f 6d 22 2c 20 22 67 6f 2e 63 6f 22 2c 20 22 74 65 63 68 63 72 75 6e 63 68 2e 63 6f 6d 22 2c 20 22 6e 69 63 2e 61 74 22 2c 20 22 73 68 69 6e 79 73 74 61 74 2e 63 6f 6d 22 2c 20 22 7a 61 6c 6f 2e 6d 65 22 2c 20 22 6d 61 74 6f 6d 6f 2e 6f 72 67 22 2c 20 22 63 72 79 6f 75 74 63 72 65 61 74 69 6f 6e 73 2e 65 75 22 2c 20 22 68 75 66 66 69 6e 67 74 6f 6e 70 6f 73 74 2e 63 6f 6d 22 2c 20 22 6b 61 6b 61 6f 2e 63 6f 6d 22 2c 20 22 32 32 2e 63 6e 22 2c 20 22 6c 69 74 65 73 70 65 65 64 74 65 63 68 2e 63 6f 6d 22 2c 20 22 62 6c 6f 6f 6d 62 65 72 67 2e 63 6f 6d 22 2c 20 22 75 6e 2e 6f 72 67 22 2c 20 22 63 6c 69 63 6b 66 75 6e 6e 65 6c 73 2e 63 6f 6d 22 2c 20 22 74 68 65 76 65 72 67 65 2e 63 6f 6d 22 2c 20 22 64 72 75 70 61 6c 2e 6f 72 67 22 2c 20 22
                                                  Data Ascii: eads.com", "go.co", "techcrunch.com", "nic.at", "shinystat.com", "zalo.me", "matomo.org", "cryoutcreations.eu", "huffingtonpost.com", "kakao.com", "22.cn", "litespeedtech.com", "bloomberg.com", "un.org", "clickfunnels.com", "theverge.com", "drupal.org", "
                                                  2024-07-22 10:34:05 UTC1369INData Raw: 61 74 69 73 74 61 2e 63 6f 6d 22 2c 20 22 31 32 33 37 37 2e 63 6e 22 2c 20 22 73 6d 61 73 68 62 61 6c 6c 6f 6f 6e 2e 63 6f 6d 22 2c 20 22 73 70 72 69 6e 67 65 72 2e 63 6f 6d 22 2c 20 22 73 74 61 6e 66 6f 72 64 2e 65 64 75 22 2c 20 22 61 69 72 62 6e 62 2e 63 6f 6d 22 2c 20 22 77 68 6f 69 73 2e 63 6f 22 2c 20 22 74 69 6d 65 2e 63 6f 6d 22 2c 20 22 61 63 74 69 76 65 6d 69 6e 64 2e 64 65 22 2c 20 22 67 69 70 68 79 2e 63 6f 6d 22 2c 20 22 6d 61 70 79 2e 63 7a 22 2c 20 22 77 69 6b 69 68 6f 77 2e 63 6f 6d 22 2c 20 22 70 68 70 62 62 2e 63 6f 6d 22 2c 20 22 61 6c 69 62 61 62 61 2e 63 6f 6d 22 2c 20 22 67 6f 6f 67 6c 65 2e 63 61 22 2c 20 22 66 64 61 2e 67 6f 76 22 2c 20 22 37 2d 7a 69 70 2e 6f 72 67 22 2c 20 22 6d 6f 7a 69 6c 6c 61 2e 63 6f 6d 22 2c 20 22 63 61 66
                                                  Data Ascii: atista.com", "12377.cn", "smashballoon.com", "springer.com", "stanford.edu", "airbnb.com", "whois.co", "time.com", "activemind.de", "giphy.com", "mapy.cz", "wikihow.com", "phpbb.com", "alibaba.com", "google.ca", "fda.gov", "7-zip.org", "mozilla.com", "caf
                                                  2024-07-22 10:34:05 UTC1369INData Raw: 2e 6f 72 67 22 2c 20 22 6c 61 74 69 6d 65 73 2e 63 6f 6d 22 2c 20 22 73 6f 75 72 63 65 6d 6f 64 2e 6e 65 74 22 2c 20 22 73 68 6f 70 70 79 2e 67 67 22 2c 20 22 62 6f 6f 74 73 74 72 61 70 64 61 73 68 2e 63 6f 6d 22 2c 20 22 6e 65 74 64 6e 61 2d 73 73 6c 2e 63 6f 6d 22 2c 20 22 69 6e 64 65 70 65 6e 64 65 6e 74 2e 63 6f 2e 75 6b 22 2c 20 22 79 6f 75 6b 75 2e 63 6f 6d 22 2c 20 22 77 6f 77 73 6c 69 64 65 72 2e 63 6f 6d 22 2c 20 22 79 61 64 69 2e 73 6b 22 2c 20 22 73 75 69 74 61 62 6c 65 6e 61 6d 65 73 2e 63 6f 6d 22 2c 20 22 63 73 73 6d 6f 62 61 6e 2e 63 6f 6d 22 2c 20 22 74 72 69 70 61 64 76 69 73 6f 72 2e 69 74 22 2c 20 22 77 77 77 2e 6e 68 73 2e 75 6b 22 2c 20 22 6d 69 70 63 6d 73 2e 63 6f 6d 22 2c 20 22 65 77 65 62 64 65 76 65 6c 6f 70 6d 65 6e 74 2e 63 6f
                                                  Data Ascii: .org", "latimes.com", "sourcemod.net", "shoppy.gg", "bootstrapdash.com", "netdna-ssl.com", "independent.co.uk", "youku.com", "wowslider.com", "yadi.sk", "suitablenames.com", "cssmoban.com", "tripadvisor.it", "www.nhs.uk", "mipcms.com", "ewebdevelopment.co
                                                  2024-07-22 10:34:05 UTC1369INData Raw: 2c 20 22 72 6f 62 6f 74 73 74 78 74 2e 6f 72 67 22 2c 20 22 69 6f 6e 6f 73 2e 66 72 22 2c 20 22 62 6f 72 6c 61 62 73 2e 69 6f 22 2c 20 22 65 76 65 6e 74 62 72 69 74 65 2e 63 6f 2e 75 6b 22 2c 20 22 67 69 74 6c 61 62 2e 63 6f 6d 22 2c 20 22 66 74 2e 63 6f 6d 22 2c 20 22 61 6e 67 69 65 73 6c 69 73 74 2e 63 6f 6d 22 2c 20 22 74 68 65 6d 65 2d 66 75 73 69 6f 6e 2e 63 6f 6d 22 2c 20 22 73 68 75 74 74 65 72 73 74 6f 63 6b 2e 63 6f 6d 22 2c 20 22 63 79 62 65 72 66 6f 6c 6b 73 2e 70 6c 22 2c 20 22 7a 7a 79 69 64 61 2e 6e 65 74 22 2c 20 22 62 6c 6f 67 73 70 6f 74 2e 63 6f 6d 2e 65 73 22 2c 20 22 6d 61 70 71 75 65 73 74 2e 63 6f 6d 22 2c 20 22 68 6f 74 6c 6f 67 2e 72 75 22 2c 20 22 73 62 61 2e 67 6f 76 22 2c 20 22 70 65 6f 70 6c 65 2e 63 6f 6d 2e 63 6e 22 2c 20 22
                                                  Data Ascii: , "robotstxt.org", "ionos.fr", "borlabs.io", "eventbrite.co.uk", "gitlab.com", "ft.com", "angieslist.com", "theme-fusion.com", "shutterstock.com", "cyberfolks.pl", "zzyida.net", "blogspot.com.es", "mapquest.com", "hotlog.ru", "sba.gov", "people.com.cn", "
                                                  2024-07-22 10:34:05 UTC1369INData Raw: 22 66 6f 72 74 75 6e 65 2e 63 6f 6d 22 2c 20 22 76 69 61 63 61 6e 61 64 61 6d 65 64 2e 63 6f 6d 22 2c 20 22 66 72 65 73 68 64 65 73 6b 2e 63 6f 6d 22 2c 20 22 75 6b 2e 63 6f 6d 22 2c 20 22 66 72 65 65 6e 6f 64 65 2e 6e 65 74 22 2c 20 22 61 6e 6f 6e 79 6d 69 7a 65 2e 63 6f 6d 22 2c 20 22 62 6c 6f 67 73 70 6f 74 2e 64 65 22 2c 20 22 61 61 72 6f 6e 70 61 72 65 63 6b 69 2e 63 6f 6d 22 2c 20 22 77 61 6c 6d 61 72 74 2e 63 6f 6d 22 2c 20 22 68 65 74 7a 6e 65 72 2e 64 65 22 2c 20 22 70 79 74 68 6f 6e 2e 6f 72 67 22 2c 20 22 72 6b 6e 2e 67 6f 76 2e 72 75 22 2c 20 22 6d 65 74 69 2e 67 6f 2e 6a 70 22 2c 20 22 68 6f 73 74 6e 65 74 2e 6e 6c 22 2c 20 22 65 6e 61 6d 61 64 2e 69 72 22 2c 20 22 62 69 74 6c 79 2e 63 6f 6d 22 2c 20 22 73 65 63 2e 67 6f 76 22 2c 20 22 6f 73
                                                  Data Ascii: "fortune.com", "viacanadamed.com", "freshdesk.com", "uk.com", "freenode.net", "anonymize.com", "blogspot.de", "aaronparecki.com", "walmart.com", "hetzner.de", "python.org", "rkn.gov.ru", "meti.go.jp", "hostnet.nl", "enamad.ir", "bitly.com", "sec.gov", "os
                                                  2024-07-22 10:34:05 UTC1369INData Raw: 70 75 62 2e 63 6f 6d 22 2c 20 22 61 6d 61 7a 6f 6e 2e 63 61 22 2c 20 22 6e 6d 6c 73 63 6f 6e 73 75 6d 65 72 61 63 63 65 73 73 2e 6f 72 67 22 2c 20 22 6d 79 6f 72 64 65 72 62 6f 78 2e 63 6f 6d 22 2c 20 22 73 6b 69 70 74 68 65 64 69 73 68 65 73 2e 63 6f 6d 22 2c 20 22 6e 70 6d 6a 73 2e 63 6f 6d 22 2c 20 22 6a 75 73 74 67 69 76 69 6e 67 2e 63 6f 6d 22 2c 20 22 62 65 66 72 69 65 6e 64 65 72 73 2e 6f 72 67 22 2c 20 22 68 65 69 73 65 2e 64 65 22 2c 20 22 73 70 68 69 6e 78 2d 64 6f 63 2e 6f 72 67 22 2c 20 22 66 6f 72 6d 73 74 61 63 6b 2e 63 6f 6d 22 2c 20 22 68 6f 6d 65 61 64 76 69 73 6f 72 2e 63 6f 6d 22 2c 20 22 62 6f 78 2e 63 6f 6d 22 2c 20 22 6d 75 66 66 69 6e 67 72 6f 75 70 2e 63 6f 6d 22 2c 20 22 61 63 75 69 74 79 73 63 68 65 64 75 6c 69 6e 67 2e 63 6f 6d
                                                  Data Ascii: pub.com", "amazon.ca", "nmlsconsumeraccess.org", "myorderbox.com", "skipthedishes.com", "npmjs.com", "justgiving.com", "befrienders.org", "heise.de", "sphinx-doc.org", "formstack.com", "homeadvisor.com", "box.com", "muffingroup.com", "acuityscheduling.com


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  8192.168.2.449762104.16.149.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:13 UTC180OUTPOST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 364
                                                  Connection: Keep-Alive
                                                  2024-07-22 10:34:13 UTC364OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 45 76 65 6e 74 44 61 74 61 22 3a 22 32 34 68 72 73 22 2c 22 45 76 65 6e 74 4e 61 6d 65 22 3a 22 4d 69 63 72 6f 74 61 72 67 65 74 69 6e 67 54 69 6d 65 72 22 2c 22 42 72 6f 77 73 65 72 4e 61 6d 65 22 3a 22 22 2c 22 53 65 61 72 63 68 45 6e 67 69 6e 65 22 3a 22 22 2c 22 49 6e 73 74 61 6c 6c 44 61 74 65 22 3a 22 32 30 32 34 2d 30 37 2d 32 32 54 30 30 3a 30 30 3a 30 30 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65 2d 31 31 32 38 2d 34 65 36 30 2d 62 65 65 61 2d 32 37 32 30 34 31 64 66 36 34 35 32 22 2c 22 4c 61 6e 67 75 61 67 65 22 3a 22 65 6e 2d 55 53 22 2c 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22
                                                  Data Ascii: {"Data": {"EventData":"24hrs","EventName":"MicrotargetingTimer","BrowserName":"","SearchEngine":"","InstallDate":"2024-07-22T00:00:00","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Language":"en-US","MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698"


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  9192.168.2.449759104.16.149.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:13 UTC180OUTPOST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 364
                                                  Connection: Keep-Alive
                                                  2024-07-22 10:34:13 UTC364OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 45 76 65 6e 74 44 61 74 61 22 3a 22 32 34 68 72 73 22 2c 22 45 76 65 6e 74 4e 61 6d 65 22 3a 22 4d 69 63 72 6f 74 61 72 67 65 74 69 6e 67 54 69 6d 65 72 22 2c 22 42 72 6f 77 73 65 72 4e 61 6d 65 22 3a 22 22 2c 22 53 65 61 72 63 68 45 6e 67 69 6e 65 22 3a 22 22 2c 22 49 6e 73 74 61 6c 6c 44 61 74 65 22 3a 22 32 30 32 34 2d 30 37 2d 32 32 54 30 30 3a 30 30 3a 30 30 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65 2d 31 31 32 38 2d 34 65 36 30 2d 62 65 65 61 2d 32 37 32 30 34 31 64 66 36 34 35 32 22 2c 22 4c 61 6e 67 75 61 67 65 22 3a 22 65 6e 2d 55 53 22 2c 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22
                                                  Data Ascii: {"Data": {"EventData":"24hrs","EventName":"MicrotargetingTimer","BrowserName":"","SearchEngine":"","InstallDate":"2024-07-22T00:00:00","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Language":"en-US","MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698"


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  10192.168.2.449761104.16.148.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:13 UTC86OUTGET /api/v2/url/blacklist HTTP/1.1
                                                  Host: acs.lavasoft.com
                                                  Connection: Keep-Alive
                                                  2024-07-22 10:34:13 UTC324INHTTP/1.1 301 Moved Permanently
                                                  Date: Mon, 22 Jul 2024 10:34:13 GMT
                                                  Content-Length: 0
                                                  Connection: close
                                                  Cache-Control: public
                                                  Cache-Control: max-age=86400
                                                  Location: https://acscdn.lavasoft.com/urlblacklist.json
                                                  api-supported-versions: 2.0
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c6e8090f43f3-EWR


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  11192.168.2.449769104.16.148.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:13 UTC62OUTGET /api/v2/url/blacklist HTTP/1.1
                                                  Host: acs.lavasoft.com


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  12192.168.2.449778104.16.149.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:15 UTC180OUTPOST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 364
                                                  Connection: Keep-Alive
                                                  2024-07-22 10:34:15 UTC364OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 45 76 65 6e 74 44 61 74 61 22 3a 22 32 34 68 72 73 22 2c 22 45 76 65 6e 74 4e 61 6d 65 22 3a 22 4d 69 63 72 6f 74 61 72 67 65 74 69 6e 67 54 69 6d 65 72 22 2c 22 42 72 6f 77 73 65 72 4e 61 6d 65 22 3a 22 22 2c 22 53 65 61 72 63 68 45 6e 67 69 6e 65 22 3a 22 22 2c 22 49 6e 73 74 61 6c 6c 44 61 74 65 22 3a 22 32 30 32 34 2d 30 37 2d 32 32 54 30 30 3a 30 30 3a 30 30 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65 2d 31 31 32 38 2d 34 65 36 30 2d 62 65 65 61 2d 32 37 32 30 34 31 64 66 36 34 35 32 22 2c 22 4c 61 6e 67 75 61 67 65 22 3a 22 65 6e 2d 55 53 22 2c 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22
                                                  Data Ascii: {"Data": {"EventData":"24hrs","EventName":"MicrotargetingTimer","BrowserName":"","SearchEngine":"","InstallDate":"2024-07-22T00:00:00","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Language":"en-US","MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698"
                                                  2024-07-22 10:34:15 UTC479INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:15 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: close
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c6f78a616a57-EWR
                                                  2024-07-22 10:34:15 UTC35INData Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}
                                                  2024-07-22 10:34:15 UTC5INData Raw: 30 0d 0a 0d 0a
                                                  Data Ascii: 0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  13192.168.2.449776104.16.149.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:15 UTC181OUTPOST /v1/event-stat?Type=DownloadError&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 411
                                                  Connection: Keep-Alive
                                                  2024-07-22 10:34:15 UTC411OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 46 69 6c 65 4e 61 6d 65 22 3a 22 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 7a 69 70 22 2c 22 53 74 61 72 74 54 72 69 67 67 65 72 22 3a 22 45 76 65 72 79 32 34 48 6f 75 72 73 52 75 6e 22 2c 22 45 72 72 6f 72 44 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 41 6e 20 65 78 63 65 70 74 69 6f 6e 20 6f 63 63 75 72 72 65 64 20 64 75 72 69 6e 67 20 61 20 57 65 62 43 6c 69 65 6e 74 20 72 65 71 75 65 73 74 2e 22 2c 22 49 6e 73 74 61 6c 6c 44 61 74 65 22 3a 22 32 30 32 34 2d 30 37 2d 32 32 54 30 30 3a 30 30 3a 30 30 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65 2d 31 31 32 38 2d 34 65 36 30 2d 62 65 65 61 2d 32 37 32 30 34 31 64 66 36 34 35 32 22 2c 22 4c 61 6e 67 75 61 67 65 22 3a 22 65 6e 2d 55 53 22 2c 22 4d 61
                                                  Data Ascii: {"Data": {"FileName":"FeatureActions.zip","StartTrigger":"Every24HoursRun","ErrorDescription":"An exception occurred during a WebClient request.","InstallDate":"2024-07-22T00:00:00","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Language":"en-US","Ma
                                                  2024-07-22 10:34:15 UTC479INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:15 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: close
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c6f83a028cc6-EWR
                                                  2024-07-22 10:34:15 UTC35INData Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}
                                                  2024-07-22 10:34:15 UTC5INData Raw: 30 0d 0a 0d 0a
                                                  Data Ascii: 0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  14192.168.2.449781104.16.148.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:15 UTC62OUTGET /api/v2/url/blacklist HTTP/1.1
                                                  Host: acs.lavasoft.com
                                                  2024-07-22 10:34:16 UTC324INHTTP/1.1 301 Moved Permanently
                                                  Date: Mon, 22 Jul 2024 10:34:16 GMT
                                                  Content-Length: 0
                                                  Connection: close
                                                  Cache-Control: public
                                                  Cache-Control: max-age=86400
                                                  Location: https://acscdn.lavasoft.com/urlblacklist.json
                                                  api-supported-versions: 2.0
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c6fa49cc4267-EWR


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  15192.168.2.449783104.16.148.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:16 UTC62OUTGET /api/v2/url/blacklist HTTP/1.1
                                                  Host: acs.lavasoft.com
                                                  2024-07-22 10:34:16 UTC324INHTTP/1.1 301 Moved Permanently
                                                  Date: Mon, 22 Jul 2024 10:34:16 GMT
                                                  Content-Length: 0
                                                  Connection: close
                                                  Cache-Control: public
                                                  Cache-Control: max-age=86400
                                                  Location: https://acscdn.lavasoft.com/urlblacklist.json
                                                  api-supported-versions: 2.0
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c6fcab5519ff-EWR


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  16192.168.2.449784104.16.149.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:16 UTC157OUTPOST /v1/event-stat?Type=DownloadError&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 411
                                                  2024-07-22 10:34:16 UTC411OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 46 69 6c 65 4e 61 6d 65 22 3a 22 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 7a 69 70 22 2c 22 53 74 61 72 74 54 72 69 67 67 65 72 22 3a 22 45 76 65 72 79 32 34 48 6f 75 72 73 52 75 6e 22 2c 22 45 72 72 6f 72 44 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 41 6e 20 65 78 63 65 70 74 69 6f 6e 20 6f 63 63 75 72 72 65 64 20 64 75 72 69 6e 67 20 61 20 57 65 62 43 6c 69 65 6e 74 20 72 65 71 75 65 73 74 2e 22 2c 22 49 6e 73 74 61 6c 6c 44 61 74 65 22 3a 22 32 30 32 34 2d 30 37 2d 32 32 54 30 30 3a 30 30 3a 30 30 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65 2d 31 31 32 38 2d 34 65 36 30 2d 62 65 65 61 2d 32 37 32 30 34 31 64 66 36 34 35 32 22 2c 22 4c 61 6e 67 75 61 67 65 22 3a 22 65 6e 2d 55 53 22 2c 22 4d 61
                                                  Data Ascii: {"Data": {"FileName":"FeatureActions.zip","StartTrigger":"Every24HoursRun","ErrorDescription":"An exception occurred during a WebClient request.","InstallDate":"2024-07-22T00:00:00","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Language":"en-US","Ma


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  17192.168.2.449787104.16.148.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:16 UTC62OUTGET /api/v2/url/blacklist HTTP/1.1
                                                  Host: acs.lavasoft.com
                                                  2024-07-22 10:34:16 UTC324INHTTP/1.1 301 Moved Permanently
                                                  Date: Mon, 22 Jul 2024 10:34:16 GMT
                                                  Content-Length: 0
                                                  Connection: close
                                                  Cache-Control: public
                                                  Cache-Control: max-age=86400
                                                  Location: https://acscdn.lavasoft.com/urlblacklist.json
                                                  api-supported-versions: 2.0
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c6ff9d287cae-EWR


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  18192.168.2.449790104.16.149.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:17 UTC156OUTPOST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 364
                                                  2024-07-22 10:34:17 UTC364OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 45 76 65 6e 74 44 61 74 61 22 3a 22 32 34 68 72 73 22 2c 22 45 76 65 6e 74 4e 61 6d 65 22 3a 22 4d 69 63 72 6f 74 61 72 67 65 74 69 6e 67 54 69 6d 65 72 22 2c 22 42 72 6f 77 73 65 72 4e 61 6d 65 22 3a 22 22 2c 22 53 65 61 72 63 68 45 6e 67 69 6e 65 22 3a 22 22 2c 22 49 6e 73 74 61 6c 6c 44 61 74 65 22 3a 22 32 30 32 34 2d 30 37 2d 32 32 54 30 30 3a 30 30 3a 30 30 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65 2d 31 31 32 38 2d 34 65 36 30 2d 62 65 65 61 2d 32 37 32 30 34 31 64 66 36 34 35 32 22 2c 22 4c 61 6e 67 75 61 67 65 22 3a 22 65 6e 2d 55 53 22 2c 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22
                                                  Data Ascii: {"Data": {"EventData":"24hrs","EventName":"MicrotargetingTimer","BrowserName":"","SearchEngine":"","InstallDate":"2024-07-22T00:00:00","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Language":"en-US","MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698"
                                                  2024-07-22 10:34:17 UTC479INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:17 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: close
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7013dbe19f7-EWR
                                                  2024-07-22 10:34:17 UTC35INData Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}
                                                  2024-07-22 10:34:17 UTC5INData Raw: 30 0d 0a 0d 0a
                                                  Data Ascii: 0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  19192.168.2.449793104.16.148.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:17 UTC62OUTGET /api/v2/url/blacklist HTTP/1.1
                                                  Host: acs.lavasoft.com
                                                  2024-07-22 10:34:17 UTC324INHTTP/1.1 301 Moved Permanently
                                                  Date: Mon, 22 Jul 2024 10:34:17 GMT
                                                  Content-Length: 0
                                                  Connection: close
                                                  Cache-Control: public
                                                  Cache-Control: max-age=86400
                                                  Location: https://acscdn.lavasoft.com/urlblacklist.json
                                                  api-supported-versions: 2.0
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7036a2e7c9f-EWR


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  20192.168.2.449794104.16.149.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:17 UTC86OUTGET /urlblacklist.json HTTP/1.1
                                                  Host: acscdn.lavasoft.com
                                                  Connection: Keep-Alive
                                                  2024-07-22 10:34:17 UTC385INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:17 GMT
                                                  Content-Type: application/json
                                                  Content-Length: 201625
                                                  Connection: close
                                                  Last-Modified: Wed, 15 Nov 2023 13:57:17 GMT
                                                  ETag: "6554ce3d-31399"
                                                  CF-Cache-Status: HIT
                                                  Age: 62174
                                                  Expires: Tue, 23 Jul 2024 06:34:17 GMT
                                                  Cache-Control: public, max-age=72000
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7041bc28cca-EWR
                                                  2024-07-22 10:34:17 UTC984INData Raw: 5b 22 6c 61 69 7a 68 65 6e 67 73 6c 74 2e 63 6e 22 2c 22 6d 79 74 6f 6f 6c 7a 2e 6e 65 74 22 2c 22 70 72 6f 74 65 63 74 32 34 37 2e 6f 6e 6c 69 6e 65 22 2c 22 78 78 6c 61 73 74 2e 63 6f 6d 22 2c 22 77 6f 72 6c 64 73 61 6e 61 6c 79 74 69 63 73 2e 63 6f 6d 22 2c 22 73 6b 69 6c 6c 74 72 61 6e 73 66 6f 72 6d 2e 63 6f 2e 69 6e 22 2c 22 6c 65 6c 61 65 72 2e 63 6f 6d 22 2c 22 6a 70 6f 70 73 69 6e 67 6c 65 73 2e 65 75 22 2c 22 72 69 73 71 75 65 67 61 6c 6b 78 2e 63 6f 6d 22 2c 22 73 76 65 74 76 79 68 6f 64 2e 73 6b 22 2c 22 6d 6f 76 69 65 63 72 75 6d 62 73 2e 6e 65 74 22 2c 22 70 68 72 61 62 75 2e 67 6f 2e 74 68 22 2c 22 6f 6e 6c 79 69 6e 64 69 61 6e 78 2e 63 63 22 2c 22 69 6b 69 73 73 2e 6f 6e 6c 69 6e 65 22 2c 22 75 72 65 77 73 61 77 61 6e 69 2e 61 75 74 6f 73
                                                  Data Ascii: ["laizhengslt.cn","mytoolz.net","protect247.online","xxlast.com","worldsanalytics.com","skilltransform.co.in","lelaer.com","jpopsingles.eu","risquegalkx.com","svetvyhod.sk","moviecrumbs.net","phrabu.go.th","onlyindianx.cc","ikiss.online","urewsawani.autos
                                                  2024-07-22 10:34:17 UTC1369INData Raw: 6b 61 74 6d 6f 76 69 65 68 64 2e 6d 6f 76 22 2c 22 62 6c 75 65 67 61 73 6c 61 6d 70 2e 6f 72 67 22 2c 22 64 72 61 67 67 65 64 6c 69 6e 65 2e 6f 72 67 22 2c 22 67 68 35 79 73 33 67 72 79 35 64 35 33 32 2e 78 79 7a 22 2c 22 6b 61 61 6d 75 75 2e 6f 72 67 22 2c 22 73 61 6f 6d 61 32 32 30 2e 78 79 7a 22 2c 22 6c 69 76 65 74 76 33 36 35 2e 6d 65 22 2c 22 70 69 73 69 2e 70 69 63 73 22 2c 22 76 61 6c 75 65 2d 6c 69 66 65 2e 78 79 7a 22 2c 22 72 69 64 6f 6d 6f 76 69 65 73 2e 74 76 22 2c 22 70 68 69 6c 77 69 6e 2e 70 68 22 2c 22 61 64 6d 69 72 61 6c 73 68 69 70 70 69 6e 67 2e 63 6f 6d 22 2c 22 66 72 65 65 74 6f 6f 6c 6f 6e 6c 69 6e 65 2e 63 6f 6d 22 2c 22 76 69 74 61 6c 61 6d 73 65 65 2e 63 6f 6d 22 2c 22 6f 72 69 67 6c 6e 61 6c 64 61 74 65 2e 63 6f 6d 22 2c 22 72
                                                  Data Ascii: katmoviehd.mov","bluegaslamp.org","draggedline.org","gh5ys3gry5d532.xyz","kaamuu.org","saoma220.xyz","livetv365.me","pisi.pics","value-life.xyz","ridomovies.tv","philwin.ph","admiralshipping.com","freetoolonline.com","vitalamsee.com","origlnaldate.com","r
                                                  2024-07-22 10:34:17 UTC1369INData Raw: 79 2e 63 6f 6d 22 2c 22 61 69 73 68 6f 72 74 2e 74 6f 70 22 2c 22 70 72 6f 6d 6c 61 7a 65 72 2e 72 75 22 2c 22 6c 65 66 74 62 69 6c 6c 2e 74 6f 70 22 2c 22 75 70 73 63 61 72 72 69 61 67 65 70 61 79 6d 65 6e 74 2e 63 6f 6d 22 2c 22 69 6e 76 65 73 74 6c 69 65 2e 63 6f 6d 22 2c 22 74 35 2d 77 69 6b 69 2e 64 65 22 2c 22 66 72 65 65 73 6f 66 74 72 75 73 2e 72 75 22 2c 22 70 61 70 73 74 72 65 61 6d 2e 63 6c 75 62 22 2c 22 77 6f 72 6c 64 6e 65 77 73 2d 32 34 2e 63 6f 6d 22 2c 22 65 6e 73 74 72 65 61 6d 2e 74 6f 70 22 2c 22 73 6f 72 63 65 72 65 72 6f 66 74 65 61 2e 63 6f 6d 22 2c 22 6d 79 63 6c 69 63 6b 2d 32 2e 63 6f 6d 22 2c 22 6c 65 6c 69 65 7a 6f 72 67 67 72 6f 65 70 2e 6e 6c 22 2c 22 6d 75 61 74 68 65 6e 67 61 79 2e 63 6f 6d 22 2c 22 78 6e 2d 2d 38 30 61 63
                                                  Data Ascii: y.com","aishort.top","promlazer.ru","leftbill.top","upscarriagepayment.com","investlie.com","t5-wiki.de","freesoftrus.ru","papstream.club","worldnews-24.com","enstream.top","sorcereroftea.com","myclick-2.com","leliezorggroep.nl","muathengay.com","xn--80ac
                                                  2024-07-22 10:34:17 UTC1369INData Raw: 64 65 2e 6c 69 66 65 22 2c 22 67 30 66 2e 63 6e 22 2c 22 65 73 75 6e 32 31 2e 63 6e 22 2c 22 62 61 6f 66 65 6e 67 6a 69 68 75 6f 2e 63 6f 6d 22 2c 22 6b 65 79 67 65 6e 73 2e 70 72 6f 22 2c 22 63 68 61 72 6d 61 6e 74 65 73 76 6f 69 73 69 6e 65 73 6d 75 72 65 73 2e 63 6f 6d 22 2c 22 76 69 61 74 72 69 73 2d 65 2d 63 68 61 6e 6e 65 6c 2e 63 6f 6d 22 2c 22 73 68 6f 72 74 6c 79 61 6d 75 73 65 6d 65 6e 74 2e 63 6f 6d 22 2c 22 32 31 39 32 39 2e 72 75 22 2c 22 67 65 74 6d 61 63 6b 65 65 70 65 72 73 6f 66 74 70 72 6f 2e 78 79 7a 22 2c 22 74 68 65 73 79 6e 74 68 65 73 69 73 2e 61 70 70 22 2c 22 63 75 74 69 6c 6e 6b 73 2e 63 6f 6d 22 2c 22 61 75 74 6f 62 69 6b 65 72 73 2e 78 79 7a 22 2c 22 70 69 72 61 74 65 2d 70 72 6f 78 79 2e 74 6f 70 22 2c 22 34 35 2e 31 34 38 2e
                                                  Data Ascii: de.life","g0f.cn","esun21.cn","baofengjihuo.com","keygens.pro","charmantesvoisinesmures.com","viatris-e-channel.com","shortlyamusement.com","21929.ru","getmackeepersoftpro.xyz","thesynthesis.app","cutilnks.com","autobikers.xyz","pirate-proxy.top","45.148.
                                                  2024-07-22 10:34:17 UTC1369INData Raw: 79 77 70 6a 6b 2e 63 6f 6d 22 2c 22 73 79 6c 76 69 6e 61 6e 6f 72 72 65 79 2e 63 6f 6d 22 2c 22 6c 6f 6e 38 38 2e 74 6f 70 22 2c 22 76 6c 61 65 6b 61 6e 2e 6b 7a 22 2c 22 73 75 70 74 72 61 66 2e 63 6f 6d 22 2c 22 67 65 74 66 6c 69 6b 2e 63 6f 6d 22 2c 22 63 6f 6f 6c 74 72 6b 2e 78 79 7a 22 2c 22 66 6c 69 72 74 74 6f 6d 65 2e 63 6f 6d 22 2c 22 6d 61 73 61 63 2e 73 62 73 22 2c 22 6e 61 69 6c 6d 61 67 61 7a 69 6e 65 2e 6f 6e 6c 69 6e 65 22 2c 22 72 6f 76 32 2e 6e 65 74 22 2c 22 63 61 73 74 6c 65 63 61 70 69 74 61 6c 2e 76 63 22 2c 22 6d 6f 62 69 6c 65 74 6f 72 72 65 6e 74 2e 69 6e 66 6f 22 2c 22 63 77 62 74 69 2e 63 6f 6d 2e 62 72 22 2c 22 70 6f 73 61 64 61 6c 61 72 6f 62 6c 65 64 61 2e 63 6f 6d 22 2c 22 61 6c 6c 75 72 69 6e 67 67 61 6c 67 2e 63 6f 6d 22 2c
                                                  Data Ascii: ywpjk.com","sylvinanorrey.com","lon88.top","vlaekan.kz","suptraf.com","getflik.com","cooltrk.xyz","flirttome.com","masac.sbs","nailmagazine.online","rov2.net","castlecapital.vc","mobiletorrent.info","cwbti.com.br","posadalarobleda.com","alluringgalg.com",
                                                  2024-07-22 10:34:17 UTC1369INData Raw: 2c 22 74 6f 72 69 6f 6c 75 6f 72 2e 63 6f 6d 22 2c 22 63 72 61 63 6b 73 75 72 6c 2e 63 6f 6d 22 2c 22 70 72 79 76 69 74 61 6e 6e 79 61 2e 74 6f 70 22 2c 22 63 68 61 6e 67 62 65 65 72 2e 73 69 74 65 22 2c 22 61 64 6f 6e 73 6f 6e 6c 79 64 2e 78 79 7a 22 2c 22 74 68 65 6d 65 6e 63 6f 64 65 2e 63 6f 6d 22 2c 22 70 65 72 61 74 75 72 61 6e 70 65 64 69 61 2e 69 64 22 2c 22 74 65 6c 75 74 6f 70 69 65 7a 2e 63 6c 75 62 22 2c 22 76 73 67 7a 64 64 6a 2e 63 6f 6d 22 2c 22 61 64 61 70 61 2d 67 72 6f 75 70 2e 63 6f 6d 22 2c 22 73 68 65 65 74 2d 6d 75 73 69 63 2e 78 79 7a 22 2c 22 72 6f 63 6b 68 61 74 74 65 72 2e 63 6f 6d 22 2c 22 63 6f 6e 73 63 69 6f 75 73 6e 65 73 73 71 75 61 69 6e 74 2e 63 6f 6d 22 2c 22 76 61 6c 6c 65 73 76 69 73 69 6f 2e 63 61 74 22 2c 22 63 73 69
                                                  Data Ascii: ,"torioluor.com","cracksurl.com","pryvitannya.top","changbeer.site","adonsonlyd.xyz","themencode.com","peraturanpedia.id","telutopiez.club","vsgzddj.com","adapa-group.com","sheet-music.xyz","rockhatter.com","consciousnessquaint.com","vallesvisio.cat","csi
                                                  2024-07-22 10:34:17 UTC1369INData Raw: 2e 63 6f 6d 2e 75 61 22 2c 22 63 61 6d 61 64 6d 69 6e 2e 72 75 22 2c 22 6a 75 62 74 31 32 2e 78 79 7a 22 2c 22 72 6b 6e 2e 67 6f 76 2e 72 75 22 2c 22 31 32 33 6d 6f 76 69 65 2e 6c 74 64 22 2c 22 64 73 32 2e 63 6c 75 62 22 2c 22 79 6f 6d 73 74 2e 6f 72 67 22 2c 22 73 75 69 62 65 2e 65 64 75 2e 63 6e 22 2c 22 38 78 62 65 74 33 30 30 2e 63 6f 6d 22 2c 22 61 70 70 6c 65 69 64 78 79 2e 74 6f 70 22 2c 22 62 69 6f 6c 61 62 73 68 6f 70 32 34 2e 63 6f 6d 22 2c 22 6d 79 66 69 6c 65 73 74 6f 72 65 2e 63 6f 6d 22 2c 22 6f 72 6b 6c 69 6e 6b 2e 63 6f 6d 22 2c 22 65 78 70 6c 6f 72 72 2e 6e 65 74 22 2c 22 67 6f 74 72 61 63 6b 72 65 64 69 72 65 63 74 2e 63 6f 6d 22 2c 22 6a 61 76 69 65 72 64 65 6c 61 73 65 6e 2e 63 6f 6d 22 2c 22 62 72 69 61 6e 73 73 63 6c 75 62 2e 63 63
                                                  Data Ascii: .com.ua","camadmin.ru","jubt12.xyz","rkn.gov.ru","123movie.ltd","ds2.club","yomst.org","suibe.edu.cn","8xbet300.com","appleidxy.top","biolabshop24.com","myfilestore.com","orklink.com","explorr.net","gotrackredirect.com","javierdelasen.com","brianssclub.cc
                                                  2024-07-22 10:34:17 UTC1369INData Raw: 2c 22 64 69 73 63 6c 6f 73 65 70 72 6f 67 72 61 6d 77 65 64 6e 65 73 64 61 79 2e 63 6f 6d 22 2c 22 6b 69 6e 6f 6e 65 77 73 2e 70 72 6f 22 2c 22 6f 68 6e 79 64 65 6c 69 67 68 74 66 75 6c 64 61 74 65 73 2e 6c 69 66 65 22 2c 22 62 6f 6b 65 70 69 64 2e 62 6f 6e 64 22 2c 22 62 6f 72 69 73 2e 64 65 22 2c 22 6d 75 6e 64 6f 63 69 6e 65 6d 61 74 6f 67 72 61 66 69 63 6f 2e 6e 65 74 22 2c 22 62 65 74 61 63 65 6e 74 61 75 72 69 2e 74 6f 70 22 2c 22 6f 6d 67 6e 6f 74 65 2e 6e 65 74 6c 69 66 79 2e 61 70 70 22 2c 22 67 72 6f 77 6e 75 70 67 61 6c 6f 72 65 2e 6c 69 66 65 22 2c 22 69 6d 70 6f 73 73 69 62 6c 65 6f 66 66 65 72 73 2e 63 6f 6d 22 2c 22 76 6b 73 74 72 65 61 6d 2e 74 6f 70 22 2c 22 68 6f 74 70 72 6f 6d 6f 74 69 6f 6e 73 2e 6f 6e 6c 69 6e 65 22 2c 22 69 6f 2e 6b
                                                  Data Ascii: ,"discloseprogramwednesday.com","kinonews.pro","ohnydelightfuldates.life","bokepid.bond","boris.de","mundocinematografico.net","betacentauri.top","omgnote.netlify.app","grownupgalore.life","impossibleoffers.com","vkstream.top","hotpromotions.online","io.k
                                                  2024-07-22 10:34:17 UTC1369INData Raw: 2e 69 74 22 2c 22 6f 6f 72 63 61 73 65 6c 6c 73 2e 63 6f 6d 22 2c 22 6f 6e 65 64 61 73 68 2e 6e 65 74 22 2c 22 74 70 61 73 2e 72 75 22 2c 22 74 65 6e 69 38 35 73 74 61 62 30 31 64 2e 63 6f 6d 22 2c 22 74 68 6f 73 65 63 61 6e 64 79 2e 63 6f 6d 22 2c 22 6e 69 6c 6b 6e 61 72 66 2e 78 79 7a 22 2c 22 72 65 69 66 65 66 72 61 75 65 6e 2e 63 6f 6d 22 2c 22 72 6f 73 65 33 33 2e 74 6f 70 22 2c 22 73 74 6f 6e 65 61 67 65 70 65 64 69 61 2e 63 6f 6d 22 2c 22 6d 79 70 72 69 76 61 74 65 2e 70 69 63 73 22 2c 22 73 6e 61 70 78 2e 69 6e 66 6f 22 2c 22 67 74 61 75 74 6f 63 6c 69 63 6b 65 72 2e 63 6f 6d 22 2c 22 66 6d 6f 76 69 65 7a 2e 69 6e 66 6f 22 2c 22 63 6f 6d 65 73 68 6f 70 69 6e 67 2e 74 6f 6b 79 6f 22 2c 22 70 65 6c 69 73 78 70 6f 72 6e 6f 2e 6e 65 74 22 2c 22 63 68
                                                  Data Ascii: .it","oorcasells.com","onedash.net","tpas.ru","teni85stab01d.com","thosecandy.com","nilknarf.xyz","reifefrauen.com","rose33.top","stoneagepedia.com","myprivate.pics","snapx.info","gtautoclicker.com","fmoviez.info","comeshoping.tokyo","pelisxporno.net","ch
                                                  2024-07-22 10:34:17 UTC1369INData Raw: 70 74 34 72 75 73 2e 72 75 22 2c 22 6c 69 76 65 64 73 6b 61 74 65 72 61 69 73 69 6e 2e 63 6f 6d 22 2c 22 61 79 65 6a 6f 6d 65 72 2e 74 6f 70 22 2c 22 6e 6a 69 32 30 2e 78 79 7a 22 2c 22 67 61 6c 61 78 79 62 79 63 6f 69 6e 2e 63 6f 6d 22 2c 22 65 73 74 61 69 6c 6f 66 61 73 68 69 6f 6e 2e 63 6f 6d 22 2c 22 61 72 63 68 65 75 72 6f 70 65 2e 69 6e 66 6f 22 2c 22 65 7a 63 67 6f 6a 61 61 6d 67 2e 63 6f 6d 22 2c 22 68 2d 67 65 6e 2e 78 79 7a 22 2c 22 78 6e 2d 2d 39 30 61 61 76 6d 66 69 37 62 31 64 2e 78 79 7a 22 2c 22 6c 69 62 72 6f 73 72 65 63 6f 6d 65 6e 64 61 64 6f 73 73 2e 63 6f 6d 22 2c 22 75 74 69 6c 69 74 79 70 72 65 73 65 6e 74 2e 63 6f 6d 22 2c 22 74 68 65 67 61 6d 65 70 6c 61 79 2e 6c 69 66 65 22 2c 22 61 69 36 38 36 38 2e 74 6f 70 22 2c 22 78 79 63 6c
                                                  Data Ascii: pt4rus.ru","livedskateraisin.com","ayejomer.top","nji20.xyz","galaxybycoin.com","estailofashion.com","archeurope.info","ezcgojaamg.com","h-gen.xyz","xn--90aavmfi7b1d.xyz","librosrecomendadoss.com","utilitypresent.com","thegameplay.life","ai6868.top","xycl


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  21192.168.2.449795104.16.149.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:17 UTC156OUTPOST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 364
                                                  2024-07-22 10:34:17 UTC364OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 45 76 65 6e 74 44 61 74 61 22 3a 22 32 34 68 72 73 22 2c 22 45 76 65 6e 74 4e 61 6d 65 22 3a 22 4d 69 63 72 6f 74 61 72 67 65 74 69 6e 67 54 69 6d 65 72 22 2c 22 42 72 6f 77 73 65 72 4e 61 6d 65 22 3a 22 22 2c 22 53 65 61 72 63 68 45 6e 67 69 6e 65 22 3a 22 22 2c 22 49 6e 73 74 61 6c 6c 44 61 74 65 22 3a 22 32 30 32 34 2d 30 37 2d 32 32 54 30 30 3a 30 30 3a 30 30 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65 2d 31 31 32 38 2d 34 65 36 30 2d 62 65 65 61 2d 32 37 32 30 34 31 64 66 36 34 35 32 22 2c 22 4c 61 6e 67 75 61 67 65 22 3a 22 65 6e 2d 55 53 22 2c 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22
                                                  Data Ascii: {"Data": {"EventData":"24hrs","EventName":"MicrotargetingTimer","BrowserName":"","SearchEngine":"","InstallDate":"2024-07-22T00:00:00","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Language":"en-US","MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698"
                                                  2024-07-22 10:34:18 UTC479INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:18 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: close
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7060e4a41ff-EWR
                                                  2024-07-22 10:34:18 UTC35INData Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}
                                                  2024-07-22 10:34:18 UTC5INData Raw: 30 0d 0a 0d 0a
                                                  Data Ascii: 0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  22192.168.2.449796104.16.149.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:17 UTC156OUTPOST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 364
                                                  2024-07-22 10:34:17 UTC364OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 45 76 65 6e 74 44 61 74 61 22 3a 22 32 34 68 72 73 22 2c 22 45 76 65 6e 74 4e 61 6d 65 22 3a 22 4d 69 63 72 6f 74 61 72 67 65 74 69 6e 67 54 69 6d 65 72 22 2c 22 42 72 6f 77 73 65 72 4e 61 6d 65 22 3a 22 22 2c 22 53 65 61 72 63 68 45 6e 67 69 6e 65 22 3a 22 22 2c 22 49 6e 73 74 61 6c 6c 44 61 74 65 22 3a 22 32 30 32 34 2d 30 37 2d 32 32 54 30 30 3a 30 30 3a 30 30 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65 2d 31 31 32 38 2d 34 65 36 30 2d 62 65 65 61 2d 32 37 32 30 34 31 64 66 36 34 35 32 22 2c 22 4c 61 6e 67 75 61 67 65 22 3a 22 65 6e 2d 55 53 22 2c 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22
                                                  Data Ascii: {"Data": {"EventData":"24hrs","EventName":"MicrotargetingTimer","BrowserName":"","SearchEngine":"","InstallDate":"2024-07-22T00:00:00","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Language":"en-US","MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698"
                                                  2024-07-22 10:34:18 UTC479INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:18 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: close
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7062eae420b-EWR
                                                  2024-07-22 10:34:18 UTC35INData Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}
                                                  2024-07-22 10:34:18 UTC5INData Raw: 30 0d 0a 0d 0a
                                                  Data Ascii: 0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  23192.168.2.449797104.16.149.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:18 UTC86OUTGET /urlblacklist.json HTTP/1.1
                                                  Host: acscdn.lavasoft.com
                                                  Connection: Keep-Alive
                                                  2024-07-22 10:34:18 UTC385INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:18 GMT
                                                  Content-Type: application/json
                                                  Content-Length: 201625
                                                  Connection: close
                                                  Last-Modified: Wed, 15 Nov 2023 13:57:17 GMT
                                                  ETag: "6554ce3d-31399"
                                                  CF-Cache-Status: HIT
                                                  Age: 62175
                                                  Expires: Tue, 23 Jul 2024 06:34:18 GMT
                                                  Cache-Control: public, max-age=72000
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c707ec054407-EWR
                                                  2024-07-22 10:34:18 UTC984INData Raw: 5b 22 6c 61 69 7a 68 65 6e 67 73 6c 74 2e 63 6e 22 2c 22 6d 79 74 6f 6f 6c 7a 2e 6e 65 74 22 2c 22 70 72 6f 74 65 63 74 32 34 37 2e 6f 6e 6c 69 6e 65 22 2c 22 78 78 6c 61 73 74 2e 63 6f 6d 22 2c 22 77 6f 72 6c 64 73 61 6e 61 6c 79 74 69 63 73 2e 63 6f 6d 22 2c 22 73 6b 69 6c 6c 74 72 61 6e 73 66 6f 72 6d 2e 63 6f 2e 69 6e 22 2c 22 6c 65 6c 61 65 72 2e 63 6f 6d 22 2c 22 6a 70 6f 70 73 69 6e 67 6c 65 73 2e 65 75 22 2c 22 72 69 73 71 75 65 67 61 6c 6b 78 2e 63 6f 6d 22 2c 22 73 76 65 74 76 79 68 6f 64 2e 73 6b 22 2c 22 6d 6f 76 69 65 63 72 75 6d 62 73 2e 6e 65 74 22 2c 22 70 68 72 61 62 75 2e 67 6f 2e 74 68 22 2c 22 6f 6e 6c 79 69 6e 64 69 61 6e 78 2e 63 63 22 2c 22 69 6b 69 73 73 2e 6f 6e 6c 69 6e 65 22 2c 22 75 72 65 77 73 61 77 61 6e 69 2e 61 75 74 6f 73
                                                  Data Ascii: ["laizhengslt.cn","mytoolz.net","protect247.online","xxlast.com","worldsanalytics.com","skilltransform.co.in","lelaer.com","jpopsingles.eu","risquegalkx.com","svetvyhod.sk","moviecrumbs.net","phrabu.go.th","onlyindianx.cc","ikiss.online","urewsawani.autos
                                                  2024-07-22 10:34:18 UTC1369INData Raw: 6b 61 74 6d 6f 76 69 65 68 64 2e 6d 6f 76 22 2c 22 62 6c 75 65 67 61 73 6c 61 6d 70 2e 6f 72 67 22 2c 22 64 72 61 67 67 65 64 6c 69 6e 65 2e 6f 72 67 22 2c 22 67 68 35 79 73 33 67 72 79 35 64 35 33 32 2e 78 79 7a 22 2c 22 6b 61 61 6d 75 75 2e 6f 72 67 22 2c 22 73 61 6f 6d 61 32 32 30 2e 78 79 7a 22 2c 22 6c 69 76 65 74 76 33 36 35 2e 6d 65 22 2c 22 70 69 73 69 2e 70 69 63 73 22 2c 22 76 61 6c 75 65 2d 6c 69 66 65 2e 78 79 7a 22 2c 22 72 69 64 6f 6d 6f 76 69 65 73 2e 74 76 22 2c 22 70 68 69 6c 77 69 6e 2e 70 68 22 2c 22 61 64 6d 69 72 61 6c 73 68 69 70 70 69 6e 67 2e 63 6f 6d 22 2c 22 66 72 65 65 74 6f 6f 6c 6f 6e 6c 69 6e 65 2e 63 6f 6d 22 2c 22 76 69 74 61 6c 61 6d 73 65 65 2e 63 6f 6d 22 2c 22 6f 72 69 67 6c 6e 61 6c 64 61 74 65 2e 63 6f 6d 22 2c 22 72
                                                  Data Ascii: katmoviehd.mov","bluegaslamp.org","draggedline.org","gh5ys3gry5d532.xyz","kaamuu.org","saoma220.xyz","livetv365.me","pisi.pics","value-life.xyz","ridomovies.tv","philwin.ph","admiralshipping.com","freetoolonline.com","vitalamsee.com","origlnaldate.com","r
                                                  2024-07-22 10:34:18 UTC1369INData Raw: 79 2e 63 6f 6d 22 2c 22 61 69 73 68 6f 72 74 2e 74 6f 70 22 2c 22 70 72 6f 6d 6c 61 7a 65 72 2e 72 75 22 2c 22 6c 65 66 74 62 69 6c 6c 2e 74 6f 70 22 2c 22 75 70 73 63 61 72 72 69 61 67 65 70 61 79 6d 65 6e 74 2e 63 6f 6d 22 2c 22 69 6e 76 65 73 74 6c 69 65 2e 63 6f 6d 22 2c 22 74 35 2d 77 69 6b 69 2e 64 65 22 2c 22 66 72 65 65 73 6f 66 74 72 75 73 2e 72 75 22 2c 22 70 61 70 73 74 72 65 61 6d 2e 63 6c 75 62 22 2c 22 77 6f 72 6c 64 6e 65 77 73 2d 32 34 2e 63 6f 6d 22 2c 22 65 6e 73 74 72 65 61 6d 2e 74 6f 70 22 2c 22 73 6f 72 63 65 72 65 72 6f 66 74 65 61 2e 63 6f 6d 22 2c 22 6d 79 63 6c 69 63 6b 2d 32 2e 63 6f 6d 22 2c 22 6c 65 6c 69 65 7a 6f 72 67 67 72 6f 65 70 2e 6e 6c 22 2c 22 6d 75 61 74 68 65 6e 67 61 79 2e 63 6f 6d 22 2c 22 78 6e 2d 2d 38 30 61 63
                                                  Data Ascii: y.com","aishort.top","promlazer.ru","leftbill.top","upscarriagepayment.com","investlie.com","t5-wiki.de","freesoftrus.ru","papstream.club","worldnews-24.com","enstream.top","sorcereroftea.com","myclick-2.com","leliezorggroep.nl","muathengay.com","xn--80ac
                                                  2024-07-22 10:34:18 UTC1369INData Raw: 64 65 2e 6c 69 66 65 22 2c 22 67 30 66 2e 63 6e 22 2c 22 65 73 75 6e 32 31 2e 63 6e 22 2c 22 62 61 6f 66 65 6e 67 6a 69 68 75 6f 2e 63 6f 6d 22 2c 22 6b 65 79 67 65 6e 73 2e 70 72 6f 22 2c 22 63 68 61 72 6d 61 6e 74 65 73 76 6f 69 73 69 6e 65 73 6d 75 72 65 73 2e 63 6f 6d 22 2c 22 76 69 61 74 72 69 73 2d 65 2d 63 68 61 6e 6e 65 6c 2e 63 6f 6d 22 2c 22 73 68 6f 72 74 6c 79 61 6d 75 73 65 6d 65 6e 74 2e 63 6f 6d 22 2c 22 32 31 39 32 39 2e 72 75 22 2c 22 67 65 74 6d 61 63 6b 65 65 70 65 72 73 6f 66 74 70 72 6f 2e 78 79 7a 22 2c 22 74 68 65 73 79 6e 74 68 65 73 69 73 2e 61 70 70 22 2c 22 63 75 74 69 6c 6e 6b 73 2e 63 6f 6d 22 2c 22 61 75 74 6f 62 69 6b 65 72 73 2e 78 79 7a 22 2c 22 70 69 72 61 74 65 2d 70 72 6f 78 79 2e 74 6f 70 22 2c 22 34 35 2e 31 34 38 2e
                                                  Data Ascii: de.life","g0f.cn","esun21.cn","baofengjihuo.com","keygens.pro","charmantesvoisinesmures.com","viatris-e-channel.com","shortlyamusement.com","21929.ru","getmackeepersoftpro.xyz","thesynthesis.app","cutilnks.com","autobikers.xyz","pirate-proxy.top","45.148.
                                                  2024-07-22 10:34:18 UTC1369INData Raw: 79 77 70 6a 6b 2e 63 6f 6d 22 2c 22 73 79 6c 76 69 6e 61 6e 6f 72 72 65 79 2e 63 6f 6d 22 2c 22 6c 6f 6e 38 38 2e 74 6f 70 22 2c 22 76 6c 61 65 6b 61 6e 2e 6b 7a 22 2c 22 73 75 70 74 72 61 66 2e 63 6f 6d 22 2c 22 67 65 74 66 6c 69 6b 2e 63 6f 6d 22 2c 22 63 6f 6f 6c 74 72 6b 2e 78 79 7a 22 2c 22 66 6c 69 72 74 74 6f 6d 65 2e 63 6f 6d 22 2c 22 6d 61 73 61 63 2e 73 62 73 22 2c 22 6e 61 69 6c 6d 61 67 61 7a 69 6e 65 2e 6f 6e 6c 69 6e 65 22 2c 22 72 6f 76 32 2e 6e 65 74 22 2c 22 63 61 73 74 6c 65 63 61 70 69 74 61 6c 2e 76 63 22 2c 22 6d 6f 62 69 6c 65 74 6f 72 72 65 6e 74 2e 69 6e 66 6f 22 2c 22 63 77 62 74 69 2e 63 6f 6d 2e 62 72 22 2c 22 70 6f 73 61 64 61 6c 61 72 6f 62 6c 65 64 61 2e 63 6f 6d 22 2c 22 61 6c 6c 75 72 69 6e 67 67 61 6c 67 2e 63 6f 6d 22 2c
                                                  Data Ascii: ywpjk.com","sylvinanorrey.com","lon88.top","vlaekan.kz","suptraf.com","getflik.com","cooltrk.xyz","flirttome.com","masac.sbs","nailmagazine.online","rov2.net","castlecapital.vc","mobiletorrent.info","cwbti.com.br","posadalarobleda.com","alluringgalg.com",
                                                  2024-07-22 10:34:18 UTC1369INData Raw: 2c 22 74 6f 72 69 6f 6c 75 6f 72 2e 63 6f 6d 22 2c 22 63 72 61 63 6b 73 75 72 6c 2e 63 6f 6d 22 2c 22 70 72 79 76 69 74 61 6e 6e 79 61 2e 74 6f 70 22 2c 22 63 68 61 6e 67 62 65 65 72 2e 73 69 74 65 22 2c 22 61 64 6f 6e 73 6f 6e 6c 79 64 2e 78 79 7a 22 2c 22 74 68 65 6d 65 6e 63 6f 64 65 2e 63 6f 6d 22 2c 22 70 65 72 61 74 75 72 61 6e 70 65 64 69 61 2e 69 64 22 2c 22 74 65 6c 75 74 6f 70 69 65 7a 2e 63 6c 75 62 22 2c 22 76 73 67 7a 64 64 6a 2e 63 6f 6d 22 2c 22 61 64 61 70 61 2d 67 72 6f 75 70 2e 63 6f 6d 22 2c 22 73 68 65 65 74 2d 6d 75 73 69 63 2e 78 79 7a 22 2c 22 72 6f 63 6b 68 61 74 74 65 72 2e 63 6f 6d 22 2c 22 63 6f 6e 73 63 69 6f 75 73 6e 65 73 73 71 75 61 69 6e 74 2e 63 6f 6d 22 2c 22 76 61 6c 6c 65 73 76 69 73 69 6f 2e 63 61 74 22 2c 22 63 73 69
                                                  Data Ascii: ,"torioluor.com","cracksurl.com","pryvitannya.top","changbeer.site","adonsonlyd.xyz","themencode.com","peraturanpedia.id","telutopiez.club","vsgzddj.com","adapa-group.com","sheet-music.xyz","rockhatter.com","consciousnessquaint.com","vallesvisio.cat","csi
                                                  2024-07-22 10:34:18 UTC1369INData Raw: 2e 63 6f 6d 2e 75 61 22 2c 22 63 61 6d 61 64 6d 69 6e 2e 72 75 22 2c 22 6a 75 62 74 31 32 2e 78 79 7a 22 2c 22 72 6b 6e 2e 67 6f 76 2e 72 75 22 2c 22 31 32 33 6d 6f 76 69 65 2e 6c 74 64 22 2c 22 64 73 32 2e 63 6c 75 62 22 2c 22 79 6f 6d 73 74 2e 6f 72 67 22 2c 22 73 75 69 62 65 2e 65 64 75 2e 63 6e 22 2c 22 38 78 62 65 74 33 30 30 2e 63 6f 6d 22 2c 22 61 70 70 6c 65 69 64 78 79 2e 74 6f 70 22 2c 22 62 69 6f 6c 61 62 73 68 6f 70 32 34 2e 63 6f 6d 22 2c 22 6d 79 66 69 6c 65 73 74 6f 72 65 2e 63 6f 6d 22 2c 22 6f 72 6b 6c 69 6e 6b 2e 63 6f 6d 22 2c 22 65 78 70 6c 6f 72 72 2e 6e 65 74 22 2c 22 67 6f 74 72 61 63 6b 72 65 64 69 72 65 63 74 2e 63 6f 6d 22 2c 22 6a 61 76 69 65 72 64 65 6c 61 73 65 6e 2e 63 6f 6d 22 2c 22 62 72 69 61 6e 73 73 63 6c 75 62 2e 63 63
                                                  Data Ascii: .com.ua","camadmin.ru","jubt12.xyz","rkn.gov.ru","123movie.ltd","ds2.club","yomst.org","suibe.edu.cn","8xbet300.com","appleidxy.top","biolabshop24.com","myfilestore.com","orklink.com","explorr.net","gotrackredirect.com","javierdelasen.com","brianssclub.cc
                                                  2024-07-22 10:34:18 UTC1369INData Raw: 2c 22 64 69 73 63 6c 6f 73 65 70 72 6f 67 72 61 6d 77 65 64 6e 65 73 64 61 79 2e 63 6f 6d 22 2c 22 6b 69 6e 6f 6e 65 77 73 2e 70 72 6f 22 2c 22 6f 68 6e 79 64 65 6c 69 67 68 74 66 75 6c 64 61 74 65 73 2e 6c 69 66 65 22 2c 22 62 6f 6b 65 70 69 64 2e 62 6f 6e 64 22 2c 22 62 6f 72 69 73 2e 64 65 22 2c 22 6d 75 6e 64 6f 63 69 6e 65 6d 61 74 6f 67 72 61 66 69 63 6f 2e 6e 65 74 22 2c 22 62 65 74 61 63 65 6e 74 61 75 72 69 2e 74 6f 70 22 2c 22 6f 6d 67 6e 6f 74 65 2e 6e 65 74 6c 69 66 79 2e 61 70 70 22 2c 22 67 72 6f 77 6e 75 70 67 61 6c 6f 72 65 2e 6c 69 66 65 22 2c 22 69 6d 70 6f 73 73 69 62 6c 65 6f 66 66 65 72 73 2e 63 6f 6d 22 2c 22 76 6b 73 74 72 65 61 6d 2e 74 6f 70 22 2c 22 68 6f 74 70 72 6f 6d 6f 74 69 6f 6e 73 2e 6f 6e 6c 69 6e 65 22 2c 22 69 6f 2e 6b
                                                  Data Ascii: ,"discloseprogramwednesday.com","kinonews.pro","ohnydelightfuldates.life","bokepid.bond","boris.de","mundocinematografico.net","betacentauri.top","omgnote.netlify.app","grownupgalore.life","impossibleoffers.com","vkstream.top","hotpromotions.online","io.k
                                                  2024-07-22 10:34:18 UTC1369INData Raw: 2e 69 74 22 2c 22 6f 6f 72 63 61 73 65 6c 6c 73 2e 63 6f 6d 22 2c 22 6f 6e 65 64 61 73 68 2e 6e 65 74 22 2c 22 74 70 61 73 2e 72 75 22 2c 22 74 65 6e 69 38 35 73 74 61 62 30 31 64 2e 63 6f 6d 22 2c 22 74 68 6f 73 65 63 61 6e 64 79 2e 63 6f 6d 22 2c 22 6e 69 6c 6b 6e 61 72 66 2e 78 79 7a 22 2c 22 72 65 69 66 65 66 72 61 75 65 6e 2e 63 6f 6d 22 2c 22 72 6f 73 65 33 33 2e 74 6f 70 22 2c 22 73 74 6f 6e 65 61 67 65 70 65 64 69 61 2e 63 6f 6d 22 2c 22 6d 79 70 72 69 76 61 74 65 2e 70 69 63 73 22 2c 22 73 6e 61 70 78 2e 69 6e 66 6f 22 2c 22 67 74 61 75 74 6f 63 6c 69 63 6b 65 72 2e 63 6f 6d 22 2c 22 66 6d 6f 76 69 65 7a 2e 69 6e 66 6f 22 2c 22 63 6f 6d 65 73 68 6f 70 69 6e 67 2e 74 6f 6b 79 6f 22 2c 22 70 65 6c 69 73 78 70 6f 72 6e 6f 2e 6e 65 74 22 2c 22 63 68
                                                  Data Ascii: .it","oorcasells.com","onedash.net","tpas.ru","teni85stab01d.com","thosecandy.com","nilknarf.xyz","reifefrauen.com","rose33.top","stoneagepedia.com","myprivate.pics","snapx.info","gtautoclicker.com","fmoviez.info","comeshoping.tokyo","pelisxporno.net","ch
                                                  2024-07-22 10:34:18 UTC1369INData Raw: 70 74 34 72 75 73 2e 72 75 22 2c 22 6c 69 76 65 64 73 6b 61 74 65 72 61 69 73 69 6e 2e 63 6f 6d 22 2c 22 61 79 65 6a 6f 6d 65 72 2e 74 6f 70 22 2c 22 6e 6a 69 32 30 2e 78 79 7a 22 2c 22 67 61 6c 61 78 79 62 79 63 6f 69 6e 2e 63 6f 6d 22 2c 22 65 73 74 61 69 6c 6f 66 61 73 68 69 6f 6e 2e 63 6f 6d 22 2c 22 61 72 63 68 65 75 72 6f 70 65 2e 69 6e 66 6f 22 2c 22 65 7a 63 67 6f 6a 61 61 6d 67 2e 63 6f 6d 22 2c 22 68 2d 67 65 6e 2e 78 79 7a 22 2c 22 78 6e 2d 2d 39 30 61 61 76 6d 66 69 37 62 31 64 2e 78 79 7a 22 2c 22 6c 69 62 72 6f 73 72 65 63 6f 6d 65 6e 64 61 64 6f 73 73 2e 63 6f 6d 22 2c 22 75 74 69 6c 69 74 79 70 72 65 73 65 6e 74 2e 63 6f 6d 22 2c 22 74 68 65 67 61 6d 65 70 6c 61 79 2e 6c 69 66 65 22 2c 22 61 69 36 38 36 38 2e 74 6f 70 22 2c 22 78 79 63 6c
                                                  Data Ascii: pt4rus.ru","livedskateraisin.com","ayejomer.top","nji20.xyz","galaxybycoin.com","estailofashion.com","archeurope.info","ezcgojaamg.com","h-gen.xyz","xn--90aavmfi7b1d.xyz","librosrecomendadoss.com","utilitypresent.com","thegameplay.life","ai6868.top","xycl


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  24192.168.2.449799104.16.149.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:18 UTC156OUTPOST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 364
                                                  2024-07-22 10:34:18 UTC364OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 45 76 65 6e 74 44 61 74 61 22 3a 22 32 34 68 72 73 22 2c 22 45 76 65 6e 74 4e 61 6d 65 22 3a 22 4d 69 63 72 6f 74 61 72 67 65 74 69 6e 67 54 69 6d 65 72 22 2c 22 42 72 6f 77 73 65 72 4e 61 6d 65 22 3a 22 22 2c 22 53 65 61 72 63 68 45 6e 67 69 6e 65 22 3a 22 22 2c 22 49 6e 73 74 61 6c 6c 44 61 74 65 22 3a 22 32 30 32 34 2d 30 37 2d 32 32 54 30 30 3a 30 30 3a 30 30 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65 2d 31 31 32 38 2d 34 65 36 30 2d 62 65 65 61 2d 32 37 32 30 34 31 64 66 36 34 35 32 22 2c 22 4c 61 6e 67 75 61 67 65 22 3a 22 65 6e 2d 55 53 22 2c 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22
                                                  Data Ascii: {"Data": {"EventData":"24hrs","EventName":"MicrotargetingTimer","BrowserName":"","SearchEngine":"","InstallDate":"2024-07-22T00:00:00","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Language":"en-US","MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698"


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  25192.168.2.449801104.16.148.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:20 UTC86OUTGET /api/v2/url/blacklist HTTP/1.1
                                                  Host: acs.lavasoft.com
                                                  Connection: Keep-Alive
                                                  2024-07-22 10:34:21 UTC324INHTTP/1.1 301 Moved Permanently
                                                  Date: Mon, 22 Jul 2024 10:34:20 GMT
                                                  Content-Length: 0
                                                  Connection: close
                                                  Cache-Control: public
                                                  Cache-Control: max-age=86400
                                                  Location: https://acscdn.lavasoft.com/urlblacklist.json
                                                  api-supported-versions: 2.0
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c718dcfcc411-EWR


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  26192.168.2.449804104.16.148.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:22 UTC86OUTGET /api/v2/url/blacklist HTTP/1.1
                                                  Host: acs.lavasoft.com
                                                  Connection: Keep-Alive


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  27192.168.2.449809104.16.148.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:28 UTC95OUTGET /api/v2/url/permanentwhitelist HTTP/1.1
                                                  Host: acs.lavasoft.com
                                                  Connection: Keep-Alive


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  28192.168.2.449811104.16.149.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:28 UTC180OUTPOST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 364
                                                  Connection: Keep-Alive
                                                  2024-07-22 10:34:28 UTC364OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 45 76 65 6e 74 44 61 74 61 22 3a 22 32 34 68 72 73 22 2c 22 45 76 65 6e 74 4e 61 6d 65 22 3a 22 4d 69 63 72 6f 74 61 72 67 65 74 69 6e 67 54 69 6d 65 72 22 2c 22 42 72 6f 77 73 65 72 4e 61 6d 65 22 3a 22 22 2c 22 53 65 61 72 63 68 45 6e 67 69 6e 65 22 3a 22 22 2c 22 49 6e 73 74 61 6c 6c 44 61 74 65 22 3a 22 32 30 32 34 2d 30 37 2d 32 32 54 30 30 3a 30 30 3a 30 30 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65 2d 31 31 32 38 2d 34 65 36 30 2d 62 65 65 61 2d 32 37 32 30 34 31 64 66 36 34 35 32 22 2c 22 4c 61 6e 67 75 61 67 65 22 3a 22 65 6e 2d 55 53 22 2c 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22
                                                  Data Ascii: {"Data": {"EventData":"24hrs","EventName":"MicrotargetingTimer","BrowserName":"","SearchEngine":"","InstallDate":"2024-07-22T00:00:00","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Language":"en-US","MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698"
                                                  2024-07-22 10:34:28 UTC479INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:28 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: close
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c747fc31c443-EWR
                                                  2024-07-22 10:34:28 UTC35INData Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}
                                                  2024-07-22 10:34:28 UTC5INData Raw: 30 0d 0a 0d 0a
                                                  Data Ascii: 0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  29192.168.2.449812104.16.149.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:28 UTC173OUTPOST /v1/event-stat?Type=Error&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 665
                                                  Connection: Keep-Alive
                                                  2024-07-22 10:34:28 UTC665OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 45 78 63 65 70 74 69 6f 6e 22 3a 22 53 79 73 74 65 6d 2e 4e 75 6c 6c 52 65 66 65 72 65 6e 63 65 45 78 63 65 70 74 69 6f 6e 3a 20 4f 62 6a 65 63 74 20 72 65 66 65 72 65 6e 63 65 20 6e 6f 74 20 73 65 74 20 74 6f 20 61 6e 20 69 6e 73 74 61 6e 63 65 20 6f 66 20 61 6e 20 6f 62 6a 65 63 74 2e 5c 72 5c 6e 20 20 20 61 74 20 57 65 62 43 6f 6d 70 61 6e 69 6f 6e 2e 55 49 2e 41 70 70 43 6f 72 65 2e 50 6f 73 74 52 75 6e 2e 46 65 61 74 75 72 65 41 63 74 69 6f 6e 48 65 6c 70 65 72 2e 49 6e 69 74 69 61 6c 69 7a 65 28 4c 69 73 74 60 31 20 63 6f 6d 6d 61 6e 64 4c 69 6e 65 41 72 67 73 2c 20 42 6f 6f 6c 65 61 6e 20 74 69 6d 65 72 2c 20 53 74 72 69 6e 67 20 66 65 61 74 75 72 65 6e 61 6d 65 29 22 2c 22 45 78 63 65 70 74 69 6f 6e 54 79 70 65 22
                                                  Data Ascii: {"Data": {"Exception":"System.NullReferenceException: Object reference not set to an instance of an object.\r\n at WebCompanion.UI.AppCore.PostRun.FeatureActionHelper.Initialize(List`1 commandLineArgs, Boolean timer, String featurename)","ExceptionType"
                                                  2024-07-22 10:34:28 UTC479INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:28 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: close
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c747fae2439a-EWR
                                                  2024-07-22 10:34:28 UTC35INData Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}
                                                  2024-07-22 10:34:28 UTC5INData Raw: 30 0d 0a 0d 0a
                                                  Data Ascii: 0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  30192.168.2.449815104.16.148.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:28 UTC86OUTGET /api/v2/url/blacklist HTTP/1.1
                                                  Host: acs.lavasoft.com
                                                  Connection: Keep-Alive
                                                  2024-07-22 10:34:29 UTC324INHTTP/1.1 301 Moved Permanently
                                                  Date: Mon, 22 Jul 2024 10:34:29 GMT
                                                  Content-Length: 0
                                                  Connection: close
                                                  Cache-Control: public
                                                  Cache-Control: max-age=86400
                                                  Location: https://acscdn.lavasoft.com/urlblacklist.json
                                                  api-supported-versions: 2.0
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c74b6c1f0f39-EWR


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  31192.168.2.449814104.16.148.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:29 UTC86OUTGET /api/v2/url/blacklist HTTP/1.1
                                                  Host: acs.lavasoft.com
                                                  Connection: Keep-Alive
                                                  2024-07-22 10:34:29 UTC324INHTTP/1.1 301 Moved Permanently
                                                  Date: Mon, 22 Jul 2024 10:34:29 GMT
                                                  Content-Length: 0
                                                  Connection: close
                                                  Cache-Control: public
                                                  Cache-Control: max-age=86400
                                                  Location: https://acscdn.lavasoft.com/urlblacklist.json
                                                  api-supported-versions: 2.0
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c74bbf544257-EWR


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  32192.168.2.449842104.16.149.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:30 UTC149OUTPOST /v1/event-stat?Type=Error&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 665
                                                  2024-07-22 10:34:30 UTC665OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 45 78 63 65 70 74 69 6f 6e 22 3a 22 53 79 73 74 65 6d 2e 4e 75 6c 6c 52 65 66 65 72 65 6e 63 65 45 78 63 65 70 74 69 6f 6e 3a 20 4f 62 6a 65 63 74 20 72 65 66 65 72 65 6e 63 65 20 6e 6f 74 20 73 65 74 20 74 6f 20 61 6e 20 69 6e 73 74 61 6e 63 65 20 6f 66 20 61 6e 20 6f 62 6a 65 63 74 2e 5c 72 5c 6e 20 20 20 61 74 20 57 65 62 43 6f 6d 70 61 6e 69 6f 6e 2e 55 49 2e 41 70 70 43 6f 72 65 2e 50 6f 73 74 52 75 6e 2e 46 65 61 74 75 72 65 41 63 74 69 6f 6e 48 65 6c 70 65 72 2e 49 6e 69 74 69 61 6c 69 7a 65 28 4c 69 73 74 60 31 20 63 6f 6d 6d 61 6e 64 4c 69 6e 65 41 72 67 73 2c 20 42 6f 6f 6c 65 61 6e 20 74 69 6d 65 72 2c 20 53 74 72 69 6e 67 20 66 65 61 74 75 72 65 6e 61 6d 65 29 22 2c 22 45 78 63 65 70 74 69 6f 6e 54 79 70 65 22
                                                  Data Ascii: {"Data": {"Exception":"System.NullReferenceException: Object reference not set to an instance of an object.\r\n at WebCompanion.UI.AppCore.PostRun.FeatureActionHelper.Initialize(List`1 commandLineArgs, Boolean timer, String featurename)","ExceptionType"
                                                  2024-07-22 10:34:31 UTC479INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:30 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: close
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c756edd9424a-EWR
                                                  2024-07-22 10:34:31 UTC35INData Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}
                                                  2024-07-22 10:34:31 UTC5INData Raw: 30 0d 0a 0d 0a
                                                  Data Ascii: 0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  33192.168.2.449847104.16.149.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:31 UTC156OUTPOST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 364
                                                  2024-07-22 10:34:31 UTC364OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 45 76 65 6e 74 44 61 74 61 22 3a 22 32 34 68 72 73 22 2c 22 45 76 65 6e 74 4e 61 6d 65 22 3a 22 4d 69 63 72 6f 74 61 72 67 65 74 69 6e 67 54 69 6d 65 72 22 2c 22 42 72 6f 77 73 65 72 4e 61 6d 65 22 3a 22 22 2c 22 53 65 61 72 63 68 45 6e 67 69 6e 65 22 3a 22 22 2c 22 49 6e 73 74 61 6c 6c 44 61 74 65 22 3a 22 32 30 32 34 2d 30 37 2d 32 32 54 30 30 3a 30 30 3a 30 30 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65 2d 31 31 32 38 2d 34 65 36 30 2d 62 65 65 61 2d 32 37 32 30 34 31 64 66 36 34 35 32 22 2c 22 4c 61 6e 67 75 61 67 65 22 3a 22 65 6e 2d 55 53 22 2c 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22
                                                  Data Ascii: {"Data": {"EventData":"24hrs","EventName":"MicrotargetingTimer","BrowserName":"","SearchEngine":"","InstallDate":"2024-07-22T00:00:00","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Language":"en-US","MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698"
                                                  2024-07-22 10:34:31 UTC479INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:31 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: close
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c759dadb41df-EWR
                                                  2024-07-22 10:34:31 UTC35INData Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}
                                                  2024-07-22 10:34:31 UTC5INData Raw: 30 0d 0a 0d 0a
                                                  Data Ascii: 0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  34192.168.2.449848104.16.149.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:31 UTC156OUTPOST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 364
                                                  2024-07-22 10:34:31 UTC364OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 45 76 65 6e 74 44 61 74 61 22 3a 22 32 34 68 72 73 22 2c 22 45 76 65 6e 74 4e 61 6d 65 22 3a 22 4d 69 63 72 6f 74 61 72 67 65 74 69 6e 67 54 69 6d 65 72 22 2c 22 42 72 6f 77 73 65 72 4e 61 6d 65 22 3a 22 22 2c 22 53 65 61 72 63 68 45 6e 67 69 6e 65 22 3a 22 22 2c 22 49 6e 73 74 61 6c 6c 44 61 74 65 22 3a 22 32 30 32 34 2d 30 37 2d 32 32 54 30 30 3a 30 30 3a 30 30 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65 2d 31 31 32 38 2d 34 65 36 30 2d 62 65 65 61 2d 32 37 32 30 34 31 64 66 36 34 35 32 22 2c 22 4c 61 6e 67 75 61 67 65 22 3a 22 65 6e 2d 55 53 22 2c 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22
                                                  Data Ascii: {"Data": {"EventData":"24hrs","EventName":"MicrotargetingTimer","BrowserName":"","SearchEngine":"","InstallDate":"2024-07-22T00:00:00","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Language":"en-US","MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698"
                                                  2024-07-22 10:34:31 UTC479INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:31 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: close
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c75c7bd21906-EWR
                                                  2024-07-22 10:34:31 UTC35INData Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}
                                                  2024-07-22 10:34:31 UTC5INData Raw: 30 0d 0a 0d 0a
                                                  Data Ascii: 0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  35192.168.2.449849104.16.149.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:31 UTC157OUTPOST /v1/event-stat?Type=DownloadError&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 517
                                                  2024-07-22 10:34:31 UTC517OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 46 69 6c 65 4e 61 6d 65 22 3a 22 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 7a 69 70 22 2c 22 53 74 61 72 74 54 72 69 67 67 65 72 22 3a 22 45 76 65 72 79 32 34 48 6f 75 72 73 52 75 6e 22 2c 22 45 72 72 6f 72 44 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 54 68 65 20 70 72 6f 63 65 73 73 20 63 61 6e 6e 6f 74 20 61 63 63 65 73 73 20 74 68 65 20 66 69 6c 65 20 27 43 3a 5c 5c 50 72 6f 67 72 61 6d 44 61 74 61 5c 5c 4c 61 76 61 73 6f 66 74 5c 5c 57 65 62 20 43 6f 6d 70 61 6e 69 6f 6e 5c 5c 4f 70 74 69 6f 6e 73 5c 5c 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 7a 69 70 2e 74 6d 70 27 20 62 65 63 61 75 73 65 20 69 74 20 69 73 20 62 65 69 6e 67 20 75 73 65 64 20 62 79 20 61 6e 6f 74 68 65 72 20 70 72 6f 63 65 73 73 2e 22 2c 22 49 6e
                                                  Data Ascii: {"Data": {"FileName":"FeatureActions.zip","StartTrigger":"Every24HoursRun","ErrorDescription":"The process cannot access the file 'C:\\ProgramData\\Lavasoft\\Web Companion\\Options\\FeatureActions.zip.tmp' because it is being used by another process.","In
                                                  2024-07-22 10:34:32 UTC479INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:32 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: close
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c75e4ee04262-EWR
                                                  2024-07-22 10:34:32 UTC35INData Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}
                                                  2024-07-22 10:34:32 UTC5INData Raw: 30 0d 0a 0d 0a
                                                  Data Ascii: 0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  36192.168.2.449851104.16.148.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:31 UTC86OUTGET /api/v2/url/blacklist HTTP/1.1
                                                  Host: acs.lavasoft.com
                                                  Connection: Keep-Alive
                                                  2024-07-22 10:34:32 UTC324INHTTP/1.1 301 Moved Permanently
                                                  Date: Mon, 22 Jul 2024 10:34:32 GMT
                                                  Content-Length: 0
                                                  Connection: close
                                                  Cache-Control: public
                                                  Cache-Control: max-age=86400
                                                  Location: https://acscdn.lavasoft.com/urlblacklist.json
                                                  api-supported-versions: 2.0
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c75e3f8d41e6-EWR


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  37192.168.2.449850104.16.148.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:32 UTC86OUTGET /api/v2/url/blacklist HTTP/1.1
                                                  Host: acs.lavasoft.com
                                                  Connection: Keep-Alive
                                                  2024-07-22 10:34:32 UTC324INHTTP/1.1 301 Moved Permanently
                                                  Date: Mon, 22 Jul 2024 10:34:32 GMT
                                                  Content-Length: 0
                                                  Connection: close
                                                  Cache-Control: public
                                                  Cache-Control: max-age=86400
                                                  Location: https://acscdn.lavasoft.com/urlblacklist.json
                                                  api-supported-versions: 2.0
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c75edecf8c95-EWR


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  38192.168.2.449853104.16.149.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:32 UTC149OUTPOST /v1/event-stat?Type=Error&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 665
                                                  2024-07-22 10:34:32 UTC665OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 45 78 63 65 70 74 69 6f 6e 22 3a 22 53 79 73 74 65 6d 2e 4e 75 6c 6c 52 65 66 65 72 65 6e 63 65 45 78 63 65 70 74 69 6f 6e 3a 20 4f 62 6a 65 63 74 20 72 65 66 65 72 65 6e 63 65 20 6e 6f 74 20 73 65 74 20 74 6f 20 61 6e 20 69 6e 73 74 61 6e 63 65 20 6f 66 20 61 6e 20 6f 62 6a 65 63 74 2e 5c 72 5c 6e 20 20 20 61 74 20 57 65 62 43 6f 6d 70 61 6e 69 6f 6e 2e 55 49 2e 41 70 70 43 6f 72 65 2e 50 6f 73 74 52 75 6e 2e 46 65 61 74 75 72 65 41 63 74 69 6f 6e 48 65 6c 70 65 72 2e 49 6e 69 74 69 61 6c 69 7a 65 28 4c 69 73 74 60 31 20 63 6f 6d 6d 61 6e 64 4c 69 6e 65 41 72 67 73 2c 20 42 6f 6f 6c 65 61 6e 20 74 69 6d 65 72 2c 20 53 74 72 69 6e 67 20 66 65 61 74 75 72 65 6e 61 6d 65 29 22 2c 22 45 78 63 65 70 74 69 6f 6e 54 79 70 65 22
                                                  Data Ascii: {"Data": {"Exception":"System.NullReferenceException: Object reference not set to an instance of an object.\r\n at WebCompanion.UI.AppCore.PostRun.FeatureActionHelper.Initialize(List`1 commandLineArgs, Boolean timer, String featurename)","ExceptionType"
                                                  2024-07-22 10:34:32 UTC479INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:32 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: close
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7614c227c93-EWR
                                                  2024-07-22 10:34:32 UTC35INData Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}
                                                  2024-07-22 10:34:32 UTC5INData Raw: 30 0d 0a 0d 0a
                                                  Data Ascii: 0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  39192.168.2.449855104.16.148.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:32 UTC62OUTGET /api/v2/url/blacklist HTTP/1.1
                                                  Host: acs.lavasoft.com
                                                  2024-07-22 10:34:33 UTC324INHTTP/1.1 301 Moved Permanently
                                                  Date: Mon, 22 Jul 2024 10:34:33 GMT
                                                  Content-Length: 0
                                                  Connection: close
                                                  Cache-Control: public
                                                  Cache-Control: max-age=86400
                                                  Location: https://acscdn.lavasoft.com/urlblacklist.json
                                                  api-supported-versions: 2.0
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7625ba172b7-EWR


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  40192.168.2.449854104.16.149.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:32 UTC86OUTGET /urlblacklist.json HTTP/1.1
                                                  Host: acscdn.lavasoft.com
                                                  Connection: Keep-Alive
                                                  2024-07-22 10:34:32 UTC385INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:32 GMT
                                                  Content-Type: application/json
                                                  Content-Length: 201625
                                                  Connection: close
                                                  Last-Modified: Wed, 15 Nov 2023 13:57:17 GMT
                                                  ETag: "6554ce3d-31399"
                                                  CF-Cache-Status: HIT
                                                  Age: 62189
                                                  Expires: Tue, 23 Jul 2024 06:34:32 GMT
                                                  Cache-Control: public, max-age=72000
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c762b9144319-EWR
                                                  2024-07-22 10:34:32 UTC984INData Raw: 5b 22 6c 61 69 7a 68 65 6e 67 73 6c 74 2e 63 6e 22 2c 22 6d 79 74 6f 6f 6c 7a 2e 6e 65 74 22 2c 22 70 72 6f 74 65 63 74 32 34 37 2e 6f 6e 6c 69 6e 65 22 2c 22 78 78 6c 61 73 74 2e 63 6f 6d 22 2c 22 77 6f 72 6c 64 73 61 6e 61 6c 79 74 69 63 73 2e 63 6f 6d 22 2c 22 73 6b 69 6c 6c 74 72 61 6e 73 66 6f 72 6d 2e 63 6f 2e 69 6e 22 2c 22 6c 65 6c 61 65 72 2e 63 6f 6d 22 2c 22 6a 70 6f 70 73 69 6e 67 6c 65 73 2e 65 75 22 2c 22 72 69 73 71 75 65 67 61 6c 6b 78 2e 63 6f 6d 22 2c 22 73 76 65 74 76 79 68 6f 64 2e 73 6b 22 2c 22 6d 6f 76 69 65 63 72 75 6d 62 73 2e 6e 65 74 22 2c 22 70 68 72 61 62 75 2e 67 6f 2e 74 68 22 2c 22 6f 6e 6c 79 69 6e 64 69 61 6e 78 2e 63 63 22 2c 22 69 6b 69 73 73 2e 6f 6e 6c 69 6e 65 22 2c 22 75 72 65 77 73 61 77 61 6e 69 2e 61 75 74 6f 73
                                                  Data Ascii: ["laizhengslt.cn","mytoolz.net","protect247.online","xxlast.com","worldsanalytics.com","skilltransform.co.in","lelaer.com","jpopsingles.eu","risquegalkx.com","svetvyhod.sk","moviecrumbs.net","phrabu.go.th","onlyindianx.cc","ikiss.online","urewsawani.autos
                                                  2024-07-22 10:34:32 UTC1369INData Raw: 6b 61 74 6d 6f 76 69 65 68 64 2e 6d 6f 76 22 2c 22 62 6c 75 65 67 61 73 6c 61 6d 70 2e 6f 72 67 22 2c 22 64 72 61 67 67 65 64 6c 69 6e 65 2e 6f 72 67 22 2c 22 67 68 35 79 73 33 67 72 79 35 64 35 33 32 2e 78 79 7a 22 2c 22 6b 61 61 6d 75 75 2e 6f 72 67 22 2c 22 73 61 6f 6d 61 32 32 30 2e 78 79 7a 22 2c 22 6c 69 76 65 74 76 33 36 35 2e 6d 65 22 2c 22 70 69 73 69 2e 70 69 63 73 22 2c 22 76 61 6c 75 65 2d 6c 69 66 65 2e 78 79 7a 22 2c 22 72 69 64 6f 6d 6f 76 69 65 73 2e 74 76 22 2c 22 70 68 69 6c 77 69 6e 2e 70 68 22 2c 22 61 64 6d 69 72 61 6c 73 68 69 70 70 69 6e 67 2e 63 6f 6d 22 2c 22 66 72 65 65 74 6f 6f 6c 6f 6e 6c 69 6e 65 2e 63 6f 6d 22 2c 22 76 69 74 61 6c 61 6d 73 65 65 2e 63 6f 6d 22 2c 22 6f 72 69 67 6c 6e 61 6c 64 61 74 65 2e 63 6f 6d 22 2c 22 72
                                                  Data Ascii: katmoviehd.mov","bluegaslamp.org","draggedline.org","gh5ys3gry5d532.xyz","kaamuu.org","saoma220.xyz","livetv365.me","pisi.pics","value-life.xyz","ridomovies.tv","philwin.ph","admiralshipping.com","freetoolonline.com","vitalamsee.com","origlnaldate.com","r
                                                  2024-07-22 10:34:32 UTC1369INData Raw: 79 2e 63 6f 6d 22 2c 22 61 69 73 68 6f 72 74 2e 74 6f 70 22 2c 22 70 72 6f 6d 6c 61 7a 65 72 2e 72 75 22 2c 22 6c 65 66 74 62 69 6c 6c 2e 74 6f 70 22 2c 22 75 70 73 63 61 72 72 69 61 67 65 70 61 79 6d 65 6e 74 2e 63 6f 6d 22 2c 22 69 6e 76 65 73 74 6c 69 65 2e 63 6f 6d 22 2c 22 74 35 2d 77 69 6b 69 2e 64 65 22 2c 22 66 72 65 65 73 6f 66 74 72 75 73 2e 72 75 22 2c 22 70 61 70 73 74 72 65 61 6d 2e 63 6c 75 62 22 2c 22 77 6f 72 6c 64 6e 65 77 73 2d 32 34 2e 63 6f 6d 22 2c 22 65 6e 73 74 72 65 61 6d 2e 74 6f 70 22 2c 22 73 6f 72 63 65 72 65 72 6f 66 74 65 61 2e 63 6f 6d 22 2c 22 6d 79 63 6c 69 63 6b 2d 32 2e 63 6f 6d 22 2c 22 6c 65 6c 69 65 7a 6f 72 67 67 72 6f 65 70 2e 6e 6c 22 2c 22 6d 75 61 74 68 65 6e 67 61 79 2e 63 6f 6d 22 2c 22 78 6e 2d 2d 38 30 61 63
                                                  Data Ascii: y.com","aishort.top","promlazer.ru","leftbill.top","upscarriagepayment.com","investlie.com","t5-wiki.de","freesoftrus.ru","papstream.club","worldnews-24.com","enstream.top","sorcereroftea.com","myclick-2.com","leliezorggroep.nl","muathengay.com","xn--80ac
                                                  2024-07-22 10:34:32 UTC1369INData Raw: 64 65 2e 6c 69 66 65 22 2c 22 67 30 66 2e 63 6e 22 2c 22 65 73 75 6e 32 31 2e 63 6e 22 2c 22 62 61 6f 66 65 6e 67 6a 69 68 75 6f 2e 63 6f 6d 22 2c 22 6b 65 79 67 65 6e 73 2e 70 72 6f 22 2c 22 63 68 61 72 6d 61 6e 74 65 73 76 6f 69 73 69 6e 65 73 6d 75 72 65 73 2e 63 6f 6d 22 2c 22 76 69 61 74 72 69 73 2d 65 2d 63 68 61 6e 6e 65 6c 2e 63 6f 6d 22 2c 22 73 68 6f 72 74 6c 79 61 6d 75 73 65 6d 65 6e 74 2e 63 6f 6d 22 2c 22 32 31 39 32 39 2e 72 75 22 2c 22 67 65 74 6d 61 63 6b 65 65 70 65 72 73 6f 66 74 70 72 6f 2e 78 79 7a 22 2c 22 74 68 65 73 79 6e 74 68 65 73 69 73 2e 61 70 70 22 2c 22 63 75 74 69 6c 6e 6b 73 2e 63 6f 6d 22 2c 22 61 75 74 6f 62 69 6b 65 72 73 2e 78 79 7a 22 2c 22 70 69 72 61 74 65 2d 70 72 6f 78 79 2e 74 6f 70 22 2c 22 34 35 2e 31 34 38 2e
                                                  Data Ascii: de.life","g0f.cn","esun21.cn","baofengjihuo.com","keygens.pro","charmantesvoisinesmures.com","viatris-e-channel.com","shortlyamusement.com","21929.ru","getmackeepersoftpro.xyz","thesynthesis.app","cutilnks.com","autobikers.xyz","pirate-proxy.top","45.148.
                                                  2024-07-22 10:34:32 UTC1369INData Raw: 79 77 70 6a 6b 2e 63 6f 6d 22 2c 22 73 79 6c 76 69 6e 61 6e 6f 72 72 65 79 2e 63 6f 6d 22 2c 22 6c 6f 6e 38 38 2e 74 6f 70 22 2c 22 76 6c 61 65 6b 61 6e 2e 6b 7a 22 2c 22 73 75 70 74 72 61 66 2e 63 6f 6d 22 2c 22 67 65 74 66 6c 69 6b 2e 63 6f 6d 22 2c 22 63 6f 6f 6c 74 72 6b 2e 78 79 7a 22 2c 22 66 6c 69 72 74 74 6f 6d 65 2e 63 6f 6d 22 2c 22 6d 61 73 61 63 2e 73 62 73 22 2c 22 6e 61 69 6c 6d 61 67 61 7a 69 6e 65 2e 6f 6e 6c 69 6e 65 22 2c 22 72 6f 76 32 2e 6e 65 74 22 2c 22 63 61 73 74 6c 65 63 61 70 69 74 61 6c 2e 76 63 22 2c 22 6d 6f 62 69 6c 65 74 6f 72 72 65 6e 74 2e 69 6e 66 6f 22 2c 22 63 77 62 74 69 2e 63 6f 6d 2e 62 72 22 2c 22 70 6f 73 61 64 61 6c 61 72 6f 62 6c 65 64 61 2e 63 6f 6d 22 2c 22 61 6c 6c 75 72 69 6e 67 67 61 6c 67 2e 63 6f 6d 22 2c
                                                  Data Ascii: ywpjk.com","sylvinanorrey.com","lon88.top","vlaekan.kz","suptraf.com","getflik.com","cooltrk.xyz","flirttome.com","masac.sbs","nailmagazine.online","rov2.net","castlecapital.vc","mobiletorrent.info","cwbti.com.br","posadalarobleda.com","alluringgalg.com",
                                                  2024-07-22 10:34:32 UTC1369INData Raw: 2c 22 74 6f 72 69 6f 6c 75 6f 72 2e 63 6f 6d 22 2c 22 63 72 61 63 6b 73 75 72 6c 2e 63 6f 6d 22 2c 22 70 72 79 76 69 74 61 6e 6e 79 61 2e 74 6f 70 22 2c 22 63 68 61 6e 67 62 65 65 72 2e 73 69 74 65 22 2c 22 61 64 6f 6e 73 6f 6e 6c 79 64 2e 78 79 7a 22 2c 22 74 68 65 6d 65 6e 63 6f 64 65 2e 63 6f 6d 22 2c 22 70 65 72 61 74 75 72 61 6e 70 65 64 69 61 2e 69 64 22 2c 22 74 65 6c 75 74 6f 70 69 65 7a 2e 63 6c 75 62 22 2c 22 76 73 67 7a 64 64 6a 2e 63 6f 6d 22 2c 22 61 64 61 70 61 2d 67 72 6f 75 70 2e 63 6f 6d 22 2c 22 73 68 65 65 74 2d 6d 75 73 69 63 2e 78 79 7a 22 2c 22 72 6f 63 6b 68 61 74 74 65 72 2e 63 6f 6d 22 2c 22 63 6f 6e 73 63 69 6f 75 73 6e 65 73 73 71 75 61 69 6e 74 2e 63 6f 6d 22 2c 22 76 61 6c 6c 65 73 76 69 73 69 6f 2e 63 61 74 22 2c 22 63 73 69
                                                  Data Ascii: ,"torioluor.com","cracksurl.com","pryvitannya.top","changbeer.site","adonsonlyd.xyz","themencode.com","peraturanpedia.id","telutopiez.club","vsgzddj.com","adapa-group.com","sheet-music.xyz","rockhatter.com","consciousnessquaint.com","vallesvisio.cat","csi
                                                  2024-07-22 10:34:32 UTC1369INData Raw: 2e 63 6f 6d 2e 75 61 22 2c 22 63 61 6d 61 64 6d 69 6e 2e 72 75 22 2c 22 6a 75 62 74 31 32 2e 78 79 7a 22 2c 22 72 6b 6e 2e 67 6f 76 2e 72 75 22 2c 22 31 32 33 6d 6f 76 69 65 2e 6c 74 64 22 2c 22 64 73 32 2e 63 6c 75 62 22 2c 22 79 6f 6d 73 74 2e 6f 72 67 22 2c 22 73 75 69 62 65 2e 65 64 75 2e 63 6e 22 2c 22 38 78 62 65 74 33 30 30 2e 63 6f 6d 22 2c 22 61 70 70 6c 65 69 64 78 79 2e 74 6f 70 22 2c 22 62 69 6f 6c 61 62 73 68 6f 70 32 34 2e 63 6f 6d 22 2c 22 6d 79 66 69 6c 65 73 74 6f 72 65 2e 63 6f 6d 22 2c 22 6f 72 6b 6c 69 6e 6b 2e 63 6f 6d 22 2c 22 65 78 70 6c 6f 72 72 2e 6e 65 74 22 2c 22 67 6f 74 72 61 63 6b 72 65 64 69 72 65 63 74 2e 63 6f 6d 22 2c 22 6a 61 76 69 65 72 64 65 6c 61 73 65 6e 2e 63 6f 6d 22 2c 22 62 72 69 61 6e 73 73 63 6c 75 62 2e 63 63
                                                  Data Ascii: .com.ua","camadmin.ru","jubt12.xyz","rkn.gov.ru","123movie.ltd","ds2.club","yomst.org","suibe.edu.cn","8xbet300.com","appleidxy.top","biolabshop24.com","myfilestore.com","orklink.com","explorr.net","gotrackredirect.com","javierdelasen.com","brianssclub.cc
                                                  2024-07-22 10:34:32 UTC1369INData Raw: 2c 22 64 69 73 63 6c 6f 73 65 70 72 6f 67 72 61 6d 77 65 64 6e 65 73 64 61 79 2e 63 6f 6d 22 2c 22 6b 69 6e 6f 6e 65 77 73 2e 70 72 6f 22 2c 22 6f 68 6e 79 64 65 6c 69 67 68 74 66 75 6c 64 61 74 65 73 2e 6c 69 66 65 22 2c 22 62 6f 6b 65 70 69 64 2e 62 6f 6e 64 22 2c 22 62 6f 72 69 73 2e 64 65 22 2c 22 6d 75 6e 64 6f 63 69 6e 65 6d 61 74 6f 67 72 61 66 69 63 6f 2e 6e 65 74 22 2c 22 62 65 74 61 63 65 6e 74 61 75 72 69 2e 74 6f 70 22 2c 22 6f 6d 67 6e 6f 74 65 2e 6e 65 74 6c 69 66 79 2e 61 70 70 22 2c 22 67 72 6f 77 6e 75 70 67 61 6c 6f 72 65 2e 6c 69 66 65 22 2c 22 69 6d 70 6f 73 73 69 62 6c 65 6f 66 66 65 72 73 2e 63 6f 6d 22 2c 22 76 6b 73 74 72 65 61 6d 2e 74 6f 70 22 2c 22 68 6f 74 70 72 6f 6d 6f 74 69 6f 6e 73 2e 6f 6e 6c 69 6e 65 22 2c 22 69 6f 2e 6b
                                                  Data Ascii: ,"discloseprogramwednesday.com","kinonews.pro","ohnydelightfuldates.life","bokepid.bond","boris.de","mundocinematografico.net","betacentauri.top","omgnote.netlify.app","grownupgalore.life","impossibleoffers.com","vkstream.top","hotpromotions.online","io.k
                                                  2024-07-22 10:34:32 UTC1369INData Raw: 2e 69 74 22 2c 22 6f 6f 72 63 61 73 65 6c 6c 73 2e 63 6f 6d 22 2c 22 6f 6e 65 64 61 73 68 2e 6e 65 74 22 2c 22 74 70 61 73 2e 72 75 22 2c 22 74 65 6e 69 38 35 73 74 61 62 30 31 64 2e 63 6f 6d 22 2c 22 74 68 6f 73 65 63 61 6e 64 79 2e 63 6f 6d 22 2c 22 6e 69 6c 6b 6e 61 72 66 2e 78 79 7a 22 2c 22 72 65 69 66 65 66 72 61 75 65 6e 2e 63 6f 6d 22 2c 22 72 6f 73 65 33 33 2e 74 6f 70 22 2c 22 73 74 6f 6e 65 61 67 65 70 65 64 69 61 2e 63 6f 6d 22 2c 22 6d 79 70 72 69 76 61 74 65 2e 70 69 63 73 22 2c 22 73 6e 61 70 78 2e 69 6e 66 6f 22 2c 22 67 74 61 75 74 6f 63 6c 69 63 6b 65 72 2e 63 6f 6d 22 2c 22 66 6d 6f 76 69 65 7a 2e 69 6e 66 6f 22 2c 22 63 6f 6d 65 73 68 6f 70 69 6e 67 2e 74 6f 6b 79 6f 22 2c 22 70 65 6c 69 73 78 70 6f 72 6e 6f 2e 6e 65 74 22 2c 22 63 68
                                                  Data Ascii: .it","oorcasells.com","onedash.net","tpas.ru","teni85stab01d.com","thosecandy.com","nilknarf.xyz","reifefrauen.com","rose33.top","stoneagepedia.com","myprivate.pics","snapx.info","gtautoclicker.com","fmoviez.info","comeshoping.tokyo","pelisxporno.net","ch
                                                  2024-07-22 10:34:32 UTC1369INData Raw: 70 74 34 72 75 73 2e 72 75 22 2c 22 6c 69 76 65 64 73 6b 61 74 65 72 61 69 73 69 6e 2e 63 6f 6d 22 2c 22 61 79 65 6a 6f 6d 65 72 2e 74 6f 70 22 2c 22 6e 6a 69 32 30 2e 78 79 7a 22 2c 22 67 61 6c 61 78 79 62 79 63 6f 69 6e 2e 63 6f 6d 22 2c 22 65 73 74 61 69 6c 6f 66 61 73 68 69 6f 6e 2e 63 6f 6d 22 2c 22 61 72 63 68 65 75 72 6f 70 65 2e 69 6e 66 6f 22 2c 22 65 7a 63 67 6f 6a 61 61 6d 67 2e 63 6f 6d 22 2c 22 68 2d 67 65 6e 2e 78 79 7a 22 2c 22 78 6e 2d 2d 39 30 61 61 76 6d 66 69 37 62 31 64 2e 78 79 7a 22 2c 22 6c 69 62 72 6f 73 72 65 63 6f 6d 65 6e 64 61 64 6f 73 73 2e 63 6f 6d 22 2c 22 75 74 69 6c 69 74 79 70 72 65 73 65 6e 74 2e 63 6f 6d 22 2c 22 74 68 65 67 61 6d 65 70 6c 61 79 2e 6c 69 66 65 22 2c 22 61 69 36 38 36 38 2e 74 6f 70 22 2c 22 78 79 63 6c
                                                  Data Ascii: pt4rus.ru","livedskateraisin.com","ayejomer.top","nji20.xyz","galaxybycoin.com","estailofashion.com","archeurope.info","ezcgojaamg.com","h-gen.xyz","xn--90aavmfi7b1d.xyz","librosrecomendadoss.com","utilitypresent.com","thegameplay.life","ai6868.top","xycl


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  41192.168.2.449856104.16.149.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:32 UTC157OUTPOST /v1/event-stat?Type=DownloadError&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 517
                                                  2024-07-22 10:34:32 UTC517OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 46 69 6c 65 4e 61 6d 65 22 3a 22 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 7a 69 70 22 2c 22 53 74 61 72 74 54 72 69 67 67 65 72 22 3a 22 45 76 65 72 79 32 34 48 6f 75 72 73 52 75 6e 22 2c 22 45 72 72 6f 72 44 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 54 68 65 20 70 72 6f 63 65 73 73 20 63 61 6e 6e 6f 74 20 61 63 63 65 73 73 20 74 68 65 20 66 69 6c 65 20 27 43 3a 5c 5c 50 72 6f 67 72 61 6d 44 61 74 61 5c 5c 4c 61 76 61 73 6f 66 74 5c 5c 57 65 62 20 43 6f 6d 70 61 6e 69 6f 6e 5c 5c 4f 70 74 69 6f 6e 73 5c 5c 46 65 61 74 75 72 65 41 63 74 69 6f 6e 73 2e 7a 69 70 2e 74 6d 70 27 20 62 65 63 61 75 73 65 20 69 74 20 69 73 20 62 65 69 6e 67 20 75 73 65 64 20 62 79 20 61 6e 6f 74 68 65 72 20 70 72 6f 63 65 73 73 2e 22 2c 22 49 6e
                                                  Data Ascii: {"Data": {"FileName":"FeatureActions.zip","StartTrigger":"Every24HoursRun","ErrorDescription":"The process cannot access the file 'C:\\ProgramData\\Lavasoft\\Web Companion\\Options\\FeatureActions.zip.tmp' because it is being used by another process.","In
                                                  2024-07-22 10:34:32 UTC479INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:32 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: close
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c762c8a40f3d-EWR
                                                  2024-07-22 10:34:32 UTC35INData Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}
                                                  2024-07-22 10:34:32 UTC5INData Raw: 30 0d 0a 0d 0a
                                                  Data Ascii: 0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  42192.168.2.449857104.16.149.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:32 UTC86OUTGET /urlblacklist.json HTTP/1.1
                                                  Host: acscdn.lavasoft.com
                                                  Connection: Keep-Alive
                                                  2024-07-22 10:34:32 UTC385INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:32 GMT
                                                  Content-Type: application/json
                                                  Content-Length: 201625
                                                  Connection: close
                                                  Last-Modified: Wed, 15 Nov 2023 13:57:17 GMT
                                                  ETag: "6554ce3d-31399"
                                                  CF-Cache-Status: HIT
                                                  Age: 62189
                                                  Expires: Tue, 23 Jul 2024 06:34:32 GMT
                                                  Cache-Control: public, max-age=72000
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7634b2f4408-EWR
                                                  2024-07-22 10:34:32 UTC984INData Raw: 5b 22 6c 61 69 7a 68 65 6e 67 73 6c 74 2e 63 6e 22 2c 22 6d 79 74 6f 6f 6c 7a 2e 6e 65 74 22 2c 22 70 72 6f 74 65 63 74 32 34 37 2e 6f 6e 6c 69 6e 65 22 2c 22 78 78 6c 61 73 74 2e 63 6f 6d 22 2c 22 77 6f 72 6c 64 73 61 6e 61 6c 79 74 69 63 73 2e 63 6f 6d 22 2c 22 73 6b 69 6c 6c 74 72 61 6e 73 66 6f 72 6d 2e 63 6f 2e 69 6e 22 2c 22 6c 65 6c 61 65 72 2e 63 6f 6d 22 2c 22 6a 70 6f 70 73 69 6e 67 6c 65 73 2e 65 75 22 2c 22 72 69 73 71 75 65 67 61 6c 6b 78 2e 63 6f 6d 22 2c 22 73 76 65 74 76 79 68 6f 64 2e 73 6b 22 2c 22 6d 6f 76 69 65 63 72 75 6d 62 73 2e 6e 65 74 22 2c 22 70 68 72 61 62 75 2e 67 6f 2e 74 68 22 2c 22 6f 6e 6c 79 69 6e 64 69 61 6e 78 2e 63 63 22 2c 22 69 6b 69 73 73 2e 6f 6e 6c 69 6e 65 22 2c 22 75 72 65 77 73 61 77 61 6e 69 2e 61 75 74 6f 73
                                                  Data Ascii: ["laizhengslt.cn","mytoolz.net","protect247.online","xxlast.com","worldsanalytics.com","skilltransform.co.in","lelaer.com","jpopsingles.eu","risquegalkx.com","svetvyhod.sk","moviecrumbs.net","phrabu.go.th","onlyindianx.cc","ikiss.online","urewsawani.autos
                                                  2024-07-22 10:34:32 UTC1369INData Raw: 6b 61 74 6d 6f 76 69 65 68 64 2e 6d 6f 76 22 2c 22 62 6c 75 65 67 61 73 6c 61 6d 70 2e 6f 72 67 22 2c 22 64 72 61 67 67 65 64 6c 69 6e 65 2e 6f 72 67 22 2c 22 67 68 35 79 73 33 67 72 79 35 64 35 33 32 2e 78 79 7a 22 2c 22 6b 61 61 6d 75 75 2e 6f 72 67 22 2c 22 73 61 6f 6d 61 32 32 30 2e 78 79 7a 22 2c 22 6c 69 76 65 74 76 33 36 35 2e 6d 65 22 2c 22 70 69 73 69 2e 70 69 63 73 22 2c 22 76 61 6c 75 65 2d 6c 69 66 65 2e 78 79 7a 22 2c 22 72 69 64 6f 6d 6f 76 69 65 73 2e 74 76 22 2c 22 70 68 69 6c 77 69 6e 2e 70 68 22 2c 22 61 64 6d 69 72 61 6c 73 68 69 70 70 69 6e 67 2e 63 6f 6d 22 2c 22 66 72 65 65 74 6f 6f 6c 6f 6e 6c 69 6e 65 2e 63 6f 6d 22 2c 22 76 69 74 61 6c 61 6d 73 65 65 2e 63 6f 6d 22 2c 22 6f 72 69 67 6c 6e 61 6c 64 61 74 65 2e 63 6f 6d 22 2c 22 72
                                                  Data Ascii: katmoviehd.mov","bluegaslamp.org","draggedline.org","gh5ys3gry5d532.xyz","kaamuu.org","saoma220.xyz","livetv365.me","pisi.pics","value-life.xyz","ridomovies.tv","philwin.ph","admiralshipping.com","freetoolonline.com","vitalamsee.com","origlnaldate.com","r
                                                  2024-07-22 10:34:32 UTC1369INData Raw: 79 2e 63 6f 6d 22 2c 22 61 69 73 68 6f 72 74 2e 74 6f 70 22 2c 22 70 72 6f 6d 6c 61 7a 65 72 2e 72 75 22 2c 22 6c 65 66 74 62 69 6c 6c 2e 74 6f 70 22 2c 22 75 70 73 63 61 72 72 69 61 67 65 70 61 79 6d 65 6e 74 2e 63 6f 6d 22 2c 22 69 6e 76 65 73 74 6c 69 65 2e 63 6f 6d 22 2c 22 74 35 2d 77 69 6b 69 2e 64 65 22 2c 22 66 72 65 65 73 6f 66 74 72 75 73 2e 72 75 22 2c 22 70 61 70 73 74 72 65 61 6d 2e 63 6c 75 62 22 2c 22 77 6f 72 6c 64 6e 65 77 73 2d 32 34 2e 63 6f 6d 22 2c 22 65 6e 73 74 72 65 61 6d 2e 74 6f 70 22 2c 22 73 6f 72 63 65 72 65 72 6f 66 74 65 61 2e 63 6f 6d 22 2c 22 6d 79 63 6c 69 63 6b 2d 32 2e 63 6f 6d 22 2c 22 6c 65 6c 69 65 7a 6f 72 67 67 72 6f 65 70 2e 6e 6c 22 2c 22 6d 75 61 74 68 65 6e 67 61 79 2e 63 6f 6d 22 2c 22 78 6e 2d 2d 38 30 61 63
                                                  Data Ascii: y.com","aishort.top","promlazer.ru","leftbill.top","upscarriagepayment.com","investlie.com","t5-wiki.de","freesoftrus.ru","papstream.club","worldnews-24.com","enstream.top","sorcereroftea.com","myclick-2.com","leliezorggroep.nl","muathengay.com","xn--80ac
                                                  2024-07-22 10:34:32 UTC1369INData Raw: 64 65 2e 6c 69 66 65 22 2c 22 67 30 66 2e 63 6e 22 2c 22 65 73 75 6e 32 31 2e 63 6e 22 2c 22 62 61 6f 66 65 6e 67 6a 69 68 75 6f 2e 63 6f 6d 22 2c 22 6b 65 79 67 65 6e 73 2e 70 72 6f 22 2c 22 63 68 61 72 6d 61 6e 74 65 73 76 6f 69 73 69 6e 65 73 6d 75 72 65 73 2e 63 6f 6d 22 2c 22 76 69 61 74 72 69 73 2d 65 2d 63 68 61 6e 6e 65 6c 2e 63 6f 6d 22 2c 22 73 68 6f 72 74 6c 79 61 6d 75 73 65 6d 65 6e 74 2e 63 6f 6d 22 2c 22 32 31 39 32 39 2e 72 75 22 2c 22 67 65 74 6d 61 63 6b 65 65 70 65 72 73 6f 66 74 70 72 6f 2e 78 79 7a 22 2c 22 74 68 65 73 79 6e 74 68 65 73 69 73 2e 61 70 70 22 2c 22 63 75 74 69 6c 6e 6b 73 2e 63 6f 6d 22 2c 22 61 75 74 6f 62 69 6b 65 72 73 2e 78 79 7a 22 2c 22 70 69 72 61 74 65 2d 70 72 6f 78 79 2e 74 6f 70 22 2c 22 34 35 2e 31 34 38 2e
                                                  Data Ascii: de.life","g0f.cn","esun21.cn","baofengjihuo.com","keygens.pro","charmantesvoisinesmures.com","viatris-e-channel.com","shortlyamusement.com","21929.ru","getmackeepersoftpro.xyz","thesynthesis.app","cutilnks.com","autobikers.xyz","pirate-proxy.top","45.148.
                                                  2024-07-22 10:34:32 UTC1369INData Raw: 79 77 70 6a 6b 2e 63 6f 6d 22 2c 22 73 79 6c 76 69 6e 61 6e 6f 72 72 65 79 2e 63 6f 6d 22 2c 22 6c 6f 6e 38 38 2e 74 6f 70 22 2c 22 76 6c 61 65 6b 61 6e 2e 6b 7a 22 2c 22 73 75 70 74 72 61 66 2e 63 6f 6d 22 2c 22 67 65 74 66 6c 69 6b 2e 63 6f 6d 22 2c 22 63 6f 6f 6c 74 72 6b 2e 78 79 7a 22 2c 22 66 6c 69 72 74 74 6f 6d 65 2e 63 6f 6d 22 2c 22 6d 61 73 61 63 2e 73 62 73 22 2c 22 6e 61 69 6c 6d 61 67 61 7a 69 6e 65 2e 6f 6e 6c 69 6e 65 22 2c 22 72 6f 76 32 2e 6e 65 74 22 2c 22 63 61 73 74 6c 65 63 61 70 69 74 61 6c 2e 76 63 22 2c 22 6d 6f 62 69 6c 65 74 6f 72 72 65 6e 74 2e 69 6e 66 6f 22 2c 22 63 77 62 74 69 2e 63 6f 6d 2e 62 72 22 2c 22 70 6f 73 61 64 61 6c 61 72 6f 62 6c 65 64 61 2e 63 6f 6d 22 2c 22 61 6c 6c 75 72 69 6e 67 67 61 6c 67 2e 63 6f 6d 22 2c
                                                  Data Ascii: ywpjk.com","sylvinanorrey.com","lon88.top","vlaekan.kz","suptraf.com","getflik.com","cooltrk.xyz","flirttome.com","masac.sbs","nailmagazine.online","rov2.net","castlecapital.vc","mobiletorrent.info","cwbti.com.br","posadalarobleda.com","alluringgalg.com",
                                                  2024-07-22 10:34:32 UTC1369INData Raw: 2c 22 74 6f 72 69 6f 6c 75 6f 72 2e 63 6f 6d 22 2c 22 63 72 61 63 6b 73 75 72 6c 2e 63 6f 6d 22 2c 22 70 72 79 76 69 74 61 6e 6e 79 61 2e 74 6f 70 22 2c 22 63 68 61 6e 67 62 65 65 72 2e 73 69 74 65 22 2c 22 61 64 6f 6e 73 6f 6e 6c 79 64 2e 78 79 7a 22 2c 22 74 68 65 6d 65 6e 63 6f 64 65 2e 63 6f 6d 22 2c 22 70 65 72 61 74 75 72 61 6e 70 65 64 69 61 2e 69 64 22 2c 22 74 65 6c 75 74 6f 70 69 65 7a 2e 63 6c 75 62 22 2c 22 76 73 67 7a 64 64 6a 2e 63 6f 6d 22 2c 22 61 64 61 70 61 2d 67 72 6f 75 70 2e 63 6f 6d 22 2c 22 73 68 65 65 74 2d 6d 75 73 69 63 2e 78 79 7a 22 2c 22 72 6f 63 6b 68 61 74 74 65 72 2e 63 6f 6d 22 2c 22 63 6f 6e 73 63 69 6f 75 73 6e 65 73 73 71 75 61 69 6e 74 2e 63 6f 6d 22 2c 22 76 61 6c 6c 65 73 76 69 73 69 6f 2e 63 61 74 22 2c 22 63 73 69
                                                  Data Ascii: ,"torioluor.com","cracksurl.com","pryvitannya.top","changbeer.site","adonsonlyd.xyz","themencode.com","peraturanpedia.id","telutopiez.club","vsgzddj.com","adapa-group.com","sheet-music.xyz","rockhatter.com","consciousnessquaint.com","vallesvisio.cat","csi
                                                  2024-07-22 10:34:32 UTC1369INData Raw: 2e 63 6f 6d 2e 75 61 22 2c 22 63 61 6d 61 64 6d 69 6e 2e 72 75 22 2c 22 6a 75 62 74 31 32 2e 78 79 7a 22 2c 22 72 6b 6e 2e 67 6f 76 2e 72 75 22 2c 22 31 32 33 6d 6f 76 69 65 2e 6c 74 64 22 2c 22 64 73 32 2e 63 6c 75 62 22 2c 22 79 6f 6d 73 74 2e 6f 72 67 22 2c 22 73 75 69 62 65 2e 65 64 75 2e 63 6e 22 2c 22 38 78 62 65 74 33 30 30 2e 63 6f 6d 22 2c 22 61 70 70 6c 65 69 64 78 79 2e 74 6f 70 22 2c 22 62 69 6f 6c 61 62 73 68 6f 70 32 34 2e 63 6f 6d 22 2c 22 6d 79 66 69 6c 65 73 74 6f 72 65 2e 63 6f 6d 22 2c 22 6f 72 6b 6c 69 6e 6b 2e 63 6f 6d 22 2c 22 65 78 70 6c 6f 72 72 2e 6e 65 74 22 2c 22 67 6f 74 72 61 63 6b 72 65 64 69 72 65 63 74 2e 63 6f 6d 22 2c 22 6a 61 76 69 65 72 64 65 6c 61 73 65 6e 2e 63 6f 6d 22 2c 22 62 72 69 61 6e 73 73 63 6c 75 62 2e 63 63
                                                  Data Ascii: .com.ua","camadmin.ru","jubt12.xyz","rkn.gov.ru","123movie.ltd","ds2.club","yomst.org","suibe.edu.cn","8xbet300.com","appleidxy.top","biolabshop24.com","myfilestore.com","orklink.com","explorr.net","gotrackredirect.com","javierdelasen.com","brianssclub.cc
                                                  2024-07-22 10:34:32 UTC1369INData Raw: 2c 22 64 69 73 63 6c 6f 73 65 70 72 6f 67 72 61 6d 77 65 64 6e 65 73 64 61 79 2e 63 6f 6d 22 2c 22 6b 69 6e 6f 6e 65 77 73 2e 70 72 6f 22 2c 22 6f 68 6e 79 64 65 6c 69 67 68 74 66 75 6c 64 61 74 65 73 2e 6c 69 66 65 22 2c 22 62 6f 6b 65 70 69 64 2e 62 6f 6e 64 22 2c 22 62 6f 72 69 73 2e 64 65 22 2c 22 6d 75 6e 64 6f 63 69 6e 65 6d 61 74 6f 67 72 61 66 69 63 6f 2e 6e 65 74 22 2c 22 62 65 74 61 63 65 6e 74 61 75 72 69 2e 74 6f 70 22 2c 22 6f 6d 67 6e 6f 74 65 2e 6e 65 74 6c 69 66 79 2e 61 70 70 22 2c 22 67 72 6f 77 6e 75 70 67 61 6c 6f 72 65 2e 6c 69 66 65 22 2c 22 69 6d 70 6f 73 73 69 62 6c 65 6f 66 66 65 72 73 2e 63 6f 6d 22 2c 22 76 6b 73 74 72 65 61 6d 2e 74 6f 70 22 2c 22 68 6f 74 70 72 6f 6d 6f 74 69 6f 6e 73 2e 6f 6e 6c 69 6e 65 22 2c 22 69 6f 2e 6b
                                                  Data Ascii: ,"discloseprogramwednesday.com","kinonews.pro","ohnydelightfuldates.life","bokepid.bond","boris.de","mundocinematografico.net","betacentauri.top","omgnote.netlify.app","grownupgalore.life","impossibleoffers.com","vkstream.top","hotpromotions.online","io.k
                                                  2024-07-22 10:34:32 UTC1369INData Raw: 2e 69 74 22 2c 22 6f 6f 72 63 61 73 65 6c 6c 73 2e 63 6f 6d 22 2c 22 6f 6e 65 64 61 73 68 2e 6e 65 74 22 2c 22 74 70 61 73 2e 72 75 22 2c 22 74 65 6e 69 38 35 73 74 61 62 30 31 64 2e 63 6f 6d 22 2c 22 74 68 6f 73 65 63 61 6e 64 79 2e 63 6f 6d 22 2c 22 6e 69 6c 6b 6e 61 72 66 2e 78 79 7a 22 2c 22 72 65 69 66 65 66 72 61 75 65 6e 2e 63 6f 6d 22 2c 22 72 6f 73 65 33 33 2e 74 6f 70 22 2c 22 73 74 6f 6e 65 61 67 65 70 65 64 69 61 2e 63 6f 6d 22 2c 22 6d 79 70 72 69 76 61 74 65 2e 70 69 63 73 22 2c 22 73 6e 61 70 78 2e 69 6e 66 6f 22 2c 22 67 74 61 75 74 6f 63 6c 69 63 6b 65 72 2e 63 6f 6d 22 2c 22 66 6d 6f 76 69 65 7a 2e 69 6e 66 6f 22 2c 22 63 6f 6d 65 73 68 6f 70 69 6e 67 2e 74 6f 6b 79 6f 22 2c 22 70 65 6c 69 73 78 70 6f 72 6e 6f 2e 6e 65 74 22 2c 22 63 68
                                                  Data Ascii: .it","oorcasells.com","onedash.net","tpas.ru","teni85stab01d.com","thosecandy.com","nilknarf.xyz","reifefrauen.com","rose33.top","stoneagepedia.com","myprivate.pics","snapx.info","gtautoclicker.com","fmoviez.info","comeshoping.tokyo","pelisxporno.net","ch
                                                  2024-07-22 10:34:32 UTC1369INData Raw: 70 74 34 72 75 73 2e 72 75 22 2c 22 6c 69 76 65 64 73 6b 61 74 65 72 61 69 73 69 6e 2e 63 6f 6d 22 2c 22 61 79 65 6a 6f 6d 65 72 2e 74 6f 70 22 2c 22 6e 6a 69 32 30 2e 78 79 7a 22 2c 22 67 61 6c 61 78 79 62 79 63 6f 69 6e 2e 63 6f 6d 22 2c 22 65 73 74 61 69 6c 6f 66 61 73 68 69 6f 6e 2e 63 6f 6d 22 2c 22 61 72 63 68 65 75 72 6f 70 65 2e 69 6e 66 6f 22 2c 22 65 7a 63 67 6f 6a 61 61 6d 67 2e 63 6f 6d 22 2c 22 68 2d 67 65 6e 2e 78 79 7a 22 2c 22 78 6e 2d 2d 39 30 61 61 76 6d 66 69 37 62 31 64 2e 78 79 7a 22 2c 22 6c 69 62 72 6f 73 72 65 63 6f 6d 65 6e 64 61 64 6f 73 73 2e 63 6f 6d 22 2c 22 75 74 69 6c 69 74 79 70 72 65 73 65 6e 74 2e 63 6f 6d 22 2c 22 74 68 65 67 61 6d 65 70 6c 61 79 2e 6c 69 66 65 22 2c 22 61 69 36 38 36 38 2e 74 6f 70 22 2c 22 78 79 63 6c
                                                  Data Ascii: pt4rus.ru","livedskateraisin.com","ayejomer.top","nji20.xyz","galaxybycoin.com","estailofashion.com","archeurope.info","ezcgojaamg.com","h-gen.xyz","xn--90aavmfi7b1d.xyz","librosrecomendadoss.com","utilitypresent.com","thegameplay.life","ai6868.top","xycl


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  43192.168.2.449858104.16.148.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:32 UTC62OUTGET /api/v2/url/blacklist HTTP/1.1
                                                  Host: acs.lavasoft.com
                                                  2024-07-22 10:34:32 UTC324INHTTP/1.1 301 Moved Permanently
                                                  Date: Mon, 22 Jul 2024 10:34:32 GMT
                                                  Content-Length: 0
                                                  Connection: close
                                                  Cache-Control: public
                                                  Cache-Control: max-age=86400
                                                  Location: https://acscdn.lavasoft.com/urlblacklist.json
                                                  api-supported-versions: 2.0
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c76358f9727b-EWR


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  44192.168.2.449860104.16.149.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:33 UTC149OUTPOST /v1/event-stat?Type=Error&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 665
                                                  2024-07-22 10:34:33 UTC665OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 45 78 63 65 70 74 69 6f 6e 22 3a 22 53 79 73 74 65 6d 2e 4e 75 6c 6c 52 65 66 65 72 65 6e 63 65 45 78 63 65 70 74 69 6f 6e 3a 20 4f 62 6a 65 63 74 20 72 65 66 65 72 65 6e 63 65 20 6e 6f 74 20 73 65 74 20 74 6f 20 61 6e 20 69 6e 73 74 61 6e 63 65 20 6f 66 20 61 6e 20 6f 62 6a 65 63 74 2e 5c 72 5c 6e 20 20 20 61 74 20 57 65 62 43 6f 6d 70 61 6e 69 6f 6e 2e 55 49 2e 41 70 70 43 6f 72 65 2e 50 6f 73 74 52 75 6e 2e 46 65 61 74 75 72 65 41 63 74 69 6f 6e 48 65 6c 70 65 72 2e 49 6e 69 74 69 61 6c 69 7a 65 28 4c 69 73 74 60 31 20 63 6f 6d 6d 61 6e 64 4c 69 6e 65 41 72 67 73 2c 20 42 6f 6f 6c 65 61 6e 20 74 69 6d 65 72 2c 20 53 74 72 69 6e 67 20 66 65 61 74 75 72 65 6e 61 6d 65 29 22 2c 22 45 78 63 65 70 74 69 6f 6e 54 79 70 65 22
                                                  Data Ascii: {"Data": {"Exception":"System.NullReferenceException: Object reference not set to an instance of an object.\r\n at WebCompanion.UI.AppCore.PostRun.FeatureActionHelper.Initialize(List`1 commandLineArgs, Boolean timer, String featurename)","ExceptionType"
                                                  2024-07-22 10:34:33 UTC479INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:33 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: close
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c765ad0f7c8a-EWR
                                                  2024-07-22 10:34:33 UTC35INData Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}
                                                  2024-07-22 10:34:33 UTC5INData Raw: 30 0d 0a 0d 0a
                                                  Data Ascii: 0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  45192.168.2.449863104.16.148.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:33 UTC62OUTGET /api/v2/url/blacklist HTTP/1.1
                                                  Host: acs.lavasoft.com
                                                  2024-07-22 10:34:33 UTC324INHTTP/1.1 301 Moved Permanently
                                                  Date: Mon, 22 Jul 2024 10:34:33 GMT
                                                  Content-Length: 0
                                                  Connection: close
                                                  Cache-Control: public
                                                  Cache-Control: max-age=86400
                                                  Location: https://acscdn.lavasoft.com/urlblacklist.json
                                                  api-supported-versions: 2.0
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7680a468c87-EWR


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  46192.168.2.449873104.16.148.130443984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:35 UTC86OUTGET /api/v2/url/blacklist HTTP/1.1
                                                  Host: acs.lavasoft.com
                                                  Connection: Keep-Alive


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  47192.168.2.449884104.16.149.130443984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:35 UTC180OUTPOST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 364
                                                  Connection: Keep-Alive
                                                  2024-07-22 10:34:35 UTC364OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 45 76 65 6e 74 44 61 74 61 22 3a 22 32 34 68 72 73 22 2c 22 45 76 65 6e 74 4e 61 6d 65 22 3a 22 4d 69 63 72 6f 74 61 72 67 65 74 69 6e 67 54 69 6d 65 72 22 2c 22 42 72 6f 77 73 65 72 4e 61 6d 65 22 3a 22 22 2c 22 53 65 61 72 63 68 45 6e 67 69 6e 65 22 3a 22 22 2c 22 49 6e 73 74 61 6c 6c 44 61 74 65 22 3a 22 32 30 32 34 2d 30 37 2d 32 32 54 30 30 3a 30 30 3a 30 30 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65 2d 31 31 32 38 2d 34 65 36 30 2d 62 65 65 61 2d 32 37 32 30 34 31 64 66 36 34 35 32 22 2c 22 4c 61 6e 67 75 61 67 65 22 3a 22 65 6e 2d 55 53 22 2c 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22
                                                  Data Ascii: {"Data": {"EventData":"24hrs","EventName":"MicrotargetingTimer","BrowserName":"","SearchEngine":"","InstallDate":"2024-07-22T00:00:00","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Language":"en-US","MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698"
                                                  2024-07-22 10:34:36 UTC479INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:36 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: close
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c776d9d518ae-EWR
                                                  2024-07-22 10:34:36 UTC35INData Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}
                                                  2024-07-22 10:34:36 UTC5INData Raw: 30 0d 0a 0d 0a
                                                  Data Ascii: 0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  48192.168.2.449881104.16.149.130443984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:35 UTC180OUTPOST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 364
                                                  Connection: Keep-Alive
                                                  2024-07-22 10:34:35 UTC364OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 45 76 65 6e 74 44 61 74 61 22 3a 22 32 34 68 72 73 22 2c 22 45 76 65 6e 74 4e 61 6d 65 22 3a 22 4d 69 63 72 6f 74 61 72 67 65 74 69 6e 67 54 69 6d 65 72 22 2c 22 42 72 6f 77 73 65 72 4e 61 6d 65 22 3a 22 22 2c 22 53 65 61 72 63 68 45 6e 67 69 6e 65 22 3a 22 22 2c 22 49 6e 73 74 61 6c 6c 44 61 74 65 22 3a 22 32 30 32 34 2d 30 37 2d 32 32 54 30 30 3a 30 30 3a 30 30 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65 2d 31 31 32 38 2d 34 65 36 30 2d 62 65 65 61 2d 32 37 32 30 34 31 64 66 36 34 35 32 22 2c 22 4c 61 6e 67 75 61 67 65 22 3a 22 65 6e 2d 55 53 22 2c 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22
                                                  Data Ascii: {"Data": {"EventData":"24hrs","EventName":"MicrotargetingTimer","BrowserName":"","SearchEngine":"","InstallDate":"2024-07-22T00:00:00","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Language":"en-US","MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698"
                                                  2024-07-22 10:34:36 UTC479INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:36 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: close
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c776c93c42d7-EWR
                                                  2024-07-22 10:34:36 UTC35INData Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}
                                                  2024-07-22 10:34:36 UTC5INData Raw: 30 0d 0a 0d 0a
                                                  Data Ascii: 0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  49192.168.2.449882104.16.148.130443984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:35 UTC86OUTGET /api/v2/url/blacklist HTTP/1.1
                                                  Host: acs.lavasoft.com
                                                  Connection: Keep-Alive
                                                  2024-07-22 10:34:36 UTC324INHTTP/1.1 301 Moved Permanently
                                                  Date: Mon, 22 Jul 2024 10:34:36 GMT
                                                  Content-Length: 0
                                                  Connection: close
                                                  Cache-Control: public
                                                  Cache-Control: max-age=86400
                                                  Location: https://acscdn.lavasoft.com/urlblacklist.json
                                                  api-supported-versions: 2.0
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c77749230c92-EWR


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  50192.168.2.449878104.16.148.130443984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:35 UTC86OUTGET /api/v2/url/blacklist HTTP/1.1
                                                  Host: acs.lavasoft.com
                                                  Connection: Keep-Alive
                                                  2024-07-22 10:34:36 UTC324INHTTP/1.1 301 Moved Permanently
                                                  Date: Mon, 22 Jul 2024 10:34:36 GMT
                                                  Content-Length: 0
                                                  Connection: close
                                                  Cache-Control: public
                                                  Cache-Control: max-age=86400
                                                  Location: https://acscdn.lavasoft.com/urlblacklist.json
                                                  api-supported-versions: 2.0
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7774fe78cca-EWR


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  51192.168.2.449864104.16.149.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:36 UTC62OUTGET /urlblacklist.json HTTP/1.1
                                                  Host: acscdn.lavasoft.com
                                                  2024-07-22 10:34:36 UTC385INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:36 GMT
                                                  Content-Type: application/json
                                                  Content-Length: 201625
                                                  Connection: close
                                                  Last-Modified: Wed, 15 Nov 2023 13:57:17 GMT
                                                  ETag: "6554ce3d-31399"
                                                  CF-Cache-Status: HIT
                                                  Age: 62193
                                                  Expires: Tue, 23 Jul 2024 06:34:36 GMT
                                                  Cache-Control: public, max-age=72000
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c778aa6943ff-EWR
                                                  2024-07-22 10:34:36 UTC984INData Raw: 5b 22 6c 61 69 7a 68 65 6e 67 73 6c 74 2e 63 6e 22 2c 22 6d 79 74 6f 6f 6c 7a 2e 6e 65 74 22 2c 22 70 72 6f 74 65 63 74 32 34 37 2e 6f 6e 6c 69 6e 65 22 2c 22 78 78 6c 61 73 74 2e 63 6f 6d 22 2c 22 77 6f 72 6c 64 73 61 6e 61 6c 79 74 69 63 73 2e 63 6f 6d 22 2c 22 73 6b 69 6c 6c 74 72 61 6e 73 66 6f 72 6d 2e 63 6f 2e 69 6e 22 2c 22 6c 65 6c 61 65 72 2e 63 6f 6d 22 2c 22 6a 70 6f 70 73 69 6e 67 6c 65 73 2e 65 75 22 2c 22 72 69 73 71 75 65 67 61 6c 6b 78 2e 63 6f 6d 22 2c 22 73 76 65 74 76 79 68 6f 64 2e 73 6b 22 2c 22 6d 6f 76 69 65 63 72 75 6d 62 73 2e 6e 65 74 22 2c 22 70 68 72 61 62 75 2e 67 6f 2e 74 68 22 2c 22 6f 6e 6c 79 69 6e 64 69 61 6e 78 2e 63 63 22 2c 22 69 6b 69 73 73 2e 6f 6e 6c 69 6e 65 22 2c 22 75 72 65 77 73 61 77 61 6e 69 2e 61 75 74 6f 73
                                                  Data Ascii: ["laizhengslt.cn","mytoolz.net","protect247.online","xxlast.com","worldsanalytics.com","skilltransform.co.in","lelaer.com","jpopsingles.eu","risquegalkx.com","svetvyhod.sk","moviecrumbs.net","phrabu.go.th","onlyindianx.cc","ikiss.online","urewsawani.autos
                                                  2024-07-22 10:34:36 UTC1369INData Raw: 6b 61 74 6d 6f 76 69 65 68 64 2e 6d 6f 76 22 2c 22 62 6c 75 65 67 61 73 6c 61 6d 70 2e 6f 72 67 22 2c 22 64 72 61 67 67 65 64 6c 69 6e 65 2e 6f 72 67 22 2c 22 67 68 35 79 73 33 67 72 79 35 64 35 33 32 2e 78 79 7a 22 2c 22 6b 61 61 6d 75 75 2e 6f 72 67 22 2c 22 73 61 6f 6d 61 32 32 30 2e 78 79 7a 22 2c 22 6c 69 76 65 74 76 33 36 35 2e 6d 65 22 2c 22 70 69 73 69 2e 70 69 63 73 22 2c 22 76 61 6c 75 65 2d 6c 69 66 65 2e 78 79 7a 22 2c 22 72 69 64 6f 6d 6f 76 69 65 73 2e 74 76 22 2c 22 70 68 69 6c 77 69 6e 2e 70 68 22 2c 22 61 64 6d 69 72 61 6c 73 68 69 70 70 69 6e 67 2e 63 6f 6d 22 2c 22 66 72 65 65 74 6f 6f 6c 6f 6e 6c 69 6e 65 2e 63 6f 6d 22 2c 22 76 69 74 61 6c 61 6d 73 65 65 2e 63 6f 6d 22 2c 22 6f 72 69 67 6c 6e 61 6c 64 61 74 65 2e 63 6f 6d 22 2c 22 72
                                                  Data Ascii: katmoviehd.mov","bluegaslamp.org","draggedline.org","gh5ys3gry5d532.xyz","kaamuu.org","saoma220.xyz","livetv365.me","pisi.pics","value-life.xyz","ridomovies.tv","philwin.ph","admiralshipping.com","freetoolonline.com","vitalamsee.com","origlnaldate.com","r
                                                  2024-07-22 10:34:36 UTC1369INData Raw: 79 2e 63 6f 6d 22 2c 22 61 69 73 68 6f 72 74 2e 74 6f 70 22 2c 22 70 72 6f 6d 6c 61 7a 65 72 2e 72 75 22 2c 22 6c 65 66 74 62 69 6c 6c 2e 74 6f 70 22 2c 22 75 70 73 63 61 72 72 69 61 67 65 70 61 79 6d 65 6e 74 2e 63 6f 6d 22 2c 22 69 6e 76 65 73 74 6c 69 65 2e 63 6f 6d 22 2c 22 74 35 2d 77 69 6b 69 2e 64 65 22 2c 22 66 72 65 65 73 6f 66 74 72 75 73 2e 72 75 22 2c 22 70 61 70 73 74 72 65 61 6d 2e 63 6c 75 62 22 2c 22 77 6f 72 6c 64 6e 65 77 73 2d 32 34 2e 63 6f 6d 22 2c 22 65 6e 73 74 72 65 61 6d 2e 74 6f 70 22 2c 22 73 6f 72 63 65 72 65 72 6f 66 74 65 61 2e 63 6f 6d 22 2c 22 6d 79 63 6c 69 63 6b 2d 32 2e 63 6f 6d 22 2c 22 6c 65 6c 69 65 7a 6f 72 67 67 72 6f 65 70 2e 6e 6c 22 2c 22 6d 75 61 74 68 65 6e 67 61 79 2e 63 6f 6d 22 2c 22 78 6e 2d 2d 38 30 61 63
                                                  Data Ascii: y.com","aishort.top","promlazer.ru","leftbill.top","upscarriagepayment.com","investlie.com","t5-wiki.de","freesoftrus.ru","papstream.club","worldnews-24.com","enstream.top","sorcereroftea.com","myclick-2.com","leliezorggroep.nl","muathengay.com","xn--80ac
                                                  2024-07-22 10:34:36 UTC1369INData Raw: 64 65 2e 6c 69 66 65 22 2c 22 67 30 66 2e 63 6e 22 2c 22 65 73 75 6e 32 31 2e 63 6e 22 2c 22 62 61 6f 66 65 6e 67 6a 69 68 75 6f 2e 63 6f 6d 22 2c 22 6b 65 79 67 65 6e 73 2e 70 72 6f 22 2c 22 63 68 61 72 6d 61 6e 74 65 73 76 6f 69 73 69 6e 65 73 6d 75 72 65 73 2e 63 6f 6d 22 2c 22 76 69 61 74 72 69 73 2d 65 2d 63 68 61 6e 6e 65 6c 2e 63 6f 6d 22 2c 22 73 68 6f 72 74 6c 79 61 6d 75 73 65 6d 65 6e 74 2e 63 6f 6d 22 2c 22 32 31 39 32 39 2e 72 75 22 2c 22 67 65 74 6d 61 63 6b 65 65 70 65 72 73 6f 66 74 70 72 6f 2e 78 79 7a 22 2c 22 74 68 65 73 79 6e 74 68 65 73 69 73 2e 61 70 70 22 2c 22 63 75 74 69 6c 6e 6b 73 2e 63 6f 6d 22 2c 22 61 75 74 6f 62 69 6b 65 72 73 2e 78 79 7a 22 2c 22 70 69 72 61 74 65 2d 70 72 6f 78 79 2e 74 6f 70 22 2c 22 34 35 2e 31 34 38 2e
                                                  Data Ascii: de.life","g0f.cn","esun21.cn","baofengjihuo.com","keygens.pro","charmantesvoisinesmures.com","viatris-e-channel.com","shortlyamusement.com","21929.ru","getmackeepersoftpro.xyz","thesynthesis.app","cutilnks.com","autobikers.xyz","pirate-proxy.top","45.148.
                                                  2024-07-22 10:34:36 UTC1369INData Raw: 79 77 70 6a 6b 2e 63 6f 6d 22 2c 22 73 79 6c 76 69 6e 61 6e 6f 72 72 65 79 2e 63 6f 6d 22 2c 22 6c 6f 6e 38 38 2e 74 6f 70 22 2c 22 76 6c 61 65 6b 61 6e 2e 6b 7a 22 2c 22 73 75 70 74 72 61 66 2e 63 6f 6d 22 2c 22 67 65 74 66 6c 69 6b 2e 63 6f 6d 22 2c 22 63 6f 6f 6c 74 72 6b 2e 78 79 7a 22 2c 22 66 6c 69 72 74 74 6f 6d 65 2e 63 6f 6d 22 2c 22 6d 61 73 61 63 2e 73 62 73 22 2c 22 6e 61 69 6c 6d 61 67 61 7a 69 6e 65 2e 6f 6e 6c 69 6e 65 22 2c 22 72 6f 76 32 2e 6e 65 74 22 2c 22 63 61 73 74 6c 65 63 61 70 69 74 61 6c 2e 76 63 22 2c 22 6d 6f 62 69 6c 65 74 6f 72 72 65 6e 74 2e 69 6e 66 6f 22 2c 22 63 77 62 74 69 2e 63 6f 6d 2e 62 72 22 2c 22 70 6f 73 61 64 61 6c 61 72 6f 62 6c 65 64 61 2e 63 6f 6d 22 2c 22 61 6c 6c 75 72 69 6e 67 67 61 6c 67 2e 63 6f 6d 22 2c
                                                  Data Ascii: ywpjk.com","sylvinanorrey.com","lon88.top","vlaekan.kz","suptraf.com","getflik.com","cooltrk.xyz","flirttome.com","masac.sbs","nailmagazine.online","rov2.net","castlecapital.vc","mobiletorrent.info","cwbti.com.br","posadalarobleda.com","alluringgalg.com",
                                                  2024-07-22 10:34:36 UTC1369INData Raw: 2c 22 74 6f 72 69 6f 6c 75 6f 72 2e 63 6f 6d 22 2c 22 63 72 61 63 6b 73 75 72 6c 2e 63 6f 6d 22 2c 22 70 72 79 76 69 74 61 6e 6e 79 61 2e 74 6f 70 22 2c 22 63 68 61 6e 67 62 65 65 72 2e 73 69 74 65 22 2c 22 61 64 6f 6e 73 6f 6e 6c 79 64 2e 78 79 7a 22 2c 22 74 68 65 6d 65 6e 63 6f 64 65 2e 63 6f 6d 22 2c 22 70 65 72 61 74 75 72 61 6e 70 65 64 69 61 2e 69 64 22 2c 22 74 65 6c 75 74 6f 70 69 65 7a 2e 63 6c 75 62 22 2c 22 76 73 67 7a 64 64 6a 2e 63 6f 6d 22 2c 22 61 64 61 70 61 2d 67 72 6f 75 70 2e 63 6f 6d 22 2c 22 73 68 65 65 74 2d 6d 75 73 69 63 2e 78 79 7a 22 2c 22 72 6f 63 6b 68 61 74 74 65 72 2e 63 6f 6d 22 2c 22 63 6f 6e 73 63 69 6f 75 73 6e 65 73 73 71 75 61 69 6e 74 2e 63 6f 6d 22 2c 22 76 61 6c 6c 65 73 76 69 73 69 6f 2e 63 61 74 22 2c 22 63 73 69
                                                  Data Ascii: ,"torioluor.com","cracksurl.com","pryvitannya.top","changbeer.site","adonsonlyd.xyz","themencode.com","peraturanpedia.id","telutopiez.club","vsgzddj.com","adapa-group.com","sheet-music.xyz","rockhatter.com","consciousnessquaint.com","vallesvisio.cat","csi
                                                  2024-07-22 10:34:36 UTC1369INData Raw: 2e 63 6f 6d 2e 75 61 22 2c 22 63 61 6d 61 64 6d 69 6e 2e 72 75 22 2c 22 6a 75 62 74 31 32 2e 78 79 7a 22 2c 22 72 6b 6e 2e 67 6f 76 2e 72 75 22 2c 22 31 32 33 6d 6f 76 69 65 2e 6c 74 64 22 2c 22 64 73 32 2e 63 6c 75 62 22 2c 22 79 6f 6d 73 74 2e 6f 72 67 22 2c 22 73 75 69 62 65 2e 65 64 75 2e 63 6e 22 2c 22 38 78 62 65 74 33 30 30 2e 63 6f 6d 22 2c 22 61 70 70 6c 65 69 64 78 79 2e 74 6f 70 22 2c 22 62 69 6f 6c 61 62 73 68 6f 70 32 34 2e 63 6f 6d 22 2c 22 6d 79 66 69 6c 65 73 74 6f 72 65 2e 63 6f 6d 22 2c 22 6f 72 6b 6c 69 6e 6b 2e 63 6f 6d 22 2c 22 65 78 70 6c 6f 72 72 2e 6e 65 74 22 2c 22 67 6f 74 72 61 63 6b 72 65 64 69 72 65 63 74 2e 63 6f 6d 22 2c 22 6a 61 76 69 65 72 64 65 6c 61 73 65 6e 2e 63 6f 6d 22 2c 22 62 72 69 61 6e 73 73 63 6c 75 62 2e 63 63
                                                  Data Ascii: .com.ua","camadmin.ru","jubt12.xyz","rkn.gov.ru","123movie.ltd","ds2.club","yomst.org","suibe.edu.cn","8xbet300.com","appleidxy.top","biolabshop24.com","myfilestore.com","orklink.com","explorr.net","gotrackredirect.com","javierdelasen.com","brianssclub.cc
                                                  2024-07-22 10:34:36 UTC1369INData Raw: 2c 22 64 69 73 63 6c 6f 73 65 70 72 6f 67 72 61 6d 77 65 64 6e 65 73 64 61 79 2e 63 6f 6d 22 2c 22 6b 69 6e 6f 6e 65 77 73 2e 70 72 6f 22 2c 22 6f 68 6e 79 64 65 6c 69 67 68 74 66 75 6c 64 61 74 65 73 2e 6c 69 66 65 22 2c 22 62 6f 6b 65 70 69 64 2e 62 6f 6e 64 22 2c 22 62 6f 72 69 73 2e 64 65 22 2c 22 6d 75 6e 64 6f 63 69 6e 65 6d 61 74 6f 67 72 61 66 69 63 6f 2e 6e 65 74 22 2c 22 62 65 74 61 63 65 6e 74 61 75 72 69 2e 74 6f 70 22 2c 22 6f 6d 67 6e 6f 74 65 2e 6e 65 74 6c 69 66 79 2e 61 70 70 22 2c 22 67 72 6f 77 6e 75 70 67 61 6c 6f 72 65 2e 6c 69 66 65 22 2c 22 69 6d 70 6f 73 73 69 62 6c 65 6f 66 66 65 72 73 2e 63 6f 6d 22 2c 22 76 6b 73 74 72 65 61 6d 2e 74 6f 70 22 2c 22 68 6f 74 70 72 6f 6d 6f 74 69 6f 6e 73 2e 6f 6e 6c 69 6e 65 22 2c 22 69 6f 2e 6b
                                                  Data Ascii: ,"discloseprogramwednesday.com","kinonews.pro","ohnydelightfuldates.life","bokepid.bond","boris.de","mundocinematografico.net","betacentauri.top","omgnote.netlify.app","grownupgalore.life","impossibleoffers.com","vkstream.top","hotpromotions.online","io.k
                                                  2024-07-22 10:34:36 UTC1369INData Raw: 2e 69 74 22 2c 22 6f 6f 72 63 61 73 65 6c 6c 73 2e 63 6f 6d 22 2c 22 6f 6e 65 64 61 73 68 2e 6e 65 74 22 2c 22 74 70 61 73 2e 72 75 22 2c 22 74 65 6e 69 38 35 73 74 61 62 30 31 64 2e 63 6f 6d 22 2c 22 74 68 6f 73 65 63 61 6e 64 79 2e 63 6f 6d 22 2c 22 6e 69 6c 6b 6e 61 72 66 2e 78 79 7a 22 2c 22 72 65 69 66 65 66 72 61 75 65 6e 2e 63 6f 6d 22 2c 22 72 6f 73 65 33 33 2e 74 6f 70 22 2c 22 73 74 6f 6e 65 61 67 65 70 65 64 69 61 2e 63 6f 6d 22 2c 22 6d 79 70 72 69 76 61 74 65 2e 70 69 63 73 22 2c 22 73 6e 61 70 78 2e 69 6e 66 6f 22 2c 22 67 74 61 75 74 6f 63 6c 69 63 6b 65 72 2e 63 6f 6d 22 2c 22 66 6d 6f 76 69 65 7a 2e 69 6e 66 6f 22 2c 22 63 6f 6d 65 73 68 6f 70 69 6e 67 2e 74 6f 6b 79 6f 22 2c 22 70 65 6c 69 73 78 70 6f 72 6e 6f 2e 6e 65 74 22 2c 22 63 68
                                                  Data Ascii: .it","oorcasells.com","onedash.net","tpas.ru","teni85stab01d.com","thosecandy.com","nilknarf.xyz","reifefrauen.com","rose33.top","stoneagepedia.com","myprivate.pics","snapx.info","gtautoclicker.com","fmoviez.info","comeshoping.tokyo","pelisxporno.net","ch
                                                  2024-07-22 10:34:36 UTC1369INData Raw: 70 74 34 72 75 73 2e 72 75 22 2c 22 6c 69 76 65 64 73 6b 61 74 65 72 61 69 73 69 6e 2e 63 6f 6d 22 2c 22 61 79 65 6a 6f 6d 65 72 2e 74 6f 70 22 2c 22 6e 6a 69 32 30 2e 78 79 7a 22 2c 22 67 61 6c 61 78 79 62 79 63 6f 69 6e 2e 63 6f 6d 22 2c 22 65 73 74 61 69 6c 6f 66 61 73 68 69 6f 6e 2e 63 6f 6d 22 2c 22 61 72 63 68 65 75 72 6f 70 65 2e 69 6e 66 6f 22 2c 22 65 7a 63 67 6f 6a 61 61 6d 67 2e 63 6f 6d 22 2c 22 68 2d 67 65 6e 2e 78 79 7a 22 2c 22 78 6e 2d 2d 39 30 61 61 76 6d 66 69 37 62 31 64 2e 78 79 7a 22 2c 22 6c 69 62 72 6f 73 72 65 63 6f 6d 65 6e 64 61 64 6f 73 73 2e 63 6f 6d 22 2c 22 75 74 69 6c 69 74 79 70 72 65 73 65 6e 74 2e 63 6f 6d 22 2c 22 74 68 65 67 61 6d 65 70 6c 61 79 2e 6c 69 66 65 22 2c 22 61 69 36 38 36 38 2e 74 6f 70 22 2c 22 78 79 63 6c
                                                  Data Ascii: pt4rus.ru","livedskateraisin.com","ayejomer.top","nji20.xyz","galaxybycoin.com","estailofashion.com","archeurope.info","ezcgojaamg.com","h-gen.xyz","xn--90aavmfi7b1d.xyz","librosrecomendadoss.com","utilitypresent.com","thegameplay.life","ai6868.top","xycl


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  52192.168.2.449865104.16.149.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:36 UTC62OUTGET /urlblacklist.json HTTP/1.1
                                                  Host: acscdn.lavasoft.com
                                                  2024-07-22 10:34:36 UTC385INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:36 GMT
                                                  Content-Type: application/json
                                                  Content-Length: 201625
                                                  Connection: close
                                                  Last-Modified: Wed, 15 Nov 2023 13:57:17 GMT
                                                  ETag: "6554ce3d-31399"
                                                  CF-Cache-Status: HIT
                                                  Age: 62193
                                                  Expires: Tue, 23 Jul 2024 06:34:36 GMT
                                                  Cache-Control: public, max-age=72000
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c778bd564334-EWR
                                                  2024-07-22 10:34:36 UTC984INData Raw: 5b 22 6c 61 69 7a 68 65 6e 67 73 6c 74 2e 63 6e 22 2c 22 6d 79 74 6f 6f 6c 7a 2e 6e 65 74 22 2c 22 70 72 6f 74 65 63 74 32 34 37 2e 6f 6e 6c 69 6e 65 22 2c 22 78 78 6c 61 73 74 2e 63 6f 6d 22 2c 22 77 6f 72 6c 64 73 61 6e 61 6c 79 74 69 63 73 2e 63 6f 6d 22 2c 22 73 6b 69 6c 6c 74 72 61 6e 73 66 6f 72 6d 2e 63 6f 2e 69 6e 22 2c 22 6c 65 6c 61 65 72 2e 63 6f 6d 22 2c 22 6a 70 6f 70 73 69 6e 67 6c 65 73 2e 65 75 22 2c 22 72 69 73 71 75 65 67 61 6c 6b 78 2e 63 6f 6d 22 2c 22 73 76 65 74 76 79 68 6f 64 2e 73 6b 22 2c 22 6d 6f 76 69 65 63 72 75 6d 62 73 2e 6e 65 74 22 2c 22 70 68 72 61 62 75 2e 67 6f 2e 74 68 22 2c 22 6f 6e 6c 79 69 6e 64 69 61 6e 78 2e 63 63 22 2c 22 69 6b 69 73 73 2e 6f 6e 6c 69 6e 65 22 2c 22 75 72 65 77 73 61 77 61 6e 69 2e 61 75 74 6f 73
                                                  Data Ascii: ["laizhengslt.cn","mytoolz.net","protect247.online","xxlast.com","worldsanalytics.com","skilltransform.co.in","lelaer.com","jpopsingles.eu","risquegalkx.com","svetvyhod.sk","moviecrumbs.net","phrabu.go.th","onlyindianx.cc","ikiss.online","urewsawani.autos
                                                  2024-07-22 10:34:36 UTC1369INData Raw: 6b 61 74 6d 6f 76 69 65 68 64 2e 6d 6f 76 22 2c 22 62 6c 75 65 67 61 73 6c 61 6d 70 2e 6f 72 67 22 2c 22 64 72 61 67 67 65 64 6c 69 6e 65 2e 6f 72 67 22 2c 22 67 68 35 79 73 33 67 72 79 35 64 35 33 32 2e 78 79 7a 22 2c 22 6b 61 61 6d 75 75 2e 6f 72 67 22 2c 22 73 61 6f 6d 61 32 32 30 2e 78 79 7a 22 2c 22 6c 69 76 65 74 76 33 36 35 2e 6d 65 22 2c 22 70 69 73 69 2e 70 69 63 73 22 2c 22 76 61 6c 75 65 2d 6c 69 66 65 2e 78 79 7a 22 2c 22 72 69 64 6f 6d 6f 76 69 65 73 2e 74 76 22 2c 22 70 68 69 6c 77 69 6e 2e 70 68 22 2c 22 61 64 6d 69 72 61 6c 73 68 69 70 70 69 6e 67 2e 63 6f 6d 22 2c 22 66 72 65 65 74 6f 6f 6c 6f 6e 6c 69 6e 65 2e 63 6f 6d 22 2c 22 76 69 74 61 6c 61 6d 73 65 65 2e 63 6f 6d 22 2c 22 6f 72 69 67 6c 6e 61 6c 64 61 74 65 2e 63 6f 6d 22 2c 22 72
                                                  Data Ascii: katmoviehd.mov","bluegaslamp.org","draggedline.org","gh5ys3gry5d532.xyz","kaamuu.org","saoma220.xyz","livetv365.me","pisi.pics","value-life.xyz","ridomovies.tv","philwin.ph","admiralshipping.com","freetoolonline.com","vitalamsee.com","origlnaldate.com","r
                                                  2024-07-22 10:34:36 UTC1369INData Raw: 79 2e 63 6f 6d 22 2c 22 61 69 73 68 6f 72 74 2e 74 6f 70 22 2c 22 70 72 6f 6d 6c 61 7a 65 72 2e 72 75 22 2c 22 6c 65 66 74 62 69 6c 6c 2e 74 6f 70 22 2c 22 75 70 73 63 61 72 72 69 61 67 65 70 61 79 6d 65 6e 74 2e 63 6f 6d 22 2c 22 69 6e 76 65 73 74 6c 69 65 2e 63 6f 6d 22 2c 22 74 35 2d 77 69 6b 69 2e 64 65 22 2c 22 66 72 65 65 73 6f 66 74 72 75 73 2e 72 75 22 2c 22 70 61 70 73 74 72 65 61 6d 2e 63 6c 75 62 22 2c 22 77 6f 72 6c 64 6e 65 77 73 2d 32 34 2e 63 6f 6d 22 2c 22 65 6e 73 74 72 65 61 6d 2e 74 6f 70 22 2c 22 73 6f 72 63 65 72 65 72 6f 66 74 65 61 2e 63 6f 6d 22 2c 22 6d 79 63 6c 69 63 6b 2d 32 2e 63 6f 6d 22 2c 22 6c 65 6c 69 65 7a 6f 72 67 67 72 6f 65 70 2e 6e 6c 22 2c 22 6d 75 61 74 68 65 6e 67 61 79 2e 63 6f 6d 22 2c 22 78 6e 2d 2d 38 30 61 63
                                                  Data Ascii: y.com","aishort.top","promlazer.ru","leftbill.top","upscarriagepayment.com","investlie.com","t5-wiki.de","freesoftrus.ru","papstream.club","worldnews-24.com","enstream.top","sorcereroftea.com","myclick-2.com","leliezorggroep.nl","muathengay.com","xn--80ac
                                                  2024-07-22 10:34:36 UTC1369INData Raw: 64 65 2e 6c 69 66 65 22 2c 22 67 30 66 2e 63 6e 22 2c 22 65 73 75 6e 32 31 2e 63 6e 22 2c 22 62 61 6f 66 65 6e 67 6a 69 68 75 6f 2e 63 6f 6d 22 2c 22 6b 65 79 67 65 6e 73 2e 70 72 6f 22 2c 22 63 68 61 72 6d 61 6e 74 65 73 76 6f 69 73 69 6e 65 73 6d 75 72 65 73 2e 63 6f 6d 22 2c 22 76 69 61 74 72 69 73 2d 65 2d 63 68 61 6e 6e 65 6c 2e 63 6f 6d 22 2c 22 73 68 6f 72 74 6c 79 61 6d 75 73 65 6d 65 6e 74 2e 63 6f 6d 22 2c 22 32 31 39 32 39 2e 72 75 22 2c 22 67 65 74 6d 61 63 6b 65 65 70 65 72 73 6f 66 74 70 72 6f 2e 78 79 7a 22 2c 22 74 68 65 73 79 6e 74 68 65 73 69 73 2e 61 70 70 22 2c 22 63 75 74 69 6c 6e 6b 73 2e 63 6f 6d 22 2c 22 61 75 74 6f 62 69 6b 65 72 73 2e 78 79 7a 22 2c 22 70 69 72 61 74 65 2d 70 72 6f 78 79 2e 74 6f 70 22 2c 22 34 35 2e 31 34 38 2e
                                                  Data Ascii: de.life","g0f.cn","esun21.cn","baofengjihuo.com","keygens.pro","charmantesvoisinesmures.com","viatris-e-channel.com","shortlyamusement.com","21929.ru","getmackeepersoftpro.xyz","thesynthesis.app","cutilnks.com","autobikers.xyz","pirate-proxy.top","45.148.
                                                  2024-07-22 10:34:36 UTC1369INData Raw: 79 77 70 6a 6b 2e 63 6f 6d 22 2c 22 73 79 6c 76 69 6e 61 6e 6f 72 72 65 79 2e 63 6f 6d 22 2c 22 6c 6f 6e 38 38 2e 74 6f 70 22 2c 22 76 6c 61 65 6b 61 6e 2e 6b 7a 22 2c 22 73 75 70 74 72 61 66 2e 63 6f 6d 22 2c 22 67 65 74 66 6c 69 6b 2e 63 6f 6d 22 2c 22 63 6f 6f 6c 74 72 6b 2e 78 79 7a 22 2c 22 66 6c 69 72 74 74 6f 6d 65 2e 63 6f 6d 22 2c 22 6d 61 73 61 63 2e 73 62 73 22 2c 22 6e 61 69 6c 6d 61 67 61 7a 69 6e 65 2e 6f 6e 6c 69 6e 65 22 2c 22 72 6f 76 32 2e 6e 65 74 22 2c 22 63 61 73 74 6c 65 63 61 70 69 74 61 6c 2e 76 63 22 2c 22 6d 6f 62 69 6c 65 74 6f 72 72 65 6e 74 2e 69 6e 66 6f 22 2c 22 63 77 62 74 69 2e 63 6f 6d 2e 62 72 22 2c 22 70 6f 73 61 64 61 6c 61 72 6f 62 6c 65 64 61 2e 63 6f 6d 22 2c 22 61 6c 6c 75 72 69 6e 67 67 61 6c 67 2e 63 6f 6d 22 2c
                                                  Data Ascii: ywpjk.com","sylvinanorrey.com","lon88.top","vlaekan.kz","suptraf.com","getflik.com","cooltrk.xyz","flirttome.com","masac.sbs","nailmagazine.online","rov2.net","castlecapital.vc","mobiletorrent.info","cwbti.com.br","posadalarobleda.com","alluringgalg.com",
                                                  2024-07-22 10:34:36 UTC1369INData Raw: 2c 22 74 6f 72 69 6f 6c 75 6f 72 2e 63 6f 6d 22 2c 22 63 72 61 63 6b 73 75 72 6c 2e 63 6f 6d 22 2c 22 70 72 79 76 69 74 61 6e 6e 79 61 2e 74 6f 70 22 2c 22 63 68 61 6e 67 62 65 65 72 2e 73 69 74 65 22 2c 22 61 64 6f 6e 73 6f 6e 6c 79 64 2e 78 79 7a 22 2c 22 74 68 65 6d 65 6e 63 6f 64 65 2e 63 6f 6d 22 2c 22 70 65 72 61 74 75 72 61 6e 70 65 64 69 61 2e 69 64 22 2c 22 74 65 6c 75 74 6f 70 69 65 7a 2e 63 6c 75 62 22 2c 22 76 73 67 7a 64 64 6a 2e 63 6f 6d 22 2c 22 61 64 61 70 61 2d 67 72 6f 75 70 2e 63 6f 6d 22 2c 22 73 68 65 65 74 2d 6d 75 73 69 63 2e 78 79 7a 22 2c 22 72 6f 63 6b 68 61 74 74 65 72 2e 63 6f 6d 22 2c 22 63 6f 6e 73 63 69 6f 75 73 6e 65 73 73 71 75 61 69 6e 74 2e 63 6f 6d 22 2c 22 76 61 6c 6c 65 73 76 69 73 69 6f 2e 63 61 74 22 2c 22 63 73 69
                                                  Data Ascii: ,"torioluor.com","cracksurl.com","pryvitannya.top","changbeer.site","adonsonlyd.xyz","themencode.com","peraturanpedia.id","telutopiez.club","vsgzddj.com","adapa-group.com","sheet-music.xyz","rockhatter.com","consciousnessquaint.com","vallesvisio.cat","csi
                                                  2024-07-22 10:34:36 UTC1369INData Raw: 2e 63 6f 6d 2e 75 61 22 2c 22 63 61 6d 61 64 6d 69 6e 2e 72 75 22 2c 22 6a 75 62 74 31 32 2e 78 79 7a 22 2c 22 72 6b 6e 2e 67 6f 76 2e 72 75 22 2c 22 31 32 33 6d 6f 76 69 65 2e 6c 74 64 22 2c 22 64 73 32 2e 63 6c 75 62 22 2c 22 79 6f 6d 73 74 2e 6f 72 67 22 2c 22 73 75 69 62 65 2e 65 64 75 2e 63 6e 22 2c 22 38 78 62 65 74 33 30 30 2e 63 6f 6d 22 2c 22 61 70 70 6c 65 69 64 78 79 2e 74 6f 70 22 2c 22 62 69 6f 6c 61 62 73 68 6f 70 32 34 2e 63 6f 6d 22 2c 22 6d 79 66 69 6c 65 73 74 6f 72 65 2e 63 6f 6d 22 2c 22 6f 72 6b 6c 69 6e 6b 2e 63 6f 6d 22 2c 22 65 78 70 6c 6f 72 72 2e 6e 65 74 22 2c 22 67 6f 74 72 61 63 6b 72 65 64 69 72 65 63 74 2e 63 6f 6d 22 2c 22 6a 61 76 69 65 72 64 65 6c 61 73 65 6e 2e 63 6f 6d 22 2c 22 62 72 69 61 6e 73 73 63 6c 75 62 2e 63 63
                                                  Data Ascii: .com.ua","camadmin.ru","jubt12.xyz","rkn.gov.ru","123movie.ltd","ds2.club","yomst.org","suibe.edu.cn","8xbet300.com","appleidxy.top","biolabshop24.com","myfilestore.com","orklink.com","explorr.net","gotrackredirect.com","javierdelasen.com","brianssclub.cc
                                                  2024-07-22 10:34:36 UTC1369INData Raw: 2c 22 64 69 73 63 6c 6f 73 65 70 72 6f 67 72 61 6d 77 65 64 6e 65 73 64 61 79 2e 63 6f 6d 22 2c 22 6b 69 6e 6f 6e 65 77 73 2e 70 72 6f 22 2c 22 6f 68 6e 79 64 65 6c 69 67 68 74 66 75 6c 64 61 74 65 73 2e 6c 69 66 65 22 2c 22 62 6f 6b 65 70 69 64 2e 62 6f 6e 64 22 2c 22 62 6f 72 69 73 2e 64 65 22 2c 22 6d 75 6e 64 6f 63 69 6e 65 6d 61 74 6f 67 72 61 66 69 63 6f 2e 6e 65 74 22 2c 22 62 65 74 61 63 65 6e 74 61 75 72 69 2e 74 6f 70 22 2c 22 6f 6d 67 6e 6f 74 65 2e 6e 65 74 6c 69 66 79 2e 61 70 70 22 2c 22 67 72 6f 77 6e 75 70 67 61 6c 6f 72 65 2e 6c 69 66 65 22 2c 22 69 6d 70 6f 73 73 69 62 6c 65 6f 66 66 65 72 73 2e 63 6f 6d 22 2c 22 76 6b 73 74 72 65 61 6d 2e 74 6f 70 22 2c 22 68 6f 74 70 72 6f 6d 6f 74 69 6f 6e 73 2e 6f 6e 6c 69 6e 65 22 2c 22 69 6f 2e 6b
                                                  Data Ascii: ,"discloseprogramwednesday.com","kinonews.pro","ohnydelightfuldates.life","bokepid.bond","boris.de","mundocinematografico.net","betacentauri.top","omgnote.netlify.app","grownupgalore.life","impossibleoffers.com","vkstream.top","hotpromotions.online","io.k
                                                  2024-07-22 10:34:36 UTC1369INData Raw: 2e 69 74 22 2c 22 6f 6f 72 63 61 73 65 6c 6c 73 2e 63 6f 6d 22 2c 22 6f 6e 65 64 61 73 68 2e 6e 65 74 22 2c 22 74 70 61 73 2e 72 75 22 2c 22 74 65 6e 69 38 35 73 74 61 62 30 31 64 2e 63 6f 6d 22 2c 22 74 68 6f 73 65 63 61 6e 64 79 2e 63 6f 6d 22 2c 22 6e 69 6c 6b 6e 61 72 66 2e 78 79 7a 22 2c 22 72 65 69 66 65 66 72 61 75 65 6e 2e 63 6f 6d 22 2c 22 72 6f 73 65 33 33 2e 74 6f 70 22 2c 22 73 74 6f 6e 65 61 67 65 70 65 64 69 61 2e 63 6f 6d 22 2c 22 6d 79 70 72 69 76 61 74 65 2e 70 69 63 73 22 2c 22 73 6e 61 70 78 2e 69 6e 66 6f 22 2c 22 67 74 61 75 74 6f 63 6c 69 63 6b 65 72 2e 63 6f 6d 22 2c 22 66 6d 6f 76 69 65 7a 2e 69 6e 66 6f 22 2c 22 63 6f 6d 65 73 68 6f 70 69 6e 67 2e 74 6f 6b 79 6f 22 2c 22 70 65 6c 69 73 78 70 6f 72 6e 6f 2e 6e 65 74 22 2c 22 63 68
                                                  Data Ascii: .it","oorcasells.com","onedash.net","tpas.ru","teni85stab01d.com","thosecandy.com","nilknarf.xyz","reifefrauen.com","rose33.top","stoneagepedia.com","myprivate.pics","snapx.info","gtautoclicker.com","fmoviez.info","comeshoping.tokyo","pelisxporno.net","ch
                                                  2024-07-22 10:34:36 UTC1369INData Raw: 70 74 34 72 75 73 2e 72 75 22 2c 22 6c 69 76 65 64 73 6b 61 74 65 72 61 69 73 69 6e 2e 63 6f 6d 22 2c 22 61 79 65 6a 6f 6d 65 72 2e 74 6f 70 22 2c 22 6e 6a 69 32 30 2e 78 79 7a 22 2c 22 67 61 6c 61 78 79 62 79 63 6f 69 6e 2e 63 6f 6d 22 2c 22 65 73 74 61 69 6c 6f 66 61 73 68 69 6f 6e 2e 63 6f 6d 22 2c 22 61 72 63 68 65 75 72 6f 70 65 2e 69 6e 66 6f 22 2c 22 65 7a 63 67 6f 6a 61 61 6d 67 2e 63 6f 6d 22 2c 22 68 2d 67 65 6e 2e 78 79 7a 22 2c 22 78 6e 2d 2d 39 30 61 61 76 6d 66 69 37 62 31 64 2e 78 79 7a 22 2c 22 6c 69 62 72 6f 73 72 65 63 6f 6d 65 6e 64 61 64 6f 73 73 2e 63 6f 6d 22 2c 22 75 74 69 6c 69 74 79 70 72 65 73 65 6e 74 2e 63 6f 6d 22 2c 22 74 68 65 67 61 6d 65 70 6c 61 79 2e 6c 69 66 65 22 2c 22 61 69 36 38 36 38 2e 74 6f 70 22 2c 22 78 79 63 6c
                                                  Data Ascii: pt4rus.ru","livedskateraisin.com","ayejomer.top","nji20.xyz","galaxybycoin.com","estailofashion.com","archeurope.info","ezcgojaamg.com","h-gen.xyz","xn--90aavmfi7b1d.xyz","librosrecomendadoss.com","utilitypresent.com","thegameplay.life","ai6868.top","xycl


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  53192.168.2.449867104.16.148.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:36 UTC62OUTGET /api/v2/url/blacklist HTTP/1.1
                                                  Host: acs.lavasoft.com
                                                  2024-07-22 10:34:36 UTC324INHTTP/1.1 301 Moved Permanently
                                                  Date: Mon, 22 Jul 2024 10:34:36 GMT
                                                  Content-Length: 0
                                                  Connection: close
                                                  Cache-Control: public
                                                  Cache-Control: max-age=86400
                                                  Location: https://acscdn.lavasoft.com/urlblacklist.json
                                                  api-supported-versions: 2.0
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c778cf8c3308-EWR


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  54192.168.2.449868104.16.148.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:36 UTC62OUTGET /api/v2/url/blacklist HTTP/1.1
                                                  Host: acs.lavasoft.com
                                                  2024-07-22 10:34:36 UTC324INHTTP/1.1 301 Moved Permanently
                                                  Date: Mon, 22 Jul 2024 10:34:36 GMT
                                                  Content-Length: 0
                                                  Connection: close
                                                  Cache-Control: public
                                                  Cache-Control: max-age=86400
                                                  Location: https://acscdn.lavasoft.com/urlblacklist.json
                                                  api-supported-versions: 2.0
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c778ccca1a30-EWR


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  55192.168.2.449866104.16.149.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:36 UTC149OUTPOST /v1/event-stat?Type=Error&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 665
                                                  2024-07-22 10:34:36 UTC665OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 45 78 63 65 70 74 69 6f 6e 22 3a 22 53 79 73 74 65 6d 2e 4e 75 6c 6c 52 65 66 65 72 65 6e 63 65 45 78 63 65 70 74 69 6f 6e 3a 20 4f 62 6a 65 63 74 20 72 65 66 65 72 65 6e 63 65 20 6e 6f 74 20 73 65 74 20 74 6f 20 61 6e 20 69 6e 73 74 61 6e 63 65 20 6f 66 20 61 6e 20 6f 62 6a 65 63 74 2e 5c 72 5c 6e 20 20 20 61 74 20 57 65 62 43 6f 6d 70 61 6e 69 6f 6e 2e 55 49 2e 41 70 70 43 6f 72 65 2e 50 6f 73 74 52 75 6e 2e 46 65 61 74 75 72 65 41 63 74 69 6f 6e 48 65 6c 70 65 72 2e 49 6e 69 74 69 61 6c 69 7a 65 28 4c 69 73 74 60 31 20 63 6f 6d 6d 61 6e 64 4c 69 6e 65 41 72 67 73 2c 20 42 6f 6f 6c 65 61 6e 20 74 69 6d 65 72 2c 20 53 74 72 69 6e 67 20 66 65 61 74 75 72 65 6e 61 6d 65 29 22 2c 22 45 78 63 65 70 74 69 6f 6e 54 79 70 65 22
                                                  Data Ascii: {"Data": {"Exception":"System.NullReferenceException: Object reference not set to an instance of an object.\r\n at WebCompanion.UI.AppCore.PostRun.FeatureActionHelper.Initialize(List`1 commandLineArgs, Boolean timer, String featurename)","ExceptionType"
                                                  2024-07-22 10:34:36 UTC479INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:36 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: close
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c77c1cc78c17-EWR
                                                  2024-07-22 10:34:36 UTC35INData Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}
                                                  2024-07-22 10:34:36 UTC5INData Raw: 30 0d 0a 0d 0a
                                                  Data Ascii: 0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  56192.168.2.449886104.16.149.130443984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:36 UTC156OUTPOST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 364
                                                  2024-07-22 10:34:36 UTC364OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 45 76 65 6e 74 44 61 74 61 22 3a 22 32 34 68 72 73 22 2c 22 45 76 65 6e 74 4e 61 6d 65 22 3a 22 4d 69 63 72 6f 74 61 72 67 65 74 69 6e 67 54 69 6d 65 72 22 2c 22 42 72 6f 77 73 65 72 4e 61 6d 65 22 3a 22 22 2c 22 53 65 61 72 63 68 45 6e 67 69 6e 65 22 3a 22 22 2c 22 49 6e 73 74 61 6c 6c 44 61 74 65 22 3a 22 32 30 32 34 2d 30 37 2d 32 32 54 30 30 3a 30 30 3a 30 30 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65 2d 31 31 32 38 2d 34 65 36 30 2d 62 65 65 61 2d 32 37 32 30 34 31 64 66 36 34 35 32 22 2c 22 4c 61 6e 67 75 61 67 65 22 3a 22 65 6e 2d 55 53 22 2c 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22
                                                  Data Ascii: {"Data": {"EventData":"24hrs","EventName":"MicrotargetingTimer","BrowserName":"","SearchEngine":"","InstallDate":"2024-07-22T00:00:00","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Language":"en-US","MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698"
                                                  2024-07-22 10:34:36 UTC479INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:36 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: close
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c77b9b8cc336-EWR
                                                  2024-07-22 10:34:36 UTC35INData Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}
                                                  2024-07-22 10:34:36 UTC5INData Raw: 30 0d 0a 0d 0a
                                                  Data Ascii: 0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  57192.168.2.449889104.16.148.130443984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:36 UTC62OUTGET /api/v2/url/blacklist HTTP/1.1
                                                  Host: acs.lavasoft.com
                                                  2024-07-22 10:34:36 UTC324INHTTP/1.1 301 Moved Permanently
                                                  Date: Mon, 22 Jul 2024 10:34:36 GMT
                                                  Content-Length: 0
                                                  Connection: close
                                                  Cache-Control: public
                                                  Cache-Control: max-age=86400
                                                  Location: https://acscdn.lavasoft.com/urlblacklist.json
                                                  api-supported-versions: 2.0
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c77bef814235-EWR


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  58192.168.2.449887104.16.149.130443984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:36 UTC86OUTGET /urlblacklist.json HTTP/1.1
                                                  Host: acscdn.lavasoft.com
                                                  Connection: Keep-Alive
                                                  2024-07-22 10:34:36 UTC385INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:36 GMT
                                                  Content-Type: application/json
                                                  Content-Length: 201625
                                                  Connection: close
                                                  Last-Modified: Wed, 15 Nov 2023 13:57:17 GMT
                                                  ETag: "6554ce3d-31399"
                                                  CF-Cache-Status: HIT
                                                  Age: 62193
                                                  Expires: Tue, 23 Jul 2024 06:34:36 GMT
                                                  Cache-Control: public, max-age=72000
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c77bfd224295-EWR
                                                  2024-07-22 10:34:36 UTC984INData Raw: 5b 22 6c 61 69 7a 68 65 6e 67 73 6c 74 2e 63 6e 22 2c 22 6d 79 74 6f 6f 6c 7a 2e 6e 65 74 22 2c 22 70 72 6f 74 65 63 74 32 34 37 2e 6f 6e 6c 69 6e 65 22 2c 22 78 78 6c 61 73 74 2e 63 6f 6d 22 2c 22 77 6f 72 6c 64 73 61 6e 61 6c 79 74 69 63 73 2e 63 6f 6d 22 2c 22 73 6b 69 6c 6c 74 72 61 6e 73 66 6f 72 6d 2e 63 6f 2e 69 6e 22 2c 22 6c 65 6c 61 65 72 2e 63 6f 6d 22 2c 22 6a 70 6f 70 73 69 6e 67 6c 65 73 2e 65 75 22 2c 22 72 69 73 71 75 65 67 61 6c 6b 78 2e 63 6f 6d 22 2c 22 73 76 65 74 76 79 68 6f 64 2e 73 6b 22 2c 22 6d 6f 76 69 65 63 72 75 6d 62 73 2e 6e 65 74 22 2c 22 70 68 72 61 62 75 2e 67 6f 2e 74 68 22 2c 22 6f 6e 6c 79 69 6e 64 69 61 6e 78 2e 63 63 22 2c 22 69 6b 69 73 73 2e 6f 6e 6c 69 6e 65 22 2c 22 75 72 65 77 73 61 77 61 6e 69 2e 61 75 74 6f 73
                                                  Data Ascii: ["laizhengslt.cn","mytoolz.net","protect247.online","xxlast.com","worldsanalytics.com","skilltransform.co.in","lelaer.com","jpopsingles.eu","risquegalkx.com","svetvyhod.sk","moviecrumbs.net","phrabu.go.th","onlyindianx.cc","ikiss.online","urewsawani.autos
                                                  2024-07-22 10:34:36 UTC1369INData Raw: 6b 61 74 6d 6f 76 69 65 68 64 2e 6d 6f 76 22 2c 22 62 6c 75 65 67 61 73 6c 61 6d 70 2e 6f 72 67 22 2c 22 64 72 61 67 67 65 64 6c 69 6e 65 2e 6f 72 67 22 2c 22 67 68 35 79 73 33 67 72 79 35 64 35 33 32 2e 78 79 7a 22 2c 22 6b 61 61 6d 75 75 2e 6f 72 67 22 2c 22 73 61 6f 6d 61 32 32 30 2e 78 79 7a 22 2c 22 6c 69 76 65 74 76 33 36 35 2e 6d 65 22 2c 22 70 69 73 69 2e 70 69 63 73 22 2c 22 76 61 6c 75 65 2d 6c 69 66 65 2e 78 79 7a 22 2c 22 72 69 64 6f 6d 6f 76 69 65 73 2e 74 76 22 2c 22 70 68 69 6c 77 69 6e 2e 70 68 22 2c 22 61 64 6d 69 72 61 6c 73 68 69 70 70 69 6e 67 2e 63 6f 6d 22 2c 22 66 72 65 65 74 6f 6f 6c 6f 6e 6c 69 6e 65 2e 63 6f 6d 22 2c 22 76 69 74 61 6c 61 6d 73 65 65 2e 63 6f 6d 22 2c 22 6f 72 69 67 6c 6e 61 6c 64 61 74 65 2e 63 6f 6d 22 2c 22 72
                                                  Data Ascii: katmoviehd.mov","bluegaslamp.org","draggedline.org","gh5ys3gry5d532.xyz","kaamuu.org","saoma220.xyz","livetv365.me","pisi.pics","value-life.xyz","ridomovies.tv","philwin.ph","admiralshipping.com","freetoolonline.com","vitalamsee.com","origlnaldate.com","r
                                                  2024-07-22 10:34:36 UTC1369INData Raw: 79 2e 63 6f 6d 22 2c 22 61 69 73 68 6f 72 74 2e 74 6f 70 22 2c 22 70 72 6f 6d 6c 61 7a 65 72 2e 72 75 22 2c 22 6c 65 66 74 62 69 6c 6c 2e 74 6f 70 22 2c 22 75 70 73 63 61 72 72 69 61 67 65 70 61 79 6d 65 6e 74 2e 63 6f 6d 22 2c 22 69 6e 76 65 73 74 6c 69 65 2e 63 6f 6d 22 2c 22 74 35 2d 77 69 6b 69 2e 64 65 22 2c 22 66 72 65 65 73 6f 66 74 72 75 73 2e 72 75 22 2c 22 70 61 70 73 74 72 65 61 6d 2e 63 6c 75 62 22 2c 22 77 6f 72 6c 64 6e 65 77 73 2d 32 34 2e 63 6f 6d 22 2c 22 65 6e 73 74 72 65 61 6d 2e 74 6f 70 22 2c 22 73 6f 72 63 65 72 65 72 6f 66 74 65 61 2e 63 6f 6d 22 2c 22 6d 79 63 6c 69 63 6b 2d 32 2e 63 6f 6d 22 2c 22 6c 65 6c 69 65 7a 6f 72 67 67 72 6f 65 70 2e 6e 6c 22 2c 22 6d 75 61 74 68 65 6e 67 61 79 2e 63 6f 6d 22 2c 22 78 6e 2d 2d 38 30 61 63
                                                  Data Ascii: y.com","aishort.top","promlazer.ru","leftbill.top","upscarriagepayment.com","investlie.com","t5-wiki.de","freesoftrus.ru","papstream.club","worldnews-24.com","enstream.top","sorcereroftea.com","myclick-2.com","leliezorggroep.nl","muathengay.com","xn--80ac
                                                  2024-07-22 10:34:36 UTC1369INData Raw: 64 65 2e 6c 69 66 65 22 2c 22 67 30 66 2e 63 6e 22 2c 22 65 73 75 6e 32 31 2e 63 6e 22 2c 22 62 61 6f 66 65 6e 67 6a 69 68 75 6f 2e 63 6f 6d 22 2c 22 6b 65 79 67 65 6e 73 2e 70 72 6f 22 2c 22 63 68 61 72 6d 61 6e 74 65 73 76 6f 69 73 69 6e 65 73 6d 75 72 65 73 2e 63 6f 6d 22 2c 22 76 69 61 74 72 69 73 2d 65 2d 63 68 61 6e 6e 65 6c 2e 63 6f 6d 22 2c 22 73 68 6f 72 74 6c 79 61 6d 75 73 65 6d 65 6e 74 2e 63 6f 6d 22 2c 22 32 31 39 32 39 2e 72 75 22 2c 22 67 65 74 6d 61 63 6b 65 65 70 65 72 73 6f 66 74 70 72 6f 2e 78 79 7a 22 2c 22 74 68 65 73 79 6e 74 68 65 73 69 73 2e 61 70 70 22 2c 22 63 75 74 69 6c 6e 6b 73 2e 63 6f 6d 22 2c 22 61 75 74 6f 62 69 6b 65 72 73 2e 78 79 7a 22 2c 22 70 69 72 61 74 65 2d 70 72 6f 78 79 2e 74 6f 70 22 2c 22 34 35 2e 31 34 38 2e
                                                  Data Ascii: de.life","g0f.cn","esun21.cn","baofengjihuo.com","keygens.pro","charmantesvoisinesmures.com","viatris-e-channel.com","shortlyamusement.com","21929.ru","getmackeepersoftpro.xyz","thesynthesis.app","cutilnks.com","autobikers.xyz","pirate-proxy.top","45.148.
                                                  2024-07-22 10:34:36 UTC1369INData Raw: 79 77 70 6a 6b 2e 63 6f 6d 22 2c 22 73 79 6c 76 69 6e 61 6e 6f 72 72 65 79 2e 63 6f 6d 22 2c 22 6c 6f 6e 38 38 2e 74 6f 70 22 2c 22 76 6c 61 65 6b 61 6e 2e 6b 7a 22 2c 22 73 75 70 74 72 61 66 2e 63 6f 6d 22 2c 22 67 65 74 66 6c 69 6b 2e 63 6f 6d 22 2c 22 63 6f 6f 6c 74 72 6b 2e 78 79 7a 22 2c 22 66 6c 69 72 74 74 6f 6d 65 2e 63 6f 6d 22 2c 22 6d 61 73 61 63 2e 73 62 73 22 2c 22 6e 61 69 6c 6d 61 67 61 7a 69 6e 65 2e 6f 6e 6c 69 6e 65 22 2c 22 72 6f 76 32 2e 6e 65 74 22 2c 22 63 61 73 74 6c 65 63 61 70 69 74 61 6c 2e 76 63 22 2c 22 6d 6f 62 69 6c 65 74 6f 72 72 65 6e 74 2e 69 6e 66 6f 22 2c 22 63 77 62 74 69 2e 63 6f 6d 2e 62 72 22 2c 22 70 6f 73 61 64 61 6c 61 72 6f 62 6c 65 64 61 2e 63 6f 6d 22 2c 22 61 6c 6c 75 72 69 6e 67 67 61 6c 67 2e 63 6f 6d 22 2c
                                                  Data Ascii: ywpjk.com","sylvinanorrey.com","lon88.top","vlaekan.kz","suptraf.com","getflik.com","cooltrk.xyz","flirttome.com","masac.sbs","nailmagazine.online","rov2.net","castlecapital.vc","mobiletorrent.info","cwbti.com.br","posadalarobleda.com","alluringgalg.com",
                                                  2024-07-22 10:34:36 UTC1369INData Raw: 2c 22 74 6f 72 69 6f 6c 75 6f 72 2e 63 6f 6d 22 2c 22 63 72 61 63 6b 73 75 72 6c 2e 63 6f 6d 22 2c 22 70 72 79 76 69 74 61 6e 6e 79 61 2e 74 6f 70 22 2c 22 63 68 61 6e 67 62 65 65 72 2e 73 69 74 65 22 2c 22 61 64 6f 6e 73 6f 6e 6c 79 64 2e 78 79 7a 22 2c 22 74 68 65 6d 65 6e 63 6f 64 65 2e 63 6f 6d 22 2c 22 70 65 72 61 74 75 72 61 6e 70 65 64 69 61 2e 69 64 22 2c 22 74 65 6c 75 74 6f 70 69 65 7a 2e 63 6c 75 62 22 2c 22 76 73 67 7a 64 64 6a 2e 63 6f 6d 22 2c 22 61 64 61 70 61 2d 67 72 6f 75 70 2e 63 6f 6d 22 2c 22 73 68 65 65 74 2d 6d 75 73 69 63 2e 78 79 7a 22 2c 22 72 6f 63 6b 68 61 74 74 65 72 2e 63 6f 6d 22 2c 22 63 6f 6e 73 63 69 6f 75 73 6e 65 73 73 71 75 61 69 6e 74 2e 63 6f 6d 22 2c 22 76 61 6c 6c 65 73 76 69 73 69 6f 2e 63 61 74 22 2c 22 63 73 69
                                                  Data Ascii: ,"torioluor.com","cracksurl.com","pryvitannya.top","changbeer.site","adonsonlyd.xyz","themencode.com","peraturanpedia.id","telutopiez.club","vsgzddj.com","adapa-group.com","sheet-music.xyz","rockhatter.com","consciousnessquaint.com","vallesvisio.cat","csi
                                                  2024-07-22 10:34:36 UTC1369INData Raw: 2e 63 6f 6d 2e 75 61 22 2c 22 63 61 6d 61 64 6d 69 6e 2e 72 75 22 2c 22 6a 75 62 74 31 32 2e 78 79 7a 22 2c 22 72 6b 6e 2e 67 6f 76 2e 72 75 22 2c 22 31 32 33 6d 6f 76 69 65 2e 6c 74 64 22 2c 22 64 73 32 2e 63 6c 75 62 22 2c 22 79 6f 6d 73 74 2e 6f 72 67 22 2c 22 73 75 69 62 65 2e 65 64 75 2e 63 6e 22 2c 22 38 78 62 65 74 33 30 30 2e 63 6f 6d 22 2c 22 61 70 70 6c 65 69 64 78 79 2e 74 6f 70 22 2c 22 62 69 6f 6c 61 62 73 68 6f 70 32 34 2e 63 6f 6d 22 2c 22 6d 79 66 69 6c 65 73 74 6f 72 65 2e 63 6f 6d 22 2c 22 6f 72 6b 6c 69 6e 6b 2e 63 6f 6d 22 2c 22 65 78 70 6c 6f 72 72 2e 6e 65 74 22 2c 22 67 6f 74 72 61 63 6b 72 65 64 69 72 65 63 74 2e 63 6f 6d 22 2c 22 6a 61 76 69 65 72 64 65 6c 61 73 65 6e 2e 63 6f 6d 22 2c 22 62 72 69 61 6e 73 73 63 6c 75 62 2e 63 63
                                                  Data Ascii: .com.ua","camadmin.ru","jubt12.xyz","rkn.gov.ru","123movie.ltd","ds2.club","yomst.org","suibe.edu.cn","8xbet300.com","appleidxy.top","biolabshop24.com","myfilestore.com","orklink.com","explorr.net","gotrackredirect.com","javierdelasen.com","brianssclub.cc
                                                  2024-07-22 10:34:36 UTC1369INData Raw: 2c 22 64 69 73 63 6c 6f 73 65 70 72 6f 67 72 61 6d 77 65 64 6e 65 73 64 61 79 2e 63 6f 6d 22 2c 22 6b 69 6e 6f 6e 65 77 73 2e 70 72 6f 22 2c 22 6f 68 6e 79 64 65 6c 69 67 68 74 66 75 6c 64 61 74 65 73 2e 6c 69 66 65 22 2c 22 62 6f 6b 65 70 69 64 2e 62 6f 6e 64 22 2c 22 62 6f 72 69 73 2e 64 65 22 2c 22 6d 75 6e 64 6f 63 69 6e 65 6d 61 74 6f 67 72 61 66 69 63 6f 2e 6e 65 74 22 2c 22 62 65 74 61 63 65 6e 74 61 75 72 69 2e 74 6f 70 22 2c 22 6f 6d 67 6e 6f 74 65 2e 6e 65 74 6c 69 66 79 2e 61 70 70 22 2c 22 67 72 6f 77 6e 75 70 67 61 6c 6f 72 65 2e 6c 69 66 65 22 2c 22 69 6d 70 6f 73 73 69 62 6c 65 6f 66 66 65 72 73 2e 63 6f 6d 22 2c 22 76 6b 73 74 72 65 61 6d 2e 74 6f 70 22 2c 22 68 6f 74 70 72 6f 6d 6f 74 69 6f 6e 73 2e 6f 6e 6c 69 6e 65 22 2c 22 69 6f 2e 6b
                                                  Data Ascii: ,"discloseprogramwednesday.com","kinonews.pro","ohnydelightfuldates.life","bokepid.bond","boris.de","mundocinematografico.net","betacentauri.top","omgnote.netlify.app","grownupgalore.life","impossibleoffers.com","vkstream.top","hotpromotions.online","io.k
                                                  2024-07-22 10:34:36 UTC1369INData Raw: 2e 69 74 22 2c 22 6f 6f 72 63 61 73 65 6c 6c 73 2e 63 6f 6d 22 2c 22 6f 6e 65 64 61 73 68 2e 6e 65 74 22 2c 22 74 70 61 73 2e 72 75 22 2c 22 74 65 6e 69 38 35 73 74 61 62 30 31 64 2e 63 6f 6d 22 2c 22 74 68 6f 73 65 63 61 6e 64 79 2e 63 6f 6d 22 2c 22 6e 69 6c 6b 6e 61 72 66 2e 78 79 7a 22 2c 22 72 65 69 66 65 66 72 61 75 65 6e 2e 63 6f 6d 22 2c 22 72 6f 73 65 33 33 2e 74 6f 70 22 2c 22 73 74 6f 6e 65 61 67 65 70 65 64 69 61 2e 63 6f 6d 22 2c 22 6d 79 70 72 69 76 61 74 65 2e 70 69 63 73 22 2c 22 73 6e 61 70 78 2e 69 6e 66 6f 22 2c 22 67 74 61 75 74 6f 63 6c 69 63 6b 65 72 2e 63 6f 6d 22 2c 22 66 6d 6f 76 69 65 7a 2e 69 6e 66 6f 22 2c 22 63 6f 6d 65 73 68 6f 70 69 6e 67 2e 74 6f 6b 79 6f 22 2c 22 70 65 6c 69 73 78 70 6f 72 6e 6f 2e 6e 65 74 22 2c 22 63 68
                                                  Data Ascii: .it","oorcasells.com","onedash.net","tpas.ru","teni85stab01d.com","thosecandy.com","nilknarf.xyz","reifefrauen.com","rose33.top","stoneagepedia.com","myprivate.pics","snapx.info","gtautoclicker.com","fmoviez.info","comeshoping.tokyo","pelisxporno.net","ch
                                                  2024-07-22 10:34:36 UTC1369INData Raw: 70 74 34 72 75 73 2e 72 75 22 2c 22 6c 69 76 65 64 73 6b 61 74 65 72 61 69 73 69 6e 2e 63 6f 6d 22 2c 22 61 79 65 6a 6f 6d 65 72 2e 74 6f 70 22 2c 22 6e 6a 69 32 30 2e 78 79 7a 22 2c 22 67 61 6c 61 78 79 62 79 63 6f 69 6e 2e 63 6f 6d 22 2c 22 65 73 74 61 69 6c 6f 66 61 73 68 69 6f 6e 2e 63 6f 6d 22 2c 22 61 72 63 68 65 75 72 6f 70 65 2e 69 6e 66 6f 22 2c 22 65 7a 63 67 6f 6a 61 61 6d 67 2e 63 6f 6d 22 2c 22 68 2d 67 65 6e 2e 78 79 7a 22 2c 22 78 6e 2d 2d 39 30 61 61 76 6d 66 69 37 62 31 64 2e 78 79 7a 22 2c 22 6c 69 62 72 6f 73 72 65 63 6f 6d 65 6e 64 61 64 6f 73 73 2e 63 6f 6d 22 2c 22 75 74 69 6c 69 74 79 70 72 65 73 65 6e 74 2e 63 6f 6d 22 2c 22 74 68 65 67 61 6d 65 70 6c 61 79 2e 6c 69 66 65 22 2c 22 61 69 36 38 36 38 2e 74 6f 70 22 2c 22 78 79 63 6c
                                                  Data Ascii: pt4rus.ru","livedskateraisin.com","ayejomer.top","nji20.xyz","galaxybycoin.com","estailofashion.com","archeurope.info","ezcgojaamg.com","h-gen.xyz","xn--90aavmfi7b1d.xyz","librosrecomendadoss.com","utilitypresent.com","thegameplay.life","ai6868.top","xycl


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  59192.168.2.449888104.16.149.130443984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:36 UTC86OUTGET /urlblacklist.json HTTP/1.1
                                                  Host: acscdn.lavasoft.com
                                                  Connection: Keep-Alive
                                                  2024-07-22 10:34:36 UTC385INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:36 GMT
                                                  Content-Type: application/json
                                                  Content-Length: 201625
                                                  Connection: close
                                                  Last-Modified: Wed, 15 Nov 2023 13:57:17 GMT
                                                  ETag: "6554ce3d-31399"
                                                  CF-Cache-Status: HIT
                                                  Age: 62193
                                                  Expires: Tue, 23 Jul 2024 06:34:36 GMT
                                                  Cache-Control: public, max-age=72000
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c77bfdd117ad-EWR
                                                  2024-07-22 10:34:36 UTC984INData Raw: 5b 22 6c 61 69 7a 68 65 6e 67 73 6c 74 2e 63 6e 22 2c 22 6d 79 74 6f 6f 6c 7a 2e 6e 65 74 22 2c 22 70 72 6f 74 65 63 74 32 34 37 2e 6f 6e 6c 69 6e 65 22 2c 22 78 78 6c 61 73 74 2e 63 6f 6d 22 2c 22 77 6f 72 6c 64 73 61 6e 61 6c 79 74 69 63 73 2e 63 6f 6d 22 2c 22 73 6b 69 6c 6c 74 72 61 6e 73 66 6f 72 6d 2e 63 6f 2e 69 6e 22 2c 22 6c 65 6c 61 65 72 2e 63 6f 6d 22 2c 22 6a 70 6f 70 73 69 6e 67 6c 65 73 2e 65 75 22 2c 22 72 69 73 71 75 65 67 61 6c 6b 78 2e 63 6f 6d 22 2c 22 73 76 65 74 76 79 68 6f 64 2e 73 6b 22 2c 22 6d 6f 76 69 65 63 72 75 6d 62 73 2e 6e 65 74 22 2c 22 70 68 72 61 62 75 2e 67 6f 2e 74 68 22 2c 22 6f 6e 6c 79 69 6e 64 69 61 6e 78 2e 63 63 22 2c 22 69 6b 69 73 73 2e 6f 6e 6c 69 6e 65 22 2c 22 75 72 65 77 73 61 77 61 6e 69 2e 61 75 74 6f 73
                                                  Data Ascii: ["laizhengslt.cn","mytoolz.net","protect247.online","xxlast.com","worldsanalytics.com","skilltransform.co.in","lelaer.com","jpopsingles.eu","risquegalkx.com","svetvyhod.sk","moviecrumbs.net","phrabu.go.th","onlyindianx.cc","ikiss.online","urewsawani.autos
                                                  2024-07-22 10:34:36 UTC1369INData Raw: 6b 61 74 6d 6f 76 69 65 68 64 2e 6d 6f 76 22 2c 22 62 6c 75 65 67 61 73 6c 61 6d 70 2e 6f 72 67 22 2c 22 64 72 61 67 67 65 64 6c 69 6e 65 2e 6f 72 67 22 2c 22 67 68 35 79 73 33 67 72 79 35 64 35 33 32 2e 78 79 7a 22 2c 22 6b 61 61 6d 75 75 2e 6f 72 67 22 2c 22 73 61 6f 6d 61 32 32 30 2e 78 79 7a 22 2c 22 6c 69 76 65 74 76 33 36 35 2e 6d 65 22 2c 22 70 69 73 69 2e 70 69 63 73 22 2c 22 76 61 6c 75 65 2d 6c 69 66 65 2e 78 79 7a 22 2c 22 72 69 64 6f 6d 6f 76 69 65 73 2e 74 76 22 2c 22 70 68 69 6c 77 69 6e 2e 70 68 22 2c 22 61 64 6d 69 72 61 6c 73 68 69 70 70 69 6e 67 2e 63 6f 6d 22 2c 22 66 72 65 65 74 6f 6f 6c 6f 6e 6c 69 6e 65 2e 63 6f 6d 22 2c 22 76 69 74 61 6c 61 6d 73 65 65 2e 63 6f 6d 22 2c 22 6f 72 69 67 6c 6e 61 6c 64 61 74 65 2e 63 6f 6d 22 2c 22 72
                                                  Data Ascii: katmoviehd.mov","bluegaslamp.org","draggedline.org","gh5ys3gry5d532.xyz","kaamuu.org","saoma220.xyz","livetv365.me","pisi.pics","value-life.xyz","ridomovies.tv","philwin.ph","admiralshipping.com","freetoolonline.com","vitalamsee.com","origlnaldate.com","r
                                                  2024-07-22 10:34:36 UTC1369INData Raw: 79 2e 63 6f 6d 22 2c 22 61 69 73 68 6f 72 74 2e 74 6f 70 22 2c 22 70 72 6f 6d 6c 61 7a 65 72 2e 72 75 22 2c 22 6c 65 66 74 62 69 6c 6c 2e 74 6f 70 22 2c 22 75 70 73 63 61 72 72 69 61 67 65 70 61 79 6d 65 6e 74 2e 63 6f 6d 22 2c 22 69 6e 76 65 73 74 6c 69 65 2e 63 6f 6d 22 2c 22 74 35 2d 77 69 6b 69 2e 64 65 22 2c 22 66 72 65 65 73 6f 66 74 72 75 73 2e 72 75 22 2c 22 70 61 70 73 74 72 65 61 6d 2e 63 6c 75 62 22 2c 22 77 6f 72 6c 64 6e 65 77 73 2d 32 34 2e 63 6f 6d 22 2c 22 65 6e 73 74 72 65 61 6d 2e 74 6f 70 22 2c 22 73 6f 72 63 65 72 65 72 6f 66 74 65 61 2e 63 6f 6d 22 2c 22 6d 79 63 6c 69 63 6b 2d 32 2e 63 6f 6d 22 2c 22 6c 65 6c 69 65 7a 6f 72 67 67 72 6f 65 70 2e 6e 6c 22 2c 22 6d 75 61 74 68 65 6e 67 61 79 2e 63 6f 6d 22 2c 22 78 6e 2d 2d 38 30 61 63
                                                  Data Ascii: y.com","aishort.top","promlazer.ru","leftbill.top","upscarriagepayment.com","investlie.com","t5-wiki.de","freesoftrus.ru","papstream.club","worldnews-24.com","enstream.top","sorcereroftea.com","myclick-2.com","leliezorggroep.nl","muathengay.com","xn--80ac
                                                  2024-07-22 10:34:36 UTC1369INData Raw: 64 65 2e 6c 69 66 65 22 2c 22 67 30 66 2e 63 6e 22 2c 22 65 73 75 6e 32 31 2e 63 6e 22 2c 22 62 61 6f 66 65 6e 67 6a 69 68 75 6f 2e 63 6f 6d 22 2c 22 6b 65 79 67 65 6e 73 2e 70 72 6f 22 2c 22 63 68 61 72 6d 61 6e 74 65 73 76 6f 69 73 69 6e 65 73 6d 75 72 65 73 2e 63 6f 6d 22 2c 22 76 69 61 74 72 69 73 2d 65 2d 63 68 61 6e 6e 65 6c 2e 63 6f 6d 22 2c 22 73 68 6f 72 74 6c 79 61 6d 75 73 65 6d 65 6e 74 2e 63 6f 6d 22 2c 22 32 31 39 32 39 2e 72 75 22 2c 22 67 65 74 6d 61 63 6b 65 65 70 65 72 73 6f 66 74 70 72 6f 2e 78 79 7a 22 2c 22 74 68 65 73 79 6e 74 68 65 73 69 73 2e 61 70 70 22 2c 22 63 75 74 69 6c 6e 6b 73 2e 63 6f 6d 22 2c 22 61 75 74 6f 62 69 6b 65 72 73 2e 78 79 7a 22 2c 22 70 69 72 61 74 65 2d 70 72 6f 78 79 2e 74 6f 70 22 2c 22 34 35 2e 31 34 38 2e
                                                  Data Ascii: de.life","g0f.cn","esun21.cn","baofengjihuo.com","keygens.pro","charmantesvoisinesmures.com","viatris-e-channel.com","shortlyamusement.com","21929.ru","getmackeepersoftpro.xyz","thesynthesis.app","cutilnks.com","autobikers.xyz","pirate-proxy.top","45.148.
                                                  2024-07-22 10:34:36 UTC1369INData Raw: 79 77 70 6a 6b 2e 63 6f 6d 22 2c 22 73 79 6c 76 69 6e 61 6e 6f 72 72 65 79 2e 63 6f 6d 22 2c 22 6c 6f 6e 38 38 2e 74 6f 70 22 2c 22 76 6c 61 65 6b 61 6e 2e 6b 7a 22 2c 22 73 75 70 74 72 61 66 2e 63 6f 6d 22 2c 22 67 65 74 66 6c 69 6b 2e 63 6f 6d 22 2c 22 63 6f 6f 6c 74 72 6b 2e 78 79 7a 22 2c 22 66 6c 69 72 74 74 6f 6d 65 2e 63 6f 6d 22 2c 22 6d 61 73 61 63 2e 73 62 73 22 2c 22 6e 61 69 6c 6d 61 67 61 7a 69 6e 65 2e 6f 6e 6c 69 6e 65 22 2c 22 72 6f 76 32 2e 6e 65 74 22 2c 22 63 61 73 74 6c 65 63 61 70 69 74 61 6c 2e 76 63 22 2c 22 6d 6f 62 69 6c 65 74 6f 72 72 65 6e 74 2e 69 6e 66 6f 22 2c 22 63 77 62 74 69 2e 63 6f 6d 2e 62 72 22 2c 22 70 6f 73 61 64 61 6c 61 72 6f 62 6c 65 64 61 2e 63 6f 6d 22 2c 22 61 6c 6c 75 72 69 6e 67 67 61 6c 67 2e 63 6f 6d 22 2c
                                                  Data Ascii: ywpjk.com","sylvinanorrey.com","lon88.top","vlaekan.kz","suptraf.com","getflik.com","cooltrk.xyz","flirttome.com","masac.sbs","nailmagazine.online","rov2.net","castlecapital.vc","mobiletorrent.info","cwbti.com.br","posadalarobleda.com","alluringgalg.com",
                                                  2024-07-22 10:34:36 UTC1369INData Raw: 2c 22 74 6f 72 69 6f 6c 75 6f 72 2e 63 6f 6d 22 2c 22 63 72 61 63 6b 73 75 72 6c 2e 63 6f 6d 22 2c 22 70 72 79 76 69 74 61 6e 6e 79 61 2e 74 6f 70 22 2c 22 63 68 61 6e 67 62 65 65 72 2e 73 69 74 65 22 2c 22 61 64 6f 6e 73 6f 6e 6c 79 64 2e 78 79 7a 22 2c 22 74 68 65 6d 65 6e 63 6f 64 65 2e 63 6f 6d 22 2c 22 70 65 72 61 74 75 72 61 6e 70 65 64 69 61 2e 69 64 22 2c 22 74 65 6c 75 74 6f 70 69 65 7a 2e 63 6c 75 62 22 2c 22 76 73 67 7a 64 64 6a 2e 63 6f 6d 22 2c 22 61 64 61 70 61 2d 67 72 6f 75 70 2e 63 6f 6d 22 2c 22 73 68 65 65 74 2d 6d 75 73 69 63 2e 78 79 7a 22 2c 22 72 6f 63 6b 68 61 74 74 65 72 2e 63 6f 6d 22 2c 22 63 6f 6e 73 63 69 6f 75 73 6e 65 73 73 71 75 61 69 6e 74 2e 63 6f 6d 22 2c 22 76 61 6c 6c 65 73 76 69 73 69 6f 2e 63 61 74 22 2c 22 63 73 69
                                                  Data Ascii: ,"torioluor.com","cracksurl.com","pryvitannya.top","changbeer.site","adonsonlyd.xyz","themencode.com","peraturanpedia.id","telutopiez.club","vsgzddj.com","adapa-group.com","sheet-music.xyz","rockhatter.com","consciousnessquaint.com","vallesvisio.cat","csi
                                                  2024-07-22 10:34:36 UTC1369INData Raw: 2e 63 6f 6d 2e 75 61 22 2c 22 63 61 6d 61 64 6d 69 6e 2e 72 75 22 2c 22 6a 75 62 74 31 32 2e 78 79 7a 22 2c 22 72 6b 6e 2e 67 6f 76 2e 72 75 22 2c 22 31 32 33 6d 6f 76 69 65 2e 6c 74 64 22 2c 22 64 73 32 2e 63 6c 75 62 22 2c 22 79 6f 6d 73 74 2e 6f 72 67 22 2c 22 73 75 69 62 65 2e 65 64 75 2e 63 6e 22 2c 22 38 78 62 65 74 33 30 30 2e 63 6f 6d 22 2c 22 61 70 70 6c 65 69 64 78 79 2e 74 6f 70 22 2c 22 62 69 6f 6c 61 62 73 68 6f 70 32 34 2e 63 6f 6d 22 2c 22 6d 79 66 69 6c 65 73 74 6f 72 65 2e 63 6f 6d 22 2c 22 6f 72 6b 6c 69 6e 6b 2e 63 6f 6d 22 2c 22 65 78 70 6c 6f 72 72 2e 6e 65 74 22 2c 22 67 6f 74 72 61 63 6b 72 65 64 69 72 65 63 74 2e 63 6f 6d 22 2c 22 6a 61 76 69 65 72 64 65 6c 61 73 65 6e 2e 63 6f 6d 22 2c 22 62 72 69 61 6e 73 73 63 6c 75 62 2e 63 63
                                                  Data Ascii: .com.ua","camadmin.ru","jubt12.xyz","rkn.gov.ru","123movie.ltd","ds2.club","yomst.org","suibe.edu.cn","8xbet300.com","appleidxy.top","biolabshop24.com","myfilestore.com","orklink.com","explorr.net","gotrackredirect.com","javierdelasen.com","brianssclub.cc
                                                  2024-07-22 10:34:36 UTC1369INData Raw: 2c 22 64 69 73 63 6c 6f 73 65 70 72 6f 67 72 61 6d 77 65 64 6e 65 73 64 61 79 2e 63 6f 6d 22 2c 22 6b 69 6e 6f 6e 65 77 73 2e 70 72 6f 22 2c 22 6f 68 6e 79 64 65 6c 69 67 68 74 66 75 6c 64 61 74 65 73 2e 6c 69 66 65 22 2c 22 62 6f 6b 65 70 69 64 2e 62 6f 6e 64 22 2c 22 62 6f 72 69 73 2e 64 65 22 2c 22 6d 75 6e 64 6f 63 69 6e 65 6d 61 74 6f 67 72 61 66 69 63 6f 2e 6e 65 74 22 2c 22 62 65 74 61 63 65 6e 74 61 75 72 69 2e 74 6f 70 22 2c 22 6f 6d 67 6e 6f 74 65 2e 6e 65 74 6c 69 66 79 2e 61 70 70 22 2c 22 67 72 6f 77 6e 75 70 67 61 6c 6f 72 65 2e 6c 69 66 65 22 2c 22 69 6d 70 6f 73 73 69 62 6c 65 6f 66 66 65 72 73 2e 63 6f 6d 22 2c 22 76 6b 73 74 72 65 61 6d 2e 74 6f 70 22 2c 22 68 6f 74 70 72 6f 6d 6f 74 69 6f 6e 73 2e 6f 6e 6c 69 6e 65 22 2c 22 69 6f 2e 6b
                                                  Data Ascii: ,"discloseprogramwednesday.com","kinonews.pro","ohnydelightfuldates.life","bokepid.bond","boris.de","mundocinematografico.net","betacentauri.top","omgnote.netlify.app","grownupgalore.life","impossibleoffers.com","vkstream.top","hotpromotions.online","io.k
                                                  2024-07-22 10:34:36 UTC1369INData Raw: 2e 69 74 22 2c 22 6f 6f 72 63 61 73 65 6c 6c 73 2e 63 6f 6d 22 2c 22 6f 6e 65 64 61 73 68 2e 6e 65 74 22 2c 22 74 70 61 73 2e 72 75 22 2c 22 74 65 6e 69 38 35 73 74 61 62 30 31 64 2e 63 6f 6d 22 2c 22 74 68 6f 73 65 63 61 6e 64 79 2e 63 6f 6d 22 2c 22 6e 69 6c 6b 6e 61 72 66 2e 78 79 7a 22 2c 22 72 65 69 66 65 66 72 61 75 65 6e 2e 63 6f 6d 22 2c 22 72 6f 73 65 33 33 2e 74 6f 70 22 2c 22 73 74 6f 6e 65 61 67 65 70 65 64 69 61 2e 63 6f 6d 22 2c 22 6d 79 70 72 69 76 61 74 65 2e 70 69 63 73 22 2c 22 73 6e 61 70 78 2e 69 6e 66 6f 22 2c 22 67 74 61 75 74 6f 63 6c 69 63 6b 65 72 2e 63 6f 6d 22 2c 22 66 6d 6f 76 69 65 7a 2e 69 6e 66 6f 22 2c 22 63 6f 6d 65 73 68 6f 70 69 6e 67 2e 74 6f 6b 79 6f 22 2c 22 70 65 6c 69 73 78 70 6f 72 6e 6f 2e 6e 65 74 22 2c 22 63 68
                                                  Data Ascii: .it","oorcasells.com","onedash.net","tpas.ru","teni85stab01d.com","thosecandy.com","nilknarf.xyz","reifefrauen.com","rose33.top","stoneagepedia.com","myprivate.pics","snapx.info","gtautoclicker.com","fmoviez.info","comeshoping.tokyo","pelisxporno.net","ch
                                                  2024-07-22 10:34:36 UTC1369INData Raw: 70 74 34 72 75 73 2e 72 75 22 2c 22 6c 69 76 65 64 73 6b 61 74 65 72 61 69 73 69 6e 2e 63 6f 6d 22 2c 22 61 79 65 6a 6f 6d 65 72 2e 74 6f 70 22 2c 22 6e 6a 69 32 30 2e 78 79 7a 22 2c 22 67 61 6c 61 78 79 62 79 63 6f 69 6e 2e 63 6f 6d 22 2c 22 65 73 74 61 69 6c 6f 66 61 73 68 69 6f 6e 2e 63 6f 6d 22 2c 22 61 72 63 68 65 75 72 6f 70 65 2e 69 6e 66 6f 22 2c 22 65 7a 63 67 6f 6a 61 61 6d 67 2e 63 6f 6d 22 2c 22 68 2d 67 65 6e 2e 78 79 7a 22 2c 22 78 6e 2d 2d 39 30 61 61 76 6d 66 69 37 62 31 64 2e 78 79 7a 22 2c 22 6c 69 62 72 6f 73 72 65 63 6f 6d 65 6e 64 61 64 6f 73 73 2e 63 6f 6d 22 2c 22 75 74 69 6c 69 74 79 70 72 65 73 65 6e 74 2e 63 6f 6d 22 2c 22 74 68 65 67 61 6d 65 70 6c 61 79 2e 6c 69 66 65 22 2c 22 61 69 36 38 36 38 2e 74 6f 70 22 2c 22 78 79 63 6c
                                                  Data Ascii: pt4rus.ru","livedskateraisin.com","ayejomer.top","nji20.xyz","galaxybycoin.com","estailofashion.com","archeurope.info","ezcgojaamg.com","h-gen.xyz","xn--90aavmfi7b1d.xyz","librosrecomendadoss.com","utilitypresent.com","thegameplay.life","ai6868.top","xycl


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  60192.168.2.449890104.16.148.130443984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:36 UTC62OUTGET /api/v2/url/blacklist HTTP/1.1
                                                  Host: acs.lavasoft.com
                                                  2024-07-22 10:34:36 UTC324INHTTP/1.1 301 Moved Permanently
                                                  Date: Mon, 22 Jul 2024 10:34:36 GMT
                                                  Content-Length: 0
                                                  Connection: close
                                                  Cache-Control: public
                                                  Cache-Control: max-age=86400
                                                  Location: https://acscdn.lavasoft.com/urlblacklist.json
                                                  api-supported-versions: 2.0
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c77c4ad742c1-EWR


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  61192.168.2.449892104.16.149.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:37 UTC156OUTPOST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 364
                                                  2024-07-22 10:34:37 UTC364OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 45 76 65 6e 74 44 61 74 61 22 3a 22 32 34 68 72 73 22 2c 22 45 76 65 6e 74 4e 61 6d 65 22 3a 22 4d 69 63 72 6f 74 61 72 67 65 74 69 6e 67 54 69 6d 65 72 22 2c 22 42 72 6f 77 73 65 72 4e 61 6d 65 22 3a 22 22 2c 22 53 65 61 72 63 68 45 6e 67 69 6e 65 22 3a 22 22 2c 22 49 6e 73 74 61 6c 6c 44 61 74 65 22 3a 22 32 30 32 34 2d 30 37 2d 32 32 54 30 30 3a 30 30 3a 30 30 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65 2d 31 31 32 38 2d 34 65 36 30 2d 62 65 65 61 2d 32 37 32 30 34 31 64 66 36 34 35 32 22 2c 22 4c 61 6e 67 75 61 67 65 22 3a 22 65 6e 2d 55 53 22 2c 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22
                                                  Data Ascii: {"Data": {"EventData":"24hrs","EventName":"MicrotargetingTimer","BrowserName":"","SearchEngine":"","InstallDate":"2024-07-22T00:00:00","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Language":"en-US","MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698"


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  62192.168.2.449894104.16.148.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:37 UTC62OUTGET /api/v2/url/blacklist HTTP/1.1
                                                  Host: acs.lavasoft.com
                                                  2024-07-22 10:34:37 UTC324INHTTP/1.1 301 Moved Permanently
                                                  Date: Mon, 22 Jul 2024 10:34:37 GMT
                                                  Content-Length: 0
                                                  Connection: close
                                                  Cache-Control: public
                                                  Cache-Control: max-age=86400
                                                  Location: https://acscdn.lavasoft.com/urlblacklist.json
                                                  api-supported-versions: 2.0
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c77d9ac180e2-EWR


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  63192.168.2.449893104.16.148.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:37 UTC62OUTGET /api/v2/url/blacklist HTTP/1.1
                                                  Host: acs.lavasoft.com
                                                  2024-07-22 10:34:37 UTC324INHTTP/1.1 301 Moved Permanently
                                                  Date: Mon, 22 Jul 2024 10:34:37 GMT
                                                  Content-Length: 0
                                                  Connection: close
                                                  Cache-Control: public
                                                  Cache-Control: max-age=86400
                                                  Location: https://acscdn.lavasoft.com/urlblacklist.json
                                                  api-supported-versions: 2.0
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c77d9c93186d-EWR


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  64192.168.2.449896104.16.149.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:37 UTC62OUTGET /urlblacklist.json HTTP/1.1
                                                  Host: acscdn.lavasoft.com


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  65192.168.2.449905104.16.149.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:37 UTC161OUTPOST /v1/event-stat?Type=BrowserExtension&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 3043
                                                  2024-07-22 10:34:37 UTC3043OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 42 72 6f 77 73 65 72 22 3a 7b 22 43 68 72 6f 6d 65 22 3a 7b 22 45 78 74 49 6e 66 6f 22 3a 5b 7b 22 69 64 22 3a 22 67 68 62 6d 6e 6e 6a 6f 6f 65 6b 70 6d 6f 65 63 6e 6e 6e 69 6c 6e 6e 62 64 6c 6f 6c 68 6b 68 69 22 2c 22 69 6e 73 74 61 6c 6c 44 61 74 65 22 3a 6e 75 6c 6c 2c 22 75 73 65 72 44 69 73 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 66 6f 72 65 69 67 6e 49 6e 73 74 61 6c 6c 22 3a 66 61 6c 73 65 2c 22 75 70 64 61 74 65 44 61 74 65 22 3a 6e 75 6c 6c 2c 22 76 65 72 73 69 6f 6e 22 3a 6e 75 6c 6c 7d 2c 7b 22 69 64 22 3a 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 2c 22 69 6e 73 74 61 6c 6c 44 61 74 65 22 3a 6e 75 6c 6c 2c 22 75 73 65 72 44 69 73 61 62 6c 65 64 22 3a
                                                  Data Ascii: {"Data": {"Browser":{"Chrome":{"ExtInfo":[{"id":"ghbmnnjooekpmoecnnnilnnbdlolhkhi","installDate":null,"userDisabled":false,"foreignInstall":false,"updateDate":null,"version":null},{"id":"nmmhkkegccagdldgiimedpiccmgmieda","installDate":null,"userDisabled":
                                                  2024-07-22 10:34:37 UTC479INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:37 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: close
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c782ac534326-EWR
                                                  2024-07-22 10:34:37 UTC35INData Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}
                                                  2024-07-22 10:34:37 UTC5INData Raw: 30 0d 0a 0d 0a
                                                  Data Ascii: 0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  66192.168.2.449897104.16.149.130443984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:38 UTC156OUTPOST /v1/event-stat?Type=NanoBrowser&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 1654
                                                  2024-07-22 10:34:38 UTC1654OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 54 72 69 67 67 65 72 22 3a 22 64 61 69 6c 79 61 63 74 69 76 69 74 79 22 2c 22 42 72 6f 77 73 65 72 22 3a 7b 22 43 68 72 6f 6d 65 22 3a 7b 22 49 73 44 65 66 61 75 6c 74 22 3a 74 72 75 65 2c 22 49 73 49 6e 73 74 61 6c 6c 65 64 22 3a 74 72 75 65 2c 22 49 73 52 75 6e 6e 69 6e 67 22 3a 66 61 6c 73 65 2c 22 4f 72 69 67 69 6e 61 6c 48 6f 6d 65 50 61 67 65 22 3a 22 61 62 6f 75 74 3a 68 6f 6d 65 22 2c 22 4f 72 69 67 69 6e 61 6c 53 65 61 72 63 68 22 3a 22 47 6f 6f 67 6c 65 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 7d 2c 22 45 64 67 65 22 3a 7b 22 49 73 44 65 66 61 75 6c 74 22 3a 66 61 6c 73 65 2c 22 49 73 49 6e 73 74 61 6c 6c 65 64 22 3a 66 61 6c 73 65 2c 22 49 73 52 75 6e 6e 69 6e 67 22 3a
                                                  Data Ascii: {"Data": {"Trigger":"dailyactivity","Browser":{"Chrome":{"IsDefault":true,"IsInstalled":true,"IsRunning":false,"OriginalHomePage":"about:home","OriginalSearch":"Google","Version":"117.0.5938.132"},"Edge":{"IsDefault":false,"IsInstalled":false,"IsRunning":
                                                  2024-07-22 10:34:38 UTC479INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:38 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: close
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7848a8043cb-EWR
                                                  2024-07-22 10:34:38 UTC35INData Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}
                                                  2024-07-22 10:34:38 UTC5INData Raw: 30 0d 0a 0d 0a
                                                  Data Ascii: 0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  67192.168.2.449907104.16.149.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:38 UTC62OUTGET /urlblacklist.json HTTP/1.1
                                                  Host: acscdn.lavasoft.com


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  68192.168.2.449901104.16.149.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:38 UTC156OUTPOST /v1/event-stat?Type=NanoBrowser&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 1649
                                                  2024-07-22 10:34:38 UTC1649OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 54 72 69 67 67 65 72 22 3a 22 64 61 69 6c 79 61 63 74 69 76 69 74 79 22 2c 22 42 72 6f 77 73 65 72 22 3a 7b 22 43 68 72 6f 6d 65 22 3a 7b 22 49 73 44 65 66 61 75 6c 74 22 3a 74 72 75 65 2c 22 49 73 49 6e 73 74 61 6c 6c 65 64 22 3a 74 72 75 65 2c 22 49 73 52 75 6e 6e 69 6e 67 22 3a 66 61 6c 73 65 2c 22 4f 72 69 67 69 6e 61 6c 48 6f 6d 65 50 61 67 65 22 3a 22 61 62 6f 75 74 3a 68 6f 6d 65 22 2c 22 4f 72 69 67 69 6e 61 6c 53 65 61 72 63 68 22 3a 22 47 6f 6f 67 6c 65 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 7d 2c 22 45 64 67 65 22 3a 7b 22 49 73 44 65 66 61 75 6c 74 22 3a 66 61 6c 73 65 2c 22 49 73 49 6e 73 74 61 6c 6c 65 64 22 3a 66 61 6c 73 65 2c 22 49 73 52 75 6e 6e 69 6e 67 22 3a
                                                  Data Ascii: {"Data": {"Trigger":"dailyactivity","Browser":{"Chrome":{"IsDefault":true,"IsInstalled":true,"IsRunning":false,"OriginalHomePage":"about:home","OriginalSearch":"Google","Version":"117.0.5938.132"},"Edge":{"IsDefault":false,"IsInstalled":false,"IsRunning":


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  69192.168.2.449899104.16.148.130443984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:38 UTC62OUTGET /api/v2/url/blacklist HTTP/1.1
                                                  Host: acs.lavasoft.com
                                                  2024-07-22 10:34:39 UTC324INHTTP/1.1 301 Moved Permanently
                                                  Date: Mon, 22 Jul 2024 10:34:39 GMT
                                                  Content-Length: 0
                                                  Connection: close
                                                  Cache-Control: public
                                                  Cache-Control: max-age=86400
                                                  Location: https://acscdn.lavasoft.com/urlblacklist.json
                                                  api-supported-versions: 2.0
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c789cacd4346-EWR


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  70192.168.2.449915104.16.149.130443984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:39 UTC156OUTPOST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 364
                                                  2024-07-22 10:34:39 UTC364OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 45 76 65 6e 74 44 61 74 61 22 3a 22 32 34 68 72 73 22 2c 22 45 76 65 6e 74 4e 61 6d 65 22 3a 22 4d 69 63 72 6f 74 61 72 67 65 74 69 6e 67 54 69 6d 65 72 22 2c 22 42 72 6f 77 73 65 72 4e 61 6d 65 22 3a 22 22 2c 22 53 65 61 72 63 68 45 6e 67 69 6e 65 22 3a 22 22 2c 22 49 6e 73 74 61 6c 6c 44 61 74 65 22 3a 22 32 30 32 34 2d 30 37 2d 32 32 54 30 30 3a 30 30 3a 30 30 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65 2d 31 31 32 38 2d 34 65 36 30 2d 62 65 65 61 2d 32 37 32 30 34 31 64 66 36 34 35 32 22 2c 22 4c 61 6e 67 75 61 67 65 22 3a 22 65 6e 2d 55 53 22 2c 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22
                                                  Data Ascii: {"Data": {"EventData":"24hrs","EventName":"MicrotargetingTimer","BrowserName":"","SearchEngine":"","InstallDate":"2024-07-22T00:00:00","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Language":"en-US","MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698"
                                                  2024-07-22 10:34:39 UTC479INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:39 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: close
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c78b0f3a0f84-EWR
                                                  2024-07-22 10:34:39 UTC35INData Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}
                                                  2024-07-22 10:34:39 UTC5INData Raw: 30 0d 0a 0d 0a
                                                  Data Ascii: 0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  71192.168.2.449912104.16.149.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:39 UTC149OUTPOST /v1/event-stat?Type=Error&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 665
                                                  2024-07-22 10:34:39 UTC665OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 45 78 63 65 70 74 69 6f 6e 22 3a 22 53 79 73 74 65 6d 2e 4e 75 6c 6c 52 65 66 65 72 65 6e 63 65 45 78 63 65 70 74 69 6f 6e 3a 20 4f 62 6a 65 63 74 20 72 65 66 65 72 65 6e 63 65 20 6e 6f 74 20 73 65 74 20 74 6f 20 61 6e 20 69 6e 73 74 61 6e 63 65 20 6f 66 20 61 6e 20 6f 62 6a 65 63 74 2e 5c 72 5c 6e 20 20 20 61 74 20 57 65 62 43 6f 6d 70 61 6e 69 6f 6e 2e 55 49 2e 41 70 70 43 6f 72 65 2e 50 6f 73 74 52 75 6e 2e 46 65 61 74 75 72 65 41 63 74 69 6f 6e 48 65 6c 70 65 72 2e 49 6e 69 74 69 61 6c 69 7a 65 28 4c 69 73 74 60 31 20 63 6f 6d 6d 61 6e 64 4c 69 6e 65 41 72 67 73 2c 20 42 6f 6f 6c 65 61 6e 20 74 69 6d 65 72 2c 20 53 74 72 69 6e 67 20 66 65 61 74 75 72 65 6e 61 6d 65 29 22 2c 22 45 78 63 65 70 74 69 6f 6e 54 79 70 65 22
                                                  Data Ascii: {"Data": {"Exception":"System.NullReferenceException: Object reference not set to an instance of an object.\r\n at WebCompanion.UI.AppCore.PostRun.FeatureActionHelper.Initialize(List`1 commandLineArgs, Boolean timer, String featurename)","ExceptionType"
                                                  2024-07-22 10:34:39 UTC479INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:39 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: close
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c78b292f0f97-EWR
                                                  2024-07-22 10:34:39 UTC35INData Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}
                                                  2024-07-22 10:34:39 UTC5INData Raw: 30 0d 0a 0d 0a
                                                  Data Ascii: 0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  72192.168.2.449913104.16.149.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:39 UTC156OUTPOST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 364
                                                  2024-07-22 10:34:39 UTC364OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 45 76 65 6e 74 44 61 74 61 22 3a 22 32 34 68 72 73 22 2c 22 45 76 65 6e 74 4e 61 6d 65 22 3a 22 4d 69 63 72 6f 74 61 72 67 65 74 69 6e 67 54 69 6d 65 72 22 2c 22 42 72 6f 77 73 65 72 4e 61 6d 65 22 3a 22 22 2c 22 53 65 61 72 63 68 45 6e 67 69 6e 65 22 3a 22 22 2c 22 49 6e 73 74 61 6c 6c 44 61 74 65 22 3a 22 32 30 32 34 2d 30 37 2d 32 32 54 30 30 3a 30 30 3a 30 30 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65 2d 31 31 32 38 2d 34 65 36 30 2d 62 65 65 61 2d 32 37 32 30 34 31 64 66 36 34 35 32 22 2c 22 4c 61 6e 67 75 61 67 65 22 3a 22 65 6e 2d 55 53 22 2c 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22
                                                  Data Ascii: {"Data": {"EventData":"24hrs","EventName":"MicrotargetingTimer","BrowserName":"","SearchEngine":"","InstallDate":"2024-07-22T00:00:00","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Language":"en-US","MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698"
                                                  2024-07-22 10:34:39 UTC479INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:39 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: close
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c78bebfa41c3-EWR
                                                  2024-07-22 10:34:39 UTC35INData Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}
                                                  2024-07-22 10:34:39 UTC5INData Raw: 30 0d 0a 0d 0a
                                                  Data Ascii: 0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  73192.168.2.449916104.16.148.130443984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:39 UTC62OUTGET /api/v2/url/blacklist HTTP/1.1
                                                  Host: acs.lavasoft.com
                                                  2024-07-22 10:34:39 UTC324INHTTP/1.1 301 Moved Permanently
                                                  Date: Mon, 22 Jul 2024 10:34:39 GMT
                                                  Content-Length: 0
                                                  Connection: close
                                                  Cache-Control: public
                                                  Cache-Control: max-age=86400
                                                  Location: https://acscdn.lavasoft.com/urlblacklist.json
                                                  api-supported-versions: 2.0
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c78d1f8042c2-EWR


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  74192.168.2.449919104.16.148.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:40 UTC86OUTGET /api/v2/url/blacklist HTTP/1.1
                                                  Host: acs.lavasoft.com
                                                  Connection: Keep-Alive
                                                  2024-07-22 10:34:40 UTC324INHTTP/1.1 301 Moved Permanently
                                                  Date: Mon, 22 Jul 2024 10:34:40 GMT
                                                  Content-Length: 0
                                                  Connection: close
                                                  Cache-Control: public
                                                  Cache-Control: max-age=86400
                                                  Location: https://acscdn.lavasoft.com/urlblacklist.json
                                                  api-supported-versions: 2.0
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c790888e434a-EWR


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  75192.168.2.449922104.16.149.130443984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:40 UTC62OUTGET /urlblacklist.json HTTP/1.1
                                                  Host: acscdn.lavasoft.com
                                                  2024-07-22 10:34:40 UTC385INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:40 GMT
                                                  Content-Type: application/json
                                                  Content-Length: 201625
                                                  Connection: close
                                                  Last-Modified: Wed, 15 Nov 2023 13:57:17 GMT
                                                  ETag: "6554ce3d-31399"
                                                  CF-Cache-Status: HIT
                                                  Age: 62197
                                                  Expires: Tue, 23 Jul 2024 06:34:40 GMT
                                                  Cache-Control: public, max-age=72000
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7918bc04362-EWR
                                                  2024-07-22 10:34:40 UTC984INData Raw: 5b 22 6c 61 69 7a 68 65 6e 67 73 6c 74 2e 63 6e 22 2c 22 6d 79 74 6f 6f 6c 7a 2e 6e 65 74 22 2c 22 70 72 6f 74 65 63 74 32 34 37 2e 6f 6e 6c 69 6e 65 22 2c 22 78 78 6c 61 73 74 2e 63 6f 6d 22 2c 22 77 6f 72 6c 64 73 61 6e 61 6c 79 74 69 63 73 2e 63 6f 6d 22 2c 22 73 6b 69 6c 6c 74 72 61 6e 73 66 6f 72 6d 2e 63 6f 2e 69 6e 22 2c 22 6c 65 6c 61 65 72 2e 63 6f 6d 22 2c 22 6a 70 6f 70 73 69 6e 67 6c 65 73 2e 65 75 22 2c 22 72 69 73 71 75 65 67 61 6c 6b 78 2e 63 6f 6d 22 2c 22 73 76 65 74 76 79 68 6f 64 2e 73 6b 22 2c 22 6d 6f 76 69 65 63 72 75 6d 62 73 2e 6e 65 74 22 2c 22 70 68 72 61 62 75 2e 67 6f 2e 74 68 22 2c 22 6f 6e 6c 79 69 6e 64 69 61 6e 78 2e 63 63 22 2c 22 69 6b 69 73 73 2e 6f 6e 6c 69 6e 65 22 2c 22 75 72 65 77 73 61 77 61 6e 69 2e 61 75 74 6f 73
                                                  Data Ascii: ["laizhengslt.cn","mytoolz.net","protect247.online","xxlast.com","worldsanalytics.com","skilltransform.co.in","lelaer.com","jpopsingles.eu","risquegalkx.com","svetvyhod.sk","moviecrumbs.net","phrabu.go.th","onlyindianx.cc","ikiss.online","urewsawani.autos
                                                  2024-07-22 10:34:40 UTC1369INData Raw: 6b 61 74 6d 6f 76 69 65 68 64 2e 6d 6f 76 22 2c 22 62 6c 75 65 67 61 73 6c 61 6d 70 2e 6f 72 67 22 2c 22 64 72 61 67 67 65 64 6c 69 6e 65 2e 6f 72 67 22 2c 22 67 68 35 79 73 33 67 72 79 35 64 35 33 32 2e 78 79 7a 22 2c 22 6b 61 61 6d 75 75 2e 6f 72 67 22 2c 22 73 61 6f 6d 61 32 32 30 2e 78 79 7a 22 2c 22 6c 69 76 65 74 76 33 36 35 2e 6d 65 22 2c 22 70 69 73 69 2e 70 69 63 73 22 2c 22 76 61 6c 75 65 2d 6c 69 66 65 2e 78 79 7a 22 2c 22 72 69 64 6f 6d 6f 76 69 65 73 2e 74 76 22 2c 22 70 68 69 6c 77 69 6e 2e 70 68 22 2c 22 61 64 6d 69 72 61 6c 73 68 69 70 70 69 6e 67 2e 63 6f 6d 22 2c 22 66 72 65 65 74 6f 6f 6c 6f 6e 6c 69 6e 65 2e 63 6f 6d 22 2c 22 76 69 74 61 6c 61 6d 73 65 65 2e 63 6f 6d 22 2c 22 6f 72 69 67 6c 6e 61 6c 64 61 74 65 2e 63 6f 6d 22 2c 22 72
                                                  Data Ascii: katmoviehd.mov","bluegaslamp.org","draggedline.org","gh5ys3gry5d532.xyz","kaamuu.org","saoma220.xyz","livetv365.me","pisi.pics","value-life.xyz","ridomovies.tv","philwin.ph","admiralshipping.com","freetoolonline.com","vitalamsee.com","origlnaldate.com","r
                                                  2024-07-22 10:34:40 UTC1369INData Raw: 79 2e 63 6f 6d 22 2c 22 61 69 73 68 6f 72 74 2e 74 6f 70 22 2c 22 70 72 6f 6d 6c 61 7a 65 72 2e 72 75 22 2c 22 6c 65 66 74 62 69 6c 6c 2e 74 6f 70 22 2c 22 75 70 73 63 61 72 72 69 61 67 65 70 61 79 6d 65 6e 74 2e 63 6f 6d 22 2c 22 69 6e 76 65 73 74 6c 69 65 2e 63 6f 6d 22 2c 22 74 35 2d 77 69 6b 69 2e 64 65 22 2c 22 66 72 65 65 73 6f 66 74 72 75 73 2e 72 75 22 2c 22 70 61 70 73 74 72 65 61 6d 2e 63 6c 75 62 22 2c 22 77 6f 72 6c 64 6e 65 77 73 2d 32 34 2e 63 6f 6d 22 2c 22 65 6e 73 74 72 65 61 6d 2e 74 6f 70 22 2c 22 73 6f 72 63 65 72 65 72 6f 66 74 65 61 2e 63 6f 6d 22 2c 22 6d 79 63 6c 69 63 6b 2d 32 2e 63 6f 6d 22 2c 22 6c 65 6c 69 65 7a 6f 72 67 67 72 6f 65 70 2e 6e 6c 22 2c 22 6d 75 61 74 68 65 6e 67 61 79 2e 63 6f 6d 22 2c 22 78 6e 2d 2d 38 30 61 63
                                                  Data Ascii: y.com","aishort.top","promlazer.ru","leftbill.top","upscarriagepayment.com","investlie.com","t5-wiki.de","freesoftrus.ru","papstream.club","worldnews-24.com","enstream.top","sorcereroftea.com","myclick-2.com","leliezorggroep.nl","muathengay.com","xn--80ac
                                                  2024-07-22 10:34:40 UTC1369INData Raw: 64 65 2e 6c 69 66 65 22 2c 22 67 30 66 2e 63 6e 22 2c 22 65 73 75 6e 32 31 2e 63 6e 22 2c 22 62 61 6f 66 65 6e 67 6a 69 68 75 6f 2e 63 6f 6d 22 2c 22 6b 65 79 67 65 6e 73 2e 70 72 6f 22 2c 22 63 68 61 72 6d 61 6e 74 65 73 76 6f 69 73 69 6e 65 73 6d 75 72 65 73 2e 63 6f 6d 22 2c 22 76 69 61 74 72 69 73 2d 65 2d 63 68 61 6e 6e 65 6c 2e 63 6f 6d 22 2c 22 73 68 6f 72 74 6c 79 61 6d 75 73 65 6d 65 6e 74 2e 63 6f 6d 22 2c 22 32 31 39 32 39 2e 72 75 22 2c 22 67 65 74 6d 61 63 6b 65 65 70 65 72 73 6f 66 74 70 72 6f 2e 78 79 7a 22 2c 22 74 68 65 73 79 6e 74 68 65 73 69 73 2e 61 70 70 22 2c 22 63 75 74 69 6c 6e 6b 73 2e 63 6f 6d 22 2c 22 61 75 74 6f 62 69 6b 65 72 73 2e 78 79 7a 22 2c 22 70 69 72 61 74 65 2d 70 72 6f 78 79 2e 74 6f 70 22 2c 22 34 35 2e 31 34 38 2e
                                                  Data Ascii: de.life","g0f.cn","esun21.cn","baofengjihuo.com","keygens.pro","charmantesvoisinesmures.com","viatris-e-channel.com","shortlyamusement.com","21929.ru","getmackeepersoftpro.xyz","thesynthesis.app","cutilnks.com","autobikers.xyz","pirate-proxy.top","45.148.
                                                  2024-07-22 10:34:40 UTC1369INData Raw: 79 77 70 6a 6b 2e 63 6f 6d 22 2c 22 73 79 6c 76 69 6e 61 6e 6f 72 72 65 79 2e 63 6f 6d 22 2c 22 6c 6f 6e 38 38 2e 74 6f 70 22 2c 22 76 6c 61 65 6b 61 6e 2e 6b 7a 22 2c 22 73 75 70 74 72 61 66 2e 63 6f 6d 22 2c 22 67 65 74 66 6c 69 6b 2e 63 6f 6d 22 2c 22 63 6f 6f 6c 74 72 6b 2e 78 79 7a 22 2c 22 66 6c 69 72 74 74 6f 6d 65 2e 63 6f 6d 22 2c 22 6d 61 73 61 63 2e 73 62 73 22 2c 22 6e 61 69 6c 6d 61 67 61 7a 69 6e 65 2e 6f 6e 6c 69 6e 65 22 2c 22 72 6f 76 32 2e 6e 65 74 22 2c 22 63 61 73 74 6c 65 63 61 70 69 74 61 6c 2e 76 63 22 2c 22 6d 6f 62 69 6c 65 74 6f 72 72 65 6e 74 2e 69 6e 66 6f 22 2c 22 63 77 62 74 69 2e 63 6f 6d 2e 62 72 22 2c 22 70 6f 73 61 64 61 6c 61 72 6f 62 6c 65 64 61 2e 63 6f 6d 22 2c 22 61 6c 6c 75 72 69 6e 67 67 61 6c 67 2e 63 6f 6d 22 2c
                                                  Data Ascii: ywpjk.com","sylvinanorrey.com","lon88.top","vlaekan.kz","suptraf.com","getflik.com","cooltrk.xyz","flirttome.com","masac.sbs","nailmagazine.online","rov2.net","castlecapital.vc","mobiletorrent.info","cwbti.com.br","posadalarobleda.com","alluringgalg.com",
                                                  2024-07-22 10:34:40 UTC1369INData Raw: 2c 22 74 6f 72 69 6f 6c 75 6f 72 2e 63 6f 6d 22 2c 22 63 72 61 63 6b 73 75 72 6c 2e 63 6f 6d 22 2c 22 70 72 79 76 69 74 61 6e 6e 79 61 2e 74 6f 70 22 2c 22 63 68 61 6e 67 62 65 65 72 2e 73 69 74 65 22 2c 22 61 64 6f 6e 73 6f 6e 6c 79 64 2e 78 79 7a 22 2c 22 74 68 65 6d 65 6e 63 6f 64 65 2e 63 6f 6d 22 2c 22 70 65 72 61 74 75 72 61 6e 70 65 64 69 61 2e 69 64 22 2c 22 74 65 6c 75 74 6f 70 69 65 7a 2e 63 6c 75 62 22 2c 22 76 73 67 7a 64 64 6a 2e 63 6f 6d 22 2c 22 61 64 61 70 61 2d 67 72 6f 75 70 2e 63 6f 6d 22 2c 22 73 68 65 65 74 2d 6d 75 73 69 63 2e 78 79 7a 22 2c 22 72 6f 63 6b 68 61 74 74 65 72 2e 63 6f 6d 22 2c 22 63 6f 6e 73 63 69 6f 75 73 6e 65 73 73 71 75 61 69 6e 74 2e 63 6f 6d 22 2c 22 76 61 6c 6c 65 73 76 69 73 69 6f 2e 63 61 74 22 2c 22 63 73 69
                                                  Data Ascii: ,"torioluor.com","cracksurl.com","pryvitannya.top","changbeer.site","adonsonlyd.xyz","themencode.com","peraturanpedia.id","telutopiez.club","vsgzddj.com","adapa-group.com","sheet-music.xyz","rockhatter.com","consciousnessquaint.com","vallesvisio.cat","csi
                                                  2024-07-22 10:34:40 UTC1369INData Raw: 2e 63 6f 6d 2e 75 61 22 2c 22 63 61 6d 61 64 6d 69 6e 2e 72 75 22 2c 22 6a 75 62 74 31 32 2e 78 79 7a 22 2c 22 72 6b 6e 2e 67 6f 76 2e 72 75 22 2c 22 31 32 33 6d 6f 76 69 65 2e 6c 74 64 22 2c 22 64 73 32 2e 63 6c 75 62 22 2c 22 79 6f 6d 73 74 2e 6f 72 67 22 2c 22 73 75 69 62 65 2e 65 64 75 2e 63 6e 22 2c 22 38 78 62 65 74 33 30 30 2e 63 6f 6d 22 2c 22 61 70 70 6c 65 69 64 78 79 2e 74 6f 70 22 2c 22 62 69 6f 6c 61 62 73 68 6f 70 32 34 2e 63 6f 6d 22 2c 22 6d 79 66 69 6c 65 73 74 6f 72 65 2e 63 6f 6d 22 2c 22 6f 72 6b 6c 69 6e 6b 2e 63 6f 6d 22 2c 22 65 78 70 6c 6f 72 72 2e 6e 65 74 22 2c 22 67 6f 74 72 61 63 6b 72 65 64 69 72 65 63 74 2e 63 6f 6d 22 2c 22 6a 61 76 69 65 72 64 65 6c 61 73 65 6e 2e 63 6f 6d 22 2c 22 62 72 69 61 6e 73 73 63 6c 75 62 2e 63 63
                                                  Data Ascii: .com.ua","camadmin.ru","jubt12.xyz","rkn.gov.ru","123movie.ltd","ds2.club","yomst.org","suibe.edu.cn","8xbet300.com","appleidxy.top","biolabshop24.com","myfilestore.com","orklink.com","explorr.net","gotrackredirect.com","javierdelasen.com","brianssclub.cc
                                                  2024-07-22 10:34:40 UTC1369INData Raw: 2c 22 64 69 73 63 6c 6f 73 65 70 72 6f 67 72 61 6d 77 65 64 6e 65 73 64 61 79 2e 63 6f 6d 22 2c 22 6b 69 6e 6f 6e 65 77 73 2e 70 72 6f 22 2c 22 6f 68 6e 79 64 65 6c 69 67 68 74 66 75 6c 64 61 74 65 73 2e 6c 69 66 65 22 2c 22 62 6f 6b 65 70 69 64 2e 62 6f 6e 64 22 2c 22 62 6f 72 69 73 2e 64 65 22 2c 22 6d 75 6e 64 6f 63 69 6e 65 6d 61 74 6f 67 72 61 66 69 63 6f 2e 6e 65 74 22 2c 22 62 65 74 61 63 65 6e 74 61 75 72 69 2e 74 6f 70 22 2c 22 6f 6d 67 6e 6f 74 65 2e 6e 65 74 6c 69 66 79 2e 61 70 70 22 2c 22 67 72 6f 77 6e 75 70 67 61 6c 6f 72 65 2e 6c 69 66 65 22 2c 22 69 6d 70 6f 73 73 69 62 6c 65 6f 66 66 65 72 73 2e 63 6f 6d 22 2c 22 76 6b 73 74 72 65 61 6d 2e 74 6f 70 22 2c 22 68 6f 74 70 72 6f 6d 6f 74 69 6f 6e 73 2e 6f 6e 6c 69 6e 65 22 2c 22 69 6f 2e 6b
                                                  Data Ascii: ,"discloseprogramwednesday.com","kinonews.pro","ohnydelightfuldates.life","bokepid.bond","boris.de","mundocinematografico.net","betacentauri.top","omgnote.netlify.app","grownupgalore.life","impossibleoffers.com","vkstream.top","hotpromotions.online","io.k
                                                  2024-07-22 10:34:40 UTC1369INData Raw: 2e 69 74 22 2c 22 6f 6f 72 63 61 73 65 6c 6c 73 2e 63 6f 6d 22 2c 22 6f 6e 65 64 61 73 68 2e 6e 65 74 22 2c 22 74 70 61 73 2e 72 75 22 2c 22 74 65 6e 69 38 35 73 74 61 62 30 31 64 2e 63 6f 6d 22 2c 22 74 68 6f 73 65 63 61 6e 64 79 2e 63 6f 6d 22 2c 22 6e 69 6c 6b 6e 61 72 66 2e 78 79 7a 22 2c 22 72 65 69 66 65 66 72 61 75 65 6e 2e 63 6f 6d 22 2c 22 72 6f 73 65 33 33 2e 74 6f 70 22 2c 22 73 74 6f 6e 65 61 67 65 70 65 64 69 61 2e 63 6f 6d 22 2c 22 6d 79 70 72 69 76 61 74 65 2e 70 69 63 73 22 2c 22 73 6e 61 70 78 2e 69 6e 66 6f 22 2c 22 67 74 61 75 74 6f 63 6c 69 63 6b 65 72 2e 63 6f 6d 22 2c 22 66 6d 6f 76 69 65 7a 2e 69 6e 66 6f 22 2c 22 63 6f 6d 65 73 68 6f 70 69 6e 67 2e 74 6f 6b 79 6f 22 2c 22 70 65 6c 69 73 78 70 6f 72 6e 6f 2e 6e 65 74 22 2c 22 63 68
                                                  Data Ascii: .it","oorcasells.com","onedash.net","tpas.ru","teni85stab01d.com","thosecandy.com","nilknarf.xyz","reifefrauen.com","rose33.top","stoneagepedia.com","myprivate.pics","snapx.info","gtautoclicker.com","fmoviez.info","comeshoping.tokyo","pelisxporno.net","ch
                                                  2024-07-22 10:34:40 UTC1369INData Raw: 70 74 34 72 75 73 2e 72 75 22 2c 22 6c 69 76 65 64 73 6b 61 74 65 72 61 69 73 69 6e 2e 63 6f 6d 22 2c 22 61 79 65 6a 6f 6d 65 72 2e 74 6f 70 22 2c 22 6e 6a 69 32 30 2e 78 79 7a 22 2c 22 67 61 6c 61 78 79 62 79 63 6f 69 6e 2e 63 6f 6d 22 2c 22 65 73 74 61 69 6c 6f 66 61 73 68 69 6f 6e 2e 63 6f 6d 22 2c 22 61 72 63 68 65 75 72 6f 70 65 2e 69 6e 66 6f 22 2c 22 65 7a 63 67 6f 6a 61 61 6d 67 2e 63 6f 6d 22 2c 22 68 2d 67 65 6e 2e 78 79 7a 22 2c 22 78 6e 2d 2d 39 30 61 61 76 6d 66 69 37 62 31 64 2e 78 79 7a 22 2c 22 6c 69 62 72 6f 73 72 65 63 6f 6d 65 6e 64 61 64 6f 73 73 2e 63 6f 6d 22 2c 22 75 74 69 6c 69 74 79 70 72 65 73 65 6e 74 2e 63 6f 6d 22 2c 22 74 68 65 67 61 6d 65 70 6c 61 79 2e 6c 69 66 65 22 2c 22 61 69 36 38 36 38 2e 74 6f 70 22 2c 22 78 79 63 6c
                                                  Data Ascii: pt4rus.ru","livedskateraisin.com","ayejomer.top","nji20.xyz","galaxybycoin.com","estailofashion.com","archeurope.info","ezcgojaamg.com","h-gen.xyz","xn--90aavmfi7b1d.xyz","librosrecomendadoss.com","utilitypresent.com","thegameplay.life","ai6868.top","xycl


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  76192.168.2.449920104.16.149.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:40 UTC149OUTPOST /v1/event-stat?Type=Error&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 665
                                                  2024-07-22 10:34:40 UTC665OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 45 78 63 65 70 74 69 6f 6e 22 3a 22 53 79 73 74 65 6d 2e 4e 75 6c 6c 52 65 66 65 72 65 6e 63 65 45 78 63 65 70 74 69 6f 6e 3a 20 4f 62 6a 65 63 74 20 72 65 66 65 72 65 6e 63 65 20 6e 6f 74 20 73 65 74 20 74 6f 20 61 6e 20 69 6e 73 74 61 6e 63 65 20 6f 66 20 61 6e 20 6f 62 6a 65 63 74 2e 5c 72 5c 6e 20 20 20 61 74 20 57 65 62 43 6f 6d 70 61 6e 69 6f 6e 2e 55 49 2e 41 70 70 43 6f 72 65 2e 50 6f 73 74 52 75 6e 2e 46 65 61 74 75 72 65 41 63 74 69 6f 6e 48 65 6c 70 65 72 2e 49 6e 69 74 69 61 6c 69 7a 65 28 4c 69 73 74 60 31 20 63 6f 6d 6d 61 6e 64 4c 69 6e 65 41 72 67 73 2c 20 42 6f 6f 6c 65 61 6e 20 74 69 6d 65 72 2c 20 53 74 72 69 6e 67 20 66 65 61 74 75 72 65 6e 61 6d 65 29 22 2c 22 45 78 63 65 70 74 69 6f 6e 54 79 70 65 22
                                                  Data Ascii: {"Data": {"Exception":"System.NullReferenceException: Object reference not set to an instance of an object.\r\n at WebCompanion.UI.AppCore.PostRun.FeatureActionHelper.Initialize(List`1 commandLineArgs, Boolean timer, String featurename)","ExceptionType"
                                                  2024-07-22 10:34:40 UTC479INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:40 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: close
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7946a4f43bb-EWR
                                                  2024-07-22 10:34:40 UTC35INData Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}
                                                  2024-07-22 10:34:40 UTC5INData Raw: 30 0d 0a 0d 0a
                                                  Data Ascii: 0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  77192.168.2.449921104.16.149.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:40 UTC156OUTPOST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 364
                                                  2024-07-22 10:34:40 UTC364OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 45 76 65 6e 74 44 61 74 61 22 3a 22 32 34 68 72 73 22 2c 22 45 76 65 6e 74 4e 61 6d 65 22 3a 22 4d 69 63 72 6f 74 61 72 67 65 74 69 6e 67 54 69 6d 65 72 22 2c 22 42 72 6f 77 73 65 72 4e 61 6d 65 22 3a 22 22 2c 22 53 65 61 72 63 68 45 6e 67 69 6e 65 22 3a 22 22 2c 22 49 6e 73 74 61 6c 6c 44 61 74 65 22 3a 22 32 30 32 34 2d 30 37 2d 32 32 54 30 30 3a 30 30 3a 30 30 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65 2d 31 31 32 38 2d 34 65 36 30 2d 62 65 65 61 2d 32 37 32 30 34 31 64 66 36 34 35 32 22 2c 22 4c 61 6e 67 75 61 67 65 22 3a 22 65 6e 2d 55 53 22 2c 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22
                                                  Data Ascii: {"Data": {"EventData":"24hrs","EventName":"MicrotargetingTimer","BrowserName":"","SearchEngine":"","InstallDate":"2024-07-22T00:00:00","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Language":"en-US","MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698"
                                                  2024-07-22 10:34:40 UTC479INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:40 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: close
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7959dd77292-EWR
                                                  2024-07-22 10:34:40 UTC35INData Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}
                                                  2024-07-22 10:34:40 UTC5INData Raw: 30 0d 0a 0d 0a
                                                  Data Ascii: 0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  78192.168.2.449924104.16.149.130443984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:40 UTC62OUTGET /urlblacklist.json HTTP/1.1
                                                  Host: acscdn.lavasoft.com
                                                  2024-07-22 10:34:41 UTC385INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:41 GMT
                                                  Content-Type: application/json
                                                  Content-Length: 201625
                                                  Connection: close
                                                  Last-Modified: Wed, 15 Nov 2023 13:57:17 GMT
                                                  ETag: "6554ce3d-31399"
                                                  CF-Cache-Status: HIT
                                                  Age: 62198
                                                  Expires: Tue, 23 Jul 2024 06:34:41 GMT
                                                  Cache-Control: public, max-age=72000
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7967d3043ab-EWR
                                                  2024-07-22 10:34:41 UTC984INData Raw: 5b 22 6c 61 69 7a 68 65 6e 67 73 6c 74 2e 63 6e 22 2c 22 6d 79 74 6f 6f 6c 7a 2e 6e 65 74 22 2c 22 70 72 6f 74 65 63 74 32 34 37 2e 6f 6e 6c 69 6e 65 22 2c 22 78 78 6c 61 73 74 2e 63 6f 6d 22 2c 22 77 6f 72 6c 64 73 61 6e 61 6c 79 74 69 63 73 2e 63 6f 6d 22 2c 22 73 6b 69 6c 6c 74 72 61 6e 73 66 6f 72 6d 2e 63 6f 2e 69 6e 22 2c 22 6c 65 6c 61 65 72 2e 63 6f 6d 22 2c 22 6a 70 6f 70 73 69 6e 67 6c 65 73 2e 65 75 22 2c 22 72 69 73 71 75 65 67 61 6c 6b 78 2e 63 6f 6d 22 2c 22 73 76 65 74 76 79 68 6f 64 2e 73 6b 22 2c 22 6d 6f 76 69 65 63 72 75 6d 62 73 2e 6e 65 74 22 2c 22 70 68 72 61 62 75 2e 67 6f 2e 74 68 22 2c 22 6f 6e 6c 79 69 6e 64 69 61 6e 78 2e 63 63 22 2c 22 69 6b 69 73 73 2e 6f 6e 6c 69 6e 65 22 2c 22 75 72 65 77 73 61 77 61 6e 69 2e 61 75 74 6f 73
                                                  Data Ascii: ["laizhengslt.cn","mytoolz.net","protect247.online","xxlast.com","worldsanalytics.com","skilltransform.co.in","lelaer.com","jpopsingles.eu","risquegalkx.com","svetvyhod.sk","moviecrumbs.net","phrabu.go.th","onlyindianx.cc","ikiss.online","urewsawani.autos
                                                  2024-07-22 10:34:41 UTC1369INData Raw: 6b 61 74 6d 6f 76 69 65 68 64 2e 6d 6f 76 22 2c 22 62 6c 75 65 67 61 73 6c 61 6d 70 2e 6f 72 67 22 2c 22 64 72 61 67 67 65 64 6c 69 6e 65 2e 6f 72 67 22 2c 22 67 68 35 79 73 33 67 72 79 35 64 35 33 32 2e 78 79 7a 22 2c 22 6b 61 61 6d 75 75 2e 6f 72 67 22 2c 22 73 61 6f 6d 61 32 32 30 2e 78 79 7a 22 2c 22 6c 69 76 65 74 76 33 36 35 2e 6d 65 22 2c 22 70 69 73 69 2e 70 69 63 73 22 2c 22 76 61 6c 75 65 2d 6c 69 66 65 2e 78 79 7a 22 2c 22 72 69 64 6f 6d 6f 76 69 65 73 2e 74 76 22 2c 22 70 68 69 6c 77 69 6e 2e 70 68 22 2c 22 61 64 6d 69 72 61 6c 73 68 69 70 70 69 6e 67 2e 63 6f 6d 22 2c 22 66 72 65 65 74 6f 6f 6c 6f 6e 6c 69 6e 65 2e 63 6f 6d 22 2c 22 76 69 74 61 6c 61 6d 73 65 65 2e 63 6f 6d 22 2c 22 6f 72 69 67 6c 6e 61 6c 64 61 74 65 2e 63 6f 6d 22 2c 22 72
                                                  Data Ascii: katmoviehd.mov","bluegaslamp.org","draggedline.org","gh5ys3gry5d532.xyz","kaamuu.org","saoma220.xyz","livetv365.me","pisi.pics","value-life.xyz","ridomovies.tv","philwin.ph","admiralshipping.com","freetoolonline.com","vitalamsee.com","origlnaldate.com","r
                                                  2024-07-22 10:34:41 UTC1369INData Raw: 79 2e 63 6f 6d 22 2c 22 61 69 73 68 6f 72 74 2e 74 6f 70 22 2c 22 70 72 6f 6d 6c 61 7a 65 72 2e 72 75 22 2c 22 6c 65 66 74 62 69 6c 6c 2e 74 6f 70 22 2c 22 75 70 73 63 61 72 72 69 61 67 65 70 61 79 6d 65 6e 74 2e 63 6f 6d 22 2c 22 69 6e 76 65 73 74 6c 69 65 2e 63 6f 6d 22 2c 22 74 35 2d 77 69 6b 69 2e 64 65 22 2c 22 66 72 65 65 73 6f 66 74 72 75 73 2e 72 75 22 2c 22 70 61 70 73 74 72 65 61 6d 2e 63 6c 75 62 22 2c 22 77 6f 72 6c 64 6e 65 77 73 2d 32 34 2e 63 6f 6d 22 2c 22 65 6e 73 74 72 65 61 6d 2e 74 6f 70 22 2c 22 73 6f 72 63 65 72 65 72 6f 66 74 65 61 2e 63 6f 6d 22 2c 22 6d 79 63 6c 69 63 6b 2d 32 2e 63 6f 6d 22 2c 22 6c 65 6c 69 65 7a 6f 72 67 67 72 6f 65 70 2e 6e 6c 22 2c 22 6d 75 61 74 68 65 6e 67 61 79 2e 63 6f 6d 22 2c 22 78 6e 2d 2d 38 30 61 63
                                                  Data Ascii: y.com","aishort.top","promlazer.ru","leftbill.top","upscarriagepayment.com","investlie.com","t5-wiki.de","freesoftrus.ru","papstream.club","worldnews-24.com","enstream.top","sorcereroftea.com","myclick-2.com","leliezorggroep.nl","muathengay.com","xn--80ac
                                                  2024-07-22 10:34:41 UTC1369INData Raw: 64 65 2e 6c 69 66 65 22 2c 22 67 30 66 2e 63 6e 22 2c 22 65 73 75 6e 32 31 2e 63 6e 22 2c 22 62 61 6f 66 65 6e 67 6a 69 68 75 6f 2e 63 6f 6d 22 2c 22 6b 65 79 67 65 6e 73 2e 70 72 6f 22 2c 22 63 68 61 72 6d 61 6e 74 65 73 76 6f 69 73 69 6e 65 73 6d 75 72 65 73 2e 63 6f 6d 22 2c 22 76 69 61 74 72 69 73 2d 65 2d 63 68 61 6e 6e 65 6c 2e 63 6f 6d 22 2c 22 73 68 6f 72 74 6c 79 61 6d 75 73 65 6d 65 6e 74 2e 63 6f 6d 22 2c 22 32 31 39 32 39 2e 72 75 22 2c 22 67 65 74 6d 61 63 6b 65 65 70 65 72 73 6f 66 74 70 72 6f 2e 78 79 7a 22 2c 22 74 68 65 73 79 6e 74 68 65 73 69 73 2e 61 70 70 22 2c 22 63 75 74 69 6c 6e 6b 73 2e 63 6f 6d 22 2c 22 61 75 74 6f 62 69 6b 65 72 73 2e 78 79 7a 22 2c 22 70 69 72 61 74 65 2d 70 72 6f 78 79 2e 74 6f 70 22 2c 22 34 35 2e 31 34 38 2e
                                                  Data Ascii: de.life","g0f.cn","esun21.cn","baofengjihuo.com","keygens.pro","charmantesvoisinesmures.com","viatris-e-channel.com","shortlyamusement.com","21929.ru","getmackeepersoftpro.xyz","thesynthesis.app","cutilnks.com","autobikers.xyz","pirate-proxy.top","45.148.
                                                  2024-07-22 10:34:41 UTC1369INData Raw: 79 77 70 6a 6b 2e 63 6f 6d 22 2c 22 73 79 6c 76 69 6e 61 6e 6f 72 72 65 79 2e 63 6f 6d 22 2c 22 6c 6f 6e 38 38 2e 74 6f 70 22 2c 22 76 6c 61 65 6b 61 6e 2e 6b 7a 22 2c 22 73 75 70 74 72 61 66 2e 63 6f 6d 22 2c 22 67 65 74 66 6c 69 6b 2e 63 6f 6d 22 2c 22 63 6f 6f 6c 74 72 6b 2e 78 79 7a 22 2c 22 66 6c 69 72 74 74 6f 6d 65 2e 63 6f 6d 22 2c 22 6d 61 73 61 63 2e 73 62 73 22 2c 22 6e 61 69 6c 6d 61 67 61 7a 69 6e 65 2e 6f 6e 6c 69 6e 65 22 2c 22 72 6f 76 32 2e 6e 65 74 22 2c 22 63 61 73 74 6c 65 63 61 70 69 74 61 6c 2e 76 63 22 2c 22 6d 6f 62 69 6c 65 74 6f 72 72 65 6e 74 2e 69 6e 66 6f 22 2c 22 63 77 62 74 69 2e 63 6f 6d 2e 62 72 22 2c 22 70 6f 73 61 64 61 6c 61 72 6f 62 6c 65 64 61 2e 63 6f 6d 22 2c 22 61 6c 6c 75 72 69 6e 67 67 61 6c 67 2e 63 6f 6d 22 2c
                                                  Data Ascii: ywpjk.com","sylvinanorrey.com","lon88.top","vlaekan.kz","suptraf.com","getflik.com","cooltrk.xyz","flirttome.com","masac.sbs","nailmagazine.online","rov2.net","castlecapital.vc","mobiletorrent.info","cwbti.com.br","posadalarobleda.com","alluringgalg.com",
                                                  2024-07-22 10:34:41 UTC1369INData Raw: 2c 22 74 6f 72 69 6f 6c 75 6f 72 2e 63 6f 6d 22 2c 22 63 72 61 63 6b 73 75 72 6c 2e 63 6f 6d 22 2c 22 70 72 79 76 69 74 61 6e 6e 79 61 2e 74 6f 70 22 2c 22 63 68 61 6e 67 62 65 65 72 2e 73 69 74 65 22 2c 22 61 64 6f 6e 73 6f 6e 6c 79 64 2e 78 79 7a 22 2c 22 74 68 65 6d 65 6e 63 6f 64 65 2e 63 6f 6d 22 2c 22 70 65 72 61 74 75 72 61 6e 70 65 64 69 61 2e 69 64 22 2c 22 74 65 6c 75 74 6f 70 69 65 7a 2e 63 6c 75 62 22 2c 22 76 73 67 7a 64 64 6a 2e 63 6f 6d 22 2c 22 61 64 61 70 61 2d 67 72 6f 75 70 2e 63 6f 6d 22 2c 22 73 68 65 65 74 2d 6d 75 73 69 63 2e 78 79 7a 22 2c 22 72 6f 63 6b 68 61 74 74 65 72 2e 63 6f 6d 22 2c 22 63 6f 6e 73 63 69 6f 75 73 6e 65 73 73 71 75 61 69 6e 74 2e 63 6f 6d 22 2c 22 76 61 6c 6c 65 73 76 69 73 69 6f 2e 63 61 74 22 2c 22 63 73 69
                                                  Data Ascii: ,"torioluor.com","cracksurl.com","pryvitannya.top","changbeer.site","adonsonlyd.xyz","themencode.com","peraturanpedia.id","telutopiez.club","vsgzddj.com","adapa-group.com","sheet-music.xyz","rockhatter.com","consciousnessquaint.com","vallesvisio.cat","csi
                                                  2024-07-22 10:34:41 UTC1369INData Raw: 2e 63 6f 6d 2e 75 61 22 2c 22 63 61 6d 61 64 6d 69 6e 2e 72 75 22 2c 22 6a 75 62 74 31 32 2e 78 79 7a 22 2c 22 72 6b 6e 2e 67 6f 76 2e 72 75 22 2c 22 31 32 33 6d 6f 76 69 65 2e 6c 74 64 22 2c 22 64 73 32 2e 63 6c 75 62 22 2c 22 79 6f 6d 73 74 2e 6f 72 67 22 2c 22 73 75 69 62 65 2e 65 64 75 2e 63 6e 22 2c 22 38 78 62 65 74 33 30 30 2e 63 6f 6d 22 2c 22 61 70 70 6c 65 69 64 78 79 2e 74 6f 70 22 2c 22 62 69 6f 6c 61 62 73 68 6f 70 32 34 2e 63 6f 6d 22 2c 22 6d 79 66 69 6c 65 73 74 6f 72 65 2e 63 6f 6d 22 2c 22 6f 72 6b 6c 69 6e 6b 2e 63 6f 6d 22 2c 22 65 78 70 6c 6f 72 72 2e 6e 65 74 22 2c 22 67 6f 74 72 61 63 6b 72 65 64 69 72 65 63 74 2e 63 6f 6d 22 2c 22 6a 61 76 69 65 72 64 65 6c 61 73 65 6e 2e 63 6f 6d 22 2c 22 62 72 69 61 6e 73 73 63 6c 75 62 2e 63 63
                                                  Data Ascii: .com.ua","camadmin.ru","jubt12.xyz","rkn.gov.ru","123movie.ltd","ds2.club","yomst.org","suibe.edu.cn","8xbet300.com","appleidxy.top","biolabshop24.com","myfilestore.com","orklink.com","explorr.net","gotrackredirect.com","javierdelasen.com","brianssclub.cc
                                                  2024-07-22 10:34:41 UTC1369INData Raw: 2c 22 64 69 73 63 6c 6f 73 65 70 72 6f 67 72 61 6d 77 65 64 6e 65 73 64 61 79 2e 63 6f 6d 22 2c 22 6b 69 6e 6f 6e 65 77 73 2e 70 72 6f 22 2c 22 6f 68 6e 79 64 65 6c 69 67 68 74 66 75 6c 64 61 74 65 73 2e 6c 69 66 65 22 2c 22 62 6f 6b 65 70 69 64 2e 62 6f 6e 64 22 2c 22 62 6f 72 69 73 2e 64 65 22 2c 22 6d 75 6e 64 6f 63 69 6e 65 6d 61 74 6f 67 72 61 66 69 63 6f 2e 6e 65 74 22 2c 22 62 65 74 61 63 65 6e 74 61 75 72 69 2e 74 6f 70 22 2c 22 6f 6d 67 6e 6f 74 65 2e 6e 65 74 6c 69 66 79 2e 61 70 70 22 2c 22 67 72 6f 77 6e 75 70 67 61 6c 6f 72 65 2e 6c 69 66 65 22 2c 22 69 6d 70 6f 73 73 69 62 6c 65 6f 66 66 65 72 73 2e 63 6f 6d 22 2c 22 76 6b 73 74 72 65 61 6d 2e 74 6f 70 22 2c 22 68 6f 74 70 72 6f 6d 6f 74 69 6f 6e 73 2e 6f 6e 6c 69 6e 65 22 2c 22 69 6f 2e 6b
                                                  Data Ascii: ,"discloseprogramwednesday.com","kinonews.pro","ohnydelightfuldates.life","bokepid.bond","boris.de","mundocinematografico.net","betacentauri.top","omgnote.netlify.app","grownupgalore.life","impossibleoffers.com","vkstream.top","hotpromotions.online","io.k
                                                  2024-07-22 10:34:41 UTC1369INData Raw: 2e 69 74 22 2c 22 6f 6f 72 63 61 73 65 6c 6c 73 2e 63 6f 6d 22 2c 22 6f 6e 65 64 61 73 68 2e 6e 65 74 22 2c 22 74 70 61 73 2e 72 75 22 2c 22 74 65 6e 69 38 35 73 74 61 62 30 31 64 2e 63 6f 6d 22 2c 22 74 68 6f 73 65 63 61 6e 64 79 2e 63 6f 6d 22 2c 22 6e 69 6c 6b 6e 61 72 66 2e 78 79 7a 22 2c 22 72 65 69 66 65 66 72 61 75 65 6e 2e 63 6f 6d 22 2c 22 72 6f 73 65 33 33 2e 74 6f 70 22 2c 22 73 74 6f 6e 65 61 67 65 70 65 64 69 61 2e 63 6f 6d 22 2c 22 6d 79 70 72 69 76 61 74 65 2e 70 69 63 73 22 2c 22 73 6e 61 70 78 2e 69 6e 66 6f 22 2c 22 67 74 61 75 74 6f 63 6c 69 63 6b 65 72 2e 63 6f 6d 22 2c 22 66 6d 6f 76 69 65 7a 2e 69 6e 66 6f 22 2c 22 63 6f 6d 65 73 68 6f 70 69 6e 67 2e 74 6f 6b 79 6f 22 2c 22 70 65 6c 69 73 78 70 6f 72 6e 6f 2e 6e 65 74 22 2c 22 63 68
                                                  Data Ascii: .it","oorcasells.com","onedash.net","tpas.ru","teni85stab01d.com","thosecandy.com","nilknarf.xyz","reifefrauen.com","rose33.top","stoneagepedia.com","myprivate.pics","snapx.info","gtautoclicker.com","fmoviez.info","comeshoping.tokyo","pelisxporno.net","ch
                                                  2024-07-22 10:34:41 UTC1369INData Raw: 70 74 34 72 75 73 2e 72 75 22 2c 22 6c 69 76 65 64 73 6b 61 74 65 72 61 69 73 69 6e 2e 63 6f 6d 22 2c 22 61 79 65 6a 6f 6d 65 72 2e 74 6f 70 22 2c 22 6e 6a 69 32 30 2e 78 79 7a 22 2c 22 67 61 6c 61 78 79 62 79 63 6f 69 6e 2e 63 6f 6d 22 2c 22 65 73 74 61 69 6c 6f 66 61 73 68 69 6f 6e 2e 63 6f 6d 22 2c 22 61 72 63 68 65 75 72 6f 70 65 2e 69 6e 66 6f 22 2c 22 65 7a 63 67 6f 6a 61 61 6d 67 2e 63 6f 6d 22 2c 22 68 2d 67 65 6e 2e 78 79 7a 22 2c 22 78 6e 2d 2d 39 30 61 61 76 6d 66 69 37 62 31 64 2e 78 79 7a 22 2c 22 6c 69 62 72 6f 73 72 65 63 6f 6d 65 6e 64 61 64 6f 73 73 2e 63 6f 6d 22 2c 22 75 74 69 6c 69 74 79 70 72 65 73 65 6e 74 2e 63 6f 6d 22 2c 22 74 68 65 67 61 6d 65 70 6c 61 79 2e 6c 69 66 65 22 2c 22 61 69 36 38 36 38 2e 74 6f 70 22 2c 22 78 79 63 6c
                                                  Data Ascii: pt4rus.ru","livedskateraisin.com","ayejomer.top","nji20.xyz","galaxybycoin.com","estailofashion.com","archeurope.info","ezcgojaamg.com","h-gen.xyz","xn--90aavmfi7b1d.xyz","librosrecomendadoss.com","utilitypresent.com","thegameplay.life","ai6868.top","xycl


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  79192.168.2.449923104.16.149.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:41 UTC86OUTGET /urlblacklist.json HTTP/1.1
                                                  Host: acscdn.lavasoft.com
                                                  Connection: Keep-Alive
                                                  2024-07-22 10:34:41 UTC385INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:41 GMT
                                                  Content-Type: application/json
                                                  Content-Length: 201625
                                                  Connection: close
                                                  Last-Modified: Wed, 15 Nov 2023 13:57:17 GMT
                                                  ETag: "6554ce3d-31399"
                                                  CF-Cache-Status: HIT
                                                  Age: 62198
                                                  Expires: Tue, 23 Jul 2024 06:34:41 GMT
                                                  Cache-Control: public, max-age=72000
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7978f687c93-EWR
                                                  2024-07-22 10:34:41 UTC984INData Raw: 5b 22 6c 61 69 7a 68 65 6e 67 73 6c 74 2e 63 6e 22 2c 22 6d 79 74 6f 6f 6c 7a 2e 6e 65 74 22 2c 22 70 72 6f 74 65 63 74 32 34 37 2e 6f 6e 6c 69 6e 65 22 2c 22 78 78 6c 61 73 74 2e 63 6f 6d 22 2c 22 77 6f 72 6c 64 73 61 6e 61 6c 79 74 69 63 73 2e 63 6f 6d 22 2c 22 73 6b 69 6c 6c 74 72 61 6e 73 66 6f 72 6d 2e 63 6f 2e 69 6e 22 2c 22 6c 65 6c 61 65 72 2e 63 6f 6d 22 2c 22 6a 70 6f 70 73 69 6e 67 6c 65 73 2e 65 75 22 2c 22 72 69 73 71 75 65 67 61 6c 6b 78 2e 63 6f 6d 22 2c 22 73 76 65 74 76 79 68 6f 64 2e 73 6b 22 2c 22 6d 6f 76 69 65 63 72 75 6d 62 73 2e 6e 65 74 22 2c 22 70 68 72 61 62 75 2e 67 6f 2e 74 68 22 2c 22 6f 6e 6c 79 69 6e 64 69 61 6e 78 2e 63 63 22 2c 22 69 6b 69 73 73 2e 6f 6e 6c 69 6e 65 22 2c 22 75 72 65 77 73 61 77 61 6e 69 2e 61 75 74 6f 73
                                                  Data Ascii: ["laizhengslt.cn","mytoolz.net","protect247.online","xxlast.com","worldsanalytics.com","skilltransform.co.in","lelaer.com","jpopsingles.eu","risquegalkx.com","svetvyhod.sk","moviecrumbs.net","phrabu.go.th","onlyindianx.cc","ikiss.online","urewsawani.autos
                                                  2024-07-22 10:34:41 UTC1369INData Raw: 6b 61 74 6d 6f 76 69 65 68 64 2e 6d 6f 76 22 2c 22 62 6c 75 65 67 61 73 6c 61 6d 70 2e 6f 72 67 22 2c 22 64 72 61 67 67 65 64 6c 69 6e 65 2e 6f 72 67 22 2c 22 67 68 35 79 73 33 67 72 79 35 64 35 33 32 2e 78 79 7a 22 2c 22 6b 61 61 6d 75 75 2e 6f 72 67 22 2c 22 73 61 6f 6d 61 32 32 30 2e 78 79 7a 22 2c 22 6c 69 76 65 74 76 33 36 35 2e 6d 65 22 2c 22 70 69 73 69 2e 70 69 63 73 22 2c 22 76 61 6c 75 65 2d 6c 69 66 65 2e 78 79 7a 22 2c 22 72 69 64 6f 6d 6f 76 69 65 73 2e 74 76 22 2c 22 70 68 69 6c 77 69 6e 2e 70 68 22 2c 22 61 64 6d 69 72 61 6c 73 68 69 70 70 69 6e 67 2e 63 6f 6d 22 2c 22 66 72 65 65 74 6f 6f 6c 6f 6e 6c 69 6e 65 2e 63 6f 6d 22 2c 22 76 69 74 61 6c 61 6d 73 65 65 2e 63 6f 6d 22 2c 22 6f 72 69 67 6c 6e 61 6c 64 61 74 65 2e 63 6f 6d 22 2c 22 72
                                                  Data Ascii: katmoviehd.mov","bluegaslamp.org","draggedline.org","gh5ys3gry5d532.xyz","kaamuu.org","saoma220.xyz","livetv365.me","pisi.pics","value-life.xyz","ridomovies.tv","philwin.ph","admiralshipping.com","freetoolonline.com","vitalamsee.com","origlnaldate.com","r
                                                  2024-07-22 10:34:41 UTC1369INData Raw: 79 2e 63 6f 6d 22 2c 22 61 69 73 68 6f 72 74 2e 74 6f 70 22 2c 22 70 72 6f 6d 6c 61 7a 65 72 2e 72 75 22 2c 22 6c 65 66 74 62 69 6c 6c 2e 74 6f 70 22 2c 22 75 70 73 63 61 72 72 69 61 67 65 70 61 79 6d 65 6e 74 2e 63 6f 6d 22 2c 22 69 6e 76 65 73 74 6c 69 65 2e 63 6f 6d 22 2c 22 74 35 2d 77 69 6b 69 2e 64 65 22 2c 22 66 72 65 65 73 6f 66 74 72 75 73 2e 72 75 22 2c 22 70 61 70 73 74 72 65 61 6d 2e 63 6c 75 62 22 2c 22 77 6f 72 6c 64 6e 65 77 73 2d 32 34 2e 63 6f 6d 22 2c 22 65 6e 73 74 72 65 61 6d 2e 74 6f 70 22 2c 22 73 6f 72 63 65 72 65 72 6f 66 74 65 61 2e 63 6f 6d 22 2c 22 6d 79 63 6c 69 63 6b 2d 32 2e 63 6f 6d 22 2c 22 6c 65 6c 69 65 7a 6f 72 67 67 72 6f 65 70 2e 6e 6c 22 2c 22 6d 75 61 74 68 65 6e 67 61 79 2e 63 6f 6d 22 2c 22 78 6e 2d 2d 38 30 61 63
                                                  Data Ascii: y.com","aishort.top","promlazer.ru","leftbill.top","upscarriagepayment.com","investlie.com","t5-wiki.de","freesoftrus.ru","papstream.club","worldnews-24.com","enstream.top","sorcereroftea.com","myclick-2.com","leliezorggroep.nl","muathengay.com","xn--80ac
                                                  2024-07-22 10:34:41 UTC1369INData Raw: 64 65 2e 6c 69 66 65 22 2c 22 67 30 66 2e 63 6e 22 2c 22 65 73 75 6e 32 31 2e 63 6e 22 2c 22 62 61 6f 66 65 6e 67 6a 69 68 75 6f 2e 63 6f 6d 22 2c 22 6b 65 79 67 65 6e 73 2e 70 72 6f 22 2c 22 63 68 61 72 6d 61 6e 74 65 73 76 6f 69 73 69 6e 65 73 6d 75 72 65 73 2e 63 6f 6d 22 2c 22 76 69 61 74 72 69 73 2d 65 2d 63 68 61 6e 6e 65 6c 2e 63 6f 6d 22 2c 22 73 68 6f 72 74 6c 79 61 6d 75 73 65 6d 65 6e 74 2e 63 6f 6d 22 2c 22 32 31 39 32 39 2e 72 75 22 2c 22 67 65 74 6d 61 63 6b 65 65 70 65 72 73 6f 66 74 70 72 6f 2e 78 79 7a 22 2c 22 74 68 65 73 79 6e 74 68 65 73 69 73 2e 61 70 70 22 2c 22 63 75 74 69 6c 6e 6b 73 2e 63 6f 6d 22 2c 22 61 75 74 6f 62 69 6b 65 72 73 2e 78 79 7a 22 2c 22 70 69 72 61 74 65 2d 70 72 6f 78 79 2e 74 6f 70 22 2c 22 34 35 2e 31 34 38 2e
                                                  Data Ascii: de.life","g0f.cn","esun21.cn","baofengjihuo.com","keygens.pro","charmantesvoisinesmures.com","viatris-e-channel.com","shortlyamusement.com","21929.ru","getmackeepersoftpro.xyz","thesynthesis.app","cutilnks.com","autobikers.xyz","pirate-proxy.top","45.148.
                                                  2024-07-22 10:34:41 UTC1369INData Raw: 79 77 70 6a 6b 2e 63 6f 6d 22 2c 22 73 79 6c 76 69 6e 61 6e 6f 72 72 65 79 2e 63 6f 6d 22 2c 22 6c 6f 6e 38 38 2e 74 6f 70 22 2c 22 76 6c 61 65 6b 61 6e 2e 6b 7a 22 2c 22 73 75 70 74 72 61 66 2e 63 6f 6d 22 2c 22 67 65 74 66 6c 69 6b 2e 63 6f 6d 22 2c 22 63 6f 6f 6c 74 72 6b 2e 78 79 7a 22 2c 22 66 6c 69 72 74 74 6f 6d 65 2e 63 6f 6d 22 2c 22 6d 61 73 61 63 2e 73 62 73 22 2c 22 6e 61 69 6c 6d 61 67 61 7a 69 6e 65 2e 6f 6e 6c 69 6e 65 22 2c 22 72 6f 76 32 2e 6e 65 74 22 2c 22 63 61 73 74 6c 65 63 61 70 69 74 61 6c 2e 76 63 22 2c 22 6d 6f 62 69 6c 65 74 6f 72 72 65 6e 74 2e 69 6e 66 6f 22 2c 22 63 77 62 74 69 2e 63 6f 6d 2e 62 72 22 2c 22 70 6f 73 61 64 61 6c 61 72 6f 62 6c 65 64 61 2e 63 6f 6d 22 2c 22 61 6c 6c 75 72 69 6e 67 67 61 6c 67 2e 63 6f 6d 22 2c
                                                  Data Ascii: ywpjk.com","sylvinanorrey.com","lon88.top","vlaekan.kz","suptraf.com","getflik.com","cooltrk.xyz","flirttome.com","masac.sbs","nailmagazine.online","rov2.net","castlecapital.vc","mobiletorrent.info","cwbti.com.br","posadalarobleda.com","alluringgalg.com",
                                                  2024-07-22 10:34:41 UTC1369INData Raw: 2c 22 74 6f 72 69 6f 6c 75 6f 72 2e 63 6f 6d 22 2c 22 63 72 61 63 6b 73 75 72 6c 2e 63 6f 6d 22 2c 22 70 72 79 76 69 74 61 6e 6e 79 61 2e 74 6f 70 22 2c 22 63 68 61 6e 67 62 65 65 72 2e 73 69 74 65 22 2c 22 61 64 6f 6e 73 6f 6e 6c 79 64 2e 78 79 7a 22 2c 22 74 68 65 6d 65 6e 63 6f 64 65 2e 63 6f 6d 22 2c 22 70 65 72 61 74 75 72 61 6e 70 65 64 69 61 2e 69 64 22 2c 22 74 65 6c 75 74 6f 70 69 65 7a 2e 63 6c 75 62 22 2c 22 76 73 67 7a 64 64 6a 2e 63 6f 6d 22 2c 22 61 64 61 70 61 2d 67 72 6f 75 70 2e 63 6f 6d 22 2c 22 73 68 65 65 74 2d 6d 75 73 69 63 2e 78 79 7a 22 2c 22 72 6f 63 6b 68 61 74 74 65 72 2e 63 6f 6d 22 2c 22 63 6f 6e 73 63 69 6f 75 73 6e 65 73 73 71 75 61 69 6e 74 2e 63 6f 6d 22 2c 22 76 61 6c 6c 65 73 76 69 73 69 6f 2e 63 61 74 22 2c 22 63 73 69
                                                  Data Ascii: ,"torioluor.com","cracksurl.com","pryvitannya.top","changbeer.site","adonsonlyd.xyz","themencode.com","peraturanpedia.id","telutopiez.club","vsgzddj.com","adapa-group.com","sheet-music.xyz","rockhatter.com","consciousnessquaint.com","vallesvisio.cat","csi
                                                  2024-07-22 10:34:41 UTC1369INData Raw: 2e 63 6f 6d 2e 75 61 22 2c 22 63 61 6d 61 64 6d 69 6e 2e 72 75 22 2c 22 6a 75 62 74 31 32 2e 78 79 7a 22 2c 22 72 6b 6e 2e 67 6f 76 2e 72 75 22 2c 22 31 32 33 6d 6f 76 69 65 2e 6c 74 64 22 2c 22 64 73 32 2e 63 6c 75 62 22 2c 22 79 6f 6d 73 74 2e 6f 72 67 22 2c 22 73 75 69 62 65 2e 65 64 75 2e 63 6e 22 2c 22 38 78 62 65 74 33 30 30 2e 63 6f 6d 22 2c 22 61 70 70 6c 65 69 64 78 79 2e 74 6f 70 22 2c 22 62 69 6f 6c 61 62 73 68 6f 70 32 34 2e 63 6f 6d 22 2c 22 6d 79 66 69 6c 65 73 74 6f 72 65 2e 63 6f 6d 22 2c 22 6f 72 6b 6c 69 6e 6b 2e 63 6f 6d 22 2c 22 65 78 70 6c 6f 72 72 2e 6e 65 74 22 2c 22 67 6f 74 72 61 63 6b 72 65 64 69 72 65 63 74 2e 63 6f 6d 22 2c 22 6a 61 76 69 65 72 64 65 6c 61 73 65 6e 2e 63 6f 6d 22 2c 22 62 72 69 61 6e 73 73 63 6c 75 62 2e 63 63
                                                  Data Ascii: .com.ua","camadmin.ru","jubt12.xyz","rkn.gov.ru","123movie.ltd","ds2.club","yomst.org","suibe.edu.cn","8xbet300.com","appleidxy.top","biolabshop24.com","myfilestore.com","orklink.com","explorr.net","gotrackredirect.com","javierdelasen.com","brianssclub.cc
                                                  2024-07-22 10:34:41 UTC1369INData Raw: 2c 22 64 69 73 63 6c 6f 73 65 70 72 6f 67 72 61 6d 77 65 64 6e 65 73 64 61 79 2e 63 6f 6d 22 2c 22 6b 69 6e 6f 6e 65 77 73 2e 70 72 6f 22 2c 22 6f 68 6e 79 64 65 6c 69 67 68 74 66 75 6c 64 61 74 65 73 2e 6c 69 66 65 22 2c 22 62 6f 6b 65 70 69 64 2e 62 6f 6e 64 22 2c 22 62 6f 72 69 73 2e 64 65 22 2c 22 6d 75 6e 64 6f 63 69 6e 65 6d 61 74 6f 67 72 61 66 69 63 6f 2e 6e 65 74 22 2c 22 62 65 74 61 63 65 6e 74 61 75 72 69 2e 74 6f 70 22 2c 22 6f 6d 67 6e 6f 74 65 2e 6e 65 74 6c 69 66 79 2e 61 70 70 22 2c 22 67 72 6f 77 6e 75 70 67 61 6c 6f 72 65 2e 6c 69 66 65 22 2c 22 69 6d 70 6f 73 73 69 62 6c 65 6f 66 66 65 72 73 2e 63 6f 6d 22 2c 22 76 6b 73 74 72 65 61 6d 2e 74 6f 70 22 2c 22 68 6f 74 70 72 6f 6d 6f 74 69 6f 6e 73 2e 6f 6e 6c 69 6e 65 22 2c 22 69 6f 2e 6b
                                                  Data Ascii: ,"discloseprogramwednesday.com","kinonews.pro","ohnydelightfuldates.life","bokepid.bond","boris.de","mundocinematografico.net","betacentauri.top","omgnote.netlify.app","grownupgalore.life","impossibleoffers.com","vkstream.top","hotpromotions.online","io.k
                                                  2024-07-22 10:34:41 UTC1369INData Raw: 2e 69 74 22 2c 22 6f 6f 72 63 61 73 65 6c 6c 73 2e 63 6f 6d 22 2c 22 6f 6e 65 64 61 73 68 2e 6e 65 74 22 2c 22 74 70 61 73 2e 72 75 22 2c 22 74 65 6e 69 38 35 73 74 61 62 30 31 64 2e 63 6f 6d 22 2c 22 74 68 6f 73 65 63 61 6e 64 79 2e 63 6f 6d 22 2c 22 6e 69 6c 6b 6e 61 72 66 2e 78 79 7a 22 2c 22 72 65 69 66 65 66 72 61 75 65 6e 2e 63 6f 6d 22 2c 22 72 6f 73 65 33 33 2e 74 6f 70 22 2c 22 73 74 6f 6e 65 61 67 65 70 65 64 69 61 2e 63 6f 6d 22 2c 22 6d 79 70 72 69 76 61 74 65 2e 70 69 63 73 22 2c 22 73 6e 61 70 78 2e 69 6e 66 6f 22 2c 22 67 74 61 75 74 6f 63 6c 69 63 6b 65 72 2e 63 6f 6d 22 2c 22 66 6d 6f 76 69 65 7a 2e 69 6e 66 6f 22 2c 22 63 6f 6d 65 73 68 6f 70 69 6e 67 2e 74 6f 6b 79 6f 22 2c 22 70 65 6c 69 73 78 70 6f 72 6e 6f 2e 6e 65 74 22 2c 22 63 68
                                                  Data Ascii: .it","oorcasells.com","onedash.net","tpas.ru","teni85stab01d.com","thosecandy.com","nilknarf.xyz","reifefrauen.com","rose33.top","stoneagepedia.com","myprivate.pics","snapx.info","gtautoclicker.com","fmoviez.info","comeshoping.tokyo","pelisxporno.net","ch
                                                  2024-07-22 10:34:41 UTC1369INData Raw: 70 74 34 72 75 73 2e 72 75 22 2c 22 6c 69 76 65 64 73 6b 61 74 65 72 61 69 73 69 6e 2e 63 6f 6d 22 2c 22 61 79 65 6a 6f 6d 65 72 2e 74 6f 70 22 2c 22 6e 6a 69 32 30 2e 78 79 7a 22 2c 22 67 61 6c 61 78 79 62 79 63 6f 69 6e 2e 63 6f 6d 22 2c 22 65 73 74 61 69 6c 6f 66 61 73 68 69 6f 6e 2e 63 6f 6d 22 2c 22 61 72 63 68 65 75 72 6f 70 65 2e 69 6e 66 6f 22 2c 22 65 7a 63 67 6f 6a 61 61 6d 67 2e 63 6f 6d 22 2c 22 68 2d 67 65 6e 2e 78 79 7a 22 2c 22 78 6e 2d 2d 39 30 61 61 76 6d 66 69 37 62 31 64 2e 78 79 7a 22 2c 22 6c 69 62 72 6f 73 72 65 63 6f 6d 65 6e 64 61 64 6f 73 73 2e 63 6f 6d 22 2c 22 75 74 69 6c 69 74 79 70 72 65 73 65 6e 74 2e 63 6f 6d 22 2c 22 74 68 65 67 61 6d 65 70 6c 61 79 2e 6c 69 66 65 22 2c 22 61 69 36 38 36 38 2e 74 6f 70 22 2c 22 78 79 63 6c
                                                  Data Ascii: pt4rus.ru","livedskateraisin.com","ayejomer.top","nji20.xyz","galaxybycoin.com","estailofashion.com","archeurope.info","ezcgojaamg.com","h-gen.xyz","xn--90aavmfi7b1d.xyz","librosrecomendadoss.com","utilitypresent.com","thegameplay.life","ai6868.top","xycl


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  80192.168.2.449925104.16.149.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:41 UTC149OUTPOST /v1/event-stat?Type=Error&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 665
                                                  2024-07-22 10:34:41 UTC665OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 45 78 63 65 70 74 69 6f 6e 22 3a 22 53 79 73 74 65 6d 2e 4e 75 6c 6c 52 65 66 65 72 65 6e 63 65 45 78 63 65 70 74 69 6f 6e 3a 20 4f 62 6a 65 63 74 20 72 65 66 65 72 65 6e 63 65 20 6e 6f 74 20 73 65 74 20 74 6f 20 61 6e 20 69 6e 73 74 61 6e 63 65 20 6f 66 20 61 6e 20 6f 62 6a 65 63 74 2e 5c 72 5c 6e 20 20 20 61 74 20 57 65 62 43 6f 6d 70 61 6e 69 6f 6e 2e 55 49 2e 41 70 70 43 6f 72 65 2e 50 6f 73 74 52 75 6e 2e 46 65 61 74 75 72 65 41 63 74 69 6f 6e 48 65 6c 70 65 72 2e 49 6e 69 74 69 61 6c 69 7a 65 28 4c 69 73 74 60 31 20 63 6f 6d 6d 61 6e 64 4c 69 6e 65 41 72 67 73 2c 20 42 6f 6f 6c 65 61 6e 20 74 69 6d 65 72 2c 20 53 74 72 69 6e 67 20 66 65 61 74 75 72 65 6e 61 6d 65 29 22 2c 22 45 78 63 65 70 74 69 6f 6e 54 79 70 65 22
                                                  Data Ascii: {"Data": {"Exception":"System.NullReferenceException: Object reference not set to an instance of an object.\r\n at WebCompanion.UI.AppCore.PostRun.FeatureActionHelper.Initialize(List`1 commandLineArgs, Boolean timer, String featurename)","ExceptionType"
                                                  2024-07-22 10:34:41 UTC479INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:41 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: close
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c79979f0434b-EWR
                                                  2024-07-22 10:34:41 UTC35INData Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}
                                                  2024-07-22 10:34:41 UTC5INData Raw: 30 0d 0a 0d 0a
                                                  Data Ascii: 0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  81192.168.2.449928104.16.149.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:41 UTC149OUTPOST /v1/event-stat?Type=Error&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 665
                                                  2024-07-22 10:34:41 UTC665OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 45 78 63 65 70 74 69 6f 6e 22 3a 22 53 79 73 74 65 6d 2e 4e 75 6c 6c 52 65 66 65 72 65 6e 63 65 45 78 63 65 70 74 69 6f 6e 3a 20 4f 62 6a 65 63 74 20 72 65 66 65 72 65 6e 63 65 20 6e 6f 74 20 73 65 74 20 74 6f 20 61 6e 20 69 6e 73 74 61 6e 63 65 20 6f 66 20 61 6e 20 6f 62 6a 65 63 74 2e 5c 72 5c 6e 20 20 20 61 74 20 57 65 62 43 6f 6d 70 61 6e 69 6f 6e 2e 55 49 2e 41 70 70 43 6f 72 65 2e 50 6f 73 74 52 75 6e 2e 46 65 61 74 75 72 65 41 63 74 69 6f 6e 48 65 6c 70 65 72 2e 49 6e 69 74 69 61 6c 69 7a 65 28 4c 69 73 74 60 31 20 63 6f 6d 6d 61 6e 64 4c 69 6e 65 41 72 67 73 2c 20 42 6f 6f 6c 65 61 6e 20 74 69 6d 65 72 2c 20 53 74 72 69 6e 67 20 66 65 61 74 75 72 65 6e 61 6d 65 29 22 2c 22 45 78 63 65 70 74 69 6f 6e 54 79 70 65 22
                                                  Data Ascii: {"Data": {"Exception":"System.NullReferenceException: Object reference not set to an instance of an object.\r\n at WebCompanion.UI.AppCore.PostRun.FeatureActionHelper.Initialize(List`1 commandLineArgs, Boolean timer, String featurename)","ExceptionType"
                                                  2024-07-22 10:34:41 UTC479INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:41 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: close
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c79b7bb40f6d-EWR
                                                  2024-07-22 10:34:41 UTC35INData Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}
                                                  2024-07-22 10:34:41 UTC5INData Raw: 30 0d 0a 0d 0a
                                                  Data Ascii: 0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  82192.168.2.449927104.16.148.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:41 UTC62OUTGET /api/v2/url/blacklist HTTP/1.1
                                                  Host: acs.lavasoft.com
                                                  2024-07-22 10:34:41 UTC324INHTTP/1.1 301 Moved Permanently
                                                  Date: Mon, 22 Jul 2024 10:34:41 GMT
                                                  Content-Length: 0
                                                  Connection: close
                                                  Cache-Control: public
                                                  Cache-Control: max-age=86400
                                                  Location: https://acscdn.lavasoft.com/urlblacklist.json
                                                  api-supported-versions: 2.0
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c79bd8e48cb9-EWR


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  83192.168.2.449933104.16.148.130443984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:43 UTC86OUTGET /api/v2/url/blacklist HTTP/1.1
                                                  Host: acs.lavasoft.com
                                                  Connection: Keep-Alive
                                                  2024-07-22 10:34:43 UTC324INHTTP/1.1 301 Moved Permanently
                                                  Date: Mon, 22 Jul 2024 10:34:43 GMT
                                                  Content-Length: 0
                                                  Connection: close
                                                  Cache-Control: public
                                                  Cache-Control: max-age=86400
                                                  Location: https://acscdn.lavasoft.com/urlblacklist.json
                                                  api-supported-versions: 2.0
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7a4c92b1831-EWR


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  84192.168.2.449934104.16.149.130443984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:43 UTC185OUTPOST /v1/event-stat?Type=BrowserExtension&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 3043
                                                  Connection: Keep-Alive
                                                  2024-07-22 10:34:43 UTC3043OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 42 72 6f 77 73 65 72 22 3a 7b 22 43 68 72 6f 6d 65 22 3a 7b 22 45 78 74 49 6e 66 6f 22 3a 5b 7b 22 69 64 22 3a 22 67 68 62 6d 6e 6e 6a 6f 6f 65 6b 70 6d 6f 65 63 6e 6e 6e 69 6c 6e 6e 62 64 6c 6f 6c 68 6b 68 69 22 2c 22 69 6e 73 74 61 6c 6c 44 61 74 65 22 3a 6e 75 6c 6c 2c 22 75 73 65 72 44 69 73 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 66 6f 72 65 69 67 6e 49 6e 73 74 61 6c 6c 22 3a 66 61 6c 73 65 2c 22 75 70 64 61 74 65 44 61 74 65 22 3a 6e 75 6c 6c 2c 22 76 65 72 73 69 6f 6e 22 3a 6e 75 6c 6c 7d 2c 7b 22 69 64 22 3a 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 2c 22 69 6e 73 74 61 6c 6c 44 61 74 65 22 3a 6e 75 6c 6c 2c 22 75 73 65 72 44 69 73 61 62 6c 65 64 22 3a
                                                  Data Ascii: {"Data": {"Browser":{"Chrome":{"ExtInfo":[{"id":"ghbmnnjooekpmoecnnnilnnbdlolhkhi","installDate":null,"userDisabled":false,"foreignInstall":false,"updateDate":null,"version":null},{"id":"nmmhkkegccagdldgiimedpiccmgmieda","installDate":null,"userDisabled":
                                                  2024-07-22 10:34:43 UTC479INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:43 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: close
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7a5efa041e9-EWR
                                                  2024-07-22 10:34:43 UTC35INData Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}
                                                  2024-07-22 10:34:43 UTC5INData Raw: 30 0d 0a 0d 0a
                                                  Data Ascii: 0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  85192.168.2.449935104.16.149.130443984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:43 UTC185OUTPOST /v1/event-stat?Type=BrowserExtension&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 3043
                                                  Connection: Keep-Alive
                                                  2024-07-22 10:34:43 UTC3043OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 42 72 6f 77 73 65 72 22 3a 7b 22 43 68 72 6f 6d 65 22 3a 7b 22 45 78 74 49 6e 66 6f 22 3a 5b 7b 22 69 64 22 3a 22 67 68 62 6d 6e 6e 6a 6f 6f 65 6b 70 6d 6f 65 63 6e 6e 6e 69 6c 6e 6e 62 64 6c 6f 6c 68 6b 68 69 22 2c 22 69 6e 73 74 61 6c 6c 44 61 74 65 22 3a 6e 75 6c 6c 2c 22 75 73 65 72 44 69 73 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 66 6f 72 65 69 67 6e 49 6e 73 74 61 6c 6c 22 3a 66 61 6c 73 65 2c 22 75 70 64 61 74 65 44 61 74 65 22 3a 6e 75 6c 6c 2c 22 76 65 72 73 69 6f 6e 22 3a 6e 75 6c 6c 7d 2c 7b 22 69 64 22 3a 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 2c 22 69 6e 73 74 61 6c 6c 44 61 74 65 22 3a 6e 75 6c 6c 2c 22 75 73 65 72 44 69 73 61 62 6c 65 64 22 3a
                                                  Data Ascii: {"Data": {"Browser":{"Chrome":{"ExtInfo":[{"id":"ghbmnnjooekpmoecnnnilnnbdlolhkhi","installDate":null,"userDisabled":false,"foreignInstall":false,"updateDate":null,"version":null},{"id":"nmmhkkegccagdldgiimedpiccmgmieda","installDate":null,"userDisabled":
                                                  2024-07-22 10:34:43 UTC479INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:43 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: close
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7a5fc428cbf-EWR
                                                  2024-07-22 10:34:43 UTC35INData Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}
                                                  2024-07-22 10:34:43 UTC5INData Raw: 30 0d 0a 0d 0a
                                                  Data Ascii: 0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  86192.168.2.449937104.16.149.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:43 UTC180OUTPOST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 364
                                                  Connection: Keep-Alive
                                                  2024-07-22 10:34:43 UTC364OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 45 76 65 6e 74 44 61 74 61 22 3a 22 32 34 68 72 73 22 2c 22 45 76 65 6e 74 4e 61 6d 65 22 3a 22 4d 69 63 72 6f 74 61 72 67 65 74 69 6e 67 54 69 6d 65 72 22 2c 22 42 72 6f 77 73 65 72 4e 61 6d 65 22 3a 22 22 2c 22 53 65 61 72 63 68 45 6e 67 69 6e 65 22 3a 22 22 2c 22 49 6e 73 74 61 6c 6c 44 61 74 65 22 3a 22 32 30 32 34 2d 30 37 2d 32 32 54 30 30 3a 30 30 3a 30 30 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65 2d 31 31 32 38 2d 34 65 36 30 2d 62 65 65 61 2d 32 37 32 30 34 31 64 66 36 34 35 32 22 2c 22 4c 61 6e 67 75 61 67 65 22 3a 22 65 6e 2d 55 53 22 2c 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22
                                                  Data Ascii: {"Data": {"EventData":"24hrs","EventName":"MicrotargetingTimer","BrowserName":"","SearchEngine":"","InstallDate":"2024-07-22T00:00:00","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Language":"en-US","MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698"
                                                  2024-07-22 10:34:44 UTC479INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:43 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: close
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7a77e550f3e-EWR
                                                  2024-07-22 10:34:44 UTC35INData Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}
                                                  2024-07-22 10:34:44 UTC5INData Raw: 30 0d 0a 0d 0a
                                                  Data Ascii: 0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  87192.168.2.449936104.16.149.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:43 UTC173OUTPOST /v1/event-stat?Type=Error&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 665
                                                  Connection: Keep-Alive
                                                  2024-07-22 10:34:43 UTC665OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 45 78 63 65 70 74 69 6f 6e 22 3a 22 53 79 73 74 65 6d 2e 4e 75 6c 6c 52 65 66 65 72 65 6e 63 65 45 78 63 65 70 74 69 6f 6e 3a 20 4f 62 6a 65 63 74 20 72 65 66 65 72 65 6e 63 65 20 6e 6f 74 20 73 65 74 20 74 6f 20 61 6e 20 69 6e 73 74 61 6e 63 65 20 6f 66 20 61 6e 20 6f 62 6a 65 63 74 2e 5c 72 5c 6e 20 20 20 61 74 20 57 65 62 43 6f 6d 70 61 6e 69 6f 6e 2e 55 49 2e 41 70 70 43 6f 72 65 2e 50 6f 73 74 52 75 6e 2e 46 65 61 74 75 72 65 41 63 74 69 6f 6e 48 65 6c 70 65 72 2e 49 6e 69 74 69 61 6c 69 7a 65 28 4c 69 73 74 60 31 20 63 6f 6d 6d 61 6e 64 4c 69 6e 65 41 72 67 73 2c 20 42 6f 6f 6c 65 61 6e 20 74 69 6d 65 72 2c 20 53 74 72 69 6e 67 20 66 65 61 74 75 72 65 6e 61 6d 65 29 22 2c 22 45 78 63 65 70 74 69 6f 6e 54 79 70 65 22
                                                  Data Ascii: {"Data": {"Exception":"System.NullReferenceException: Object reference not set to an instance of an object.\r\n at WebCompanion.UI.AppCore.PostRun.FeatureActionHelper.Initialize(List`1 commandLineArgs, Boolean timer, String featurename)","ExceptionType"
                                                  2024-07-22 10:34:44 UTC479INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:43 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: close
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7a7baf643df-EWR
                                                  2024-07-22 10:34:44 UTC35INData Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}
                                                  2024-07-22 10:34:44 UTC5INData Raw: 30 0d 0a 0d 0a
                                                  Data Ascii: 0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  88192.168.2.449939104.16.149.130443984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:45 UTC86OUTGET /urlblacklist.json HTTP/1.1
                                                  Host: acscdn.lavasoft.com
                                                  Connection: Keep-Alive
                                                  2024-07-22 10:34:45 UTC385INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:45 GMT
                                                  Content-Type: application/json
                                                  Content-Length: 201625
                                                  Connection: close
                                                  Last-Modified: Wed, 15 Nov 2023 13:57:17 GMT
                                                  ETag: "6554ce3d-31399"
                                                  CF-Cache-Status: HIT
                                                  Age: 62202
                                                  Expires: Tue, 23 Jul 2024 06:34:45 GMT
                                                  Cache-Control: public, max-age=72000
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7b1ee4778d9-EWR
                                                  2024-07-22 10:34:45 UTC984INData Raw: 5b 22 6c 61 69 7a 68 65 6e 67 73 6c 74 2e 63 6e 22 2c 22 6d 79 74 6f 6f 6c 7a 2e 6e 65 74 22 2c 22 70 72 6f 74 65 63 74 32 34 37 2e 6f 6e 6c 69 6e 65 22 2c 22 78 78 6c 61 73 74 2e 63 6f 6d 22 2c 22 77 6f 72 6c 64 73 61 6e 61 6c 79 74 69 63 73 2e 63 6f 6d 22 2c 22 73 6b 69 6c 6c 74 72 61 6e 73 66 6f 72 6d 2e 63 6f 2e 69 6e 22 2c 22 6c 65 6c 61 65 72 2e 63 6f 6d 22 2c 22 6a 70 6f 70 73 69 6e 67 6c 65 73 2e 65 75 22 2c 22 72 69 73 71 75 65 67 61 6c 6b 78 2e 63 6f 6d 22 2c 22 73 76 65 74 76 79 68 6f 64 2e 73 6b 22 2c 22 6d 6f 76 69 65 63 72 75 6d 62 73 2e 6e 65 74 22 2c 22 70 68 72 61 62 75 2e 67 6f 2e 74 68 22 2c 22 6f 6e 6c 79 69 6e 64 69 61 6e 78 2e 63 63 22 2c 22 69 6b 69 73 73 2e 6f 6e 6c 69 6e 65 22 2c 22 75 72 65 77 73 61 77 61 6e 69 2e 61 75 74 6f 73
                                                  Data Ascii: ["laizhengslt.cn","mytoolz.net","protect247.online","xxlast.com","worldsanalytics.com","skilltransform.co.in","lelaer.com","jpopsingles.eu","risquegalkx.com","svetvyhod.sk","moviecrumbs.net","phrabu.go.th","onlyindianx.cc","ikiss.online","urewsawani.autos
                                                  2024-07-22 10:34:45 UTC1369INData Raw: 6b 61 74 6d 6f 76 69 65 68 64 2e 6d 6f 76 22 2c 22 62 6c 75 65 67 61 73 6c 61 6d 70 2e 6f 72 67 22 2c 22 64 72 61 67 67 65 64 6c 69 6e 65 2e 6f 72 67 22 2c 22 67 68 35 79 73 33 67 72 79 35 64 35 33 32 2e 78 79 7a 22 2c 22 6b 61 61 6d 75 75 2e 6f 72 67 22 2c 22 73 61 6f 6d 61 32 32 30 2e 78 79 7a 22 2c 22 6c 69 76 65 74 76 33 36 35 2e 6d 65 22 2c 22 70 69 73 69 2e 70 69 63 73 22 2c 22 76 61 6c 75 65 2d 6c 69 66 65 2e 78 79 7a 22 2c 22 72 69 64 6f 6d 6f 76 69 65 73 2e 74 76 22 2c 22 70 68 69 6c 77 69 6e 2e 70 68 22 2c 22 61 64 6d 69 72 61 6c 73 68 69 70 70 69 6e 67 2e 63 6f 6d 22 2c 22 66 72 65 65 74 6f 6f 6c 6f 6e 6c 69 6e 65 2e 63 6f 6d 22 2c 22 76 69 74 61 6c 61 6d 73 65 65 2e 63 6f 6d 22 2c 22 6f 72 69 67 6c 6e 61 6c 64 61 74 65 2e 63 6f 6d 22 2c 22 72
                                                  Data Ascii: katmoviehd.mov","bluegaslamp.org","draggedline.org","gh5ys3gry5d532.xyz","kaamuu.org","saoma220.xyz","livetv365.me","pisi.pics","value-life.xyz","ridomovies.tv","philwin.ph","admiralshipping.com","freetoolonline.com","vitalamsee.com","origlnaldate.com","r
                                                  2024-07-22 10:34:45 UTC1369INData Raw: 79 2e 63 6f 6d 22 2c 22 61 69 73 68 6f 72 74 2e 74 6f 70 22 2c 22 70 72 6f 6d 6c 61 7a 65 72 2e 72 75 22 2c 22 6c 65 66 74 62 69 6c 6c 2e 74 6f 70 22 2c 22 75 70 73 63 61 72 72 69 61 67 65 70 61 79 6d 65 6e 74 2e 63 6f 6d 22 2c 22 69 6e 76 65 73 74 6c 69 65 2e 63 6f 6d 22 2c 22 74 35 2d 77 69 6b 69 2e 64 65 22 2c 22 66 72 65 65 73 6f 66 74 72 75 73 2e 72 75 22 2c 22 70 61 70 73 74 72 65 61 6d 2e 63 6c 75 62 22 2c 22 77 6f 72 6c 64 6e 65 77 73 2d 32 34 2e 63 6f 6d 22 2c 22 65 6e 73 74 72 65 61 6d 2e 74 6f 70 22 2c 22 73 6f 72 63 65 72 65 72 6f 66 74 65 61 2e 63 6f 6d 22 2c 22 6d 79 63 6c 69 63 6b 2d 32 2e 63 6f 6d 22 2c 22 6c 65 6c 69 65 7a 6f 72 67 67 72 6f 65 70 2e 6e 6c 22 2c 22 6d 75 61 74 68 65 6e 67 61 79 2e 63 6f 6d 22 2c 22 78 6e 2d 2d 38 30 61 63
                                                  Data Ascii: y.com","aishort.top","promlazer.ru","leftbill.top","upscarriagepayment.com","investlie.com","t5-wiki.de","freesoftrus.ru","papstream.club","worldnews-24.com","enstream.top","sorcereroftea.com","myclick-2.com","leliezorggroep.nl","muathengay.com","xn--80ac
                                                  2024-07-22 10:34:45 UTC1369INData Raw: 64 65 2e 6c 69 66 65 22 2c 22 67 30 66 2e 63 6e 22 2c 22 65 73 75 6e 32 31 2e 63 6e 22 2c 22 62 61 6f 66 65 6e 67 6a 69 68 75 6f 2e 63 6f 6d 22 2c 22 6b 65 79 67 65 6e 73 2e 70 72 6f 22 2c 22 63 68 61 72 6d 61 6e 74 65 73 76 6f 69 73 69 6e 65 73 6d 75 72 65 73 2e 63 6f 6d 22 2c 22 76 69 61 74 72 69 73 2d 65 2d 63 68 61 6e 6e 65 6c 2e 63 6f 6d 22 2c 22 73 68 6f 72 74 6c 79 61 6d 75 73 65 6d 65 6e 74 2e 63 6f 6d 22 2c 22 32 31 39 32 39 2e 72 75 22 2c 22 67 65 74 6d 61 63 6b 65 65 70 65 72 73 6f 66 74 70 72 6f 2e 78 79 7a 22 2c 22 74 68 65 73 79 6e 74 68 65 73 69 73 2e 61 70 70 22 2c 22 63 75 74 69 6c 6e 6b 73 2e 63 6f 6d 22 2c 22 61 75 74 6f 62 69 6b 65 72 73 2e 78 79 7a 22 2c 22 70 69 72 61 74 65 2d 70 72 6f 78 79 2e 74 6f 70 22 2c 22 34 35 2e 31 34 38 2e
                                                  Data Ascii: de.life","g0f.cn","esun21.cn","baofengjihuo.com","keygens.pro","charmantesvoisinesmures.com","viatris-e-channel.com","shortlyamusement.com","21929.ru","getmackeepersoftpro.xyz","thesynthesis.app","cutilnks.com","autobikers.xyz","pirate-proxy.top","45.148.
                                                  2024-07-22 10:34:45 UTC1369INData Raw: 79 77 70 6a 6b 2e 63 6f 6d 22 2c 22 73 79 6c 76 69 6e 61 6e 6f 72 72 65 79 2e 63 6f 6d 22 2c 22 6c 6f 6e 38 38 2e 74 6f 70 22 2c 22 76 6c 61 65 6b 61 6e 2e 6b 7a 22 2c 22 73 75 70 74 72 61 66 2e 63 6f 6d 22 2c 22 67 65 74 66 6c 69 6b 2e 63 6f 6d 22 2c 22 63 6f 6f 6c 74 72 6b 2e 78 79 7a 22 2c 22 66 6c 69 72 74 74 6f 6d 65 2e 63 6f 6d 22 2c 22 6d 61 73 61 63 2e 73 62 73 22 2c 22 6e 61 69 6c 6d 61 67 61 7a 69 6e 65 2e 6f 6e 6c 69 6e 65 22 2c 22 72 6f 76 32 2e 6e 65 74 22 2c 22 63 61 73 74 6c 65 63 61 70 69 74 61 6c 2e 76 63 22 2c 22 6d 6f 62 69 6c 65 74 6f 72 72 65 6e 74 2e 69 6e 66 6f 22 2c 22 63 77 62 74 69 2e 63 6f 6d 2e 62 72 22 2c 22 70 6f 73 61 64 61 6c 61 72 6f 62 6c 65 64 61 2e 63 6f 6d 22 2c 22 61 6c 6c 75 72 69 6e 67 67 61 6c 67 2e 63 6f 6d 22 2c
                                                  Data Ascii: ywpjk.com","sylvinanorrey.com","lon88.top","vlaekan.kz","suptraf.com","getflik.com","cooltrk.xyz","flirttome.com","masac.sbs","nailmagazine.online","rov2.net","castlecapital.vc","mobiletorrent.info","cwbti.com.br","posadalarobleda.com","alluringgalg.com",
                                                  2024-07-22 10:34:45 UTC1369INData Raw: 2c 22 74 6f 72 69 6f 6c 75 6f 72 2e 63 6f 6d 22 2c 22 63 72 61 63 6b 73 75 72 6c 2e 63 6f 6d 22 2c 22 70 72 79 76 69 74 61 6e 6e 79 61 2e 74 6f 70 22 2c 22 63 68 61 6e 67 62 65 65 72 2e 73 69 74 65 22 2c 22 61 64 6f 6e 73 6f 6e 6c 79 64 2e 78 79 7a 22 2c 22 74 68 65 6d 65 6e 63 6f 64 65 2e 63 6f 6d 22 2c 22 70 65 72 61 74 75 72 61 6e 70 65 64 69 61 2e 69 64 22 2c 22 74 65 6c 75 74 6f 70 69 65 7a 2e 63 6c 75 62 22 2c 22 76 73 67 7a 64 64 6a 2e 63 6f 6d 22 2c 22 61 64 61 70 61 2d 67 72 6f 75 70 2e 63 6f 6d 22 2c 22 73 68 65 65 74 2d 6d 75 73 69 63 2e 78 79 7a 22 2c 22 72 6f 63 6b 68 61 74 74 65 72 2e 63 6f 6d 22 2c 22 63 6f 6e 73 63 69 6f 75 73 6e 65 73 73 71 75 61 69 6e 74 2e 63 6f 6d 22 2c 22 76 61 6c 6c 65 73 76 69 73 69 6f 2e 63 61 74 22 2c 22 63 73 69
                                                  Data Ascii: ,"torioluor.com","cracksurl.com","pryvitannya.top","changbeer.site","adonsonlyd.xyz","themencode.com","peraturanpedia.id","telutopiez.club","vsgzddj.com","adapa-group.com","sheet-music.xyz","rockhatter.com","consciousnessquaint.com","vallesvisio.cat","csi
                                                  2024-07-22 10:34:45 UTC1369INData Raw: 2e 63 6f 6d 2e 75 61 22 2c 22 63 61 6d 61 64 6d 69 6e 2e 72 75 22 2c 22 6a 75 62 74 31 32 2e 78 79 7a 22 2c 22 72 6b 6e 2e 67 6f 76 2e 72 75 22 2c 22 31 32 33 6d 6f 76 69 65 2e 6c 74 64 22 2c 22 64 73 32 2e 63 6c 75 62 22 2c 22 79 6f 6d 73 74 2e 6f 72 67 22 2c 22 73 75 69 62 65 2e 65 64 75 2e 63 6e 22 2c 22 38 78 62 65 74 33 30 30 2e 63 6f 6d 22 2c 22 61 70 70 6c 65 69 64 78 79 2e 74 6f 70 22 2c 22 62 69 6f 6c 61 62 73 68 6f 70 32 34 2e 63 6f 6d 22 2c 22 6d 79 66 69 6c 65 73 74 6f 72 65 2e 63 6f 6d 22 2c 22 6f 72 6b 6c 69 6e 6b 2e 63 6f 6d 22 2c 22 65 78 70 6c 6f 72 72 2e 6e 65 74 22 2c 22 67 6f 74 72 61 63 6b 72 65 64 69 72 65 63 74 2e 63 6f 6d 22 2c 22 6a 61 76 69 65 72 64 65 6c 61 73 65 6e 2e 63 6f 6d 22 2c 22 62 72 69 61 6e 73 73 63 6c 75 62 2e 63 63
                                                  Data Ascii: .com.ua","camadmin.ru","jubt12.xyz","rkn.gov.ru","123movie.ltd","ds2.club","yomst.org","suibe.edu.cn","8xbet300.com","appleidxy.top","biolabshop24.com","myfilestore.com","orklink.com","explorr.net","gotrackredirect.com","javierdelasen.com","brianssclub.cc
                                                  2024-07-22 10:34:45 UTC1369INData Raw: 2c 22 64 69 73 63 6c 6f 73 65 70 72 6f 67 72 61 6d 77 65 64 6e 65 73 64 61 79 2e 63 6f 6d 22 2c 22 6b 69 6e 6f 6e 65 77 73 2e 70 72 6f 22 2c 22 6f 68 6e 79 64 65 6c 69 67 68 74 66 75 6c 64 61 74 65 73 2e 6c 69 66 65 22 2c 22 62 6f 6b 65 70 69 64 2e 62 6f 6e 64 22 2c 22 62 6f 72 69 73 2e 64 65 22 2c 22 6d 75 6e 64 6f 63 69 6e 65 6d 61 74 6f 67 72 61 66 69 63 6f 2e 6e 65 74 22 2c 22 62 65 74 61 63 65 6e 74 61 75 72 69 2e 74 6f 70 22 2c 22 6f 6d 67 6e 6f 74 65 2e 6e 65 74 6c 69 66 79 2e 61 70 70 22 2c 22 67 72 6f 77 6e 75 70 67 61 6c 6f 72 65 2e 6c 69 66 65 22 2c 22 69 6d 70 6f 73 73 69 62 6c 65 6f 66 66 65 72 73 2e 63 6f 6d 22 2c 22 76 6b 73 74 72 65 61 6d 2e 74 6f 70 22 2c 22 68 6f 74 70 72 6f 6d 6f 74 69 6f 6e 73 2e 6f 6e 6c 69 6e 65 22 2c 22 69 6f 2e 6b
                                                  Data Ascii: ,"discloseprogramwednesday.com","kinonews.pro","ohnydelightfuldates.life","bokepid.bond","boris.de","mundocinematografico.net","betacentauri.top","omgnote.netlify.app","grownupgalore.life","impossibleoffers.com","vkstream.top","hotpromotions.online","io.k
                                                  2024-07-22 10:34:45 UTC1369INData Raw: 2e 69 74 22 2c 22 6f 6f 72 63 61 73 65 6c 6c 73 2e 63 6f 6d 22 2c 22 6f 6e 65 64 61 73 68 2e 6e 65 74 22 2c 22 74 70 61 73 2e 72 75 22 2c 22 74 65 6e 69 38 35 73 74 61 62 30 31 64 2e 63 6f 6d 22 2c 22 74 68 6f 73 65 63 61 6e 64 79 2e 63 6f 6d 22 2c 22 6e 69 6c 6b 6e 61 72 66 2e 78 79 7a 22 2c 22 72 65 69 66 65 66 72 61 75 65 6e 2e 63 6f 6d 22 2c 22 72 6f 73 65 33 33 2e 74 6f 70 22 2c 22 73 74 6f 6e 65 61 67 65 70 65 64 69 61 2e 63 6f 6d 22 2c 22 6d 79 70 72 69 76 61 74 65 2e 70 69 63 73 22 2c 22 73 6e 61 70 78 2e 69 6e 66 6f 22 2c 22 67 74 61 75 74 6f 63 6c 69 63 6b 65 72 2e 63 6f 6d 22 2c 22 66 6d 6f 76 69 65 7a 2e 69 6e 66 6f 22 2c 22 63 6f 6d 65 73 68 6f 70 69 6e 67 2e 74 6f 6b 79 6f 22 2c 22 70 65 6c 69 73 78 70 6f 72 6e 6f 2e 6e 65 74 22 2c 22 63 68
                                                  Data Ascii: .it","oorcasells.com","onedash.net","tpas.ru","teni85stab01d.com","thosecandy.com","nilknarf.xyz","reifefrauen.com","rose33.top","stoneagepedia.com","myprivate.pics","snapx.info","gtautoclicker.com","fmoviez.info","comeshoping.tokyo","pelisxporno.net","ch
                                                  2024-07-22 10:34:45 UTC1369INData Raw: 70 74 34 72 75 73 2e 72 75 22 2c 22 6c 69 76 65 64 73 6b 61 74 65 72 61 69 73 69 6e 2e 63 6f 6d 22 2c 22 61 79 65 6a 6f 6d 65 72 2e 74 6f 70 22 2c 22 6e 6a 69 32 30 2e 78 79 7a 22 2c 22 67 61 6c 61 78 79 62 79 63 6f 69 6e 2e 63 6f 6d 22 2c 22 65 73 74 61 69 6c 6f 66 61 73 68 69 6f 6e 2e 63 6f 6d 22 2c 22 61 72 63 68 65 75 72 6f 70 65 2e 69 6e 66 6f 22 2c 22 65 7a 63 67 6f 6a 61 61 6d 67 2e 63 6f 6d 22 2c 22 68 2d 67 65 6e 2e 78 79 7a 22 2c 22 78 6e 2d 2d 39 30 61 61 76 6d 66 69 37 62 31 64 2e 78 79 7a 22 2c 22 6c 69 62 72 6f 73 72 65 63 6f 6d 65 6e 64 61 64 6f 73 73 2e 63 6f 6d 22 2c 22 75 74 69 6c 69 74 79 70 72 65 73 65 6e 74 2e 63 6f 6d 22 2c 22 74 68 65 67 61 6d 65 70 6c 61 79 2e 6c 69 66 65 22 2c 22 61 69 36 38 36 38 2e 74 6f 70 22 2c 22 78 79 63 6c
                                                  Data Ascii: pt4rus.ru","livedskateraisin.com","ayejomer.top","nji20.xyz","galaxybycoin.com","estailofashion.com","archeurope.info","ezcgojaamg.com","h-gen.xyz","xn--90aavmfi7b1d.xyz","librosrecomendadoss.com","utilitypresent.com","thegameplay.life","ai6868.top","xycl


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  89192.168.2.449938104.16.149.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:45 UTC62OUTGET /urlblacklist.json HTTP/1.1
                                                  Host: acscdn.lavasoft.com
                                                  2024-07-22 10:34:45 UTC385INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:45 GMT
                                                  Content-Type: application/json
                                                  Content-Length: 201625
                                                  Connection: close
                                                  Last-Modified: Wed, 15 Nov 2023 13:57:17 GMT
                                                  ETag: "6554ce3d-31399"
                                                  CF-Cache-Status: HIT
                                                  Age: 62202
                                                  Expires: Tue, 23 Jul 2024 06:34:45 GMT
                                                  Cache-Control: public, max-age=72000
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7b2be5043ee-EWR
                                                  2024-07-22 10:34:45 UTC984INData Raw: 5b 22 6c 61 69 7a 68 65 6e 67 73 6c 74 2e 63 6e 22 2c 22 6d 79 74 6f 6f 6c 7a 2e 6e 65 74 22 2c 22 70 72 6f 74 65 63 74 32 34 37 2e 6f 6e 6c 69 6e 65 22 2c 22 78 78 6c 61 73 74 2e 63 6f 6d 22 2c 22 77 6f 72 6c 64 73 61 6e 61 6c 79 74 69 63 73 2e 63 6f 6d 22 2c 22 73 6b 69 6c 6c 74 72 61 6e 73 66 6f 72 6d 2e 63 6f 2e 69 6e 22 2c 22 6c 65 6c 61 65 72 2e 63 6f 6d 22 2c 22 6a 70 6f 70 73 69 6e 67 6c 65 73 2e 65 75 22 2c 22 72 69 73 71 75 65 67 61 6c 6b 78 2e 63 6f 6d 22 2c 22 73 76 65 74 76 79 68 6f 64 2e 73 6b 22 2c 22 6d 6f 76 69 65 63 72 75 6d 62 73 2e 6e 65 74 22 2c 22 70 68 72 61 62 75 2e 67 6f 2e 74 68 22 2c 22 6f 6e 6c 79 69 6e 64 69 61 6e 78 2e 63 63 22 2c 22 69 6b 69 73 73 2e 6f 6e 6c 69 6e 65 22 2c 22 75 72 65 77 73 61 77 61 6e 69 2e 61 75 74 6f 73
                                                  Data Ascii: ["laizhengslt.cn","mytoolz.net","protect247.online","xxlast.com","worldsanalytics.com","skilltransform.co.in","lelaer.com","jpopsingles.eu","risquegalkx.com","svetvyhod.sk","moviecrumbs.net","phrabu.go.th","onlyindianx.cc","ikiss.online","urewsawani.autos
                                                  2024-07-22 10:34:45 UTC1369INData Raw: 6b 61 74 6d 6f 76 69 65 68 64 2e 6d 6f 76 22 2c 22 62 6c 75 65 67 61 73 6c 61 6d 70 2e 6f 72 67 22 2c 22 64 72 61 67 67 65 64 6c 69 6e 65 2e 6f 72 67 22 2c 22 67 68 35 79 73 33 67 72 79 35 64 35 33 32 2e 78 79 7a 22 2c 22 6b 61 61 6d 75 75 2e 6f 72 67 22 2c 22 73 61 6f 6d 61 32 32 30 2e 78 79 7a 22 2c 22 6c 69 76 65 74 76 33 36 35 2e 6d 65 22 2c 22 70 69 73 69 2e 70 69 63 73 22 2c 22 76 61 6c 75 65 2d 6c 69 66 65 2e 78 79 7a 22 2c 22 72 69 64 6f 6d 6f 76 69 65 73 2e 74 76 22 2c 22 70 68 69 6c 77 69 6e 2e 70 68 22 2c 22 61 64 6d 69 72 61 6c 73 68 69 70 70 69 6e 67 2e 63 6f 6d 22 2c 22 66 72 65 65 74 6f 6f 6c 6f 6e 6c 69 6e 65 2e 63 6f 6d 22 2c 22 76 69 74 61 6c 61 6d 73 65 65 2e 63 6f 6d 22 2c 22 6f 72 69 67 6c 6e 61 6c 64 61 74 65 2e 63 6f 6d 22 2c 22 72
                                                  Data Ascii: katmoviehd.mov","bluegaslamp.org","draggedline.org","gh5ys3gry5d532.xyz","kaamuu.org","saoma220.xyz","livetv365.me","pisi.pics","value-life.xyz","ridomovies.tv","philwin.ph","admiralshipping.com","freetoolonline.com","vitalamsee.com","origlnaldate.com","r
                                                  2024-07-22 10:34:45 UTC1369INData Raw: 79 2e 63 6f 6d 22 2c 22 61 69 73 68 6f 72 74 2e 74 6f 70 22 2c 22 70 72 6f 6d 6c 61 7a 65 72 2e 72 75 22 2c 22 6c 65 66 74 62 69 6c 6c 2e 74 6f 70 22 2c 22 75 70 73 63 61 72 72 69 61 67 65 70 61 79 6d 65 6e 74 2e 63 6f 6d 22 2c 22 69 6e 76 65 73 74 6c 69 65 2e 63 6f 6d 22 2c 22 74 35 2d 77 69 6b 69 2e 64 65 22 2c 22 66 72 65 65 73 6f 66 74 72 75 73 2e 72 75 22 2c 22 70 61 70 73 74 72 65 61 6d 2e 63 6c 75 62 22 2c 22 77 6f 72 6c 64 6e 65 77 73 2d 32 34 2e 63 6f 6d 22 2c 22 65 6e 73 74 72 65 61 6d 2e 74 6f 70 22 2c 22 73 6f 72 63 65 72 65 72 6f 66 74 65 61 2e 63 6f 6d 22 2c 22 6d 79 63 6c 69 63 6b 2d 32 2e 63 6f 6d 22 2c 22 6c 65 6c 69 65 7a 6f 72 67 67 72 6f 65 70 2e 6e 6c 22 2c 22 6d 75 61 74 68 65 6e 67 61 79 2e 63 6f 6d 22 2c 22 78 6e 2d 2d 38 30 61 63
                                                  Data Ascii: y.com","aishort.top","promlazer.ru","leftbill.top","upscarriagepayment.com","investlie.com","t5-wiki.de","freesoftrus.ru","papstream.club","worldnews-24.com","enstream.top","sorcereroftea.com","myclick-2.com","leliezorggroep.nl","muathengay.com","xn--80ac
                                                  2024-07-22 10:34:45 UTC1369INData Raw: 64 65 2e 6c 69 66 65 22 2c 22 67 30 66 2e 63 6e 22 2c 22 65 73 75 6e 32 31 2e 63 6e 22 2c 22 62 61 6f 66 65 6e 67 6a 69 68 75 6f 2e 63 6f 6d 22 2c 22 6b 65 79 67 65 6e 73 2e 70 72 6f 22 2c 22 63 68 61 72 6d 61 6e 74 65 73 76 6f 69 73 69 6e 65 73 6d 75 72 65 73 2e 63 6f 6d 22 2c 22 76 69 61 74 72 69 73 2d 65 2d 63 68 61 6e 6e 65 6c 2e 63 6f 6d 22 2c 22 73 68 6f 72 74 6c 79 61 6d 75 73 65 6d 65 6e 74 2e 63 6f 6d 22 2c 22 32 31 39 32 39 2e 72 75 22 2c 22 67 65 74 6d 61 63 6b 65 65 70 65 72 73 6f 66 74 70 72 6f 2e 78 79 7a 22 2c 22 74 68 65 73 79 6e 74 68 65 73 69 73 2e 61 70 70 22 2c 22 63 75 74 69 6c 6e 6b 73 2e 63 6f 6d 22 2c 22 61 75 74 6f 62 69 6b 65 72 73 2e 78 79 7a 22 2c 22 70 69 72 61 74 65 2d 70 72 6f 78 79 2e 74 6f 70 22 2c 22 34 35 2e 31 34 38 2e
                                                  Data Ascii: de.life","g0f.cn","esun21.cn","baofengjihuo.com","keygens.pro","charmantesvoisinesmures.com","viatris-e-channel.com","shortlyamusement.com","21929.ru","getmackeepersoftpro.xyz","thesynthesis.app","cutilnks.com","autobikers.xyz","pirate-proxy.top","45.148.
                                                  2024-07-22 10:34:45 UTC1369INData Raw: 79 77 70 6a 6b 2e 63 6f 6d 22 2c 22 73 79 6c 76 69 6e 61 6e 6f 72 72 65 79 2e 63 6f 6d 22 2c 22 6c 6f 6e 38 38 2e 74 6f 70 22 2c 22 76 6c 61 65 6b 61 6e 2e 6b 7a 22 2c 22 73 75 70 74 72 61 66 2e 63 6f 6d 22 2c 22 67 65 74 66 6c 69 6b 2e 63 6f 6d 22 2c 22 63 6f 6f 6c 74 72 6b 2e 78 79 7a 22 2c 22 66 6c 69 72 74 74 6f 6d 65 2e 63 6f 6d 22 2c 22 6d 61 73 61 63 2e 73 62 73 22 2c 22 6e 61 69 6c 6d 61 67 61 7a 69 6e 65 2e 6f 6e 6c 69 6e 65 22 2c 22 72 6f 76 32 2e 6e 65 74 22 2c 22 63 61 73 74 6c 65 63 61 70 69 74 61 6c 2e 76 63 22 2c 22 6d 6f 62 69 6c 65 74 6f 72 72 65 6e 74 2e 69 6e 66 6f 22 2c 22 63 77 62 74 69 2e 63 6f 6d 2e 62 72 22 2c 22 70 6f 73 61 64 61 6c 61 72 6f 62 6c 65 64 61 2e 63 6f 6d 22 2c 22 61 6c 6c 75 72 69 6e 67 67 61 6c 67 2e 63 6f 6d 22 2c
                                                  Data Ascii: ywpjk.com","sylvinanorrey.com","lon88.top","vlaekan.kz","suptraf.com","getflik.com","cooltrk.xyz","flirttome.com","masac.sbs","nailmagazine.online","rov2.net","castlecapital.vc","mobiletorrent.info","cwbti.com.br","posadalarobleda.com","alluringgalg.com",
                                                  2024-07-22 10:34:45 UTC1369INData Raw: 2c 22 74 6f 72 69 6f 6c 75 6f 72 2e 63 6f 6d 22 2c 22 63 72 61 63 6b 73 75 72 6c 2e 63 6f 6d 22 2c 22 70 72 79 76 69 74 61 6e 6e 79 61 2e 74 6f 70 22 2c 22 63 68 61 6e 67 62 65 65 72 2e 73 69 74 65 22 2c 22 61 64 6f 6e 73 6f 6e 6c 79 64 2e 78 79 7a 22 2c 22 74 68 65 6d 65 6e 63 6f 64 65 2e 63 6f 6d 22 2c 22 70 65 72 61 74 75 72 61 6e 70 65 64 69 61 2e 69 64 22 2c 22 74 65 6c 75 74 6f 70 69 65 7a 2e 63 6c 75 62 22 2c 22 76 73 67 7a 64 64 6a 2e 63 6f 6d 22 2c 22 61 64 61 70 61 2d 67 72 6f 75 70 2e 63 6f 6d 22 2c 22 73 68 65 65 74 2d 6d 75 73 69 63 2e 78 79 7a 22 2c 22 72 6f 63 6b 68 61 74 74 65 72 2e 63 6f 6d 22 2c 22 63 6f 6e 73 63 69 6f 75 73 6e 65 73 73 71 75 61 69 6e 74 2e 63 6f 6d 22 2c 22 76 61 6c 6c 65 73 76 69 73 69 6f 2e 63 61 74 22 2c 22 63 73 69
                                                  Data Ascii: ,"torioluor.com","cracksurl.com","pryvitannya.top","changbeer.site","adonsonlyd.xyz","themencode.com","peraturanpedia.id","telutopiez.club","vsgzddj.com","adapa-group.com","sheet-music.xyz","rockhatter.com","consciousnessquaint.com","vallesvisio.cat","csi
                                                  2024-07-22 10:34:45 UTC1369INData Raw: 2e 63 6f 6d 2e 75 61 22 2c 22 63 61 6d 61 64 6d 69 6e 2e 72 75 22 2c 22 6a 75 62 74 31 32 2e 78 79 7a 22 2c 22 72 6b 6e 2e 67 6f 76 2e 72 75 22 2c 22 31 32 33 6d 6f 76 69 65 2e 6c 74 64 22 2c 22 64 73 32 2e 63 6c 75 62 22 2c 22 79 6f 6d 73 74 2e 6f 72 67 22 2c 22 73 75 69 62 65 2e 65 64 75 2e 63 6e 22 2c 22 38 78 62 65 74 33 30 30 2e 63 6f 6d 22 2c 22 61 70 70 6c 65 69 64 78 79 2e 74 6f 70 22 2c 22 62 69 6f 6c 61 62 73 68 6f 70 32 34 2e 63 6f 6d 22 2c 22 6d 79 66 69 6c 65 73 74 6f 72 65 2e 63 6f 6d 22 2c 22 6f 72 6b 6c 69 6e 6b 2e 63 6f 6d 22 2c 22 65 78 70 6c 6f 72 72 2e 6e 65 74 22 2c 22 67 6f 74 72 61 63 6b 72 65 64 69 72 65 63 74 2e 63 6f 6d 22 2c 22 6a 61 76 69 65 72 64 65 6c 61 73 65 6e 2e 63 6f 6d 22 2c 22 62 72 69 61 6e 73 73 63 6c 75 62 2e 63 63
                                                  Data Ascii: .com.ua","camadmin.ru","jubt12.xyz","rkn.gov.ru","123movie.ltd","ds2.club","yomst.org","suibe.edu.cn","8xbet300.com","appleidxy.top","biolabshop24.com","myfilestore.com","orklink.com","explorr.net","gotrackredirect.com","javierdelasen.com","brianssclub.cc
                                                  2024-07-22 10:34:45 UTC1369INData Raw: 2c 22 64 69 73 63 6c 6f 73 65 70 72 6f 67 72 61 6d 77 65 64 6e 65 73 64 61 79 2e 63 6f 6d 22 2c 22 6b 69 6e 6f 6e 65 77 73 2e 70 72 6f 22 2c 22 6f 68 6e 79 64 65 6c 69 67 68 74 66 75 6c 64 61 74 65 73 2e 6c 69 66 65 22 2c 22 62 6f 6b 65 70 69 64 2e 62 6f 6e 64 22 2c 22 62 6f 72 69 73 2e 64 65 22 2c 22 6d 75 6e 64 6f 63 69 6e 65 6d 61 74 6f 67 72 61 66 69 63 6f 2e 6e 65 74 22 2c 22 62 65 74 61 63 65 6e 74 61 75 72 69 2e 74 6f 70 22 2c 22 6f 6d 67 6e 6f 74 65 2e 6e 65 74 6c 69 66 79 2e 61 70 70 22 2c 22 67 72 6f 77 6e 75 70 67 61 6c 6f 72 65 2e 6c 69 66 65 22 2c 22 69 6d 70 6f 73 73 69 62 6c 65 6f 66 66 65 72 73 2e 63 6f 6d 22 2c 22 76 6b 73 74 72 65 61 6d 2e 74 6f 70 22 2c 22 68 6f 74 70 72 6f 6d 6f 74 69 6f 6e 73 2e 6f 6e 6c 69 6e 65 22 2c 22 69 6f 2e 6b
                                                  Data Ascii: ,"discloseprogramwednesday.com","kinonews.pro","ohnydelightfuldates.life","bokepid.bond","boris.de","mundocinematografico.net","betacentauri.top","omgnote.netlify.app","grownupgalore.life","impossibleoffers.com","vkstream.top","hotpromotions.online","io.k
                                                  2024-07-22 10:34:45 UTC1369INData Raw: 2e 69 74 22 2c 22 6f 6f 72 63 61 73 65 6c 6c 73 2e 63 6f 6d 22 2c 22 6f 6e 65 64 61 73 68 2e 6e 65 74 22 2c 22 74 70 61 73 2e 72 75 22 2c 22 74 65 6e 69 38 35 73 74 61 62 30 31 64 2e 63 6f 6d 22 2c 22 74 68 6f 73 65 63 61 6e 64 79 2e 63 6f 6d 22 2c 22 6e 69 6c 6b 6e 61 72 66 2e 78 79 7a 22 2c 22 72 65 69 66 65 66 72 61 75 65 6e 2e 63 6f 6d 22 2c 22 72 6f 73 65 33 33 2e 74 6f 70 22 2c 22 73 74 6f 6e 65 61 67 65 70 65 64 69 61 2e 63 6f 6d 22 2c 22 6d 79 70 72 69 76 61 74 65 2e 70 69 63 73 22 2c 22 73 6e 61 70 78 2e 69 6e 66 6f 22 2c 22 67 74 61 75 74 6f 63 6c 69 63 6b 65 72 2e 63 6f 6d 22 2c 22 66 6d 6f 76 69 65 7a 2e 69 6e 66 6f 22 2c 22 63 6f 6d 65 73 68 6f 70 69 6e 67 2e 74 6f 6b 79 6f 22 2c 22 70 65 6c 69 73 78 70 6f 72 6e 6f 2e 6e 65 74 22 2c 22 63 68
                                                  Data Ascii: .it","oorcasells.com","onedash.net","tpas.ru","teni85stab01d.com","thosecandy.com","nilknarf.xyz","reifefrauen.com","rose33.top","stoneagepedia.com","myprivate.pics","snapx.info","gtautoclicker.com","fmoviez.info","comeshoping.tokyo","pelisxporno.net","ch
                                                  2024-07-22 10:34:45 UTC1369INData Raw: 70 74 34 72 75 73 2e 72 75 22 2c 22 6c 69 76 65 64 73 6b 61 74 65 72 61 69 73 69 6e 2e 63 6f 6d 22 2c 22 61 79 65 6a 6f 6d 65 72 2e 74 6f 70 22 2c 22 6e 6a 69 32 30 2e 78 79 7a 22 2c 22 67 61 6c 61 78 79 62 79 63 6f 69 6e 2e 63 6f 6d 22 2c 22 65 73 74 61 69 6c 6f 66 61 73 68 69 6f 6e 2e 63 6f 6d 22 2c 22 61 72 63 68 65 75 72 6f 70 65 2e 69 6e 66 6f 22 2c 22 65 7a 63 67 6f 6a 61 61 6d 67 2e 63 6f 6d 22 2c 22 68 2d 67 65 6e 2e 78 79 7a 22 2c 22 78 6e 2d 2d 39 30 61 61 76 6d 66 69 37 62 31 64 2e 78 79 7a 22 2c 22 6c 69 62 72 6f 73 72 65 63 6f 6d 65 6e 64 61 64 6f 73 73 2e 63 6f 6d 22 2c 22 75 74 69 6c 69 74 79 70 72 65 73 65 6e 74 2e 63 6f 6d 22 2c 22 74 68 65 67 61 6d 65 70 6c 61 79 2e 6c 69 66 65 22 2c 22 61 69 36 38 36 38 2e 74 6f 70 22 2c 22 78 79 63 6c
                                                  Data Ascii: pt4rus.ru","livedskateraisin.com","ayejomer.top","nji20.xyz","galaxybycoin.com","estailofashion.com","archeurope.info","ezcgojaamg.com","h-gen.xyz","xn--90aavmfi7b1d.xyz","librosrecomendadoss.com","utilitypresent.com","thegameplay.life","ai6868.top","xycl


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  90192.168.2.449943104.16.149.130443984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:45 UTC156OUTPOST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 364
                                                  2024-07-22 10:34:45 UTC364OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 45 76 65 6e 74 44 61 74 61 22 3a 22 32 34 68 72 73 22 2c 22 45 76 65 6e 74 4e 61 6d 65 22 3a 22 4d 69 63 72 6f 74 61 72 67 65 74 69 6e 67 54 69 6d 65 72 22 2c 22 42 72 6f 77 73 65 72 4e 61 6d 65 22 3a 22 22 2c 22 53 65 61 72 63 68 45 6e 67 69 6e 65 22 3a 22 22 2c 22 49 6e 73 74 61 6c 6c 44 61 74 65 22 3a 22 32 30 32 34 2d 30 37 2d 32 32 54 30 30 3a 30 30 3a 30 30 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65 2d 31 31 32 38 2d 34 65 36 30 2d 62 65 65 61 2d 32 37 32 30 34 31 64 66 36 34 35 32 22 2c 22 4c 61 6e 67 75 61 67 65 22 3a 22 65 6e 2d 55 53 22 2c 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22
                                                  Data Ascii: {"Data": {"EventData":"24hrs","EventName":"MicrotargetingTimer","BrowserName":"","SearchEngine":"","InstallDate":"2024-07-22T00:00:00","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Language":"en-US","MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698"
                                                  2024-07-22 10:34:46 UTC479INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:45 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: close
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7b4ffce7c69-EWR
                                                  2024-07-22 10:34:46 UTC35INData Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}
                                                  2024-07-22 10:34:46 UTC5INData Raw: 30 0d 0a 0d 0a
                                                  Data Ascii: 0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  91192.168.2.449942104.16.148.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:46 UTC62OUTGET /api/v2/url/blacklist HTTP/1.1
                                                  Host: acs.lavasoft.com
                                                  2024-07-22 10:34:46 UTC324INHTTP/1.1 301 Moved Permanently
                                                  Date: Mon, 22 Jul 2024 10:34:46 GMT
                                                  Content-Length: 0
                                                  Connection: close
                                                  Cache-Control: public
                                                  Cache-Control: max-age=86400
                                                  Location: https://acscdn.lavasoft.com/urlblacklist.json
                                                  api-supported-versions: 2.0
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7b6dd1843c8-EWR


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  92192.168.2.449941104.16.148.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:46 UTC62OUTGET /api/v2/url/blacklist HTTP/1.1
                                                  Host: acs.lavasoft.com
                                                  2024-07-22 10:34:46 UTC324INHTTP/1.1 301 Moved Permanently
                                                  Date: Mon, 22 Jul 2024 10:34:46 GMT
                                                  Content-Length: 0
                                                  Connection: close
                                                  Cache-Control: public
                                                  Cache-Control: max-age=86400
                                                  Location: https://acscdn.lavasoft.com/urlblacklist.json
                                                  api-supported-versions: 2.0
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7b6dd36c427-EWR


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  93192.168.2.449947104.16.149.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:46 UTC156OUTPOST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 364
                                                  2024-07-22 10:34:46 UTC364OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 45 76 65 6e 74 44 61 74 61 22 3a 22 32 34 68 72 73 22 2c 22 45 76 65 6e 74 4e 61 6d 65 22 3a 22 4d 69 63 72 6f 74 61 72 67 65 74 69 6e 67 54 69 6d 65 72 22 2c 22 42 72 6f 77 73 65 72 4e 61 6d 65 22 3a 22 22 2c 22 53 65 61 72 63 68 45 6e 67 69 6e 65 22 3a 22 22 2c 22 49 6e 73 74 61 6c 6c 44 61 74 65 22 3a 22 32 30 32 34 2d 30 37 2d 32 32 54 30 30 3a 30 30 3a 30 30 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65 2d 31 31 32 38 2d 34 65 36 30 2d 62 65 65 61 2d 32 37 32 30 34 31 64 66 36 34 35 32 22 2c 22 4c 61 6e 67 75 61 67 65 22 3a 22 65 6e 2d 55 53 22 2c 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22
                                                  Data Ascii: {"Data": {"EventData":"24hrs","EventName":"MicrotargetingTimer","BrowserName":"","SearchEngine":"","InstallDate":"2024-07-22T00:00:00","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Language":"en-US","MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698"
                                                  2024-07-22 10:34:46 UTC479INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:46 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: close
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7b8d9ed8c81-EWR
                                                  2024-07-22 10:34:46 UTC35INData Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}
                                                  2024-07-22 10:34:46 UTC5INData Raw: 30 0d 0a 0d 0a
                                                  Data Ascii: 0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  94192.168.2.449945104.16.149.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:46 UTC149OUTPOST /v1/event-stat?Type=Error&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 665
                                                  2024-07-22 10:34:46 UTC665OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 45 78 63 65 70 74 69 6f 6e 22 3a 22 53 79 73 74 65 6d 2e 4e 75 6c 6c 52 65 66 65 72 65 6e 63 65 45 78 63 65 70 74 69 6f 6e 3a 20 4f 62 6a 65 63 74 20 72 65 66 65 72 65 6e 63 65 20 6e 6f 74 20 73 65 74 20 74 6f 20 61 6e 20 69 6e 73 74 61 6e 63 65 20 6f 66 20 61 6e 20 6f 62 6a 65 63 74 2e 5c 72 5c 6e 20 20 20 61 74 20 57 65 62 43 6f 6d 70 61 6e 69 6f 6e 2e 55 49 2e 41 70 70 43 6f 72 65 2e 50 6f 73 74 52 75 6e 2e 46 65 61 74 75 72 65 41 63 74 69 6f 6e 48 65 6c 70 65 72 2e 49 6e 69 74 69 61 6c 69 7a 65 28 4c 69 73 74 60 31 20 63 6f 6d 6d 61 6e 64 4c 69 6e 65 41 72 67 73 2c 20 42 6f 6f 6c 65 61 6e 20 74 69 6d 65 72 2c 20 53 74 72 69 6e 67 20 66 65 61 74 75 72 65 6e 61 6d 65 29 22 2c 22 45 78 63 65 70 74 69 6f 6e 54 79 70 65 22
                                                  Data Ascii: {"Data": {"Exception":"System.NullReferenceException: Object reference not set to an instance of an object.\r\n at WebCompanion.UI.AppCore.PostRun.FeatureActionHelper.Initialize(List`1 commandLineArgs, Boolean timer, String featurename)","ExceptionType"
                                                  2024-07-22 10:34:47 UTC479INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:47 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: close
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7bbaf778cb4-EWR
                                                  2024-07-22 10:34:47 UTC35INData Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}
                                                  2024-07-22 10:34:47 UTC5INData Raw: 30 0d 0a 0d 0a
                                                  Data Ascii: 0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  95192.168.2.449951104.16.149.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:46 UTC62OUTGET /urlblacklist.json HTTP/1.1
                                                  Host: acscdn.lavasoft.com
                                                  2024-07-22 10:34:47 UTC385INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:46 GMT
                                                  Content-Type: application/json
                                                  Content-Length: 201625
                                                  Connection: close
                                                  Last-Modified: Wed, 15 Nov 2023 13:57:17 GMT
                                                  ETag: "6554ce3d-31399"
                                                  CF-Cache-Status: HIT
                                                  Age: 62203
                                                  Expires: Tue, 23 Jul 2024 06:34:46 GMT
                                                  Cache-Control: public, max-age=72000
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7bbac61436c-EWR
                                                  2024-07-22 10:34:47 UTC984INData Raw: 5b 22 6c 61 69 7a 68 65 6e 67 73 6c 74 2e 63 6e 22 2c 22 6d 79 74 6f 6f 6c 7a 2e 6e 65 74 22 2c 22 70 72 6f 74 65 63 74 32 34 37 2e 6f 6e 6c 69 6e 65 22 2c 22 78 78 6c 61 73 74 2e 63 6f 6d 22 2c 22 77 6f 72 6c 64 73 61 6e 61 6c 79 74 69 63 73 2e 63 6f 6d 22 2c 22 73 6b 69 6c 6c 74 72 61 6e 73 66 6f 72 6d 2e 63 6f 2e 69 6e 22 2c 22 6c 65 6c 61 65 72 2e 63 6f 6d 22 2c 22 6a 70 6f 70 73 69 6e 67 6c 65 73 2e 65 75 22 2c 22 72 69 73 71 75 65 67 61 6c 6b 78 2e 63 6f 6d 22 2c 22 73 76 65 74 76 79 68 6f 64 2e 73 6b 22 2c 22 6d 6f 76 69 65 63 72 75 6d 62 73 2e 6e 65 74 22 2c 22 70 68 72 61 62 75 2e 67 6f 2e 74 68 22 2c 22 6f 6e 6c 79 69 6e 64 69 61 6e 78 2e 63 63 22 2c 22 69 6b 69 73 73 2e 6f 6e 6c 69 6e 65 22 2c 22 75 72 65 77 73 61 77 61 6e 69 2e 61 75 74 6f 73
                                                  Data Ascii: ["laizhengslt.cn","mytoolz.net","protect247.online","xxlast.com","worldsanalytics.com","skilltransform.co.in","lelaer.com","jpopsingles.eu","risquegalkx.com","svetvyhod.sk","moviecrumbs.net","phrabu.go.th","onlyindianx.cc","ikiss.online","urewsawani.autos
                                                  2024-07-22 10:34:47 UTC1369INData Raw: 6b 61 74 6d 6f 76 69 65 68 64 2e 6d 6f 76 22 2c 22 62 6c 75 65 67 61 73 6c 61 6d 70 2e 6f 72 67 22 2c 22 64 72 61 67 67 65 64 6c 69 6e 65 2e 6f 72 67 22 2c 22 67 68 35 79 73 33 67 72 79 35 64 35 33 32 2e 78 79 7a 22 2c 22 6b 61 61 6d 75 75 2e 6f 72 67 22 2c 22 73 61 6f 6d 61 32 32 30 2e 78 79 7a 22 2c 22 6c 69 76 65 74 76 33 36 35 2e 6d 65 22 2c 22 70 69 73 69 2e 70 69 63 73 22 2c 22 76 61 6c 75 65 2d 6c 69 66 65 2e 78 79 7a 22 2c 22 72 69 64 6f 6d 6f 76 69 65 73 2e 74 76 22 2c 22 70 68 69 6c 77 69 6e 2e 70 68 22 2c 22 61 64 6d 69 72 61 6c 73 68 69 70 70 69 6e 67 2e 63 6f 6d 22 2c 22 66 72 65 65 74 6f 6f 6c 6f 6e 6c 69 6e 65 2e 63 6f 6d 22 2c 22 76 69 74 61 6c 61 6d 73 65 65 2e 63 6f 6d 22 2c 22 6f 72 69 67 6c 6e 61 6c 64 61 74 65 2e 63 6f 6d 22 2c 22 72
                                                  Data Ascii: katmoviehd.mov","bluegaslamp.org","draggedline.org","gh5ys3gry5d532.xyz","kaamuu.org","saoma220.xyz","livetv365.me","pisi.pics","value-life.xyz","ridomovies.tv","philwin.ph","admiralshipping.com","freetoolonline.com","vitalamsee.com","origlnaldate.com","r
                                                  2024-07-22 10:34:47 UTC1369INData Raw: 79 2e 63 6f 6d 22 2c 22 61 69 73 68 6f 72 74 2e 74 6f 70 22 2c 22 70 72 6f 6d 6c 61 7a 65 72 2e 72 75 22 2c 22 6c 65 66 74 62 69 6c 6c 2e 74 6f 70 22 2c 22 75 70 73 63 61 72 72 69 61 67 65 70 61 79 6d 65 6e 74 2e 63 6f 6d 22 2c 22 69 6e 76 65 73 74 6c 69 65 2e 63 6f 6d 22 2c 22 74 35 2d 77 69 6b 69 2e 64 65 22 2c 22 66 72 65 65 73 6f 66 74 72 75 73 2e 72 75 22 2c 22 70 61 70 73 74 72 65 61 6d 2e 63 6c 75 62 22 2c 22 77 6f 72 6c 64 6e 65 77 73 2d 32 34 2e 63 6f 6d 22 2c 22 65 6e 73 74 72 65 61 6d 2e 74 6f 70 22 2c 22 73 6f 72 63 65 72 65 72 6f 66 74 65 61 2e 63 6f 6d 22 2c 22 6d 79 63 6c 69 63 6b 2d 32 2e 63 6f 6d 22 2c 22 6c 65 6c 69 65 7a 6f 72 67 67 72 6f 65 70 2e 6e 6c 22 2c 22 6d 75 61 74 68 65 6e 67 61 79 2e 63 6f 6d 22 2c 22 78 6e 2d 2d 38 30 61 63
                                                  Data Ascii: y.com","aishort.top","promlazer.ru","leftbill.top","upscarriagepayment.com","investlie.com","t5-wiki.de","freesoftrus.ru","papstream.club","worldnews-24.com","enstream.top","sorcereroftea.com","myclick-2.com","leliezorggroep.nl","muathengay.com","xn--80ac
                                                  2024-07-22 10:34:47 UTC1369INData Raw: 64 65 2e 6c 69 66 65 22 2c 22 67 30 66 2e 63 6e 22 2c 22 65 73 75 6e 32 31 2e 63 6e 22 2c 22 62 61 6f 66 65 6e 67 6a 69 68 75 6f 2e 63 6f 6d 22 2c 22 6b 65 79 67 65 6e 73 2e 70 72 6f 22 2c 22 63 68 61 72 6d 61 6e 74 65 73 76 6f 69 73 69 6e 65 73 6d 75 72 65 73 2e 63 6f 6d 22 2c 22 76 69 61 74 72 69 73 2d 65 2d 63 68 61 6e 6e 65 6c 2e 63 6f 6d 22 2c 22 73 68 6f 72 74 6c 79 61 6d 75 73 65 6d 65 6e 74 2e 63 6f 6d 22 2c 22 32 31 39 32 39 2e 72 75 22 2c 22 67 65 74 6d 61 63 6b 65 65 70 65 72 73 6f 66 74 70 72 6f 2e 78 79 7a 22 2c 22 74 68 65 73 79 6e 74 68 65 73 69 73 2e 61 70 70 22 2c 22 63 75 74 69 6c 6e 6b 73 2e 63 6f 6d 22 2c 22 61 75 74 6f 62 69 6b 65 72 73 2e 78 79 7a 22 2c 22 70 69 72 61 74 65 2d 70 72 6f 78 79 2e 74 6f 70 22 2c 22 34 35 2e 31 34 38 2e
                                                  Data Ascii: de.life","g0f.cn","esun21.cn","baofengjihuo.com","keygens.pro","charmantesvoisinesmures.com","viatris-e-channel.com","shortlyamusement.com","21929.ru","getmackeepersoftpro.xyz","thesynthesis.app","cutilnks.com","autobikers.xyz","pirate-proxy.top","45.148.
                                                  2024-07-22 10:34:47 UTC1369INData Raw: 79 77 70 6a 6b 2e 63 6f 6d 22 2c 22 73 79 6c 76 69 6e 61 6e 6f 72 72 65 79 2e 63 6f 6d 22 2c 22 6c 6f 6e 38 38 2e 74 6f 70 22 2c 22 76 6c 61 65 6b 61 6e 2e 6b 7a 22 2c 22 73 75 70 74 72 61 66 2e 63 6f 6d 22 2c 22 67 65 74 66 6c 69 6b 2e 63 6f 6d 22 2c 22 63 6f 6f 6c 74 72 6b 2e 78 79 7a 22 2c 22 66 6c 69 72 74 74 6f 6d 65 2e 63 6f 6d 22 2c 22 6d 61 73 61 63 2e 73 62 73 22 2c 22 6e 61 69 6c 6d 61 67 61 7a 69 6e 65 2e 6f 6e 6c 69 6e 65 22 2c 22 72 6f 76 32 2e 6e 65 74 22 2c 22 63 61 73 74 6c 65 63 61 70 69 74 61 6c 2e 76 63 22 2c 22 6d 6f 62 69 6c 65 74 6f 72 72 65 6e 74 2e 69 6e 66 6f 22 2c 22 63 77 62 74 69 2e 63 6f 6d 2e 62 72 22 2c 22 70 6f 73 61 64 61 6c 61 72 6f 62 6c 65 64 61 2e 63 6f 6d 22 2c 22 61 6c 6c 75 72 69 6e 67 67 61 6c 67 2e 63 6f 6d 22 2c
                                                  Data Ascii: ywpjk.com","sylvinanorrey.com","lon88.top","vlaekan.kz","suptraf.com","getflik.com","cooltrk.xyz","flirttome.com","masac.sbs","nailmagazine.online","rov2.net","castlecapital.vc","mobiletorrent.info","cwbti.com.br","posadalarobleda.com","alluringgalg.com",
                                                  2024-07-22 10:34:47 UTC1369INData Raw: 2c 22 74 6f 72 69 6f 6c 75 6f 72 2e 63 6f 6d 22 2c 22 63 72 61 63 6b 73 75 72 6c 2e 63 6f 6d 22 2c 22 70 72 79 76 69 74 61 6e 6e 79 61 2e 74 6f 70 22 2c 22 63 68 61 6e 67 62 65 65 72 2e 73 69 74 65 22 2c 22 61 64 6f 6e 73 6f 6e 6c 79 64 2e 78 79 7a 22 2c 22 74 68 65 6d 65 6e 63 6f 64 65 2e 63 6f 6d 22 2c 22 70 65 72 61 74 75 72 61 6e 70 65 64 69 61 2e 69 64 22 2c 22 74 65 6c 75 74 6f 70 69 65 7a 2e 63 6c 75 62 22 2c 22 76 73 67 7a 64 64 6a 2e 63 6f 6d 22 2c 22 61 64 61 70 61 2d 67 72 6f 75 70 2e 63 6f 6d 22 2c 22 73 68 65 65 74 2d 6d 75 73 69 63 2e 78 79 7a 22 2c 22 72 6f 63 6b 68 61 74 74 65 72 2e 63 6f 6d 22 2c 22 63 6f 6e 73 63 69 6f 75 73 6e 65 73 73 71 75 61 69 6e 74 2e 63 6f 6d 22 2c 22 76 61 6c 6c 65 73 76 69 73 69 6f 2e 63 61 74 22 2c 22 63 73 69
                                                  Data Ascii: ,"torioluor.com","cracksurl.com","pryvitannya.top","changbeer.site","adonsonlyd.xyz","themencode.com","peraturanpedia.id","telutopiez.club","vsgzddj.com","adapa-group.com","sheet-music.xyz","rockhatter.com","consciousnessquaint.com","vallesvisio.cat","csi
                                                  2024-07-22 10:34:47 UTC1369INData Raw: 2e 63 6f 6d 2e 75 61 22 2c 22 63 61 6d 61 64 6d 69 6e 2e 72 75 22 2c 22 6a 75 62 74 31 32 2e 78 79 7a 22 2c 22 72 6b 6e 2e 67 6f 76 2e 72 75 22 2c 22 31 32 33 6d 6f 76 69 65 2e 6c 74 64 22 2c 22 64 73 32 2e 63 6c 75 62 22 2c 22 79 6f 6d 73 74 2e 6f 72 67 22 2c 22 73 75 69 62 65 2e 65 64 75 2e 63 6e 22 2c 22 38 78 62 65 74 33 30 30 2e 63 6f 6d 22 2c 22 61 70 70 6c 65 69 64 78 79 2e 74 6f 70 22 2c 22 62 69 6f 6c 61 62 73 68 6f 70 32 34 2e 63 6f 6d 22 2c 22 6d 79 66 69 6c 65 73 74 6f 72 65 2e 63 6f 6d 22 2c 22 6f 72 6b 6c 69 6e 6b 2e 63 6f 6d 22 2c 22 65 78 70 6c 6f 72 72 2e 6e 65 74 22 2c 22 67 6f 74 72 61 63 6b 72 65 64 69 72 65 63 74 2e 63 6f 6d 22 2c 22 6a 61 76 69 65 72 64 65 6c 61 73 65 6e 2e 63 6f 6d 22 2c 22 62 72 69 61 6e 73 73 63 6c 75 62 2e 63 63
                                                  Data Ascii: .com.ua","camadmin.ru","jubt12.xyz","rkn.gov.ru","123movie.ltd","ds2.club","yomst.org","suibe.edu.cn","8xbet300.com","appleidxy.top","biolabshop24.com","myfilestore.com","orklink.com","explorr.net","gotrackredirect.com","javierdelasen.com","brianssclub.cc
                                                  2024-07-22 10:34:47 UTC1369INData Raw: 2c 22 64 69 73 63 6c 6f 73 65 70 72 6f 67 72 61 6d 77 65 64 6e 65 73 64 61 79 2e 63 6f 6d 22 2c 22 6b 69 6e 6f 6e 65 77 73 2e 70 72 6f 22 2c 22 6f 68 6e 79 64 65 6c 69 67 68 74 66 75 6c 64 61 74 65 73 2e 6c 69 66 65 22 2c 22 62 6f 6b 65 70 69 64 2e 62 6f 6e 64 22 2c 22 62 6f 72 69 73 2e 64 65 22 2c 22 6d 75 6e 64 6f 63 69 6e 65 6d 61 74 6f 67 72 61 66 69 63 6f 2e 6e 65 74 22 2c 22 62 65 74 61 63 65 6e 74 61 75 72 69 2e 74 6f 70 22 2c 22 6f 6d 67 6e 6f 74 65 2e 6e 65 74 6c 69 66 79 2e 61 70 70 22 2c 22 67 72 6f 77 6e 75 70 67 61 6c 6f 72 65 2e 6c 69 66 65 22 2c 22 69 6d 70 6f 73 73 69 62 6c 65 6f 66 66 65 72 73 2e 63 6f 6d 22 2c 22 76 6b 73 74 72 65 61 6d 2e 74 6f 70 22 2c 22 68 6f 74 70 72 6f 6d 6f 74 69 6f 6e 73 2e 6f 6e 6c 69 6e 65 22 2c 22 69 6f 2e 6b
                                                  Data Ascii: ,"discloseprogramwednesday.com","kinonews.pro","ohnydelightfuldates.life","bokepid.bond","boris.de","mundocinematografico.net","betacentauri.top","omgnote.netlify.app","grownupgalore.life","impossibleoffers.com","vkstream.top","hotpromotions.online","io.k
                                                  2024-07-22 10:34:47 UTC1369INData Raw: 2e 69 74 22 2c 22 6f 6f 72 63 61 73 65 6c 6c 73 2e 63 6f 6d 22 2c 22 6f 6e 65 64 61 73 68 2e 6e 65 74 22 2c 22 74 70 61 73 2e 72 75 22 2c 22 74 65 6e 69 38 35 73 74 61 62 30 31 64 2e 63 6f 6d 22 2c 22 74 68 6f 73 65 63 61 6e 64 79 2e 63 6f 6d 22 2c 22 6e 69 6c 6b 6e 61 72 66 2e 78 79 7a 22 2c 22 72 65 69 66 65 66 72 61 75 65 6e 2e 63 6f 6d 22 2c 22 72 6f 73 65 33 33 2e 74 6f 70 22 2c 22 73 74 6f 6e 65 61 67 65 70 65 64 69 61 2e 63 6f 6d 22 2c 22 6d 79 70 72 69 76 61 74 65 2e 70 69 63 73 22 2c 22 73 6e 61 70 78 2e 69 6e 66 6f 22 2c 22 67 74 61 75 74 6f 63 6c 69 63 6b 65 72 2e 63 6f 6d 22 2c 22 66 6d 6f 76 69 65 7a 2e 69 6e 66 6f 22 2c 22 63 6f 6d 65 73 68 6f 70 69 6e 67 2e 74 6f 6b 79 6f 22 2c 22 70 65 6c 69 73 78 70 6f 72 6e 6f 2e 6e 65 74 22 2c 22 63 68
                                                  Data Ascii: .it","oorcasells.com","onedash.net","tpas.ru","teni85stab01d.com","thosecandy.com","nilknarf.xyz","reifefrauen.com","rose33.top","stoneagepedia.com","myprivate.pics","snapx.info","gtautoclicker.com","fmoviez.info","comeshoping.tokyo","pelisxporno.net","ch
                                                  2024-07-22 10:34:47 UTC1369INData Raw: 70 74 34 72 75 73 2e 72 75 22 2c 22 6c 69 76 65 64 73 6b 61 74 65 72 61 69 73 69 6e 2e 63 6f 6d 22 2c 22 61 79 65 6a 6f 6d 65 72 2e 74 6f 70 22 2c 22 6e 6a 69 32 30 2e 78 79 7a 22 2c 22 67 61 6c 61 78 79 62 79 63 6f 69 6e 2e 63 6f 6d 22 2c 22 65 73 74 61 69 6c 6f 66 61 73 68 69 6f 6e 2e 63 6f 6d 22 2c 22 61 72 63 68 65 75 72 6f 70 65 2e 69 6e 66 6f 22 2c 22 65 7a 63 67 6f 6a 61 61 6d 67 2e 63 6f 6d 22 2c 22 68 2d 67 65 6e 2e 78 79 7a 22 2c 22 78 6e 2d 2d 39 30 61 61 76 6d 66 69 37 62 31 64 2e 78 79 7a 22 2c 22 6c 69 62 72 6f 73 72 65 63 6f 6d 65 6e 64 61 64 6f 73 73 2e 63 6f 6d 22 2c 22 75 74 69 6c 69 74 79 70 72 65 73 65 6e 74 2e 63 6f 6d 22 2c 22 74 68 65 67 61 6d 65 70 6c 61 79 2e 6c 69 66 65 22 2c 22 61 69 36 38 36 38 2e 74 6f 70 22 2c 22 78 79 63 6c
                                                  Data Ascii: pt4rus.ru","livedskateraisin.com","ayejomer.top","nji20.xyz","galaxybycoin.com","estailofashion.com","archeurope.info","ezcgojaamg.com","h-gen.xyz","xn--90aavmfi7b1d.xyz","librosrecomendadoss.com","utilitypresent.com","thegameplay.life","ai6868.top","xycl


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  96192.168.2.449952104.16.148.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:46 UTC62OUTGET /api/v2/url/blacklist HTTP/1.1
                                                  Host: acs.lavasoft.com
                                                  2024-07-22 10:34:47 UTC324INHTTP/1.1 301 Moved Permanently
                                                  Date: Mon, 22 Jul 2024 10:34:47 GMT
                                                  Content-Length: 0
                                                  Connection: close
                                                  Cache-Control: public
                                                  Cache-Control: max-age=86400
                                                  Location: https://acscdn.lavasoft.com/urlblacklist.json
                                                  api-supported-versions: 2.0
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7bbcd1443d9-EWR


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  97192.168.2.449956104.16.149.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:47 UTC156OUTPOST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 364
                                                  2024-07-22 10:34:47 UTC364OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 45 76 65 6e 74 44 61 74 61 22 3a 22 32 34 68 72 73 22 2c 22 45 76 65 6e 74 4e 61 6d 65 22 3a 22 4d 69 63 72 6f 74 61 72 67 65 74 69 6e 67 54 69 6d 65 72 22 2c 22 42 72 6f 77 73 65 72 4e 61 6d 65 22 3a 22 22 2c 22 53 65 61 72 63 68 45 6e 67 69 6e 65 22 3a 22 22 2c 22 49 6e 73 74 61 6c 6c 44 61 74 65 22 3a 22 32 30 32 34 2d 30 37 2d 32 32 54 30 30 3a 30 30 3a 30 30 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65 2d 31 31 32 38 2d 34 65 36 30 2d 62 65 65 61 2d 32 37 32 30 34 31 64 66 36 34 35 32 22 2c 22 4c 61 6e 67 75 61 67 65 22 3a 22 65 6e 2d 55 53 22 2c 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22
                                                  Data Ascii: {"Data": {"EventData":"24hrs","EventName":"MicrotargetingTimer","BrowserName":"","SearchEngine":"","InstallDate":"2024-07-22T00:00:00","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Language":"en-US","MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698"
                                                  2024-07-22 10:34:47 UTC479INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:47 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: close
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7bdfbff0f69-EWR
                                                  2024-07-22 10:34:47 UTC35INData Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}
                                                  2024-07-22 10:34:47 UTC5INData Raw: 30 0d 0a 0d 0a
                                                  Data Ascii: 0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  98192.168.2.449949104.16.149.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:47 UTC62OUTGET /urlblacklist.json HTTP/1.1
                                                  Host: acscdn.lavasoft.com
                                                  2024-07-22 10:34:47 UTC385INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:47 GMT
                                                  Content-Type: application/json
                                                  Content-Length: 201625
                                                  Connection: close
                                                  Last-Modified: Wed, 15 Nov 2023 13:57:17 GMT
                                                  ETag: "6554ce3d-31399"
                                                  CF-Cache-Status: HIT
                                                  Age: 62204
                                                  Expires: Tue, 23 Jul 2024 06:34:47 GMT
                                                  Cache-Control: public, max-age=72000
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7c09fcf429e-EWR
                                                  2024-07-22 10:34:47 UTC984INData Raw: 5b 22 6c 61 69 7a 68 65 6e 67 73 6c 74 2e 63 6e 22 2c 22 6d 79 74 6f 6f 6c 7a 2e 6e 65 74 22 2c 22 70 72 6f 74 65 63 74 32 34 37 2e 6f 6e 6c 69 6e 65 22 2c 22 78 78 6c 61 73 74 2e 63 6f 6d 22 2c 22 77 6f 72 6c 64 73 61 6e 61 6c 79 74 69 63 73 2e 63 6f 6d 22 2c 22 73 6b 69 6c 6c 74 72 61 6e 73 66 6f 72 6d 2e 63 6f 2e 69 6e 22 2c 22 6c 65 6c 61 65 72 2e 63 6f 6d 22 2c 22 6a 70 6f 70 73 69 6e 67 6c 65 73 2e 65 75 22 2c 22 72 69 73 71 75 65 67 61 6c 6b 78 2e 63 6f 6d 22 2c 22 73 76 65 74 76 79 68 6f 64 2e 73 6b 22 2c 22 6d 6f 76 69 65 63 72 75 6d 62 73 2e 6e 65 74 22 2c 22 70 68 72 61 62 75 2e 67 6f 2e 74 68 22 2c 22 6f 6e 6c 79 69 6e 64 69 61 6e 78 2e 63 63 22 2c 22 69 6b 69 73 73 2e 6f 6e 6c 69 6e 65 22 2c 22 75 72 65 77 73 61 77 61 6e 69 2e 61 75 74 6f 73
                                                  Data Ascii: ["laizhengslt.cn","mytoolz.net","protect247.online","xxlast.com","worldsanalytics.com","skilltransform.co.in","lelaer.com","jpopsingles.eu","risquegalkx.com","svetvyhod.sk","moviecrumbs.net","phrabu.go.th","onlyindianx.cc","ikiss.online","urewsawani.autos
                                                  2024-07-22 10:34:47 UTC1369INData Raw: 6b 61 74 6d 6f 76 69 65 68 64 2e 6d 6f 76 22 2c 22 62 6c 75 65 67 61 73 6c 61 6d 70 2e 6f 72 67 22 2c 22 64 72 61 67 67 65 64 6c 69 6e 65 2e 6f 72 67 22 2c 22 67 68 35 79 73 33 67 72 79 35 64 35 33 32 2e 78 79 7a 22 2c 22 6b 61 61 6d 75 75 2e 6f 72 67 22 2c 22 73 61 6f 6d 61 32 32 30 2e 78 79 7a 22 2c 22 6c 69 76 65 74 76 33 36 35 2e 6d 65 22 2c 22 70 69 73 69 2e 70 69 63 73 22 2c 22 76 61 6c 75 65 2d 6c 69 66 65 2e 78 79 7a 22 2c 22 72 69 64 6f 6d 6f 76 69 65 73 2e 74 76 22 2c 22 70 68 69 6c 77 69 6e 2e 70 68 22 2c 22 61 64 6d 69 72 61 6c 73 68 69 70 70 69 6e 67 2e 63 6f 6d 22 2c 22 66 72 65 65 74 6f 6f 6c 6f 6e 6c 69 6e 65 2e 63 6f 6d 22 2c 22 76 69 74 61 6c 61 6d 73 65 65 2e 63 6f 6d 22 2c 22 6f 72 69 67 6c 6e 61 6c 64 61 74 65 2e 63 6f 6d 22 2c 22 72
                                                  Data Ascii: katmoviehd.mov","bluegaslamp.org","draggedline.org","gh5ys3gry5d532.xyz","kaamuu.org","saoma220.xyz","livetv365.me","pisi.pics","value-life.xyz","ridomovies.tv","philwin.ph","admiralshipping.com","freetoolonline.com","vitalamsee.com","origlnaldate.com","r
                                                  2024-07-22 10:34:47 UTC1369INData Raw: 79 2e 63 6f 6d 22 2c 22 61 69 73 68 6f 72 74 2e 74 6f 70 22 2c 22 70 72 6f 6d 6c 61 7a 65 72 2e 72 75 22 2c 22 6c 65 66 74 62 69 6c 6c 2e 74 6f 70 22 2c 22 75 70 73 63 61 72 72 69 61 67 65 70 61 79 6d 65 6e 74 2e 63 6f 6d 22 2c 22 69 6e 76 65 73 74 6c 69 65 2e 63 6f 6d 22 2c 22 74 35 2d 77 69 6b 69 2e 64 65 22 2c 22 66 72 65 65 73 6f 66 74 72 75 73 2e 72 75 22 2c 22 70 61 70 73 74 72 65 61 6d 2e 63 6c 75 62 22 2c 22 77 6f 72 6c 64 6e 65 77 73 2d 32 34 2e 63 6f 6d 22 2c 22 65 6e 73 74 72 65 61 6d 2e 74 6f 70 22 2c 22 73 6f 72 63 65 72 65 72 6f 66 74 65 61 2e 63 6f 6d 22 2c 22 6d 79 63 6c 69 63 6b 2d 32 2e 63 6f 6d 22 2c 22 6c 65 6c 69 65 7a 6f 72 67 67 72 6f 65 70 2e 6e 6c 22 2c 22 6d 75 61 74 68 65 6e 67 61 79 2e 63 6f 6d 22 2c 22 78 6e 2d 2d 38 30 61 63
                                                  Data Ascii: y.com","aishort.top","promlazer.ru","leftbill.top","upscarriagepayment.com","investlie.com","t5-wiki.de","freesoftrus.ru","papstream.club","worldnews-24.com","enstream.top","sorcereroftea.com","myclick-2.com","leliezorggroep.nl","muathengay.com","xn--80ac
                                                  2024-07-22 10:34:47 UTC1369INData Raw: 64 65 2e 6c 69 66 65 22 2c 22 67 30 66 2e 63 6e 22 2c 22 65 73 75 6e 32 31 2e 63 6e 22 2c 22 62 61 6f 66 65 6e 67 6a 69 68 75 6f 2e 63 6f 6d 22 2c 22 6b 65 79 67 65 6e 73 2e 70 72 6f 22 2c 22 63 68 61 72 6d 61 6e 74 65 73 76 6f 69 73 69 6e 65 73 6d 75 72 65 73 2e 63 6f 6d 22 2c 22 76 69 61 74 72 69 73 2d 65 2d 63 68 61 6e 6e 65 6c 2e 63 6f 6d 22 2c 22 73 68 6f 72 74 6c 79 61 6d 75 73 65 6d 65 6e 74 2e 63 6f 6d 22 2c 22 32 31 39 32 39 2e 72 75 22 2c 22 67 65 74 6d 61 63 6b 65 65 70 65 72 73 6f 66 74 70 72 6f 2e 78 79 7a 22 2c 22 74 68 65 73 79 6e 74 68 65 73 69 73 2e 61 70 70 22 2c 22 63 75 74 69 6c 6e 6b 73 2e 63 6f 6d 22 2c 22 61 75 74 6f 62 69 6b 65 72 73 2e 78 79 7a 22 2c 22 70 69 72 61 74 65 2d 70 72 6f 78 79 2e 74 6f 70 22 2c 22 34 35 2e 31 34 38 2e
                                                  Data Ascii: de.life","g0f.cn","esun21.cn","baofengjihuo.com","keygens.pro","charmantesvoisinesmures.com","viatris-e-channel.com","shortlyamusement.com","21929.ru","getmackeepersoftpro.xyz","thesynthesis.app","cutilnks.com","autobikers.xyz","pirate-proxy.top","45.148.
                                                  2024-07-22 10:34:47 UTC1369INData Raw: 79 77 70 6a 6b 2e 63 6f 6d 22 2c 22 73 79 6c 76 69 6e 61 6e 6f 72 72 65 79 2e 63 6f 6d 22 2c 22 6c 6f 6e 38 38 2e 74 6f 70 22 2c 22 76 6c 61 65 6b 61 6e 2e 6b 7a 22 2c 22 73 75 70 74 72 61 66 2e 63 6f 6d 22 2c 22 67 65 74 66 6c 69 6b 2e 63 6f 6d 22 2c 22 63 6f 6f 6c 74 72 6b 2e 78 79 7a 22 2c 22 66 6c 69 72 74 74 6f 6d 65 2e 63 6f 6d 22 2c 22 6d 61 73 61 63 2e 73 62 73 22 2c 22 6e 61 69 6c 6d 61 67 61 7a 69 6e 65 2e 6f 6e 6c 69 6e 65 22 2c 22 72 6f 76 32 2e 6e 65 74 22 2c 22 63 61 73 74 6c 65 63 61 70 69 74 61 6c 2e 76 63 22 2c 22 6d 6f 62 69 6c 65 74 6f 72 72 65 6e 74 2e 69 6e 66 6f 22 2c 22 63 77 62 74 69 2e 63 6f 6d 2e 62 72 22 2c 22 70 6f 73 61 64 61 6c 61 72 6f 62 6c 65 64 61 2e 63 6f 6d 22 2c 22 61 6c 6c 75 72 69 6e 67 67 61 6c 67 2e 63 6f 6d 22 2c
                                                  Data Ascii: ywpjk.com","sylvinanorrey.com","lon88.top","vlaekan.kz","suptraf.com","getflik.com","cooltrk.xyz","flirttome.com","masac.sbs","nailmagazine.online","rov2.net","castlecapital.vc","mobiletorrent.info","cwbti.com.br","posadalarobleda.com","alluringgalg.com",
                                                  2024-07-22 10:34:47 UTC1369INData Raw: 2c 22 74 6f 72 69 6f 6c 75 6f 72 2e 63 6f 6d 22 2c 22 63 72 61 63 6b 73 75 72 6c 2e 63 6f 6d 22 2c 22 70 72 79 76 69 74 61 6e 6e 79 61 2e 74 6f 70 22 2c 22 63 68 61 6e 67 62 65 65 72 2e 73 69 74 65 22 2c 22 61 64 6f 6e 73 6f 6e 6c 79 64 2e 78 79 7a 22 2c 22 74 68 65 6d 65 6e 63 6f 64 65 2e 63 6f 6d 22 2c 22 70 65 72 61 74 75 72 61 6e 70 65 64 69 61 2e 69 64 22 2c 22 74 65 6c 75 74 6f 70 69 65 7a 2e 63 6c 75 62 22 2c 22 76 73 67 7a 64 64 6a 2e 63 6f 6d 22 2c 22 61 64 61 70 61 2d 67 72 6f 75 70 2e 63 6f 6d 22 2c 22 73 68 65 65 74 2d 6d 75 73 69 63 2e 78 79 7a 22 2c 22 72 6f 63 6b 68 61 74 74 65 72 2e 63 6f 6d 22 2c 22 63 6f 6e 73 63 69 6f 75 73 6e 65 73 73 71 75 61 69 6e 74 2e 63 6f 6d 22 2c 22 76 61 6c 6c 65 73 76 69 73 69 6f 2e 63 61 74 22 2c 22 63 73 69
                                                  Data Ascii: ,"torioluor.com","cracksurl.com","pryvitannya.top","changbeer.site","adonsonlyd.xyz","themencode.com","peraturanpedia.id","telutopiez.club","vsgzddj.com","adapa-group.com","sheet-music.xyz","rockhatter.com","consciousnessquaint.com","vallesvisio.cat","csi
                                                  2024-07-22 10:34:47 UTC1369INData Raw: 2e 63 6f 6d 2e 75 61 22 2c 22 63 61 6d 61 64 6d 69 6e 2e 72 75 22 2c 22 6a 75 62 74 31 32 2e 78 79 7a 22 2c 22 72 6b 6e 2e 67 6f 76 2e 72 75 22 2c 22 31 32 33 6d 6f 76 69 65 2e 6c 74 64 22 2c 22 64 73 32 2e 63 6c 75 62 22 2c 22 79 6f 6d 73 74 2e 6f 72 67 22 2c 22 73 75 69 62 65 2e 65 64 75 2e 63 6e 22 2c 22 38 78 62 65 74 33 30 30 2e 63 6f 6d 22 2c 22 61 70 70 6c 65 69 64 78 79 2e 74 6f 70 22 2c 22 62 69 6f 6c 61 62 73 68 6f 70 32 34 2e 63 6f 6d 22 2c 22 6d 79 66 69 6c 65 73 74 6f 72 65 2e 63 6f 6d 22 2c 22 6f 72 6b 6c 69 6e 6b 2e 63 6f 6d 22 2c 22 65 78 70 6c 6f 72 72 2e 6e 65 74 22 2c 22 67 6f 74 72 61 63 6b 72 65 64 69 72 65 63 74 2e 63 6f 6d 22 2c 22 6a 61 76 69 65 72 64 65 6c 61 73 65 6e 2e 63 6f 6d 22 2c 22 62 72 69 61 6e 73 73 63 6c 75 62 2e 63 63
                                                  Data Ascii: .com.ua","camadmin.ru","jubt12.xyz","rkn.gov.ru","123movie.ltd","ds2.club","yomst.org","suibe.edu.cn","8xbet300.com","appleidxy.top","biolabshop24.com","myfilestore.com","orklink.com","explorr.net","gotrackredirect.com","javierdelasen.com","brianssclub.cc
                                                  2024-07-22 10:34:47 UTC1369INData Raw: 2c 22 64 69 73 63 6c 6f 73 65 70 72 6f 67 72 61 6d 77 65 64 6e 65 73 64 61 79 2e 63 6f 6d 22 2c 22 6b 69 6e 6f 6e 65 77 73 2e 70 72 6f 22 2c 22 6f 68 6e 79 64 65 6c 69 67 68 74 66 75 6c 64 61 74 65 73 2e 6c 69 66 65 22 2c 22 62 6f 6b 65 70 69 64 2e 62 6f 6e 64 22 2c 22 62 6f 72 69 73 2e 64 65 22 2c 22 6d 75 6e 64 6f 63 69 6e 65 6d 61 74 6f 67 72 61 66 69 63 6f 2e 6e 65 74 22 2c 22 62 65 74 61 63 65 6e 74 61 75 72 69 2e 74 6f 70 22 2c 22 6f 6d 67 6e 6f 74 65 2e 6e 65 74 6c 69 66 79 2e 61 70 70 22 2c 22 67 72 6f 77 6e 75 70 67 61 6c 6f 72 65 2e 6c 69 66 65 22 2c 22 69 6d 70 6f 73 73 69 62 6c 65 6f 66 66 65 72 73 2e 63 6f 6d 22 2c 22 76 6b 73 74 72 65 61 6d 2e 74 6f 70 22 2c 22 68 6f 74 70 72 6f 6d 6f 74 69 6f 6e 73 2e 6f 6e 6c 69 6e 65 22 2c 22 69 6f 2e 6b
                                                  Data Ascii: ,"discloseprogramwednesday.com","kinonews.pro","ohnydelightfuldates.life","bokepid.bond","boris.de","mundocinematografico.net","betacentauri.top","omgnote.netlify.app","grownupgalore.life","impossibleoffers.com","vkstream.top","hotpromotions.online","io.k
                                                  2024-07-22 10:34:47 UTC1369INData Raw: 2e 69 74 22 2c 22 6f 6f 72 63 61 73 65 6c 6c 73 2e 63 6f 6d 22 2c 22 6f 6e 65 64 61 73 68 2e 6e 65 74 22 2c 22 74 70 61 73 2e 72 75 22 2c 22 74 65 6e 69 38 35 73 74 61 62 30 31 64 2e 63 6f 6d 22 2c 22 74 68 6f 73 65 63 61 6e 64 79 2e 63 6f 6d 22 2c 22 6e 69 6c 6b 6e 61 72 66 2e 78 79 7a 22 2c 22 72 65 69 66 65 66 72 61 75 65 6e 2e 63 6f 6d 22 2c 22 72 6f 73 65 33 33 2e 74 6f 70 22 2c 22 73 74 6f 6e 65 61 67 65 70 65 64 69 61 2e 63 6f 6d 22 2c 22 6d 79 70 72 69 76 61 74 65 2e 70 69 63 73 22 2c 22 73 6e 61 70 78 2e 69 6e 66 6f 22 2c 22 67 74 61 75 74 6f 63 6c 69 63 6b 65 72 2e 63 6f 6d 22 2c 22 66 6d 6f 76 69 65 7a 2e 69 6e 66 6f 22 2c 22 63 6f 6d 65 73 68 6f 70 69 6e 67 2e 74 6f 6b 79 6f 22 2c 22 70 65 6c 69 73 78 70 6f 72 6e 6f 2e 6e 65 74 22 2c 22 63 68
                                                  Data Ascii: .it","oorcasells.com","onedash.net","tpas.ru","teni85stab01d.com","thosecandy.com","nilknarf.xyz","reifefrauen.com","rose33.top","stoneagepedia.com","myprivate.pics","snapx.info","gtautoclicker.com","fmoviez.info","comeshoping.tokyo","pelisxporno.net","ch
                                                  2024-07-22 10:34:47 UTC1369INData Raw: 70 74 34 72 75 73 2e 72 75 22 2c 22 6c 69 76 65 64 73 6b 61 74 65 72 61 69 73 69 6e 2e 63 6f 6d 22 2c 22 61 79 65 6a 6f 6d 65 72 2e 74 6f 70 22 2c 22 6e 6a 69 32 30 2e 78 79 7a 22 2c 22 67 61 6c 61 78 79 62 79 63 6f 69 6e 2e 63 6f 6d 22 2c 22 65 73 74 61 69 6c 6f 66 61 73 68 69 6f 6e 2e 63 6f 6d 22 2c 22 61 72 63 68 65 75 72 6f 70 65 2e 69 6e 66 6f 22 2c 22 65 7a 63 67 6f 6a 61 61 6d 67 2e 63 6f 6d 22 2c 22 68 2d 67 65 6e 2e 78 79 7a 22 2c 22 78 6e 2d 2d 39 30 61 61 76 6d 66 69 37 62 31 64 2e 78 79 7a 22 2c 22 6c 69 62 72 6f 73 72 65 63 6f 6d 65 6e 64 61 64 6f 73 73 2e 63 6f 6d 22 2c 22 75 74 69 6c 69 74 79 70 72 65 73 65 6e 74 2e 63 6f 6d 22 2c 22 74 68 65 67 61 6d 65 70 6c 61 79 2e 6c 69 66 65 22 2c 22 61 69 36 38 36 38 2e 74 6f 70 22 2c 22 78 79 63 6c
                                                  Data Ascii: pt4rus.ru","livedskateraisin.com","ayejomer.top","nji20.xyz","galaxybycoin.com","estailofashion.com","archeurope.info","ezcgojaamg.com","h-gen.xyz","xn--90aavmfi7b1d.xyz","librosrecomendadoss.com","utilitypresent.com","thegameplay.life","ai6868.top","xycl


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  99192.168.2.449950104.16.148.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:48 UTC62OUTGET /api/v2/url/blacklist HTTP/1.1
                                                  Host: acs.lavasoft.com
                                                  2024-07-22 10:34:48 UTC324INHTTP/1.1 301 Moved Permanently
                                                  Date: Mon, 22 Jul 2024 10:34:48 GMT
                                                  Content-Length: 0
                                                  Connection: close
                                                  Cache-Control: public
                                                  Cache-Control: max-age=86400
                                                  Location: https://acscdn.lavasoft.com/urlblacklist.json
                                                  api-supported-versions: 2.0
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7c2c88c7cab-EWR


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  100192.168.2.449957104.16.149.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:48 UTC156OUTPOST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 364
                                                  2024-07-22 10:34:48 UTC364OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 45 76 65 6e 74 44 61 74 61 22 3a 22 32 34 68 72 73 22 2c 22 45 76 65 6e 74 4e 61 6d 65 22 3a 22 4d 69 63 72 6f 74 61 72 67 65 74 69 6e 67 54 69 6d 65 72 22 2c 22 42 72 6f 77 73 65 72 4e 61 6d 65 22 3a 22 22 2c 22 53 65 61 72 63 68 45 6e 67 69 6e 65 22 3a 22 22 2c 22 49 6e 73 74 61 6c 6c 44 61 74 65 22 3a 22 32 30 32 34 2d 30 37 2d 32 32 54 30 30 3a 30 30 3a 30 30 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65 2d 31 31 32 38 2d 34 65 36 30 2d 62 65 65 61 2d 32 37 32 30 34 31 64 66 36 34 35 32 22 2c 22 4c 61 6e 67 75 61 67 65 22 3a 22 65 6e 2d 55 53 22 2c 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22
                                                  Data Ascii: {"Data": {"EventData":"24hrs","EventName":"MicrotargetingTimer","BrowserName":"","SearchEngine":"","InstallDate":"2024-07-22T00:00:00","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Language":"en-US","MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698"
                                                  2024-07-22 10:34:48 UTC479INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:48 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: close
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7c3afa4727b-EWR
                                                  2024-07-22 10:34:48 UTC35INData Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}
                                                  2024-07-22 10:34:48 UTC5INData Raw: 30 0d 0a 0d 0a
                                                  Data Ascii: 0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  101192.168.2.449958104.16.149.130443984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:48 UTC161OUTPOST /v1/event-stat?Type=BrowserExtension&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 3043
                                                  2024-07-22 10:34:48 UTC3043OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 42 72 6f 77 73 65 72 22 3a 7b 22 43 68 72 6f 6d 65 22 3a 7b 22 45 78 74 49 6e 66 6f 22 3a 5b 7b 22 69 64 22 3a 22 67 68 62 6d 6e 6e 6a 6f 6f 65 6b 70 6d 6f 65 63 6e 6e 6e 69 6c 6e 6e 62 64 6c 6f 6c 68 6b 68 69 22 2c 22 69 6e 73 74 61 6c 6c 44 61 74 65 22 3a 6e 75 6c 6c 2c 22 75 73 65 72 44 69 73 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 66 6f 72 65 69 67 6e 49 6e 73 74 61 6c 6c 22 3a 66 61 6c 73 65 2c 22 75 70 64 61 74 65 44 61 74 65 22 3a 6e 75 6c 6c 2c 22 76 65 72 73 69 6f 6e 22 3a 6e 75 6c 6c 7d 2c 7b 22 69 64 22 3a 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 2c 22 69 6e 73 74 61 6c 6c 44 61 74 65 22 3a 6e 75 6c 6c 2c 22 75 73 65 72 44 69 73 61 62 6c 65 64 22 3a
                                                  Data Ascii: {"Data": {"Browser":{"Chrome":{"ExtInfo":[{"id":"ghbmnnjooekpmoecnnnilnnbdlolhkhi","installDate":null,"userDisabled":false,"foreignInstall":false,"updateDate":null,"version":null},{"id":"nmmhkkegccagdldgiimedpiccmgmieda","installDate":null,"userDisabled":
                                                  2024-07-22 10:34:48 UTC479INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:48 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: close
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7c4cb5d0f87-EWR
                                                  2024-07-22 10:34:48 UTC35INData Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}
                                                  2024-07-22 10:34:48 UTC5INData Raw: 30 0d 0a 0d 0a
                                                  Data Ascii: 0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  102192.168.2.449959104.16.149.130443984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:48 UTC156OUTPOST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 364
                                                  2024-07-22 10:34:48 UTC364OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 45 76 65 6e 74 44 61 74 61 22 3a 22 32 34 68 72 73 22 2c 22 45 76 65 6e 74 4e 61 6d 65 22 3a 22 4d 69 63 72 6f 74 61 72 67 65 74 69 6e 67 54 69 6d 65 72 22 2c 22 42 72 6f 77 73 65 72 4e 61 6d 65 22 3a 22 22 2c 22 53 65 61 72 63 68 45 6e 67 69 6e 65 22 3a 22 22 2c 22 49 6e 73 74 61 6c 6c 44 61 74 65 22 3a 22 32 30 32 34 2d 30 37 2d 32 32 54 30 30 3a 30 30 3a 30 30 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65 2d 31 31 32 38 2d 34 65 36 30 2d 62 65 65 61 2d 32 37 32 30 34 31 64 66 36 34 35 32 22 2c 22 4c 61 6e 67 75 61 67 65 22 3a 22 65 6e 2d 55 53 22 2c 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22
                                                  Data Ascii: {"Data": {"EventData":"24hrs","EventName":"MicrotargetingTimer","BrowserName":"","SearchEngine":"","InstallDate":"2024-07-22T00:00:00","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Language":"en-US","MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698"
                                                  2024-07-22 10:34:48 UTC479INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:48 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: close
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7c5ec4c41f3-EWR
                                                  2024-07-22 10:34:48 UTC35INData Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}
                                                  2024-07-22 10:34:48 UTC5INData Raw: 30 0d 0a 0d 0a
                                                  Data Ascii: 0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  103192.168.2.449960104.16.148.130443984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:48 UTC86OUTGET /api/v2/url/blacklist HTTP/1.1
                                                  Host: acs.lavasoft.com
                                                  Connection: Keep-Alive
                                                  2024-07-22 10:34:48 UTC324INHTTP/1.1 301 Moved Permanently
                                                  Date: Mon, 22 Jul 2024 10:34:48 GMT
                                                  Content-Length: 0
                                                  Connection: close
                                                  Cache-Control: public
                                                  Cache-Control: max-age=86400
                                                  Location: https://acscdn.lavasoft.com/urlblacklist.json
                                                  api-supported-versions: 2.0
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7c75e727d14-EWR


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  104192.168.2.449963104.16.148.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:48 UTC62OUTGET /api/v2/url/blacklist HTTP/1.1
                                                  Host: acs.lavasoft.com
                                                  2024-07-22 10:34:49 UTC324INHTTP/1.1 301 Moved Permanently
                                                  Date: Mon, 22 Jul 2024 10:34:48 GMT
                                                  Content-Length: 0
                                                  Connection: close
                                                  Cache-Control: public
                                                  Cache-Control: max-age=86400
                                                  Location: https://acscdn.lavasoft.com/urlblacklist.json
                                                  api-supported-versions: 2.0
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7c7e90e433d-EWR


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  105192.168.2.449961104.16.149.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:48 UTC161OUTPOST /v1/event-stat?Type=BrowserExtension&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 3043
                                                  2024-07-22 10:34:49 UTC3043OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 42 72 6f 77 73 65 72 22 3a 7b 22 43 68 72 6f 6d 65 22 3a 7b 22 45 78 74 49 6e 66 6f 22 3a 5b 7b 22 69 64 22 3a 22 67 68 62 6d 6e 6e 6a 6f 6f 65 6b 70 6d 6f 65 63 6e 6e 6e 69 6c 6e 6e 62 64 6c 6f 6c 68 6b 68 69 22 2c 22 69 6e 73 74 61 6c 6c 44 61 74 65 22 3a 6e 75 6c 6c 2c 22 75 73 65 72 44 69 73 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 66 6f 72 65 69 67 6e 49 6e 73 74 61 6c 6c 22 3a 66 61 6c 73 65 2c 22 75 70 64 61 74 65 44 61 74 65 22 3a 6e 75 6c 6c 2c 22 76 65 72 73 69 6f 6e 22 3a 6e 75 6c 6c 7d 2c 7b 22 69 64 22 3a 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 2c 22 69 6e 73 74 61 6c 6c 44 61 74 65 22 3a 6e 75 6c 6c 2c 22 75 73 65 72 44 69 73 61 62 6c 65 64 22 3a
                                                  Data Ascii: {"Data": {"Browser":{"Chrome":{"ExtInfo":[{"id":"ghbmnnjooekpmoecnnnilnnbdlolhkhi","installDate":null,"userDisabled":false,"foreignInstall":false,"updateDate":null,"version":null},{"id":"nmmhkkegccagdldgiimedpiccmgmieda","installDate":null,"userDisabled":
                                                  2024-07-22 10:34:49 UTC479INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:49 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: close
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7c85acd430e-EWR
                                                  2024-07-22 10:34:49 UTC35INData Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}
                                                  2024-07-22 10:34:49 UTC5INData Raw: 30 0d 0a 0d 0a
                                                  Data Ascii: 0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  106192.168.2.449962104.16.149.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:48 UTC62OUTGET /urlblacklist.json HTTP/1.1
                                                  Host: acscdn.lavasoft.com
                                                  2024-07-22 10:34:49 UTC385INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:49 GMT
                                                  Content-Type: application/json
                                                  Content-Length: 201625
                                                  Connection: close
                                                  Last-Modified: Wed, 15 Nov 2023 13:57:17 GMT
                                                  ETag: "6554ce3d-31399"
                                                  CF-Cache-Status: HIT
                                                  Age: 62206
                                                  Expires: Tue, 23 Jul 2024 06:34:49 GMT
                                                  Cache-Control: public, max-age=72000
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7c85d9d1871-EWR
                                                  2024-07-22 10:34:49 UTC984INData Raw: 5b 22 6c 61 69 7a 68 65 6e 67 73 6c 74 2e 63 6e 22 2c 22 6d 79 74 6f 6f 6c 7a 2e 6e 65 74 22 2c 22 70 72 6f 74 65 63 74 32 34 37 2e 6f 6e 6c 69 6e 65 22 2c 22 78 78 6c 61 73 74 2e 63 6f 6d 22 2c 22 77 6f 72 6c 64 73 61 6e 61 6c 79 74 69 63 73 2e 63 6f 6d 22 2c 22 73 6b 69 6c 6c 74 72 61 6e 73 66 6f 72 6d 2e 63 6f 2e 69 6e 22 2c 22 6c 65 6c 61 65 72 2e 63 6f 6d 22 2c 22 6a 70 6f 70 73 69 6e 67 6c 65 73 2e 65 75 22 2c 22 72 69 73 71 75 65 67 61 6c 6b 78 2e 63 6f 6d 22 2c 22 73 76 65 74 76 79 68 6f 64 2e 73 6b 22 2c 22 6d 6f 76 69 65 63 72 75 6d 62 73 2e 6e 65 74 22 2c 22 70 68 72 61 62 75 2e 67 6f 2e 74 68 22 2c 22 6f 6e 6c 79 69 6e 64 69 61 6e 78 2e 63 63 22 2c 22 69 6b 69 73 73 2e 6f 6e 6c 69 6e 65 22 2c 22 75 72 65 77 73 61 77 61 6e 69 2e 61 75 74 6f 73
                                                  Data Ascii: ["laizhengslt.cn","mytoolz.net","protect247.online","xxlast.com","worldsanalytics.com","skilltransform.co.in","lelaer.com","jpopsingles.eu","risquegalkx.com","svetvyhod.sk","moviecrumbs.net","phrabu.go.th","onlyindianx.cc","ikiss.online","urewsawani.autos
                                                  2024-07-22 10:34:49 UTC1369INData Raw: 6b 61 74 6d 6f 76 69 65 68 64 2e 6d 6f 76 22 2c 22 62 6c 75 65 67 61 73 6c 61 6d 70 2e 6f 72 67 22 2c 22 64 72 61 67 67 65 64 6c 69 6e 65 2e 6f 72 67 22 2c 22 67 68 35 79 73 33 67 72 79 35 64 35 33 32 2e 78 79 7a 22 2c 22 6b 61 61 6d 75 75 2e 6f 72 67 22 2c 22 73 61 6f 6d 61 32 32 30 2e 78 79 7a 22 2c 22 6c 69 76 65 74 76 33 36 35 2e 6d 65 22 2c 22 70 69 73 69 2e 70 69 63 73 22 2c 22 76 61 6c 75 65 2d 6c 69 66 65 2e 78 79 7a 22 2c 22 72 69 64 6f 6d 6f 76 69 65 73 2e 74 76 22 2c 22 70 68 69 6c 77 69 6e 2e 70 68 22 2c 22 61 64 6d 69 72 61 6c 73 68 69 70 70 69 6e 67 2e 63 6f 6d 22 2c 22 66 72 65 65 74 6f 6f 6c 6f 6e 6c 69 6e 65 2e 63 6f 6d 22 2c 22 76 69 74 61 6c 61 6d 73 65 65 2e 63 6f 6d 22 2c 22 6f 72 69 67 6c 6e 61 6c 64 61 74 65 2e 63 6f 6d 22 2c 22 72
                                                  Data Ascii: katmoviehd.mov","bluegaslamp.org","draggedline.org","gh5ys3gry5d532.xyz","kaamuu.org","saoma220.xyz","livetv365.me","pisi.pics","value-life.xyz","ridomovies.tv","philwin.ph","admiralshipping.com","freetoolonline.com","vitalamsee.com","origlnaldate.com","r
                                                  2024-07-22 10:34:49 UTC1369INData Raw: 79 2e 63 6f 6d 22 2c 22 61 69 73 68 6f 72 74 2e 74 6f 70 22 2c 22 70 72 6f 6d 6c 61 7a 65 72 2e 72 75 22 2c 22 6c 65 66 74 62 69 6c 6c 2e 74 6f 70 22 2c 22 75 70 73 63 61 72 72 69 61 67 65 70 61 79 6d 65 6e 74 2e 63 6f 6d 22 2c 22 69 6e 76 65 73 74 6c 69 65 2e 63 6f 6d 22 2c 22 74 35 2d 77 69 6b 69 2e 64 65 22 2c 22 66 72 65 65 73 6f 66 74 72 75 73 2e 72 75 22 2c 22 70 61 70 73 74 72 65 61 6d 2e 63 6c 75 62 22 2c 22 77 6f 72 6c 64 6e 65 77 73 2d 32 34 2e 63 6f 6d 22 2c 22 65 6e 73 74 72 65 61 6d 2e 74 6f 70 22 2c 22 73 6f 72 63 65 72 65 72 6f 66 74 65 61 2e 63 6f 6d 22 2c 22 6d 79 63 6c 69 63 6b 2d 32 2e 63 6f 6d 22 2c 22 6c 65 6c 69 65 7a 6f 72 67 67 72 6f 65 70 2e 6e 6c 22 2c 22 6d 75 61 74 68 65 6e 67 61 79 2e 63 6f 6d 22 2c 22 78 6e 2d 2d 38 30 61 63
                                                  Data Ascii: y.com","aishort.top","promlazer.ru","leftbill.top","upscarriagepayment.com","investlie.com","t5-wiki.de","freesoftrus.ru","papstream.club","worldnews-24.com","enstream.top","sorcereroftea.com","myclick-2.com","leliezorggroep.nl","muathengay.com","xn--80ac
                                                  2024-07-22 10:34:49 UTC1369INData Raw: 64 65 2e 6c 69 66 65 22 2c 22 67 30 66 2e 63 6e 22 2c 22 65 73 75 6e 32 31 2e 63 6e 22 2c 22 62 61 6f 66 65 6e 67 6a 69 68 75 6f 2e 63 6f 6d 22 2c 22 6b 65 79 67 65 6e 73 2e 70 72 6f 22 2c 22 63 68 61 72 6d 61 6e 74 65 73 76 6f 69 73 69 6e 65 73 6d 75 72 65 73 2e 63 6f 6d 22 2c 22 76 69 61 74 72 69 73 2d 65 2d 63 68 61 6e 6e 65 6c 2e 63 6f 6d 22 2c 22 73 68 6f 72 74 6c 79 61 6d 75 73 65 6d 65 6e 74 2e 63 6f 6d 22 2c 22 32 31 39 32 39 2e 72 75 22 2c 22 67 65 74 6d 61 63 6b 65 65 70 65 72 73 6f 66 74 70 72 6f 2e 78 79 7a 22 2c 22 74 68 65 73 79 6e 74 68 65 73 69 73 2e 61 70 70 22 2c 22 63 75 74 69 6c 6e 6b 73 2e 63 6f 6d 22 2c 22 61 75 74 6f 62 69 6b 65 72 73 2e 78 79 7a 22 2c 22 70 69 72 61 74 65 2d 70 72 6f 78 79 2e 74 6f 70 22 2c 22 34 35 2e 31 34 38 2e
                                                  Data Ascii: de.life","g0f.cn","esun21.cn","baofengjihuo.com","keygens.pro","charmantesvoisinesmures.com","viatris-e-channel.com","shortlyamusement.com","21929.ru","getmackeepersoftpro.xyz","thesynthesis.app","cutilnks.com","autobikers.xyz","pirate-proxy.top","45.148.
                                                  2024-07-22 10:34:49 UTC1369INData Raw: 79 77 70 6a 6b 2e 63 6f 6d 22 2c 22 73 79 6c 76 69 6e 61 6e 6f 72 72 65 79 2e 63 6f 6d 22 2c 22 6c 6f 6e 38 38 2e 74 6f 70 22 2c 22 76 6c 61 65 6b 61 6e 2e 6b 7a 22 2c 22 73 75 70 74 72 61 66 2e 63 6f 6d 22 2c 22 67 65 74 66 6c 69 6b 2e 63 6f 6d 22 2c 22 63 6f 6f 6c 74 72 6b 2e 78 79 7a 22 2c 22 66 6c 69 72 74 74 6f 6d 65 2e 63 6f 6d 22 2c 22 6d 61 73 61 63 2e 73 62 73 22 2c 22 6e 61 69 6c 6d 61 67 61 7a 69 6e 65 2e 6f 6e 6c 69 6e 65 22 2c 22 72 6f 76 32 2e 6e 65 74 22 2c 22 63 61 73 74 6c 65 63 61 70 69 74 61 6c 2e 76 63 22 2c 22 6d 6f 62 69 6c 65 74 6f 72 72 65 6e 74 2e 69 6e 66 6f 22 2c 22 63 77 62 74 69 2e 63 6f 6d 2e 62 72 22 2c 22 70 6f 73 61 64 61 6c 61 72 6f 62 6c 65 64 61 2e 63 6f 6d 22 2c 22 61 6c 6c 75 72 69 6e 67 67 61 6c 67 2e 63 6f 6d 22 2c
                                                  Data Ascii: ywpjk.com","sylvinanorrey.com","lon88.top","vlaekan.kz","suptraf.com","getflik.com","cooltrk.xyz","flirttome.com","masac.sbs","nailmagazine.online","rov2.net","castlecapital.vc","mobiletorrent.info","cwbti.com.br","posadalarobleda.com","alluringgalg.com",
                                                  2024-07-22 10:34:49 UTC1369INData Raw: 2c 22 74 6f 72 69 6f 6c 75 6f 72 2e 63 6f 6d 22 2c 22 63 72 61 63 6b 73 75 72 6c 2e 63 6f 6d 22 2c 22 70 72 79 76 69 74 61 6e 6e 79 61 2e 74 6f 70 22 2c 22 63 68 61 6e 67 62 65 65 72 2e 73 69 74 65 22 2c 22 61 64 6f 6e 73 6f 6e 6c 79 64 2e 78 79 7a 22 2c 22 74 68 65 6d 65 6e 63 6f 64 65 2e 63 6f 6d 22 2c 22 70 65 72 61 74 75 72 61 6e 70 65 64 69 61 2e 69 64 22 2c 22 74 65 6c 75 74 6f 70 69 65 7a 2e 63 6c 75 62 22 2c 22 76 73 67 7a 64 64 6a 2e 63 6f 6d 22 2c 22 61 64 61 70 61 2d 67 72 6f 75 70 2e 63 6f 6d 22 2c 22 73 68 65 65 74 2d 6d 75 73 69 63 2e 78 79 7a 22 2c 22 72 6f 63 6b 68 61 74 74 65 72 2e 63 6f 6d 22 2c 22 63 6f 6e 73 63 69 6f 75 73 6e 65 73 73 71 75 61 69 6e 74 2e 63 6f 6d 22 2c 22 76 61 6c 6c 65 73 76 69 73 69 6f 2e 63 61 74 22 2c 22 63 73 69
                                                  Data Ascii: ,"torioluor.com","cracksurl.com","pryvitannya.top","changbeer.site","adonsonlyd.xyz","themencode.com","peraturanpedia.id","telutopiez.club","vsgzddj.com","adapa-group.com","sheet-music.xyz","rockhatter.com","consciousnessquaint.com","vallesvisio.cat","csi
                                                  2024-07-22 10:34:49 UTC1369INData Raw: 2e 63 6f 6d 2e 75 61 22 2c 22 63 61 6d 61 64 6d 69 6e 2e 72 75 22 2c 22 6a 75 62 74 31 32 2e 78 79 7a 22 2c 22 72 6b 6e 2e 67 6f 76 2e 72 75 22 2c 22 31 32 33 6d 6f 76 69 65 2e 6c 74 64 22 2c 22 64 73 32 2e 63 6c 75 62 22 2c 22 79 6f 6d 73 74 2e 6f 72 67 22 2c 22 73 75 69 62 65 2e 65 64 75 2e 63 6e 22 2c 22 38 78 62 65 74 33 30 30 2e 63 6f 6d 22 2c 22 61 70 70 6c 65 69 64 78 79 2e 74 6f 70 22 2c 22 62 69 6f 6c 61 62 73 68 6f 70 32 34 2e 63 6f 6d 22 2c 22 6d 79 66 69 6c 65 73 74 6f 72 65 2e 63 6f 6d 22 2c 22 6f 72 6b 6c 69 6e 6b 2e 63 6f 6d 22 2c 22 65 78 70 6c 6f 72 72 2e 6e 65 74 22 2c 22 67 6f 74 72 61 63 6b 72 65 64 69 72 65 63 74 2e 63 6f 6d 22 2c 22 6a 61 76 69 65 72 64 65 6c 61 73 65 6e 2e 63 6f 6d 22 2c 22 62 72 69 61 6e 73 73 63 6c 75 62 2e 63 63
                                                  Data Ascii: .com.ua","camadmin.ru","jubt12.xyz","rkn.gov.ru","123movie.ltd","ds2.club","yomst.org","suibe.edu.cn","8xbet300.com","appleidxy.top","biolabshop24.com","myfilestore.com","orklink.com","explorr.net","gotrackredirect.com","javierdelasen.com","brianssclub.cc
                                                  2024-07-22 10:34:49 UTC1369INData Raw: 2c 22 64 69 73 63 6c 6f 73 65 70 72 6f 67 72 61 6d 77 65 64 6e 65 73 64 61 79 2e 63 6f 6d 22 2c 22 6b 69 6e 6f 6e 65 77 73 2e 70 72 6f 22 2c 22 6f 68 6e 79 64 65 6c 69 67 68 74 66 75 6c 64 61 74 65 73 2e 6c 69 66 65 22 2c 22 62 6f 6b 65 70 69 64 2e 62 6f 6e 64 22 2c 22 62 6f 72 69 73 2e 64 65 22 2c 22 6d 75 6e 64 6f 63 69 6e 65 6d 61 74 6f 67 72 61 66 69 63 6f 2e 6e 65 74 22 2c 22 62 65 74 61 63 65 6e 74 61 75 72 69 2e 74 6f 70 22 2c 22 6f 6d 67 6e 6f 74 65 2e 6e 65 74 6c 69 66 79 2e 61 70 70 22 2c 22 67 72 6f 77 6e 75 70 67 61 6c 6f 72 65 2e 6c 69 66 65 22 2c 22 69 6d 70 6f 73 73 69 62 6c 65 6f 66 66 65 72 73 2e 63 6f 6d 22 2c 22 76 6b 73 74 72 65 61 6d 2e 74 6f 70 22 2c 22 68 6f 74 70 72 6f 6d 6f 74 69 6f 6e 73 2e 6f 6e 6c 69 6e 65 22 2c 22 69 6f 2e 6b
                                                  Data Ascii: ,"discloseprogramwednesday.com","kinonews.pro","ohnydelightfuldates.life","bokepid.bond","boris.de","mundocinematografico.net","betacentauri.top","omgnote.netlify.app","grownupgalore.life","impossibleoffers.com","vkstream.top","hotpromotions.online","io.k
                                                  2024-07-22 10:34:49 UTC1369INData Raw: 2e 69 74 22 2c 22 6f 6f 72 63 61 73 65 6c 6c 73 2e 63 6f 6d 22 2c 22 6f 6e 65 64 61 73 68 2e 6e 65 74 22 2c 22 74 70 61 73 2e 72 75 22 2c 22 74 65 6e 69 38 35 73 74 61 62 30 31 64 2e 63 6f 6d 22 2c 22 74 68 6f 73 65 63 61 6e 64 79 2e 63 6f 6d 22 2c 22 6e 69 6c 6b 6e 61 72 66 2e 78 79 7a 22 2c 22 72 65 69 66 65 66 72 61 75 65 6e 2e 63 6f 6d 22 2c 22 72 6f 73 65 33 33 2e 74 6f 70 22 2c 22 73 74 6f 6e 65 61 67 65 70 65 64 69 61 2e 63 6f 6d 22 2c 22 6d 79 70 72 69 76 61 74 65 2e 70 69 63 73 22 2c 22 73 6e 61 70 78 2e 69 6e 66 6f 22 2c 22 67 74 61 75 74 6f 63 6c 69 63 6b 65 72 2e 63 6f 6d 22 2c 22 66 6d 6f 76 69 65 7a 2e 69 6e 66 6f 22 2c 22 63 6f 6d 65 73 68 6f 70 69 6e 67 2e 74 6f 6b 79 6f 22 2c 22 70 65 6c 69 73 78 70 6f 72 6e 6f 2e 6e 65 74 22 2c 22 63 68
                                                  Data Ascii: .it","oorcasells.com","onedash.net","tpas.ru","teni85stab01d.com","thosecandy.com","nilknarf.xyz","reifefrauen.com","rose33.top","stoneagepedia.com","myprivate.pics","snapx.info","gtautoclicker.com","fmoviez.info","comeshoping.tokyo","pelisxporno.net","ch
                                                  2024-07-22 10:34:49 UTC1369INData Raw: 70 74 34 72 75 73 2e 72 75 22 2c 22 6c 69 76 65 64 73 6b 61 74 65 72 61 69 73 69 6e 2e 63 6f 6d 22 2c 22 61 79 65 6a 6f 6d 65 72 2e 74 6f 70 22 2c 22 6e 6a 69 32 30 2e 78 79 7a 22 2c 22 67 61 6c 61 78 79 62 79 63 6f 69 6e 2e 63 6f 6d 22 2c 22 65 73 74 61 69 6c 6f 66 61 73 68 69 6f 6e 2e 63 6f 6d 22 2c 22 61 72 63 68 65 75 72 6f 70 65 2e 69 6e 66 6f 22 2c 22 65 7a 63 67 6f 6a 61 61 6d 67 2e 63 6f 6d 22 2c 22 68 2d 67 65 6e 2e 78 79 7a 22 2c 22 78 6e 2d 2d 39 30 61 61 76 6d 66 69 37 62 31 64 2e 78 79 7a 22 2c 22 6c 69 62 72 6f 73 72 65 63 6f 6d 65 6e 64 61 64 6f 73 73 2e 63 6f 6d 22 2c 22 75 74 69 6c 69 74 79 70 72 65 73 65 6e 74 2e 63 6f 6d 22 2c 22 74 68 65 67 61 6d 65 70 6c 61 79 2e 6c 69 66 65 22 2c 22 61 69 36 38 36 38 2e 74 6f 70 22 2c 22 78 79 63 6c
                                                  Data Ascii: pt4rus.ru","livedskateraisin.com","ayejomer.top","nji20.xyz","galaxybycoin.com","estailofashion.com","archeurope.info","ezcgojaamg.com","h-gen.xyz","xn--90aavmfi7b1d.xyz","librosrecomendadoss.com","utilitypresent.com","thegameplay.life","ai6868.top","xycl


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  107192.168.2.449964104.16.149.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:49 UTC156OUTPOST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 364
                                                  2024-07-22 10:34:49 UTC364OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 45 76 65 6e 74 44 61 74 61 22 3a 22 32 34 68 72 73 22 2c 22 45 76 65 6e 74 4e 61 6d 65 22 3a 22 4d 69 63 72 6f 74 61 72 67 65 74 69 6e 67 54 69 6d 65 72 22 2c 22 42 72 6f 77 73 65 72 4e 61 6d 65 22 3a 22 22 2c 22 53 65 61 72 63 68 45 6e 67 69 6e 65 22 3a 22 22 2c 22 49 6e 73 74 61 6c 6c 44 61 74 65 22 3a 22 32 30 32 34 2d 30 37 2d 32 32 54 30 30 3a 30 30 3a 30 30 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65 2d 31 31 32 38 2d 34 65 36 30 2d 62 65 65 61 2d 32 37 32 30 34 31 64 66 36 34 35 32 22 2c 22 4c 61 6e 67 75 61 67 65 22 3a 22 65 6e 2d 55 53 22 2c 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22
                                                  Data Ascii: {"Data": {"EventData":"24hrs","EventName":"MicrotargetingTimer","BrowserName":"","SearchEngine":"","InstallDate":"2024-07-22T00:00:00","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Language":"en-US","MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698"
                                                  2024-07-22 10:34:49 UTC479INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:49 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: close
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7caeda072b7-EWR
                                                  2024-07-22 10:34:49 UTC35INData Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}
                                                  2024-07-22 10:34:49 UTC5INData Raw: 30 0d 0a 0d 0a
                                                  Data Ascii: 0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  108192.168.2.449965104.16.149.130443984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:49 UTC86OUTGET /urlblacklist.json HTTP/1.1
                                                  Host: acscdn.lavasoft.com
                                                  Connection: Keep-Alive


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  109192.168.2.449967104.16.149.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:50 UTC149OUTPOST /v1/event-stat?Type=Error&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 665
                                                  2024-07-22 10:34:50 UTC665OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 45 78 63 65 70 74 69 6f 6e 22 3a 22 53 79 73 74 65 6d 2e 4e 75 6c 6c 52 65 66 65 72 65 6e 63 65 45 78 63 65 70 74 69 6f 6e 3a 20 4f 62 6a 65 63 74 20 72 65 66 65 72 65 6e 63 65 20 6e 6f 74 20 73 65 74 20 74 6f 20 61 6e 20 69 6e 73 74 61 6e 63 65 20 6f 66 20 61 6e 20 6f 62 6a 65 63 74 2e 5c 72 5c 6e 20 20 20 61 74 20 57 65 62 43 6f 6d 70 61 6e 69 6f 6e 2e 55 49 2e 41 70 70 43 6f 72 65 2e 50 6f 73 74 52 75 6e 2e 46 65 61 74 75 72 65 41 63 74 69 6f 6e 48 65 6c 70 65 72 2e 49 6e 69 74 69 61 6c 69 7a 65 28 4c 69 73 74 60 31 20 63 6f 6d 6d 61 6e 64 4c 69 6e 65 41 72 67 73 2c 20 42 6f 6f 6c 65 61 6e 20 74 69 6d 65 72 2c 20 53 74 72 69 6e 67 20 66 65 61 74 75 72 65 6e 61 6d 65 29 22 2c 22 45 78 63 65 70 74 69 6f 6e 54 79 70 65 22
                                                  Data Ascii: {"Data": {"Exception":"System.NullReferenceException: Object reference not set to an instance of an object.\r\n at WebCompanion.UI.AppCore.PostRun.FeatureActionHelper.Initialize(List`1 commandLineArgs, Boolean timer, String featurename)","ExceptionType"
                                                  2024-07-22 10:34:50 UTC479INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:50 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: close
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7d02a9a438b-EWR
                                                  2024-07-22 10:34:50 UTC35INData Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}
                                                  2024-07-22 10:34:50 UTC5INData Raw: 30 0d 0a 0d 0a
                                                  Data Ascii: 0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  110192.168.2.449971104.16.149.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:50 UTC62OUTGET /urlblacklist.json HTTP/1.1
                                                  Host: acscdn.lavasoft.com
                                                  2024-07-22 10:34:50 UTC385INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:50 GMT
                                                  Content-Type: application/json
                                                  Content-Length: 201625
                                                  Connection: close
                                                  Last-Modified: Wed, 15 Nov 2023 13:57:17 GMT
                                                  ETag: "6554ce3d-31399"
                                                  CF-Cache-Status: HIT
                                                  Age: 62207
                                                  Expires: Tue, 23 Jul 2024 06:34:50 GMT
                                                  Cache-Control: public, max-age=72000
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7d42ea68c53-EWR
                                                  2024-07-22 10:34:50 UTC984INData Raw: 5b 22 6c 61 69 7a 68 65 6e 67 73 6c 74 2e 63 6e 22 2c 22 6d 79 74 6f 6f 6c 7a 2e 6e 65 74 22 2c 22 70 72 6f 74 65 63 74 32 34 37 2e 6f 6e 6c 69 6e 65 22 2c 22 78 78 6c 61 73 74 2e 63 6f 6d 22 2c 22 77 6f 72 6c 64 73 61 6e 61 6c 79 74 69 63 73 2e 63 6f 6d 22 2c 22 73 6b 69 6c 6c 74 72 61 6e 73 66 6f 72 6d 2e 63 6f 2e 69 6e 22 2c 22 6c 65 6c 61 65 72 2e 63 6f 6d 22 2c 22 6a 70 6f 70 73 69 6e 67 6c 65 73 2e 65 75 22 2c 22 72 69 73 71 75 65 67 61 6c 6b 78 2e 63 6f 6d 22 2c 22 73 76 65 74 76 79 68 6f 64 2e 73 6b 22 2c 22 6d 6f 76 69 65 63 72 75 6d 62 73 2e 6e 65 74 22 2c 22 70 68 72 61 62 75 2e 67 6f 2e 74 68 22 2c 22 6f 6e 6c 79 69 6e 64 69 61 6e 78 2e 63 63 22 2c 22 69 6b 69 73 73 2e 6f 6e 6c 69 6e 65 22 2c 22 75 72 65 77 73 61 77 61 6e 69 2e 61 75 74 6f 73
                                                  Data Ascii: ["laizhengslt.cn","mytoolz.net","protect247.online","xxlast.com","worldsanalytics.com","skilltransform.co.in","lelaer.com","jpopsingles.eu","risquegalkx.com","svetvyhod.sk","moviecrumbs.net","phrabu.go.th","onlyindianx.cc","ikiss.online","urewsawani.autos
                                                  2024-07-22 10:34:50 UTC1369INData Raw: 6b 61 74 6d 6f 76 69 65 68 64 2e 6d 6f 76 22 2c 22 62 6c 75 65 67 61 73 6c 61 6d 70 2e 6f 72 67 22 2c 22 64 72 61 67 67 65 64 6c 69 6e 65 2e 6f 72 67 22 2c 22 67 68 35 79 73 33 67 72 79 35 64 35 33 32 2e 78 79 7a 22 2c 22 6b 61 61 6d 75 75 2e 6f 72 67 22 2c 22 73 61 6f 6d 61 32 32 30 2e 78 79 7a 22 2c 22 6c 69 76 65 74 76 33 36 35 2e 6d 65 22 2c 22 70 69 73 69 2e 70 69 63 73 22 2c 22 76 61 6c 75 65 2d 6c 69 66 65 2e 78 79 7a 22 2c 22 72 69 64 6f 6d 6f 76 69 65 73 2e 74 76 22 2c 22 70 68 69 6c 77 69 6e 2e 70 68 22 2c 22 61 64 6d 69 72 61 6c 73 68 69 70 70 69 6e 67 2e 63 6f 6d 22 2c 22 66 72 65 65 74 6f 6f 6c 6f 6e 6c 69 6e 65 2e 63 6f 6d 22 2c 22 76 69 74 61 6c 61 6d 73 65 65 2e 63 6f 6d 22 2c 22 6f 72 69 67 6c 6e 61 6c 64 61 74 65 2e 63 6f 6d 22 2c 22 72
                                                  Data Ascii: katmoviehd.mov","bluegaslamp.org","draggedline.org","gh5ys3gry5d532.xyz","kaamuu.org","saoma220.xyz","livetv365.me","pisi.pics","value-life.xyz","ridomovies.tv","philwin.ph","admiralshipping.com","freetoolonline.com","vitalamsee.com","origlnaldate.com","r
                                                  2024-07-22 10:34:50 UTC1369INData Raw: 79 2e 63 6f 6d 22 2c 22 61 69 73 68 6f 72 74 2e 74 6f 70 22 2c 22 70 72 6f 6d 6c 61 7a 65 72 2e 72 75 22 2c 22 6c 65 66 74 62 69 6c 6c 2e 74 6f 70 22 2c 22 75 70 73 63 61 72 72 69 61 67 65 70 61 79 6d 65 6e 74 2e 63 6f 6d 22 2c 22 69 6e 76 65 73 74 6c 69 65 2e 63 6f 6d 22 2c 22 74 35 2d 77 69 6b 69 2e 64 65 22 2c 22 66 72 65 65 73 6f 66 74 72 75 73 2e 72 75 22 2c 22 70 61 70 73 74 72 65 61 6d 2e 63 6c 75 62 22 2c 22 77 6f 72 6c 64 6e 65 77 73 2d 32 34 2e 63 6f 6d 22 2c 22 65 6e 73 74 72 65 61 6d 2e 74 6f 70 22 2c 22 73 6f 72 63 65 72 65 72 6f 66 74 65 61 2e 63 6f 6d 22 2c 22 6d 79 63 6c 69 63 6b 2d 32 2e 63 6f 6d 22 2c 22 6c 65 6c 69 65 7a 6f 72 67 67 72 6f 65 70 2e 6e 6c 22 2c 22 6d 75 61 74 68 65 6e 67 61 79 2e 63 6f 6d 22 2c 22 78 6e 2d 2d 38 30 61 63
                                                  Data Ascii: y.com","aishort.top","promlazer.ru","leftbill.top","upscarriagepayment.com","investlie.com","t5-wiki.de","freesoftrus.ru","papstream.club","worldnews-24.com","enstream.top","sorcereroftea.com","myclick-2.com","leliezorggroep.nl","muathengay.com","xn--80ac
                                                  2024-07-22 10:34:50 UTC1369INData Raw: 64 65 2e 6c 69 66 65 22 2c 22 67 30 66 2e 63 6e 22 2c 22 65 73 75 6e 32 31 2e 63 6e 22 2c 22 62 61 6f 66 65 6e 67 6a 69 68 75 6f 2e 63 6f 6d 22 2c 22 6b 65 79 67 65 6e 73 2e 70 72 6f 22 2c 22 63 68 61 72 6d 61 6e 74 65 73 76 6f 69 73 69 6e 65 73 6d 75 72 65 73 2e 63 6f 6d 22 2c 22 76 69 61 74 72 69 73 2d 65 2d 63 68 61 6e 6e 65 6c 2e 63 6f 6d 22 2c 22 73 68 6f 72 74 6c 79 61 6d 75 73 65 6d 65 6e 74 2e 63 6f 6d 22 2c 22 32 31 39 32 39 2e 72 75 22 2c 22 67 65 74 6d 61 63 6b 65 65 70 65 72 73 6f 66 74 70 72 6f 2e 78 79 7a 22 2c 22 74 68 65 73 79 6e 74 68 65 73 69 73 2e 61 70 70 22 2c 22 63 75 74 69 6c 6e 6b 73 2e 63 6f 6d 22 2c 22 61 75 74 6f 62 69 6b 65 72 73 2e 78 79 7a 22 2c 22 70 69 72 61 74 65 2d 70 72 6f 78 79 2e 74 6f 70 22 2c 22 34 35 2e 31 34 38 2e
                                                  Data Ascii: de.life","g0f.cn","esun21.cn","baofengjihuo.com","keygens.pro","charmantesvoisinesmures.com","viatris-e-channel.com","shortlyamusement.com","21929.ru","getmackeepersoftpro.xyz","thesynthesis.app","cutilnks.com","autobikers.xyz","pirate-proxy.top","45.148.
                                                  2024-07-22 10:34:50 UTC1369INData Raw: 79 77 70 6a 6b 2e 63 6f 6d 22 2c 22 73 79 6c 76 69 6e 61 6e 6f 72 72 65 79 2e 63 6f 6d 22 2c 22 6c 6f 6e 38 38 2e 74 6f 70 22 2c 22 76 6c 61 65 6b 61 6e 2e 6b 7a 22 2c 22 73 75 70 74 72 61 66 2e 63 6f 6d 22 2c 22 67 65 74 66 6c 69 6b 2e 63 6f 6d 22 2c 22 63 6f 6f 6c 74 72 6b 2e 78 79 7a 22 2c 22 66 6c 69 72 74 74 6f 6d 65 2e 63 6f 6d 22 2c 22 6d 61 73 61 63 2e 73 62 73 22 2c 22 6e 61 69 6c 6d 61 67 61 7a 69 6e 65 2e 6f 6e 6c 69 6e 65 22 2c 22 72 6f 76 32 2e 6e 65 74 22 2c 22 63 61 73 74 6c 65 63 61 70 69 74 61 6c 2e 76 63 22 2c 22 6d 6f 62 69 6c 65 74 6f 72 72 65 6e 74 2e 69 6e 66 6f 22 2c 22 63 77 62 74 69 2e 63 6f 6d 2e 62 72 22 2c 22 70 6f 73 61 64 61 6c 61 72 6f 62 6c 65 64 61 2e 63 6f 6d 22 2c 22 61 6c 6c 75 72 69 6e 67 67 61 6c 67 2e 63 6f 6d 22 2c
                                                  Data Ascii: ywpjk.com","sylvinanorrey.com","lon88.top","vlaekan.kz","suptraf.com","getflik.com","cooltrk.xyz","flirttome.com","masac.sbs","nailmagazine.online","rov2.net","castlecapital.vc","mobiletorrent.info","cwbti.com.br","posadalarobleda.com","alluringgalg.com",
                                                  2024-07-22 10:34:50 UTC1369INData Raw: 2c 22 74 6f 72 69 6f 6c 75 6f 72 2e 63 6f 6d 22 2c 22 63 72 61 63 6b 73 75 72 6c 2e 63 6f 6d 22 2c 22 70 72 79 76 69 74 61 6e 6e 79 61 2e 74 6f 70 22 2c 22 63 68 61 6e 67 62 65 65 72 2e 73 69 74 65 22 2c 22 61 64 6f 6e 73 6f 6e 6c 79 64 2e 78 79 7a 22 2c 22 74 68 65 6d 65 6e 63 6f 64 65 2e 63 6f 6d 22 2c 22 70 65 72 61 74 75 72 61 6e 70 65 64 69 61 2e 69 64 22 2c 22 74 65 6c 75 74 6f 70 69 65 7a 2e 63 6c 75 62 22 2c 22 76 73 67 7a 64 64 6a 2e 63 6f 6d 22 2c 22 61 64 61 70 61 2d 67 72 6f 75 70 2e 63 6f 6d 22 2c 22 73 68 65 65 74 2d 6d 75 73 69 63 2e 78 79 7a 22 2c 22 72 6f 63 6b 68 61 74 74 65 72 2e 63 6f 6d 22 2c 22 63 6f 6e 73 63 69 6f 75 73 6e 65 73 73 71 75 61 69 6e 74 2e 63 6f 6d 22 2c 22 76 61 6c 6c 65 73 76 69 73 69 6f 2e 63 61 74 22 2c 22 63 73 69
                                                  Data Ascii: ,"torioluor.com","cracksurl.com","pryvitannya.top","changbeer.site","adonsonlyd.xyz","themencode.com","peraturanpedia.id","telutopiez.club","vsgzddj.com","adapa-group.com","sheet-music.xyz","rockhatter.com","consciousnessquaint.com","vallesvisio.cat","csi
                                                  2024-07-22 10:34:50 UTC1369INData Raw: 2e 63 6f 6d 2e 75 61 22 2c 22 63 61 6d 61 64 6d 69 6e 2e 72 75 22 2c 22 6a 75 62 74 31 32 2e 78 79 7a 22 2c 22 72 6b 6e 2e 67 6f 76 2e 72 75 22 2c 22 31 32 33 6d 6f 76 69 65 2e 6c 74 64 22 2c 22 64 73 32 2e 63 6c 75 62 22 2c 22 79 6f 6d 73 74 2e 6f 72 67 22 2c 22 73 75 69 62 65 2e 65 64 75 2e 63 6e 22 2c 22 38 78 62 65 74 33 30 30 2e 63 6f 6d 22 2c 22 61 70 70 6c 65 69 64 78 79 2e 74 6f 70 22 2c 22 62 69 6f 6c 61 62 73 68 6f 70 32 34 2e 63 6f 6d 22 2c 22 6d 79 66 69 6c 65 73 74 6f 72 65 2e 63 6f 6d 22 2c 22 6f 72 6b 6c 69 6e 6b 2e 63 6f 6d 22 2c 22 65 78 70 6c 6f 72 72 2e 6e 65 74 22 2c 22 67 6f 74 72 61 63 6b 72 65 64 69 72 65 63 74 2e 63 6f 6d 22 2c 22 6a 61 76 69 65 72 64 65 6c 61 73 65 6e 2e 63 6f 6d 22 2c 22 62 72 69 61 6e 73 73 63 6c 75 62 2e 63 63
                                                  Data Ascii: .com.ua","camadmin.ru","jubt12.xyz","rkn.gov.ru","123movie.ltd","ds2.club","yomst.org","suibe.edu.cn","8xbet300.com","appleidxy.top","biolabshop24.com","myfilestore.com","orklink.com","explorr.net","gotrackredirect.com","javierdelasen.com","brianssclub.cc
                                                  2024-07-22 10:34:50 UTC1369INData Raw: 2c 22 64 69 73 63 6c 6f 73 65 70 72 6f 67 72 61 6d 77 65 64 6e 65 73 64 61 79 2e 63 6f 6d 22 2c 22 6b 69 6e 6f 6e 65 77 73 2e 70 72 6f 22 2c 22 6f 68 6e 79 64 65 6c 69 67 68 74 66 75 6c 64 61 74 65 73 2e 6c 69 66 65 22 2c 22 62 6f 6b 65 70 69 64 2e 62 6f 6e 64 22 2c 22 62 6f 72 69 73 2e 64 65 22 2c 22 6d 75 6e 64 6f 63 69 6e 65 6d 61 74 6f 67 72 61 66 69 63 6f 2e 6e 65 74 22 2c 22 62 65 74 61 63 65 6e 74 61 75 72 69 2e 74 6f 70 22 2c 22 6f 6d 67 6e 6f 74 65 2e 6e 65 74 6c 69 66 79 2e 61 70 70 22 2c 22 67 72 6f 77 6e 75 70 67 61 6c 6f 72 65 2e 6c 69 66 65 22 2c 22 69 6d 70 6f 73 73 69 62 6c 65 6f 66 66 65 72 73 2e 63 6f 6d 22 2c 22 76 6b 73 74 72 65 61 6d 2e 74 6f 70 22 2c 22 68 6f 74 70 72 6f 6d 6f 74 69 6f 6e 73 2e 6f 6e 6c 69 6e 65 22 2c 22 69 6f 2e 6b
                                                  Data Ascii: ,"discloseprogramwednesday.com","kinonews.pro","ohnydelightfuldates.life","bokepid.bond","boris.de","mundocinematografico.net","betacentauri.top","omgnote.netlify.app","grownupgalore.life","impossibleoffers.com","vkstream.top","hotpromotions.online","io.k
                                                  2024-07-22 10:34:50 UTC1369INData Raw: 2e 69 74 22 2c 22 6f 6f 72 63 61 73 65 6c 6c 73 2e 63 6f 6d 22 2c 22 6f 6e 65 64 61 73 68 2e 6e 65 74 22 2c 22 74 70 61 73 2e 72 75 22 2c 22 74 65 6e 69 38 35 73 74 61 62 30 31 64 2e 63 6f 6d 22 2c 22 74 68 6f 73 65 63 61 6e 64 79 2e 63 6f 6d 22 2c 22 6e 69 6c 6b 6e 61 72 66 2e 78 79 7a 22 2c 22 72 65 69 66 65 66 72 61 75 65 6e 2e 63 6f 6d 22 2c 22 72 6f 73 65 33 33 2e 74 6f 70 22 2c 22 73 74 6f 6e 65 61 67 65 70 65 64 69 61 2e 63 6f 6d 22 2c 22 6d 79 70 72 69 76 61 74 65 2e 70 69 63 73 22 2c 22 73 6e 61 70 78 2e 69 6e 66 6f 22 2c 22 67 74 61 75 74 6f 63 6c 69 63 6b 65 72 2e 63 6f 6d 22 2c 22 66 6d 6f 76 69 65 7a 2e 69 6e 66 6f 22 2c 22 63 6f 6d 65 73 68 6f 70 69 6e 67 2e 74 6f 6b 79 6f 22 2c 22 70 65 6c 69 73 78 70 6f 72 6e 6f 2e 6e 65 74 22 2c 22 63 68
                                                  Data Ascii: .it","oorcasells.com","onedash.net","tpas.ru","teni85stab01d.com","thosecandy.com","nilknarf.xyz","reifefrauen.com","rose33.top","stoneagepedia.com","myprivate.pics","snapx.info","gtautoclicker.com","fmoviez.info","comeshoping.tokyo","pelisxporno.net","ch
                                                  2024-07-22 10:34:50 UTC1369INData Raw: 70 74 34 72 75 73 2e 72 75 22 2c 22 6c 69 76 65 64 73 6b 61 74 65 72 61 69 73 69 6e 2e 63 6f 6d 22 2c 22 61 79 65 6a 6f 6d 65 72 2e 74 6f 70 22 2c 22 6e 6a 69 32 30 2e 78 79 7a 22 2c 22 67 61 6c 61 78 79 62 79 63 6f 69 6e 2e 63 6f 6d 22 2c 22 65 73 74 61 69 6c 6f 66 61 73 68 69 6f 6e 2e 63 6f 6d 22 2c 22 61 72 63 68 65 75 72 6f 70 65 2e 69 6e 66 6f 22 2c 22 65 7a 63 67 6f 6a 61 61 6d 67 2e 63 6f 6d 22 2c 22 68 2d 67 65 6e 2e 78 79 7a 22 2c 22 78 6e 2d 2d 39 30 61 61 76 6d 66 69 37 62 31 64 2e 78 79 7a 22 2c 22 6c 69 62 72 6f 73 72 65 63 6f 6d 65 6e 64 61 64 6f 73 73 2e 63 6f 6d 22 2c 22 75 74 69 6c 69 74 79 70 72 65 73 65 6e 74 2e 63 6f 6d 22 2c 22 74 68 65 67 61 6d 65 70 6c 61 79 2e 6c 69 66 65 22 2c 22 61 69 36 38 36 38 2e 74 6f 70 22 2c 22 78 79 63 6c
                                                  Data Ascii: pt4rus.ru","livedskateraisin.com","ayejomer.top","nji20.xyz","galaxybycoin.com","estailofashion.com","archeurope.info","ezcgojaamg.com","h-gen.xyz","xn--90aavmfi7b1d.xyz","librosrecomendadoss.com","utilitypresent.com","thegameplay.life","ai6868.top","xycl


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  111192.168.2.449973104.16.148.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:50 UTC86OUTGET /api/v2/url/blacklist HTTP/1.1
                                                  Host: acs.lavasoft.com
                                                  Connection: Keep-Alive
                                                  2024-07-22 10:34:50 UTC324INHTTP/1.1 301 Moved Permanently
                                                  Date: Mon, 22 Jul 2024 10:34:50 GMT
                                                  Content-Length: 0
                                                  Connection: close
                                                  Cache-Control: public
                                                  Cache-Control: max-age=86400
                                                  Location: https://acscdn.lavasoft.com/urlblacklist.json
                                                  api-supported-versions: 2.0
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7d42b9d41d3-EWR


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  112192.168.2.449972104.16.148.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:50 UTC86OUTGET /api/v2/url/blacklist HTTP/1.1
                                                  Host: acs.lavasoft.com
                                                  Connection: Keep-Alive
                                                  2024-07-22 10:34:51 UTC324INHTTP/1.1 301 Moved Permanently
                                                  Date: Mon, 22 Jul 2024 10:34:51 GMT
                                                  Content-Length: 0
                                                  Connection: close
                                                  Cache-Control: public
                                                  Cache-Control: max-age=86400
                                                  Location: https://acscdn.lavasoft.com/urlblacklist.json
                                                  api-supported-versions: 2.0
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7d4d9dc41e9-EWR


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  113192.168.2.449966104.16.149.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:50 UTC62OUTGET /urlblacklist.json HTTP/1.1
                                                  Host: acscdn.lavasoft.com
                                                  2024-07-22 10:34:51 UTC385INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:51 GMT
                                                  Content-Type: application/json
                                                  Content-Length: 201625
                                                  Connection: close
                                                  Last-Modified: Wed, 15 Nov 2023 13:57:17 GMT
                                                  ETag: "6554ce3d-31399"
                                                  CF-Cache-Status: HIT
                                                  Age: 62208
                                                  Expires: Tue, 23 Jul 2024 06:34:51 GMT
                                                  Cache-Control: public, max-age=72000
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7d4e9918c93-EWR
                                                  2024-07-22 10:34:51 UTC984INData Raw: 5b 22 6c 61 69 7a 68 65 6e 67 73 6c 74 2e 63 6e 22 2c 22 6d 79 74 6f 6f 6c 7a 2e 6e 65 74 22 2c 22 70 72 6f 74 65 63 74 32 34 37 2e 6f 6e 6c 69 6e 65 22 2c 22 78 78 6c 61 73 74 2e 63 6f 6d 22 2c 22 77 6f 72 6c 64 73 61 6e 61 6c 79 74 69 63 73 2e 63 6f 6d 22 2c 22 73 6b 69 6c 6c 74 72 61 6e 73 66 6f 72 6d 2e 63 6f 2e 69 6e 22 2c 22 6c 65 6c 61 65 72 2e 63 6f 6d 22 2c 22 6a 70 6f 70 73 69 6e 67 6c 65 73 2e 65 75 22 2c 22 72 69 73 71 75 65 67 61 6c 6b 78 2e 63 6f 6d 22 2c 22 73 76 65 74 76 79 68 6f 64 2e 73 6b 22 2c 22 6d 6f 76 69 65 63 72 75 6d 62 73 2e 6e 65 74 22 2c 22 70 68 72 61 62 75 2e 67 6f 2e 74 68 22 2c 22 6f 6e 6c 79 69 6e 64 69 61 6e 78 2e 63 63 22 2c 22 69 6b 69 73 73 2e 6f 6e 6c 69 6e 65 22 2c 22 75 72 65 77 73 61 77 61 6e 69 2e 61 75 74 6f 73
                                                  Data Ascii: ["laizhengslt.cn","mytoolz.net","protect247.online","xxlast.com","worldsanalytics.com","skilltransform.co.in","lelaer.com","jpopsingles.eu","risquegalkx.com","svetvyhod.sk","moviecrumbs.net","phrabu.go.th","onlyindianx.cc","ikiss.online","urewsawani.autos
                                                  2024-07-22 10:34:51 UTC1369INData Raw: 6b 61 74 6d 6f 76 69 65 68 64 2e 6d 6f 76 22 2c 22 62 6c 75 65 67 61 73 6c 61 6d 70 2e 6f 72 67 22 2c 22 64 72 61 67 67 65 64 6c 69 6e 65 2e 6f 72 67 22 2c 22 67 68 35 79 73 33 67 72 79 35 64 35 33 32 2e 78 79 7a 22 2c 22 6b 61 61 6d 75 75 2e 6f 72 67 22 2c 22 73 61 6f 6d 61 32 32 30 2e 78 79 7a 22 2c 22 6c 69 76 65 74 76 33 36 35 2e 6d 65 22 2c 22 70 69 73 69 2e 70 69 63 73 22 2c 22 76 61 6c 75 65 2d 6c 69 66 65 2e 78 79 7a 22 2c 22 72 69 64 6f 6d 6f 76 69 65 73 2e 74 76 22 2c 22 70 68 69 6c 77 69 6e 2e 70 68 22 2c 22 61 64 6d 69 72 61 6c 73 68 69 70 70 69 6e 67 2e 63 6f 6d 22 2c 22 66 72 65 65 74 6f 6f 6c 6f 6e 6c 69 6e 65 2e 63 6f 6d 22 2c 22 76 69 74 61 6c 61 6d 73 65 65 2e 63 6f 6d 22 2c 22 6f 72 69 67 6c 6e 61 6c 64 61 74 65 2e 63 6f 6d 22 2c 22 72
                                                  Data Ascii: katmoviehd.mov","bluegaslamp.org","draggedline.org","gh5ys3gry5d532.xyz","kaamuu.org","saoma220.xyz","livetv365.me","pisi.pics","value-life.xyz","ridomovies.tv","philwin.ph","admiralshipping.com","freetoolonline.com","vitalamsee.com","origlnaldate.com","r
                                                  2024-07-22 10:34:51 UTC1369INData Raw: 79 2e 63 6f 6d 22 2c 22 61 69 73 68 6f 72 74 2e 74 6f 70 22 2c 22 70 72 6f 6d 6c 61 7a 65 72 2e 72 75 22 2c 22 6c 65 66 74 62 69 6c 6c 2e 74 6f 70 22 2c 22 75 70 73 63 61 72 72 69 61 67 65 70 61 79 6d 65 6e 74 2e 63 6f 6d 22 2c 22 69 6e 76 65 73 74 6c 69 65 2e 63 6f 6d 22 2c 22 74 35 2d 77 69 6b 69 2e 64 65 22 2c 22 66 72 65 65 73 6f 66 74 72 75 73 2e 72 75 22 2c 22 70 61 70 73 74 72 65 61 6d 2e 63 6c 75 62 22 2c 22 77 6f 72 6c 64 6e 65 77 73 2d 32 34 2e 63 6f 6d 22 2c 22 65 6e 73 74 72 65 61 6d 2e 74 6f 70 22 2c 22 73 6f 72 63 65 72 65 72 6f 66 74 65 61 2e 63 6f 6d 22 2c 22 6d 79 63 6c 69 63 6b 2d 32 2e 63 6f 6d 22 2c 22 6c 65 6c 69 65 7a 6f 72 67 67 72 6f 65 70 2e 6e 6c 22 2c 22 6d 75 61 74 68 65 6e 67 61 79 2e 63 6f 6d 22 2c 22 78 6e 2d 2d 38 30 61 63
                                                  Data Ascii: y.com","aishort.top","promlazer.ru","leftbill.top","upscarriagepayment.com","investlie.com","t5-wiki.de","freesoftrus.ru","papstream.club","worldnews-24.com","enstream.top","sorcereroftea.com","myclick-2.com","leliezorggroep.nl","muathengay.com","xn--80ac
                                                  2024-07-22 10:34:51 UTC1369INData Raw: 64 65 2e 6c 69 66 65 22 2c 22 67 30 66 2e 63 6e 22 2c 22 65 73 75 6e 32 31 2e 63 6e 22 2c 22 62 61 6f 66 65 6e 67 6a 69 68 75 6f 2e 63 6f 6d 22 2c 22 6b 65 79 67 65 6e 73 2e 70 72 6f 22 2c 22 63 68 61 72 6d 61 6e 74 65 73 76 6f 69 73 69 6e 65 73 6d 75 72 65 73 2e 63 6f 6d 22 2c 22 76 69 61 74 72 69 73 2d 65 2d 63 68 61 6e 6e 65 6c 2e 63 6f 6d 22 2c 22 73 68 6f 72 74 6c 79 61 6d 75 73 65 6d 65 6e 74 2e 63 6f 6d 22 2c 22 32 31 39 32 39 2e 72 75 22 2c 22 67 65 74 6d 61 63 6b 65 65 70 65 72 73 6f 66 74 70 72 6f 2e 78 79 7a 22 2c 22 74 68 65 73 79 6e 74 68 65 73 69 73 2e 61 70 70 22 2c 22 63 75 74 69 6c 6e 6b 73 2e 63 6f 6d 22 2c 22 61 75 74 6f 62 69 6b 65 72 73 2e 78 79 7a 22 2c 22 70 69 72 61 74 65 2d 70 72 6f 78 79 2e 74 6f 70 22 2c 22 34 35 2e 31 34 38 2e
                                                  Data Ascii: de.life","g0f.cn","esun21.cn","baofengjihuo.com","keygens.pro","charmantesvoisinesmures.com","viatris-e-channel.com","shortlyamusement.com","21929.ru","getmackeepersoftpro.xyz","thesynthesis.app","cutilnks.com","autobikers.xyz","pirate-proxy.top","45.148.
                                                  2024-07-22 10:34:51 UTC1369INData Raw: 79 77 70 6a 6b 2e 63 6f 6d 22 2c 22 73 79 6c 76 69 6e 61 6e 6f 72 72 65 79 2e 63 6f 6d 22 2c 22 6c 6f 6e 38 38 2e 74 6f 70 22 2c 22 76 6c 61 65 6b 61 6e 2e 6b 7a 22 2c 22 73 75 70 74 72 61 66 2e 63 6f 6d 22 2c 22 67 65 74 66 6c 69 6b 2e 63 6f 6d 22 2c 22 63 6f 6f 6c 74 72 6b 2e 78 79 7a 22 2c 22 66 6c 69 72 74 74 6f 6d 65 2e 63 6f 6d 22 2c 22 6d 61 73 61 63 2e 73 62 73 22 2c 22 6e 61 69 6c 6d 61 67 61 7a 69 6e 65 2e 6f 6e 6c 69 6e 65 22 2c 22 72 6f 76 32 2e 6e 65 74 22 2c 22 63 61 73 74 6c 65 63 61 70 69 74 61 6c 2e 76 63 22 2c 22 6d 6f 62 69 6c 65 74 6f 72 72 65 6e 74 2e 69 6e 66 6f 22 2c 22 63 77 62 74 69 2e 63 6f 6d 2e 62 72 22 2c 22 70 6f 73 61 64 61 6c 61 72 6f 62 6c 65 64 61 2e 63 6f 6d 22 2c 22 61 6c 6c 75 72 69 6e 67 67 61 6c 67 2e 63 6f 6d 22 2c
                                                  Data Ascii: ywpjk.com","sylvinanorrey.com","lon88.top","vlaekan.kz","suptraf.com","getflik.com","cooltrk.xyz","flirttome.com","masac.sbs","nailmagazine.online","rov2.net","castlecapital.vc","mobiletorrent.info","cwbti.com.br","posadalarobleda.com","alluringgalg.com",
                                                  2024-07-22 10:34:51 UTC1369INData Raw: 2c 22 74 6f 72 69 6f 6c 75 6f 72 2e 63 6f 6d 22 2c 22 63 72 61 63 6b 73 75 72 6c 2e 63 6f 6d 22 2c 22 70 72 79 76 69 74 61 6e 6e 79 61 2e 74 6f 70 22 2c 22 63 68 61 6e 67 62 65 65 72 2e 73 69 74 65 22 2c 22 61 64 6f 6e 73 6f 6e 6c 79 64 2e 78 79 7a 22 2c 22 74 68 65 6d 65 6e 63 6f 64 65 2e 63 6f 6d 22 2c 22 70 65 72 61 74 75 72 61 6e 70 65 64 69 61 2e 69 64 22 2c 22 74 65 6c 75 74 6f 70 69 65 7a 2e 63 6c 75 62 22 2c 22 76 73 67 7a 64 64 6a 2e 63 6f 6d 22 2c 22 61 64 61 70 61 2d 67 72 6f 75 70 2e 63 6f 6d 22 2c 22 73 68 65 65 74 2d 6d 75 73 69 63 2e 78 79 7a 22 2c 22 72 6f 63 6b 68 61 74 74 65 72 2e 63 6f 6d 22 2c 22 63 6f 6e 73 63 69 6f 75 73 6e 65 73 73 71 75 61 69 6e 74 2e 63 6f 6d 22 2c 22 76 61 6c 6c 65 73 76 69 73 69 6f 2e 63 61 74 22 2c 22 63 73 69
                                                  Data Ascii: ,"torioluor.com","cracksurl.com","pryvitannya.top","changbeer.site","adonsonlyd.xyz","themencode.com","peraturanpedia.id","telutopiez.club","vsgzddj.com","adapa-group.com","sheet-music.xyz","rockhatter.com","consciousnessquaint.com","vallesvisio.cat","csi
                                                  2024-07-22 10:34:51 UTC1369INData Raw: 2e 63 6f 6d 2e 75 61 22 2c 22 63 61 6d 61 64 6d 69 6e 2e 72 75 22 2c 22 6a 75 62 74 31 32 2e 78 79 7a 22 2c 22 72 6b 6e 2e 67 6f 76 2e 72 75 22 2c 22 31 32 33 6d 6f 76 69 65 2e 6c 74 64 22 2c 22 64 73 32 2e 63 6c 75 62 22 2c 22 79 6f 6d 73 74 2e 6f 72 67 22 2c 22 73 75 69 62 65 2e 65 64 75 2e 63 6e 22 2c 22 38 78 62 65 74 33 30 30 2e 63 6f 6d 22 2c 22 61 70 70 6c 65 69 64 78 79 2e 74 6f 70 22 2c 22 62 69 6f 6c 61 62 73 68 6f 70 32 34 2e 63 6f 6d 22 2c 22 6d 79 66 69 6c 65 73 74 6f 72 65 2e 63 6f 6d 22 2c 22 6f 72 6b 6c 69 6e 6b 2e 63 6f 6d 22 2c 22 65 78 70 6c 6f 72 72 2e 6e 65 74 22 2c 22 67 6f 74 72 61 63 6b 72 65 64 69 72 65 63 74 2e 63 6f 6d 22 2c 22 6a 61 76 69 65 72 64 65 6c 61 73 65 6e 2e 63 6f 6d 22 2c 22 62 72 69 61 6e 73 73 63 6c 75 62 2e 63 63
                                                  Data Ascii: .com.ua","camadmin.ru","jubt12.xyz","rkn.gov.ru","123movie.ltd","ds2.club","yomst.org","suibe.edu.cn","8xbet300.com","appleidxy.top","biolabshop24.com","myfilestore.com","orklink.com","explorr.net","gotrackredirect.com","javierdelasen.com","brianssclub.cc
                                                  2024-07-22 10:34:51 UTC1369INData Raw: 2c 22 64 69 73 63 6c 6f 73 65 70 72 6f 67 72 61 6d 77 65 64 6e 65 73 64 61 79 2e 63 6f 6d 22 2c 22 6b 69 6e 6f 6e 65 77 73 2e 70 72 6f 22 2c 22 6f 68 6e 79 64 65 6c 69 67 68 74 66 75 6c 64 61 74 65 73 2e 6c 69 66 65 22 2c 22 62 6f 6b 65 70 69 64 2e 62 6f 6e 64 22 2c 22 62 6f 72 69 73 2e 64 65 22 2c 22 6d 75 6e 64 6f 63 69 6e 65 6d 61 74 6f 67 72 61 66 69 63 6f 2e 6e 65 74 22 2c 22 62 65 74 61 63 65 6e 74 61 75 72 69 2e 74 6f 70 22 2c 22 6f 6d 67 6e 6f 74 65 2e 6e 65 74 6c 69 66 79 2e 61 70 70 22 2c 22 67 72 6f 77 6e 75 70 67 61 6c 6f 72 65 2e 6c 69 66 65 22 2c 22 69 6d 70 6f 73 73 69 62 6c 65 6f 66 66 65 72 73 2e 63 6f 6d 22 2c 22 76 6b 73 74 72 65 61 6d 2e 74 6f 70 22 2c 22 68 6f 74 70 72 6f 6d 6f 74 69 6f 6e 73 2e 6f 6e 6c 69 6e 65 22 2c 22 69 6f 2e 6b
                                                  Data Ascii: ,"discloseprogramwednesday.com","kinonews.pro","ohnydelightfuldates.life","bokepid.bond","boris.de","mundocinematografico.net","betacentauri.top","omgnote.netlify.app","grownupgalore.life","impossibleoffers.com","vkstream.top","hotpromotions.online","io.k
                                                  2024-07-22 10:34:51 UTC1369INData Raw: 2e 69 74 22 2c 22 6f 6f 72 63 61 73 65 6c 6c 73 2e 63 6f 6d 22 2c 22 6f 6e 65 64 61 73 68 2e 6e 65 74 22 2c 22 74 70 61 73 2e 72 75 22 2c 22 74 65 6e 69 38 35 73 74 61 62 30 31 64 2e 63 6f 6d 22 2c 22 74 68 6f 73 65 63 61 6e 64 79 2e 63 6f 6d 22 2c 22 6e 69 6c 6b 6e 61 72 66 2e 78 79 7a 22 2c 22 72 65 69 66 65 66 72 61 75 65 6e 2e 63 6f 6d 22 2c 22 72 6f 73 65 33 33 2e 74 6f 70 22 2c 22 73 74 6f 6e 65 61 67 65 70 65 64 69 61 2e 63 6f 6d 22 2c 22 6d 79 70 72 69 76 61 74 65 2e 70 69 63 73 22 2c 22 73 6e 61 70 78 2e 69 6e 66 6f 22 2c 22 67 74 61 75 74 6f 63 6c 69 63 6b 65 72 2e 63 6f 6d 22 2c 22 66 6d 6f 76 69 65 7a 2e 69 6e 66 6f 22 2c 22 63 6f 6d 65 73 68 6f 70 69 6e 67 2e 74 6f 6b 79 6f 22 2c 22 70 65 6c 69 73 78 70 6f 72 6e 6f 2e 6e 65 74 22 2c 22 63 68
                                                  Data Ascii: .it","oorcasells.com","onedash.net","tpas.ru","teni85stab01d.com","thosecandy.com","nilknarf.xyz","reifefrauen.com","rose33.top","stoneagepedia.com","myprivate.pics","snapx.info","gtautoclicker.com","fmoviez.info","comeshoping.tokyo","pelisxporno.net","ch
                                                  2024-07-22 10:34:51 UTC1369INData Raw: 70 74 34 72 75 73 2e 72 75 22 2c 22 6c 69 76 65 64 73 6b 61 74 65 72 61 69 73 69 6e 2e 63 6f 6d 22 2c 22 61 79 65 6a 6f 6d 65 72 2e 74 6f 70 22 2c 22 6e 6a 69 32 30 2e 78 79 7a 22 2c 22 67 61 6c 61 78 79 62 79 63 6f 69 6e 2e 63 6f 6d 22 2c 22 65 73 74 61 69 6c 6f 66 61 73 68 69 6f 6e 2e 63 6f 6d 22 2c 22 61 72 63 68 65 75 72 6f 70 65 2e 69 6e 66 6f 22 2c 22 65 7a 63 67 6f 6a 61 61 6d 67 2e 63 6f 6d 22 2c 22 68 2d 67 65 6e 2e 78 79 7a 22 2c 22 78 6e 2d 2d 39 30 61 61 76 6d 66 69 37 62 31 64 2e 78 79 7a 22 2c 22 6c 69 62 72 6f 73 72 65 63 6f 6d 65 6e 64 61 64 6f 73 73 2e 63 6f 6d 22 2c 22 75 74 69 6c 69 74 79 70 72 65 73 65 6e 74 2e 63 6f 6d 22 2c 22 74 68 65 67 61 6d 65 70 6c 61 79 2e 6c 69 66 65 22 2c 22 61 69 36 38 36 38 2e 74 6f 70 22 2c 22 78 79 63 6c
                                                  Data Ascii: pt4rus.ru","livedskateraisin.com","ayejomer.top","nji20.xyz","galaxybycoin.com","estailofashion.com","archeurope.info","ezcgojaamg.com","h-gen.xyz","xn--90aavmfi7b1d.xyz","librosrecomendadoss.com","utilitypresent.com","thegameplay.life","ai6868.top","xycl


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  114192.168.2.449970104.16.149.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:51 UTC161OUTPOST /v1/event-stat?Type=BrowserExtension&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 3043
                                                  2024-07-22 10:34:51 UTC3043OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 42 72 6f 77 73 65 72 22 3a 7b 22 43 68 72 6f 6d 65 22 3a 7b 22 45 78 74 49 6e 66 6f 22 3a 5b 7b 22 69 64 22 3a 22 67 68 62 6d 6e 6e 6a 6f 6f 65 6b 70 6d 6f 65 63 6e 6e 6e 69 6c 6e 6e 62 64 6c 6f 6c 68 6b 68 69 22 2c 22 69 6e 73 74 61 6c 6c 44 61 74 65 22 3a 6e 75 6c 6c 2c 22 75 73 65 72 44 69 73 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 66 6f 72 65 69 67 6e 49 6e 73 74 61 6c 6c 22 3a 66 61 6c 73 65 2c 22 75 70 64 61 74 65 44 61 74 65 22 3a 6e 75 6c 6c 2c 22 76 65 72 73 69 6f 6e 22 3a 6e 75 6c 6c 7d 2c 7b 22 69 64 22 3a 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 2c 22 69 6e 73 74 61 6c 6c 44 61 74 65 22 3a 6e 75 6c 6c 2c 22 75 73 65 72 44 69 73 61 62 6c 65 64 22 3a
                                                  Data Ascii: {"Data": {"Browser":{"Chrome":{"ExtInfo":[{"id":"ghbmnnjooekpmoecnnnilnnbdlolhkhi","installDate":null,"userDisabled":false,"foreignInstall":false,"updateDate":null,"version":null},{"id":"nmmhkkegccagdldgiimedpiccmgmieda","installDate":null,"userDisabled":
                                                  2024-07-22 10:34:51 UTC479INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:51 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: close
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7d6af4a423d-EWR
                                                  2024-07-22 10:34:51 UTC35INData Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}
                                                  2024-07-22 10:34:51 UTC5INData Raw: 30 0d 0a 0d 0a
                                                  Data Ascii: 0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  115192.168.2.449975104.16.148.130443984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:51 UTC95OUTGET /api/v2/url/permanentwhitelist HTTP/1.1
                                                  Host: acs.lavasoft.com
                                                  Connection: Keep-Alive
                                                  2024-07-22 10:34:51 UTC333INHTTP/1.1 301 Moved Permanently
                                                  Date: Mon, 22 Jul 2024 10:34:51 GMT
                                                  Content-Length: 0
                                                  Connection: close
                                                  Cache-Control: public
                                                  Cache-Control: max-age=86400
                                                  Location: https://acscdn.lavasoft.com/permanentUrlWhitelist.json
                                                  api-supported-versions: 2.0
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7d799ae1861-EWR


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  116192.168.2.449974104.16.149.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:51 UTC161OUTPOST /v1/event-stat?Type=BrowserExtension&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 3043
                                                  2024-07-22 10:34:51 UTC3043OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 42 72 6f 77 73 65 72 22 3a 7b 22 43 68 72 6f 6d 65 22 3a 7b 22 45 78 74 49 6e 66 6f 22 3a 5b 7b 22 69 64 22 3a 22 67 68 62 6d 6e 6e 6a 6f 6f 65 6b 70 6d 6f 65 63 6e 6e 6e 69 6c 6e 6e 62 64 6c 6f 6c 68 6b 68 69 22 2c 22 69 6e 73 74 61 6c 6c 44 61 74 65 22 3a 6e 75 6c 6c 2c 22 75 73 65 72 44 69 73 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 66 6f 72 65 69 67 6e 49 6e 73 74 61 6c 6c 22 3a 66 61 6c 73 65 2c 22 75 70 64 61 74 65 44 61 74 65 22 3a 6e 75 6c 6c 2c 22 76 65 72 73 69 6f 6e 22 3a 6e 75 6c 6c 7d 2c 7b 22 69 64 22 3a 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 2c 22 69 6e 73 74 61 6c 6c 44 61 74 65 22 3a 6e 75 6c 6c 2c 22 75 73 65 72 44 69 73 61 62 6c 65 64 22 3a
                                                  Data Ascii: {"Data": {"Browser":{"Chrome":{"ExtInfo":[{"id":"ghbmnnjooekpmoecnnnilnnbdlolhkhi","installDate":null,"userDisabled":false,"foreignInstall":false,"updateDate":null,"version":null},{"id":"nmmhkkegccagdldgiimedpiccmgmieda","installDate":null,"userDisabled":
                                                  2024-07-22 10:34:51 UTC479INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:51 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: close
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7d8fe6a8c0c-EWR
                                                  2024-07-22 10:34:51 UTC35INData Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}
                                                  2024-07-22 10:34:51 UTC5INData Raw: 30 0d 0a 0d 0a
                                                  Data Ascii: 0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  117192.168.2.449979104.16.149.130443984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:52 UTC95OUTGET /permanentUrlWhitelist.json HTTP/1.1
                                                  Host: acscdn.lavasoft.com
                                                  Connection: Keep-Alive
                                                  2024-07-22 10:34:52 UTC383INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:52 GMT
                                                  Content-Type: application/json
                                                  Content-Length: 16065
                                                  Connection: close
                                                  Last-Modified: Wed, 15 Nov 2023 13:57:17 GMT
                                                  ETag: "6554ce3d-3ec1"
                                                  CF-Cache-Status: HIT
                                                  Age: 37811
                                                  Expires: Tue, 23 Jul 2024 06:34:52 GMT
                                                  Cache-Control: public, max-age=72000
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7dc6b61c352-EWR
                                                  2024-07-22 10:34:52 UTC986INData Raw: 5b 22 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 22 2c 20 22 69 6e 73 74 61 67 72 61 6d 2e 63 6f 6d 22 2c 20 22 74 77 69 74 74 65 72 2e 63 6f 6d 22 2c 20 22 67 6f 6f 67 6c 65 2e 63 6f 6d 22 2c 20 22 77 6f 72 64 70 72 65 73 73 2e 6f 72 67 22 2c 20 22 79 6f 75 74 75 62 65 2e 63 6f 6d 22 2c 20 22 6c 69 6e 6b 65 64 69 6e 2e 63 6f 6d 22 2c 20 22 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 22 2c 20 22 70 69 6e 74 65 72 65 73 74 2e 63 6f 6d 22 2c 20 22 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 22 2c 20 22 61 70 70 6c 65 2e 63 6f 6d 22 2c 20 22 61 64 61 77 61 72 65 2e 63 6f 6d 22 2c 20 22 61 76 61 6e 71 75 65 73 74 2e 63 6f 6d 22 2c 20 22 77 65 62 63 6f 6d 70 61 6e 69 6f 6e 2e 63 6f 6d 22 2c 20 22 73 6f 64 61 70 64 66 2e 63 6f 6d 22 2c 20 22 69 6e 70 69 78 69 6f 2e 63 6f 6d
                                                  Data Ascii: ["facebook.com", "instagram.com", "twitter.com", "google.com", "wordpress.org", "youtube.com", "linkedin.com", "cloudflare.com", "pinterest.com", "microsoft.com", "apple.com", "adaware.com", "avanquest.com", "webcompanion.com", "sodapdf.com", "inpixio.com
                                                  2024-07-22 10:34:52 UTC1369INData Raw: 20 22 6e 65 74 77 6f 72 6b 73 6f 6c 75 74 69 6f 6e 73 2e 63 6f 6d 22 2c 20 22 61 6d 61 7a 6f 6e 2e 63 6f 6d 22 2c 20 22 73 68 6f 70 69 66 79 2e 63 6f 6d 22 2c 20 22 64 61 6e 2e 63 6f 6d 22 2c 20 22 62 69 74 2e 6c 79 22 2c 20 22 62 6c 6f 67 73 70 6f 74 2e 63 6f 6d 22 2c 20 22 66 69 6c 65 73 75 73 72 2e 63 6f 6d 22 2c 20 22 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 22 2c 20 22 73 74 61 74 63 6f 75 6e 74 65 72 2e 63 6f 6d 22 2c 20 22 74 75 6d 62 6c 72 2e 63 6f 6d 22 2c 20 22 79 61 6e 64 65 78 2e 72 75 22 2c 20 22 77 61 2e 6d 65 22 2c 20 22 63 70 61 6e 65 6c 2e 6e 65 74 22 2c 20 22 63 70 61 6e 65 6c 2e 63 6f 6d 22 2c 20 22 6a 69 6d 64 6f 2e 63 6f 6d 22 2c 20 22 70 61 79 70 61 6c 2e 63 6f 6d 22 2c 20 22 77 33 2e 6f 72 67 22 2c 20 22 62 6c 75 65 68 6f 73 74 2e 63 6f 6d
                                                  Data Ascii: "networksolutions.com", "amazon.com", "shopify.com", "dan.com", "bit.ly", "blogspot.com", "filesusr.com", "mozilla.org", "statcounter.com", "tumblr.com", "yandex.ru", "wa.me", "cpanel.net", "cpanel.com", "jimdo.com", "paypal.com", "w3.org", "bluehost.com
                                                  2024-07-22 10:34:52 UTC1369INData Raw: 31 61 6e 64 31 2d 65 64 69 74 6f 72 2e 63 6f 6d 22 2c 20 22 6e 67 69 6e 78 2e 6f 72 67 22 2c 20 22 74 72 69 70 61 64 76 69 73 6f 72 2e 63 6f 6d 22 2c 20 22 6d 61 69 6c 63 68 69 6d 70 2e 63 6f 6d 22 2c 20 22 74 72 61 64 65 69 6e 64 69 61 2e 63 6f 6d 22 2c 20 22 77 70 65 6e 67 69 6e 65 2e 63 6f 6d 22 2c 20 22 74 72 75 73 74 70 69 6c 6f 74 2e 63 6f 6d 22 2c 20 22 68 61 74 65 6e 61 2e 6e 65 2e 6a 70 22 2c 20 22 6d 79 73 68 6f 70 69 66 79 2e 63 6f 6d 22 2c 20 22 6f 70 65 6e 73 74 72 65 65 74 6d 61 70 2e 6f 72 67 22 2c 20 22 65 74 73 79 2e 63 6f 6d 22 2c 20 22 69 73 73 75 75 2e 63 6f 6d 22 2c 20 22 74 68 65 6d 65 69 73 6c 65 2e 63 6f 6d 22 2c 20 22 62 65 68 61 6e 63 65 2e 6e 65 74 22 2c 20 22 6e 67 69 6e 78 2e 63 6f 6d 22 2c 20 22 6f 6b 2e 72 75 22 2c 20 22 65
                                                  Data Ascii: 1and1-editor.com", "nginx.org", "tripadvisor.com", "mailchimp.com", "tradeindia.com", "wpengine.com", "trustpilot.com", "hatena.ne.jp", "myshopify.com", "openstreetmap.org", "etsy.com", "issuu.com", "themeisle.com", "behance.net", "nginx.com", "ok.ru", "e
                                                  2024-07-22 10:34:52 UTC1369INData Raw: 73 68 6f 70 2e 63 6f 6d 22 2c 20 22 6d 61 69 6c 63 68 69 2e 6d 70 22 2c 20 22 73 71 75 61 72 65 75 70 2e 63 6f 6d 22 2c 20 22 62 69 67 63 6f 6d 6d 65 72 63 65 2e 63 6f 6d 22 2c 20 22 77 69 6b 69 6d 65 64 69 61 2e 6f 72 67 22 2c 20 22 73 74 72 69 70 65 2e 63 6f 6d 22 2c 20 22 70 61 74 72 65 6f 6e 2e 63 6f 6d 22 2c 20 22 73 6b 79 70 65 2e 63 6f 6d 22 2c 20 22 73 74 75 6d 62 6c 65 75 70 6f 6e 2e 63 6f 6d 22 2c 20 22 73 69 74 65 67 72 6f 75 6e 64 2e 63 6f 6d 22 2c 20 22 74 69 6e 79 75 72 6c 2e 63 6f 6d 22 2c 20 22 6c 69 76 65 63 68 61 74 69 6e 63 2e 63 6f 6d 22 2c 20 22 70 61 79 70 61 6c 2e 6d 65 22 2c 20 22 66 62 2e 6d 65 22 2c 20 22 62 69 6e 67 2e 63 6f 6d 22 2c 20 22 63 61 6c 65 6e 64 6c 79 2e 63 6f 6d 22 2c 20 22 74 65 61 6d 76 69 65 77 65 72 2e 63 6f 6d
                                                  Data Ascii: shop.com", "mailchi.mp", "squareup.com", "bigcommerce.com", "wikimedia.org", "stripe.com", "patreon.com", "skype.com", "stumbleupon.com", "siteground.com", "tinyurl.com", "livechatinc.com", "paypal.me", "fb.me", "bing.com", "calendly.com", "teamviewer.com
                                                  2024-07-22 10:34:52 UTC1369INData Raw: 65 61 64 73 2e 63 6f 6d 22 2c 20 22 67 6f 2e 63 6f 22 2c 20 22 74 65 63 68 63 72 75 6e 63 68 2e 63 6f 6d 22 2c 20 22 6e 69 63 2e 61 74 22 2c 20 22 73 68 69 6e 79 73 74 61 74 2e 63 6f 6d 22 2c 20 22 7a 61 6c 6f 2e 6d 65 22 2c 20 22 6d 61 74 6f 6d 6f 2e 6f 72 67 22 2c 20 22 63 72 79 6f 75 74 63 72 65 61 74 69 6f 6e 73 2e 65 75 22 2c 20 22 68 75 66 66 69 6e 67 74 6f 6e 70 6f 73 74 2e 63 6f 6d 22 2c 20 22 6b 61 6b 61 6f 2e 63 6f 6d 22 2c 20 22 32 32 2e 63 6e 22 2c 20 22 6c 69 74 65 73 70 65 65 64 74 65 63 68 2e 63 6f 6d 22 2c 20 22 62 6c 6f 6f 6d 62 65 72 67 2e 63 6f 6d 22 2c 20 22 75 6e 2e 6f 72 67 22 2c 20 22 63 6c 69 63 6b 66 75 6e 6e 65 6c 73 2e 63 6f 6d 22 2c 20 22 74 68 65 76 65 72 67 65 2e 63 6f 6d 22 2c 20 22 64 72 75 70 61 6c 2e 6f 72 67 22 2c 20 22
                                                  Data Ascii: eads.com", "go.co", "techcrunch.com", "nic.at", "shinystat.com", "zalo.me", "matomo.org", "cryoutcreations.eu", "huffingtonpost.com", "kakao.com", "22.cn", "litespeedtech.com", "bloomberg.com", "un.org", "clickfunnels.com", "theverge.com", "drupal.org", "
                                                  2024-07-22 10:34:52 UTC1369INData Raw: 61 74 69 73 74 61 2e 63 6f 6d 22 2c 20 22 31 32 33 37 37 2e 63 6e 22 2c 20 22 73 6d 61 73 68 62 61 6c 6c 6f 6f 6e 2e 63 6f 6d 22 2c 20 22 73 70 72 69 6e 67 65 72 2e 63 6f 6d 22 2c 20 22 73 74 61 6e 66 6f 72 64 2e 65 64 75 22 2c 20 22 61 69 72 62 6e 62 2e 63 6f 6d 22 2c 20 22 77 68 6f 69 73 2e 63 6f 22 2c 20 22 74 69 6d 65 2e 63 6f 6d 22 2c 20 22 61 63 74 69 76 65 6d 69 6e 64 2e 64 65 22 2c 20 22 67 69 70 68 79 2e 63 6f 6d 22 2c 20 22 6d 61 70 79 2e 63 7a 22 2c 20 22 77 69 6b 69 68 6f 77 2e 63 6f 6d 22 2c 20 22 70 68 70 62 62 2e 63 6f 6d 22 2c 20 22 61 6c 69 62 61 62 61 2e 63 6f 6d 22 2c 20 22 67 6f 6f 67 6c 65 2e 63 61 22 2c 20 22 66 64 61 2e 67 6f 76 22 2c 20 22 37 2d 7a 69 70 2e 6f 72 67 22 2c 20 22 6d 6f 7a 69 6c 6c 61 2e 63 6f 6d 22 2c 20 22 63 61 66
                                                  Data Ascii: atista.com", "12377.cn", "smashballoon.com", "springer.com", "stanford.edu", "airbnb.com", "whois.co", "time.com", "activemind.de", "giphy.com", "mapy.cz", "wikihow.com", "phpbb.com", "alibaba.com", "google.ca", "fda.gov", "7-zip.org", "mozilla.com", "caf
                                                  2024-07-22 10:34:52 UTC1369INData Raw: 2e 6f 72 67 22 2c 20 22 6c 61 74 69 6d 65 73 2e 63 6f 6d 22 2c 20 22 73 6f 75 72 63 65 6d 6f 64 2e 6e 65 74 22 2c 20 22 73 68 6f 70 70 79 2e 67 67 22 2c 20 22 62 6f 6f 74 73 74 72 61 70 64 61 73 68 2e 63 6f 6d 22 2c 20 22 6e 65 74 64 6e 61 2d 73 73 6c 2e 63 6f 6d 22 2c 20 22 69 6e 64 65 70 65 6e 64 65 6e 74 2e 63 6f 2e 75 6b 22 2c 20 22 79 6f 75 6b 75 2e 63 6f 6d 22 2c 20 22 77 6f 77 73 6c 69 64 65 72 2e 63 6f 6d 22 2c 20 22 79 61 64 69 2e 73 6b 22 2c 20 22 73 75 69 74 61 62 6c 65 6e 61 6d 65 73 2e 63 6f 6d 22 2c 20 22 63 73 73 6d 6f 62 61 6e 2e 63 6f 6d 22 2c 20 22 74 72 69 70 61 64 76 69 73 6f 72 2e 69 74 22 2c 20 22 77 77 77 2e 6e 68 73 2e 75 6b 22 2c 20 22 6d 69 70 63 6d 73 2e 63 6f 6d 22 2c 20 22 65 77 65 62 64 65 76 65 6c 6f 70 6d 65 6e 74 2e 63 6f
                                                  Data Ascii: .org", "latimes.com", "sourcemod.net", "shoppy.gg", "bootstrapdash.com", "netdna-ssl.com", "independent.co.uk", "youku.com", "wowslider.com", "yadi.sk", "suitablenames.com", "cssmoban.com", "tripadvisor.it", "www.nhs.uk", "mipcms.com", "ewebdevelopment.co
                                                  2024-07-22 10:34:52 UTC1369INData Raw: 2c 20 22 72 6f 62 6f 74 73 74 78 74 2e 6f 72 67 22 2c 20 22 69 6f 6e 6f 73 2e 66 72 22 2c 20 22 62 6f 72 6c 61 62 73 2e 69 6f 22 2c 20 22 65 76 65 6e 74 62 72 69 74 65 2e 63 6f 2e 75 6b 22 2c 20 22 67 69 74 6c 61 62 2e 63 6f 6d 22 2c 20 22 66 74 2e 63 6f 6d 22 2c 20 22 61 6e 67 69 65 73 6c 69 73 74 2e 63 6f 6d 22 2c 20 22 74 68 65 6d 65 2d 66 75 73 69 6f 6e 2e 63 6f 6d 22 2c 20 22 73 68 75 74 74 65 72 73 74 6f 63 6b 2e 63 6f 6d 22 2c 20 22 63 79 62 65 72 66 6f 6c 6b 73 2e 70 6c 22 2c 20 22 7a 7a 79 69 64 61 2e 6e 65 74 22 2c 20 22 62 6c 6f 67 73 70 6f 74 2e 63 6f 6d 2e 65 73 22 2c 20 22 6d 61 70 71 75 65 73 74 2e 63 6f 6d 22 2c 20 22 68 6f 74 6c 6f 67 2e 72 75 22 2c 20 22 73 62 61 2e 67 6f 76 22 2c 20 22 70 65 6f 70 6c 65 2e 63 6f 6d 2e 63 6e 22 2c 20 22
                                                  Data Ascii: , "robotstxt.org", "ionos.fr", "borlabs.io", "eventbrite.co.uk", "gitlab.com", "ft.com", "angieslist.com", "theme-fusion.com", "shutterstock.com", "cyberfolks.pl", "zzyida.net", "blogspot.com.es", "mapquest.com", "hotlog.ru", "sba.gov", "people.com.cn", "
                                                  2024-07-22 10:34:52 UTC1369INData Raw: 22 66 6f 72 74 75 6e 65 2e 63 6f 6d 22 2c 20 22 76 69 61 63 61 6e 61 64 61 6d 65 64 2e 63 6f 6d 22 2c 20 22 66 72 65 73 68 64 65 73 6b 2e 63 6f 6d 22 2c 20 22 75 6b 2e 63 6f 6d 22 2c 20 22 66 72 65 65 6e 6f 64 65 2e 6e 65 74 22 2c 20 22 61 6e 6f 6e 79 6d 69 7a 65 2e 63 6f 6d 22 2c 20 22 62 6c 6f 67 73 70 6f 74 2e 64 65 22 2c 20 22 61 61 72 6f 6e 70 61 72 65 63 6b 69 2e 63 6f 6d 22 2c 20 22 77 61 6c 6d 61 72 74 2e 63 6f 6d 22 2c 20 22 68 65 74 7a 6e 65 72 2e 64 65 22 2c 20 22 70 79 74 68 6f 6e 2e 6f 72 67 22 2c 20 22 72 6b 6e 2e 67 6f 76 2e 72 75 22 2c 20 22 6d 65 74 69 2e 67 6f 2e 6a 70 22 2c 20 22 68 6f 73 74 6e 65 74 2e 6e 6c 22 2c 20 22 65 6e 61 6d 61 64 2e 69 72 22 2c 20 22 62 69 74 6c 79 2e 63 6f 6d 22 2c 20 22 73 65 63 2e 67 6f 76 22 2c 20 22 6f 73
                                                  Data Ascii: "fortune.com", "viacanadamed.com", "freshdesk.com", "uk.com", "freenode.net", "anonymize.com", "blogspot.de", "aaronparecki.com", "walmart.com", "hetzner.de", "python.org", "rkn.gov.ru", "meti.go.jp", "hostnet.nl", "enamad.ir", "bitly.com", "sec.gov", "os
                                                  2024-07-22 10:34:52 UTC1369INData Raw: 70 75 62 2e 63 6f 6d 22 2c 20 22 61 6d 61 7a 6f 6e 2e 63 61 22 2c 20 22 6e 6d 6c 73 63 6f 6e 73 75 6d 65 72 61 63 63 65 73 73 2e 6f 72 67 22 2c 20 22 6d 79 6f 72 64 65 72 62 6f 78 2e 63 6f 6d 22 2c 20 22 73 6b 69 70 74 68 65 64 69 73 68 65 73 2e 63 6f 6d 22 2c 20 22 6e 70 6d 6a 73 2e 63 6f 6d 22 2c 20 22 6a 75 73 74 67 69 76 69 6e 67 2e 63 6f 6d 22 2c 20 22 62 65 66 72 69 65 6e 64 65 72 73 2e 6f 72 67 22 2c 20 22 68 65 69 73 65 2e 64 65 22 2c 20 22 73 70 68 69 6e 78 2d 64 6f 63 2e 6f 72 67 22 2c 20 22 66 6f 72 6d 73 74 61 63 6b 2e 63 6f 6d 22 2c 20 22 68 6f 6d 65 61 64 76 69 73 6f 72 2e 63 6f 6d 22 2c 20 22 62 6f 78 2e 63 6f 6d 22 2c 20 22 6d 75 66 66 69 6e 67 72 6f 75 70 2e 63 6f 6d 22 2c 20 22 61 63 75 69 74 79 73 63 68 65 64 75 6c 69 6e 67 2e 63 6f 6d
                                                  Data Ascii: pub.com", "amazon.ca", "nmlsconsumeraccess.org", "myorderbox.com", "skipthedishes.com", "npmjs.com", "justgiving.com", "befrienders.org", "heise.de", "sphinx-doc.org", "formstack.com", "homeadvisor.com", "box.com", "muffingroup.com", "acuityscheduling.com


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  118192.168.2.449980104.16.148.130443984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:52 UTC62OUTGET /api/v2/url/blacklist HTTP/1.1
                                                  Host: acs.lavasoft.com
                                                  2024-07-22 10:34:52 UTC324INHTTP/1.1 301 Moved Permanently
                                                  Date: Mon, 22 Jul 2024 10:34:52 GMT
                                                  Content-Length: 0
                                                  Connection: close
                                                  Cache-Control: public
                                                  Cache-Control: max-age=86400
                                                  Location: https://acscdn.lavasoft.com/urlblacklist.json
                                                  api-supported-versions: 2.0
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7dc79436a59-EWR


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  119192.168.2.449976104.16.148.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:52 UTC62OUTGET /api/v2/url/blacklist HTTP/1.1
                                                  Host: acs.lavasoft.com
                                                  2024-07-22 10:34:52 UTC324INHTTP/1.1 301 Moved Permanently
                                                  Date: Mon, 22 Jul 2024 10:34:52 GMT
                                                  Content-Length: 0
                                                  Connection: close
                                                  Cache-Control: public
                                                  Cache-Control: max-age=86400
                                                  Location: https://acscdn.lavasoft.com/urlblacklist.json
                                                  api-supported-versions: 2.0
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7dcdfa441b2-EWR


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  120192.168.2.449978104.16.149.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:52 UTC161OUTPOST /v1/event-stat?Type=BrowserExtension&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 3043
                                                  2024-07-22 10:34:52 UTC3043OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 42 72 6f 77 73 65 72 22 3a 7b 22 43 68 72 6f 6d 65 22 3a 7b 22 45 78 74 49 6e 66 6f 22 3a 5b 7b 22 69 64 22 3a 22 67 68 62 6d 6e 6e 6a 6f 6f 65 6b 70 6d 6f 65 63 6e 6e 6e 69 6c 6e 6e 62 64 6c 6f 6c 68 6b 68 69 22 2c 22 69 6e 73 74 61 6c 6c 44 61 74 65 22 3a 6e 75 6c 6c 2c 22 75 73 65 72 44 69 73 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 66 6f 72 65 69 67 6e 49 6e 73 74 61 6c 6c 22 3a 66 61 6c 73 65 2c 22 75 70 64 61 74 65 44 61 74 65 22 3a 6e 75 6c 6c 2c 22 76 65 72 73 69 6f 6e 22 3a 6e 75 6c 6c 7d 2c 7b 22 69 64 22 3a 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 2c 22 69 6e 73 74 61 6c 6c 44 61 74 65 22 3a 6e 75 6c 6c 2c 22 75 73 65 72 44 69 73 61 62 6c 65 64 22 3a
                                                  Data Ascii: {"Data": {"Browser":{"Chrome":{"ExtInfo":[{"id":"ghbmnnjooekpmoecnnnilnnbdlolhkhi","installDate":null,"userDisabled":false,"foreignInstall":false,"updateDate":null,"version":null},{"id":"nmmhkkegccagdldgiimedpiccmgmieda","installDate":null,"userDisabled":
                                                  2024-07-22 10:34:52 UTC479INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:52 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: close
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7e08dae8c0b-EWR
                                                  2024-07-22 10:34:52 UTC35INData Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}
                                                  2024-07-22 10:34:52 UTC5INData Raw: 30 0d 0a 0d 0a
                                                  Data Ascii: 0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  121192.168.2.449981104.16.149.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:52 UTC62OUTGET /urlblacklist.json HTTP/1.1
                                                  Host: acscdn.lavasoft.com
                                                  2024-07-22 10:34:52 UTC385INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:52 GMT
                                                  Content-Type: application/json
                                                  Content-Length: 201625
                                                  Connection: close
                                                  Last-Modified: Wed, 15 Nov 2023 13:57:17 GMT
                                                  ETag: "6554ce3d-31399"
                                                  CF-Cache-Status: HIT
                                                  Age: 62209
                                                  Expires: Tue, 23 Jul 2024 06:34:52 GMT
                                                  Cache-Control: public, max-age=72000
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7e089f28ce2-EWR
                                                  2024-07-22 10:34:52 UTC984INData Raw: 5b 22 6c 61 69 7a 68 65 6e 67 73 6c 74 2e 63 6e 22 2c 22 6d 79 74 6f 6f 6c 7a 2e 6e 65 74 22 2c 22 70 72 6f 74 65 63 74 32 34 37 2e 6f 6e 6c 69 6e 65 22 2c 22 78 78 6c 61 73 74 2e 63 6f 6d 22 2c 22 77 6f 72 6c 64 73 61 6e 61 6c 79 74 69 63 73 2e 63 6f 6d 22 2c 22 73 6b 69 6c 6c 74 72 61 6e 73 66 6f 72 6d 2e 63 6f 2e 69 6e 22 2c 22 6c 65 6c 61 65 72 2e 63 6f 6d 22 2c 22 6a 70 6f 70 73 69 6e 67 6c 65 73 2e 65 75 22 2c 22 72 69 73 71 75 65 67 61 6c 6b 78 2e 63 6f 6d 22 2c 22 73 76 65 74 76 79 68 6f 64 2e 73 6b 22 2c 22 6d 6f 76 69 65 63 72 75 6d 62 73 2e 6e 65 74 22 2c 22 70 68 72 61 62 75 2e 67 6f 2e 74 68 22 2c 22 6f 6e 6c 79 69 6e 64 69 61 6e 78 2e 63 63 22 2c 22 69 6b 69 73 73 2e 6f 6e 6c 69 6e 65 22 2c 22 75 72 65 77 73 61 77 61 6e 69 2e 61 75 74 6f 73
                                                  Data Ascii: ["laizhengslt.cn","mytoolz.net","protect247.online","xxlast.com","worldsanalytics.com","skilltransform.co.in","lelaer.com","jpopsingles.eu","risquegalkx.com","svetvyhod.sk","moviecrumbs.net","phrabu.go.th","onlyindianx.cc","ikiss.online","urewsawani.autos
                                                  2024-07-22 10:34:52 UTC1369INData Raw: 6b 61 74 6d 6f 76 69 65 68 64 2e 6d 6f 76 22 2c 22 62 6c 75 65 67 61 73 6c 61 6d 70 2e 6f 72 67 22 2c 22 64 72 61 67 67 65 64 6c 69 6e 65 2e 6f 72 67 22 2c 22 67 68 35 79 73 33 67 72 79 35 64 35 33 32 2e 78 79 7a 22 2c 22 6b 61 61 6d 75 75 2e 6f 72 67 22 2c 22 73 61 6f 6d 61 32 32 30 2e 78 79 7a 22 2c 22 6c 69 76 65 74 76 33 36 35 2e 6d 65 22 2c 22 70 69 73 69 2e 70 69 63 73 22 2c 22 76 61 6c 75 65 2d 6c 69 66 65 2e 78 79 7a 22 2c 22 72 69 64 6f 6d 6f 76 69 65 73 2e 74 76 22 2c 22 70 68 69 6c 77 69 6e 2e 70 68 22 2c 22 61 64 6d 69 72 61 6c 73 68 69 70 70 69 6e 67 2e 63 6f 6d 22 2c 22 66 72 65 65 74 6f 6f 6c 6f 6e 6c 69 6e 65 2e 63 6f 6d 22 2c 22 76 69 74 61 6c 61 6d 73 65 65 2e 63 6f 6d 22 2c 22 6f 72 69 67 6c 6e 61 6c 64 61 74 65 2e 63 6f 6d 22 2c 22 72
                                                  Data Ascii: katmoviehd.mov","bluegaslamp.org","draggedline.org","gh5ys3gry5d532.xyz","kaamuu.org","saoma220.xyz","livetv365.me","pisi.pics","value-life.xyz","ridomovies.tv","philwin.ph","admiralshipping.com","freetoolonline.com","vitalamsee.com","origlnaldate.com","r
                                                  2024-07-22 10:34:52 UTC1369INData Raw: 79 2e 63 6f 6d 22 2c 22 61 69 73 68 6f 72 74 2e 74 6f 70 22 2c 22 70 72 6f 6d 6c 61 7a 65 72 2e 72 75 22 2c 22 6c 65 66 74 62 69 6c 6c 2e 74 6f 70 22 2c 22 75 70 73 63 61 72 72 69 61 67 65 70 61 79 6d 65 6e 74 2e 63 6f 6d 22 2c 22 69 6e 76 65 73 74 6c 69 65 2e 63 6f 6d 22 2c 22 74 35 2d 77 69 6b 69 2e 64 65 22 2c 22 66 72 65 65 73 6f 66 74 72 75 73 2e 72 75 22 2c 22 70 61 70 73 74 72 65 61 6d 2e 63 6c 75 62 22 2c 22 77 6f 72 6c 64 6e 65 77 73 2d 32 34 2e 63 6f 6d 22 2c 22 65 6e 73 74 72 65 61 6d 2e 74 6f 70 22 2c 22 73 6f 72 63 65 72 65 72 6f 66 74 65 61 2e 63 6f 6d 22 2c 22 6d 79 63 6c 69 63 6b 2d 32 2e 63 6f 6d 22 2c 22 6c 65 6c 69 65 7a 6f 72 67 67 72 6f 65 70 2e 6e 6c 22 2c 22 6d 75 61 74 68 65 6e 67 61 79 2e 63 6f 6d 22 2c 22 78 6e 2d 2d 38 30 61 63
                                                  Data Ascii: y.com","aishort.top","promlazer.ru","leftbill.top","upscarriagepayment.com","investlie.com","t5-wiki.de","freesoftrus.ru","papstream.club","worldnews-24.com","enstream.top","sorcereroftea.com","myclick-2.com","leliezorggroep.nl","muathengay.com","xn--80ac
                                                  2024-07-22 10:34:52 UTC1369INData Raw: 64 65 2e 6c 69 66 65 22 2c 22 67 30 66 2e 63 6e 22 2c 22 65 73 75 6e 32 31 2e 63 6e 22 2c 22 62 61 6f 66 65 6e 67 6a 69 68 75 6f 2e 63 6f 6d 22 2c 22 6b 65 79 67 65 6e 73 2e 70 72 6f 22 2c 22 63 68 61 72 6d 61 6e 74 65 73 76 6f 69 73 69 6e 65 73 6d 75 72 65 73 2e 63 6f 6d 22 2c 22 76 69 61 74 72 69 73 2d 65 2d 63 68 61 6e 6e 65 6c 2e 63 6f 6d 22 2c 22 73 68 6f 72 74 6c 79 61 6d 75 73 65 6d 65 6e 74 2e 63 6f 6d 22 2c 22 32 31 39 32 39 2e 72 75 22 2c 22 67 65 74 6d 61 63 6b 65 65 70 65 72 73 6f 66 74 70 72 6f 2e 78 79 7a 22 2c 22 74 68 65 73 79 6e 74 68 65 73 69 73 2e 61 70 70 22 2c 22 63 75 74 69 6c 6e 6b 73 2e 63 6f 6d 22 2c 22 61 75 74 6f 62 69 6b 65 72 73 2e 78 79 7a 22 2c 22 70 69 72 61 74 65 2d 70 72 6f 78 79 2e 74 6f 70 22 2c 22 34 35 2e 31 34 38 2e
                                                  Data Ascii: de.life","g0f.cn","esun21.cn","baofengjihuo.com","keygens.pro","charmantesvoisinesmures.com","viatris-e-channel.com","shortlyamusement.com","21929.ru","getmackeepersoftpro.xyz","thesynthesis.app","cutilnks.com","autobikers.xyz","pirate-proxy.top","45.148.
                                                  2024-07-22 10:34:52 UTC1369INData Raw: 79 77 70 6a 6b 2e 63 6f 6d 22 2c 22 73 79 6c 76 69 6e 61 6e 6f 72 72 65 79 2e 63 6f 6d 22 2c 22 6c 6f 6e 38 38 2e 74 6f 70 22 2c 22 76 6c 61 65 6b 61 6e 2e 6b 7a 22 2c 22 73 75 70 74 72 61 66 2e 63 6f 6d 22 2c 22 67 65 74 66 6c 69 6b 2e 63 6f 6d 22 2c 22 63 6f 6f 6c 74 72 6b 2e 78 79 7a 22 2c 22 66 6c 69 72 74 74 6f 6d 65 2e 63 6f 6d 22 2c 22 6d 61 73 61 63 2e 73 62 73 22 2c 22 6e 61 69 6c 6d 61 67 61 7a 69 6e 65 2e 6f 6e 6c 69 6e 65 22 2c 22 72 6f 76 32 2e 6e 65 74 22 2c 22 63 61 73 74 6c 65 63 61 70 69 74 61 6c 2e 76 63 22 2c 22 6d 6f 62 69 6c 65 74 6f 72 72 65 6e 74 2e 69 6e 66 6f 22 2c 22 63 77 62 74 69 2e 63 6f 6d 2e 62 72 22 2c 22 70 6f 73 61 64 61 6c 61 72 6f 62 6c 65 64 61 2e 63 6f 6d 22 2c 22 61 6c 6c 75 72 69 6e 67 67 61 6c 67 2e 63 6f 6d 22 2c
                                                  Data Ascii: ywpjk.com","sylvinanorrey.com","lon88.top","vlaekan.kz","suptraf.com","getflik.com","cooltrk.xyz","flirttome.com","masac.sbs","nailmagazine.online","rov2.net","castlecapital.vc","mobiletorrent.info","cwbti.com.br","posadalarobleda.com","alluringgalg.com",
                                                  2024-07-22 10:34:52 UTC1369INData Raw: 2c 22 74 6f 72 69 6f 6c 75 6f 72 2e 63 6f 6d 22 2c 22 63 72 61 63 6b 73 75 72 6c 2e 63 6f 6d 22 2c 22 70 72 79 76 69 74 61 6e 6e 79 61 2e 74 6f 70 22 2c 22 63 68 61 6e 67 62 65 65 72 2e 73 69 74 65 22 2c 22 61 64 6f 6e 73 6f 6e 6c 79 64 2e 78 79 7a 22 2c 22 74 68 65 6d 65 6e 63 6f 64 65 2e 63 6f 6d 22 2c 22 70 65 72 61 74 75 72 61 6e 70 65 64 69 61 2e 69 64 22 2c 22 74 65 6c 75 74 6f 70 69 65 7a 2e 63 6c 75 62 22 2c 22 76 73 67 7a 64 64 6a 2e 63 6f 6d 22 2c 22 61 64 61 70 61 2d 67 72 6f 75 70 2e 63 6f 6d 22 2c 22 73 68 65 65 74 2d 6d 75 73 69 63 2e 78 79 7a 22 2c 22 72 6f 63 6b 68 61 74 74 65 72 2e 63 6f 6d 22 2c 22 63 6f 6e 73 63 69 6f 75 73 6e 65 73 73 71 75 61 69 6e 74 2e 63 6f 6d 22 2c 22 76 61 6c 6c 65 73 76 69 73 69 6f 2e 63 61 74 22 2c 22 63 73 69
                                                  Data Ascii: ,"torioluor.com","cracksurl.com","pryvitannya.top","changbeer.site","adonsonlyd.xyz","themencode.com","peraturanpedia.id","telutopiez.club","vsgzddj.com","adapa-group.com","sheet-music.xyz","rockhatter.com","consciousnessquaint.com","vallesvisio.cat","csi
                                                  2024-07-22 10:34:52 UTC1369INData Raw: 2e 63 6f 6d 2e 75 61 22 2c 22 63 61 6d 61 64 6d 69 6e 2e 72 75 22 2c 22 6a 75 62 74 31 32 2e 78 79 7a 22 2c 22 72 6b 6e 2e 67 6f 76 2e 72 75 22 2c 22 31 32 33 6d 6f 76 69 65 2e 6c 74 64 22 2c 22 64 73 32 2e 63 6c 75 62 22 2c 22 79 6f 6d 73 74 2e 6f 72 67 22 2c 22 73 75 69 62 65 2e 65 64 75 2e 63 6e 22 2c 22 38 78 62 65 74 33 30 30 2e 63 6f 6d 22 2c 22 61 70 70 6c 65 69 64 78 79 2e 74 6f 70 22 2c 22 62 69 6f 6c 61 62 73 68 6f 70 32 34 2e 63 6f 6d 22 2c 22 6d 79 66 69 6c 65 73 74 6f 72 65 2e 63 6f 6d 22 2c 22 6f 72 6b 6c 69 6e 6b 2e 63 6f 6d 22 2c 22 65 78 70 6c 6f 72 72 2e 6e 65 74 22 2c 22 67 6f 74 72 61 63 6b 72 65 64 69 72 65 63 74 2e 63 6f 6d 22 2c 22 6a 61 76 69 65 72 64 65 6c 61 73 65 6e 2e 63 6f 6d 22 2c 22 62 72 69 61 6e 73 73 63 6c 75 62 2e 63 63
                                                  Data Ascii: .com.ua","camadmin.ru","jubt12.xyz","rkn.gov.ru","123movie.ltd","ds2.club","yomst.org","suibe.edu.cn","8xbet300.com","appleidxy.top","biolabshop24.com","myfilestore.com","orklink.com","explorr.net","gotrackredirect.com","javierdelasen.com","brianssclub.cc
                                                  2024-07-22 10:34:52 UTC1369INData Raw: 2c 22 64 69 73 63 6c 6f 73 65 70 72 6f 67 72 61 6d 77 65 64 6e 65 73 64 61 79 2e 63 6f 6d 22 2c 22 6b 69 6e 6f 6e 65 77 73 2e 70 72 6f 22 2c 22 6f 68 6e 79 64 65 6c 69 67 68 74 66 75 6c 64 61 74 65 73 2e 6c 69 66 65 22 2c 22 62 6f 6b 65 70 69 64 2e 62 6f 6e 64 22 2c 22 62 6f 72 69 73 2e 64 65 22 2c 22 6d 75 6e 64 6f 63 69 6e 65 6d 61 74 6f 67 72 61 66 69 63 6f 2e 6e 65 74 22 2c 22 62 65 74 61 63 65 6e 74 61 75 72 69 2e 74 6f 70 22 2c 22 6f 6d 67 6e 6f 74 65 2e 6e 65 74 6c 69 66 79 2e 61 70 70 22 2c 22 67 72 6f 77 6e 75 70 67 61 6c 6f 72 65 2e 6c 69 66 65 22 2c 22 69 6d 70 6f 73 73 69 62 6c 65 6f 66 66 65 72 73 2e 63 6f 6d 22 2c 22 76 6b 73 74 72 65 61 6d 2e 74 6f 70 22 2c 22 68 6f 74 70 72 6f 6d 6f 74 69 6f 6e 73 2e 6f 6e 6c 69 6e 65 22 2c 22 69 6f 2e 6b
                                                  Data Ascii: ,"discloseprogramwednesday.com","kinonews.pro","ohnydelightfuldates.life","bokepid.bond","boris.de","mundocinematografico.net","betacentauri.top","omgnote.netlify.app","grownupgalore.life","impossibleoffers.com","vkstream.top","hotpromotions.online","io.k
                                                  2024-07-22 10:34:52 UTC1369INData Raw: 2e 69 74 22 2c 22 6f 6f 72 63 61 73 65 6c 6c 73 2e 63 6f 6d 22 2c 22 6f 6e 65 64 61 73 68 2e 6e 65 74 22 2c 22 74 70 61 73 2e 72 75 22 2c 22 74 65 6e 69 38 35 73 74 61 62 30 31 64 2e 63 6f 6d 22 2c 22 74 68 6f 73 65 63 61 6e 64 79 2e 63 6f 6d 22 2c 22 6e 69 6c 6b 6e 61 72 66 2e 78 79 7a 22 2c 22 72 65 69 66 65 66 72 61 75 65 6e 2e 63 6f 6d 22 2c 22 72 6f 73 65 33 33 2e 74 6f 70 22 2c 22 73 74 6f 6e 65 61 67 65 70 65 64 69 61 2e 63 6f 6d 22 2c 22 6d 79 70 72 69 76 61 74 65 2e 70 69 63 73 22 2c 22 73 6e 61 70 78 2e 69 6e 66 6f 22 2c 22 67 74 61 75 74 6f 63 6c 69 63 6b 65 72 2e 63 6f 6d 22 2c 22 66 6d 6f 76 69 65 7a 2e 69 6e 66 6f 22 2c 22 63 6f 6d 65 73 68 6f 70 69 6e 67 2e 74 6f 6b 79 6f 22 2c 22 70 65 6c 69 73 78 70 6f 72 6e 6f 2e 6e 65 74 22 2c 22 63 68
                                                  Data Ascii: .it","oorcasells.com","onedash.net","tpas.ru","teni85stab01d.com","thosecandy.com","nilknarf.xyz","reifefrauen.com","rose33.top","stoneagepedia.com","myprivate.pics","snapx.info","gtautoclicker.com","fmoviez.info","comeshoping.tokyo","pelisxporno.net","ch
                                                  2024-07-22 10:34:52 UTC1369INData Raw: 70 74 34 72 75 73 2e 72 75 22 2c 22 6c 69 76 65 64 73 6b 61 74 65 72 61 69 73 69 6e 2e 63 6f 6d 22 2c 22 61 79 65 6a 6f 6d 65 72 2e 74 6f 70 22 2c 22 6e 6a 69 32 30 2e 78 79 7a 22 2c 22 67 61 6c 61 78 79 62 79 63 6f 69 6e 2e 63 6f 6d 22 2c 22 65 73 74 61 69 6c 6f 66 61 73 68 69 6f 6e 2e 63 6f 6d 22 2c 22 61 72 63 68 65 75 72 6f 70 65 2e 69 6e 66 6f 22 2c 22 65 7a 63 67 6f 6a 61 61 6d 67 2e 63 6f 6d 22 2c 22 68 2d 67 65 6e 2e 78 79 7a 22 2c 22 78 6e 2d 2d 39 30 61 61 76 6d 66 69 37 62 31 64 2e 78 79 7a 22 2c 22 6c 69 62 72 6f 73 72 65 63 6f 6d 65 6e 64 61 64 6f 73 73 2e 63 6f 6d 22 2c 22 75 74 69 6c 69 74 79 70 72 65 73 65 6e 74 2e 63 6f 6d 22 2c 22 74 68 65 67 61 6d 65 70 6c 61 79 2e 6c 69 66 65 22 2c 22 61 69 36 38 36 38 2e 74 6f 70 22 2c 22 78 79 63 6c
                                                  Data Ascii: pt4rus.ru","livedskateraisin.com","ayejomer.top","nji20.xyz","galaxybycoin.com","estailofashion.com","archeurope.info","ezcgojaamg.com","h-gen.xyz","xn--90aavmfi7b1d.xyz","librosrecomendadoss.com","utilitypresent.com","thegameplay.life","ai6868.top","xycl


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  122192.168.2.449986104.16.148.130443984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:53 UTC71OUTGET /api/v2/url/permanentwhitelist HTTP/1.1
                                                  Host: acs.lavasoft.com
                                                  2024-07-22 10:34:53 UTC333INHTTP/1.1 301 Moved Permanently
                                                  Date: Mon, 22 Jul 2024 10:34:53 GMT
                                                  Content-Length: 0
                                                  Connection: close
                                                  Cache-Control: public
                                                  Cache-Control: max-age=86400
                                                  Location: https://acscdn.lavasoft.com/permanentUrlWhitelist.json
                                                  api-supported-versions: 2.0
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7e588464233-EWR


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  123192.168.2.449990104.16.149.130443984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:53 UTC180OUTPOST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 364
                                                  Connection: Keep-Alive
                                                  2024-07-22 10:34:53 UTC364OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 45 76 65 6e 74 44 61 74 61 22 3a 22 32 34 68 72 73 22 2c 22 45 76 65 6e 74 4e 61 6d 65 22 3a 22 4d 69 63 72 6f 74 61 72 67 65 74 69 6e 67 54 69 6d 65 72 22 2c 22 42 72 6f 77 73 65 72 4e 61 6d 65 22 3a 22 22 2c 22 53 65 61 72 63 68 45 6e 67 69 6e 65 22 3a 22 22 2c 22 49 6e 73 74 61 6c 6c 44 61 74 65 22 3a 22 32 30 32 34 2d 30 37 2d 32 32 54 30 30 3a 30 30 3a 30 30 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65 2d 31 31 32 38 2d 34 65 36 30 2d 62 65 65 61 2d 32 37 32 30 34 31 64 66 36 34 35 32 22 2c 22 4c 61 6e 67 75 61 67 65 22 3a 22 65 6e 2d 55 53 22 2c 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22
                                                  Data Ascii: {"Data": {"EventData":"24hrs","EventName":"MicrotargetingTimer","BrowserName":"","SearchEngine":"","InstallDate":"2024-07-22T00:00:00","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Language":"en-US","MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698"
                                                  2024-07-22 10:34:53 UTC479INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:53 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: close
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7e5fce57288-EWR
                                                  2024-07-22 10:34:53 UTC35INData Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}
                                                  2024-07-22 10:34:53 UTC5INData Raw: 30 0d 0a 0d 0a
                                                  Data Ascii: 0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  124192.168.2.449989104.16.148.130443984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:53 UTC71OUTGET /api/v2/url/permanentwhitelist HTTP/1.1
                                                  Host: acs.lavasoft.com
                                                  2024-07-22 10:34:54 UTC333INHTTP/1.1 301 Moved Permanently
                                                  Date: Mon, 22 Jul 2024 10:34:54 GMT
                                                  Content-Length: 0
                                                  Connection: close
                                                  Cache-Control: public
                                                  Cache-Control: max-age=86400
                                                  Location: https://acscdn.lavasoft.com/permanentUrlWhitelist.json
                                                  api-supported-versions: 2.0
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7e60d5c1912-EWR


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  125192.168.2.449983104.16.149.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:53 UTC161OUTPOST /v1/event-stat?Type=BrowserExtension&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 3043
                                                  2024-07-22 10:34:56 UTC3043OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 42 72 6f 77 73 65 72 22 3a 7b 22 43 68 72 6f 6d 65 22 3a 7b 22 45 78 74 49 6e 66 6f 22 3a 5b 7b 22 69 64 22 3a 22 67 68 62 6d 6e 6e 6a 6f 6f 65 6b 70 6d 6f 65 63 6e 6e 6e 69 6c 6e 6e 62 64 6c 6f 6c 68 6b 68 69 22 2c 22 69 6e 73 74 61 6c 6c 44 61 74 65 22 3a 6e 75 6c 6c 2c 22 75 73 65 72 44 69 73 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 66 6f 72 65 69 67 6e 49 6e 73 74 61 6c 6c 22 3a 66 61 6c 73 65 2c 22 75 70 64 61 74 65 44 61 74 65 22 3a 6e 75 6c 6c 2c 22 76 65 72 73 69 6f 6e 22 3a 6e 75 6c 6c 7d 2c 7b 22 69 64 22 3a 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 2c 22 69 6e 73 74 61 6c 6c 44 61 74 65 22 3a 6e 75 6c 6c 2c 22 75 73 65 72 44 69 73 61 62 6c 65 64 22 3a
                                                  Data Ascii: {"Data": {"Browser":{"Chrome":{"ExtInfo":[{"id":"ghbmnnjooekpmoecnnnilnnbdlolhkhi","installDate":null,"userDisabled":false,"foreignInstall":false,"updateDate":null,"version":null},{"id":"nmmhkkegccagdldgiimedpiccmgmieda","installDate":null,"userDisabled":
                                                  2024-07-22 10:34:56 UTC479INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:56 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: close
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7e71ce018ea-EWR
                                                  2024-07-22 10:34:56 UTC35INData Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}
                                                  2024-07-22 10:34:56 UTC5INData Raw: 30 0d 0a 0d 0a
                                                  Data Ascii: 0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  126192.168.2.449982104.16.149.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:54 UTC62OUTGET /urlblacklist.json HTTP/1.1
                                                  Host: acscdn.lavasoft.com
                                                  2024-07-22 10:34:54 UTC385INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:54 GMT
                                                  Content-Type: application/json
                                                  Content-Length: 201625
                                                  Connection: close
                                                  Last-Modified: Wed, 15 Nov 2023 13:57:17 GMT
                                                  ETag: "6554ce3d-31399"
                                                  CF-Cache-Status: HIT
                                                  Age: 62211
                                                  Expires: Tue, 23 Jul 2024 06:34:54 GMT
                                                  Cache-Control: public, max-age=72000
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7e958848c6c-EWR
                                                  2024-07-22 10:34:54 UTC984INData Raw: 5b 22 6c 61 69 7a 68 65 6e 67 73 6c 74 2e 63 6e 22 2c 22 6d 79 74 6f 6f 6c 7a 2e 6e 65 74 22 2c 22 70 72 6f 74 65 63 74 32 34 37 2e 6f 6e 6c 69 6e 65 22 2c 22 78 78 6c 61 73 74 2e 63 6f 6d 22 2c 22 77 6f 72 6c 64 73 61 6e 61 6c 79 74 69 63 73 2e 63 6f 6d 22 2c 22 73 6b 69 6c 6c 74 72 61 6e 73 66 6f 72 6d 2e 63 6f 2e 69 6e 22 2c 22 6c 65 6c 61 65 72 2e 63 6f 6d 22 2c 22 6a 70 6f 70 73 69 6e 67 6c 65 73 2e 65 75 22 2c 22 72 69 73 71 75 65 67 61 6c 6b 78 2e 63 6f 6d 22 2c 22 73 76 65 74 76 79 68 6f 64 2e 73 6b 22 2c 22 6d 6f 76 69 65 63 72 75 6d 62 73 2e 6e 65 74 22 2c 22 70 68 72 61 62 75 2e 67 6f 2e 74 68 22 2c 22 6f 6e 6c 79 69 6e 64 69 61 6e 78 2e 63 63 22 2c 22 69 6b 69 73 73 2e 6f 6e 6c 69 6e 65 22 2c 22 75 72 65 77 73 61 77 61 6e 69 2e 61 75 74 6f 73
                                                  Data Ascii: ["laizhengslt.cn","mytoolz.net","protect247.online","xxlast.com","worldsanalytics.com","skilltransform.co.in","lelaer.com","jpopsingles.eu","risquegalkx.com","svetvyhod.sk","moviecrumbs.net","phrabu.go.th","onlyindianx.cc","ikiss.online","urewsawani.autos
                                                  2024-07-22 10:34:54 UTC1369INData Raw: 6b 61 74 6d 6f 76 69 65 68 64 2e 6d 6f 76 22 2c 22 62 6c 75 65 67 61 73 6c 61 6d 70 2e 6f 72 67 22 2c 22 64 72 61 67 67 65 64 6c 69 6e 65 2e 6f 72 67 22 2c 22 67 68 35 79 73 33 67 72 79 35 64 35 33 32 2e 78 79 7a 22 2c 22 6b 61 61 6d 75 75 2e 6f 72 67 22 2c 22 73 61 6f 6d 61 32 32 30 2e 78 79 7a 22 2c 22 6c 69 76 65 74 76 33 36 35 2e 6d 65 22 2c 22 70 69 73 69 2e 70 69 63 73 22 2c 22 76 61 6c 75 65 2d 6c 69 66 65 2e 78 79 7a 22 2c 22 72 69 64 6f 6d 6f 76 69 65 73 2e 74 76 22 2c 22 70 68 69 6c 77 69 6e 2e 70 68 22 2c 22 61 64 6d 69 72 61 6c 73 68 69 70 70 69 6e 67 2e 63 6f 6d 22 2c 22 66 72 65 65 74 6f 6f 6c 6f 6e 6c 69 6e 65 2e 63 6f 6d 22 2c 22 76 69 74 61 6c 61 6d 73 65 65 2e 63 6f 6d 22 2c 22 6f 72 69 67 6c 6e 61 6c 64 61 74 65 2e 63 6f 6d 22 2c 22 72
                                                  Data Ascii: katmoviehd.mov","bluegaslamp.org","draggedline.org","gh5ys3gry5d532.xyz","kaamuu.org","saoma220.xyz","livetv365.me","pisi.pics","value-life.xyz","ridomovies.tv","philwin.ph","admiralshipping.com","freetoolonline.com","vitalamsee.com","origlnaldate.com","r
                                                  2024-07-22 10:34:54 UTC1369INData Raw: 79 2e 63 6f 6d 22 2c 22 61 69 73 68 6f 72 74 2e 74 6f 70 22 2c 22 70 72 6f 6d 6c 61 7a 65 72 2e 72 75 22 2c 22 6c 65 66 74 62 69 6c 6c 2e 74 6f 70 22 2c 22 75 70 73 63 61 72 72 69 61 67 65 70 61 79 6d 65 6e 74 2e 63 6f 6d 22 2c 22 69 6e 76 65 73 74 6c 69 65 2e 63 6f 6d 22 2c 22 74 35 2d 77 69 6b 69 2e 64 65 22 2c 22 66 72 65 65 73 6f 66 74 72 75 73 2e 72 75 22 2c 22 70 61 70 73 74 72 65 61 6d 2e 63 6c 75 62 22 2c 22 77 6f 72 6c 64 6e 65 77 73 2d 32 34 2e 63 6f 6d 22 2c 22 65 6e 73 74 72 65 61 6d 2e 74 6f 70 22 2c 22 73 6f 72 63 65 72 65 72 6f 66 74 65 61 2e 63 6f 6d 22 2c 22 6d 79 63 6c 69 63 6b 2d 32 2e 63 6f 6d 22 2c 22 6c 65 6c 69 65 7a 6f 72 67 67 72 6f 65 70 2e 6e 6c 22 2c 22 6d 75 61 74 68 65 6e 67 61 79 2e 63 6f 6d 22 2c 22 78 6e 2d 2d 38 30 61 63
                                                  Data Ascii: y.com","aishort.top","promlazer.ru","leftbill.top","upscarriagepayment.com","investlie.com","t5-wiki.de","freesoftrus.ru","papstream.club","worldnews-24.com","enstream.top","sorcereroftea.com","myclick-2.com","leliezorggroep.nl","muathengay.com","xn--80ac
                                                  2024-07-22 10:34:54 UTC1369INData Raw: 64 65 2e 6c 69 66 65 22 2c 22 67 30 66 2e 63 6e 22 2c 22 65 73 75 6e 32 31 2e 63 6e 22 2c 22 62 61 6f 66 65 6e 67 6a 69 68 75 6f 2e 63 6f 6d 22 2c 22 6b 65 79 67 65 6e 73 2e 70 72 6f 22 2c 22 63 68 61 72 6d 61 6e 74 65 73 76 6f 69 73 69 6e 65 73 6d 75 72 65 73 2e 63 6f 6d 22 2c 22 76 69 61 74 72 69 73 2d 65 2d 63 68 61 6e 6e 65 6c 2e 63 6f 6d 22 2c 22 73 68 6f 72 74 6c 79 61 6d 75 73 65 6d 65 6e 74 2e 63 6f 6d 22 2c 22 32 31 39 32 39 2e 72 75 22 2c 22 67 65 74 6d 61 63 6b 65 65 70 65 72 73 6f 66 74 70 72 6f 2e 78 79 7a 22 2c 22 74 68 65 73 79 6e 74 68 65 73 69 73 2e 61 70 70 22 2c 22 63 75 74 69 6c 6e 6b 73 2e 63 6f 6d 22 2c 22 61 75 74 6f 62 69 6b 65 72 73 2e 78 79 7a 22 2c 22 70 69 72 61 74 65 2d 70 72 6f 78 79 2e 74 6f 70 22 2c 22 34 35 2e 31 34 38 2e
                                                  Data Ascii: de.life","g0f.cn","esun21.cn","baofengjihuo.com","keygens.pro","charmantesvoisinesmures.com","viatris-e-channel.com","shortlyamusement.com","21929.ru","getmackeepersoftpro.xyz","thesynthesis.app","cutilnks.com","autobikers.xyz","pirate-proxy.top","45.148.
                                                  2024-07-22 10:34:54 UTC1369INData Raw: 79 77 70 6a 6b 2e 63 6f 6d 22 2c 22 73 79 6c 76 69 6e 61 6e 6f 72 72 65 79 2e 63 6f 6d 22 2c 22 6c 6f 6e 38 38 2e 74 6f 70 22 2c 22 76 6c 61 65 6b 61 6e 2e 6b 7a 22 2c 22 73 75 70 74 72 61 66 2e 63 6f 6d 22 2c 22 67 65 74 66 6c 69 6b 2e 63 6f 6d 22 2c 22 63 6f 6f 6c 74 72 6b 2e 78 79 7a 22 2c 22 66 6c 69 72 74 74 6f 6d 65 2e 63 6f 6d 22 2c 22 6d 61 73 61 63 2e 73 62 73 22 2c 22 6e 61 69 6c 6d 61 67 61 7a 69 6e 65 2e 6f 6e 6c 69 6e 65 22 2c 22 72 6f 76 32 2e 6e 65 74 22 2c 22 63 61 73 74 6c 65 63 61 70 69 74 61 6c 2e 76 63 22 2c 22 6d 6f 62 69 6c 65 74 6f 72 72 65 6e 74 2e 69 6e 66 6f 22 2c 22 63 77 62 74 69 2e 63 6f 6d 2e 62 72 22 2c 22 70 6f 73 61 64 61 6c 61 72 6f 62 6c 65 64 61 2e 63 6f 6d 22 2c 22 61 6c 6c 75 72 69 6e 67 67 61 6c 67 2e 63 6f 6d 22 2c
                                                  Data Ascii: ywpjk.com","sylvinanorrey.com","lon88.top","vlaekan.kz","suptraf.com","getflik.com","cooltrk.xyz","flirttome.com","masac.sbs","nailmagazine.online","rov2.net","castlecapital.vc","mobiletorrent.info","cwbti.com.br","posadalarobleda.com","alluringgalg.com",
                                                  2024-07-22 10:34:54 UTC1369INData Raw: 2c 22 74 6f 72 69 6f 6c 75 6f 72 2e 63 6f 6d 22 2c 22 63 72 61 63 6b 73 75 72 6c 2e 63 6f 6d 22 2c 22 70 72 79 76 69 74 61 6e 6e 79 61 2e 74 6f 70 22 2c 22 63 68 61 6e 67 62 65 65 72 2e 73 69 74 65 22 2c 22 61 64 6f 6e 73 6f 6e 6c 79 64 2e 78 79 7a 22 2c 22 74 68 65 6d 65 6e 63 6f 64 65 2e 63 6f 6d 22 2c 22 70 65 72 61 74 75 72 61 6e 70 65 64 69 61 2e 69 64 22 2c 22 74 65 6c 75 74 6f 70 69 65 7a 2e 63 6c 75 62 22 2c 22 76 73 67 7a 64 64 6a 2e 63 6f 6d 22 2c 22 61 64 61 70 61 2d 67 72 6f 75 70 2e 63 6f 6d 22 2c 22 73 68 65 65 74 2d 6d 75 73 69 63 2e 78 79 7a 22 2c 22 72 6f 63 6b 68 61 74 74 65 72 2e 63 6f 6d 22 2c 22 63 6f 6e 73 63 69 6f 75 73 6e 65 73 73 71 75 61 69 6e 74 2e 63 6f 6d 22 2c 22 76 61 6c 6c 65 73 76 69 73 69 6f 2e 63 61 74 22 2c 22 63 73 69
                                                  Data Ascii: ,"torioluor.com","cracksurl.com","pryvitannya.top","changbeer.site","adonsonlyd.xyz","themencode.com","peraturanpedia.id","telutopiez.club","vsgzddj.com","adapa-group.com","sheet-music.xyz","rockhatter.com","consciousnessquaint.com","vallesvisio.cat","csi
                                                  2024-07-22 10:34:54 UTC1369INData Raw: 2e 63 6f 6d 2e 75 61 22 2c 22 63 61 6d 61 64 6d 69 6e 2e 72 75 22 2c 22 6a 75 62 74 31 32 2e 78 79 7a 22 2c 22 72 6b 6e 2e 67 6f 76 2e 72 75 22 2c 22 31 32 33 6d 6f 76 69 65 2e 6c 74 64 22 2c 22 64 73 32 2e 63 6c 75 62 22 2c 22 79 6f 6d 73 74 2e 6f 72 67 22 2c 22 73 75 69 62 65 2e 65 64 75 2e 63 6e 22 2c 22 38 78 62 65 74 33 30 30 2e 63 6f 6d 22 2c 22 61 70 70 6c 65 69 64 78 79 2e 74 6f 70 22 2c 22 62 69 6f 6c 61 62 73 68 6f 70 32 34 2e 63 6f 6d 22 2c 22 6d 79 66 69 6c 65 73 74 6f 72 65 2e 63 6f 6d 22 2c 22 6f 72 6b 6c 69 6e 6b 2e 63 6f 6d 22 2c 22 65 78 70 6c 6f 72 72 2e 6e 65 74 22 2c 22 67 6f 74 72 61 63 6b 72 65 64 69 72 65 63 74 2e 63 6f 6d 22 2c 22 6a 61 76 69 65 72 64 65 6c 61 73 65 6e 2e 63 6f 6d 22 2c 22 62 72 69 61 6e 73 73 63 6c 75 62 2e 63 63
                                                  Data Ascii: .com.ua","camadmin.ru","jubt12.xyz","rkn.gov.ru","123movie.ltd","ds2.club","yomst.org","suibe.edu.cn","8xbet300.com","appleidxy.top","biolabshop24.com","myfilestore.com","orklink.com","explorr.net","gotrackredirect.com","javierdelasen.com","brianssclub.cc
                                                  2024-07-22 10:34:54 UTC1369INData Raw: 2c 22 64 69 73 63 6c 6f 73 65 70 72 6f 67 72 61 6d 77 65 64 6e 65 73 64 61 79 2e 63 6f 6d 22 2c 22 6b 69 6e 6f 6e 65 77 73 2e 70 72 6f 22 2c 22 6f 68 6e 79 64 65 6c 69 67 68 74 66 75 6c 64 61 74 65 73 2e 6c 69 66 65 22 2c 22 62 6f 6b 65 70 69 64 2e 62 6f 6e 64 22 2c 22 62 6f 72 69 73 2e 64 65 22 2c 22 6d 75 6e 64 6f 63 69 6e 65 6d 61 74 6f 67 72 61 66 69 63 6f 2e 6e 65 74 22 2c 22 62 65 74 61 63 65 6e 74 61 75 72 69 2e 74 6f 70 22 2c 22 6f 6d 67 6e 6f 74 65 2e 6e 65 74 6c 69 66 79 2e 61 70 70 22 2c 22 67 72 6f 77 6e 75 70 67 61 6c 6f 72 65 2e 6c 69 66 65 22 2c 22 69 6d 70 6f 73 73 69 62 6c 65 6f 66 66 65 72 73 2e 63 6f 6d 22 2c 22 76 6b 73 74 72 65 61 6d 2e 74 6f 70 22 2c 22 68 6f 74 70 72 6f 6d 6f 74 69 6f 6e 73 2e 6f 6e 6c 69 6e 65 22 2c 22 69 6f 2e 6b
                                                  Data Ascii: ,"discloseprogramwednesday.com","kinonews.pro","ohnydelightfuldates.life","bokepid.bond","boris.de","mundocinematografico.net","betacentauri.top","omgnote.netlify.app","grownupgalore.life","impossibleoffers.com","vkstream.top","hotpromotions.online","io.k
                                                  2024-07-22 10:34:54 UTC1369INData Raw: 2e 69 74 22 2c 22 6f 6f 72 63 61 73 65 6c 6c 73 2e 63 6f 6d 22 2c 22 6f 6e 65 64 61 73 68 2e 6e 65 74 22 2c 22 74 70 61 73 2e 72 75 22 2c 22 74 65 6e 69 38 35 73 74 61 62 30 31 64 2e 63 6f 6d 22 2c 22 74 68 6f 73 65 63 61 6e 64 79 2e 63 6f 6d 22 2c 22 6e 69 6c 6b 6e 61 72 66 2e 78 79 7a 22 2c 22 72 65 69 66 65 66 72 61 75 65 6e 2e 63 6f 6d 22 2c 22 72 6f 73 65 33 33 2e 74 6f 70 22 2c 22 73 74 6f 6e 65 61 67 65 70 65 64 69 61 2e 63 6f 6d 22 2c 22 6d 79 70 72 69 76 61 74 65 2e 70 69 63 73 22 2c 22 73 6e 61 70 78 2e 69 6e 66 6f 22 2c 22 67 74 61 75 74 6f 63 6c 69 63 6b 65 72 2e 63 6f 6d 22 2c 22 66 6d 6f 76 69 65 7a 2e 69 6e 66 6f 22 2c 22 63 6f 6d 65 73 68 6f 70 69 6e 67 2e 74 6f 6b 79 6f 22 2c 22 70 65 6c 69 73 78 70 6f 72 6e 6f 2e 6e 65 74 22 2c 22 63 68
                                                  Data Ascii: .it","oorcasells.com","onedash.net","tpas.ru","teni85stab01d.com","thosecandy.com","nilknarf.xyz","reifefrauen.com","rose33.top","stoneagepedia.com","myprivate.pics","snapx.info","gtautoclicker.com","fmoviez.info","comeshoping.tokyo","pelisxporno.net","ch
                                                  2024-07-22 10:34:54 UTC1369INData Raw: 70 74 34 72 75 73 2e 72 75 22 2c 22 6c 69 76 65 64 73 6b 61 74 65 72 61 69 73 69 6e 2e 63 6f 6d 22 2c 22 61 79 65 6a 6f 6d 65 72 2e 74 6f 70 22 2c 22 6e 6a 69 32 30 2e 78 79 7a 22 2c 22 67 61 6c 61 78 79 62 79 63 6f 69 6e 2e 63 6f 6d 22 2c 22 65 73 74 61 69 6c 6f 66 61 73 68 69 6f 6e 2e 63 6f 6d 22 2c 22 61 72 63 68 65 75 72 6f 70 65 2e 69 6e 66 6f 22 2c 22 65 7a 63 67 6f 6a 61 61 6d 67 2e 63 6f 6d 22 2c 22 68 2d 67 65 6e 2e 78 79 7a 22 2c 22 78 6e 2d 2d 39 30 61 61 76 6d 66 69 37 62 31 64 2e 78 79 7a 22 2c 22 6c 69 62 72 6f 73 72 65 63 6f 6d 65 6e 64 61 64 6f 73 73 2e 63 6f 6d 22 2c 22 75 74 69 6c 69 74 79 70 72 65 73 65 6e 74 2e 63 6f 6d 22 2c 22 74 68 65 67 61 6d 65 70 6c 61 79 2e 6c 69 66 65 22 2c 22 61 69 36 38 36 38 2e 74 6f 70 22 2c 22 78 79 63 6c
                                                  Data Ascii: pt4rus.ru","livedskateraisin.com","ayejomer.top","nji20.xyz","galaxybycoin.com","estailofashion.com","archeurope.info","ezcgojaamg.com","h-gen.xyz","xn--90aavmfi7b1d.xyz","librosrecomendadoss.com","utilitypresent.com","thegameplay.life","ai6868.top","xycl


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  127192.168.2.449996104.16.149.130443984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:54 UTC95OUTGET /permanentUrlWhitelist.json HTTP/1.1
                                                  Host: acscdn.lavasoft.com
                                                  Connection: Keep-Alive
                                                  2024-07-22 10:34:54 UTC383INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:54 GMT
                                                  Content-Type: application/json
                                                  Content-Length: 16065
                                                  Connection: close
                                                  Last-Modified: Wed, 15 Nov 2023 13:57:17 GMT
                                                  ETag: "6554ce3d-3ec1"
                                                  CF-Cache-Status: HIT
                                                  Age: 37813
                                                  Expires: Tue, 23 Jul 2024 06:34:54 GMT
                                                  Cache-Control: public, max-age=72000
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7ec0bdd0cba-EWR
                                                  2024-07-22 10:34:54 UTC986INData Raw: 5b 22 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 22 2c 20 22 69 6e 73 74 61 67 72 61 6d 2e 63 6f 6d 22 2c 20 22 74 77 69 74 74 65 72 2e 63 6f 6d 22 2c 20 22 67 6f 6f 67 6c 65 2e 63 6f 6d 22 2c 20 22 77 6f 72 64 70 72 65 73 73 2e 6f 72 67 22 2c 20 22 79 6f 75 74 75 62 65 2e 63 6f 6d 22 2c 20 22 6c 69 6e 6b 65 64 69 6e 2e 63 6f 6d 22 2c 20 22 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 22 2c 20 22 70 69 6e 74 65 72 65 73 74 2e 63 6f 6d 22 2c 20 22 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 22 2c 20 22 61 70 70 6c 65 2e 63 6f 6d 22 2c 20 22 61 64 61 77 61 72 65 2e 63 6f 6d 22 2c 20 22 61 76 61 6e 71 75 65 73 74 2e 63 6f 6d 22 2c 20 22 77 65 62 63 6f 6d 70 61 6e 69 6f 6e 2e 63 6f 6d 22 2c 20 22 73 6f 64 61 70 64 66 2e 63 6f 6d 22 2c 20 22 69 6e 70 69 78 69 6f 2e 63 6f 6d
                                                  Data Ascii: ["facebook.com", "instagram.com", "twitter.com", "google.com", "wordpress.org", "youtube.com", "linkedin.com", "cloudflare.com", "pinterest.com", "microsoft.com", "apple.com", "adaware.com", "avanquest.com", "webcompanion.com", "sodapdf.com", "inpixio.com
                                                  2024-07-22 10:34:54 UTC1369INData Raw: 20 22 6e 65 74 77 6f 72 6b 73 6f 6c 75 74 69 6f 6e 73 2e 63 6f 6d 22 2c 20 22 61 6d 61 7a 6f 6e 2e 63 6f 6d 22 2c 20 22 73 68 6f 70 69 66 79 2e 63 6f 6d 22 2c 20 22 64 61 6e 2e 63 6f 6d 22 2c 20 22 62 69 74 2e 6c 79 22 2c 20 22 62 6c 6f 67 73 70 6f 74 2e 63 6f 6d 22 2c 20 22 66 69 6c 65 73 75 73 72 2e 63 6f 6d 22 2c 20 22 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 22 2c 20 22 73 74 61 74 63 6f 75 6e 74 65 72 2e 63 6f 6d 22 2c 20 22 74 75 6d 62 6c 72 2e 63 6f 6d 22 2c 20 22 79 61 6e 64 65 78 2e 72 75 22 2c 20 22 77 61 2e 6d 65 22 2c 20 22 63 70 61 6e 65 6c 2e 6e 65 74 22 2c 20 22 63 70 61 6e 65 6c 2e 63 6f 6d 22 2c 20 22 6a 69 6d 64 6f 2e 63 6f 6d 22 2c 20 22 70 61 79 70 61 6c 2e 63 6f 6d 22 2c 20 22 77 33 2e 6f 72 67 22 2c 20 22 62 6c 75 65 68 6f 73 74 2e 63 6f 6d
                                                  Data Ascii: "networksolutions.com", "amazon.com", "shopify.com", "dan.com", "bit.ly", "blogspot.com", "filesusr.com", "mozilla.org", "statcounter.com", "tumblr.com", "yandex.ru", "wa.me", "cpanel.net", "cpanel.com", "jimdo.com", "paypal.com", "w3.org", "bluehost.com
                                                  2024-07-22 10:34:54 UTC1369INData Raw: 31 61 6e 64 31 2d 65 64 69 74 6f 72 2e 63 6f 6d 22 2c 20 22 6e 67 69 6e 78 2e 6f 72 67 22 2c 20 22 74 72 69 70 61 64 76 69 73 6f 72 2e 63 6f 6d 22 2c 20 22 6d 61 69 6c 63 68 69 6d 70 2e 63 6f 6d 22 2c 20 22 74 72 61 64 65 69 6e 64 69 61 2e 63 6f 6d 22 2c 20 22 77 70 65 6e 67 69 6e 65 2e 63 6f 6d 22 2c 20 22 74 72 75 73 74 70 69 6c 6f 74 2e 63 6f 6d 22 2c 20 22 68 61 74 65 6e 61 2e 6e 65 2e 6a 70 22 2c 20 22 6d 79 73 68 6f 70 69 66 79 2e 63 6f 6d 22 2c 20 22 6f 70 65 6e 73 74 72 65 65 74 6d 61 70 2e 6f 72 67 22 2c 20 22 65 74 73 79 2e 63 6f 6d 22 2c 20 22 69 73 73 75 75 2e 63 6f 6d 22 2c 20 22 74 68 65 6d 65 69 73 6c 65 2e 63 6f 6d 22 2c 20 22 62 65 68 61 6e 63 65 2e 6e 65 74 22 2c 20 22 6e 67 69 6e 78 2e 63 6f 6d 22 2c 20 22 6f 6b 2e 72 75 22 2c 20 22 65
                                                  Data Ascii: 1and1-editor.com", "nginx.org", "tripadvisor.com", "mailchimp.com", "tradeindia.com", "wpengine.com", "trustpilot.com", "hatena.ne.jp", "myshopify.com", "openstreetmap.org", "etsy.com", "issuu.com", "themeisle.com", "behance.net", "nginx.com", "ok.ru", "e
                                                  2024-07-22 10:34:54 UTC1369INData Raw: 73 68 6f 70 2e 63 6f 6d 22 2c 20 22 6d 61 69 6c 63 68 69 2e 6d 70 22 2c 20 22 73 71 75 61 72 65 75 70 2e 63 6f 6d 22 2c 20 22 62 69 67 63 6f 6d 6d 65 72 63 65 2e 63 6f 6d 22 2c 20 22 77 69 6b 69 6d 65 64 69 61 2e 6f 72 67 22 2c 20 22 73 74 72 69 70 65 2e 63 6f 6d 22 2c 20 22 70 61 74 72 65 6f 6e 2e 63 6f 6d 22 2c 20 22 73 6b 79 70 65 2e 63 6f 6d 22 2c 20 22 73 74 75 6d 62 6c 65 75 70 6f 6e 2e 63 6f 6d 22 2c 20 22 73 69 74 65 67 72 6f 75 6e 64 2e 63 6f 6d 22 2c 20 22 74 69 6e 79 75 72 6c 2e 63 6f 6d 22 2c 20 22 6c 69 76 65 63 68 61 74 69 6e 63 2e 63 6f 6d 22 2c 20 22 70 61 79 70 61 6c 2e 6d 65 22 2c 20 22 66 62 2e 6d 65 22 2c 20 22 62 69 6e 67 2e 63 6f 6d 22 2c 20 22 63 61 6c 65 6e 64 6c 79 2e 63 6f 6d 22 2c 20 22 74 65 61 6d 76 69 65 77 65 72 2e 63 6f 6d
                                                  Data Ascii: shop.com", "mailchi.mp", "squareup.com", "bigcommerce.com", "wikimedia.org", "stripe.com", "patreon.com", "skype.com", "stumbleupon.com", "siteground.com", "tinyurl.com", "livechatinc.com", "paypal.me", "fb.me", "bing.com", "calendly.com", "teamviewer.com
                                                  2024-07-22 10:34:54 UTC1369INData Raw: 65 61 64 73 2e 63 6f 6d 22 2c 20 22 67 6f 2e 63 6f 22 2c 20 22 74 65 63 68 63 72 75 6e 63 68 2e 63 6f 6d 22 2c 20 22 6e 69 63 2e 61 74 22 2c 20 22 73 68 69 6e 79 73 74 61 74 2e 63 6f 6d 22 2c 20 22 7a 61 6c 6f 2e 6d 65 22 2c 20 22 6d 61 74 6f 6d 6f 2e 6f 72 67 22 2c 20 22 63 72 79 6f 75 74 63 72 65 61 74 69 6f 6e 73 2e 65 75 22 2c 20 22 68 75 66 66 69 6e 67 74 6f 6e 70 6f 73 74 2e 63 6f 6d 22 2c 20 22 6b 61 6b 61 6f 2e 63 6f 6d 22 2c 20 22 32 32 2e 63 6e 22 2c 20 22 6c 69 74 65 73 70 65 65 64 74 65 63 68 2e 63 6f 6d 22 2c 20 22 62 6c 6f 6f 6d 62 65 72 67 2e 63 6f 6d 22 2c 20 22 75 6e 2e 6f 72 67 22 2c 20 22 63 6c 69 63 6b 66 75 6e 6e 65 6c 73 2e 63 6f 6d 22 2c 20 22 74 68 65 76 65 72 67 65 2e 63 6f 6d 22 2c 20 22 64 72 75 70 61 6c 2e 6f 72 67 22 2c 20 22
                                                  Data Ascii: eads.com", "go.co", "techcrunch.com", "nic.at", "shinystat.com", "zalo.me", "matomo.org", "cryoutcreations.eu", "huffingtonpost.com", "kakao.com", "22.cn", "litespeedtech.com", "bloomberg.com", "un.org", "clickfunnels.com", "theverge.com", "drupal.org", "
                                                  2024-07-22 10:34:54 UTC1369INData Raw: 61 74 69 73 74 61 2e 63 6f 6d 22 2c 20 22 31 32 33 37 37 2e 63 6e 22 2c 20 22 73 6d 61 73 68 62 61 6c 6c 6f 6f 6e 2e 63 6f 6d 22 2c 20 22 73 70 72 69 6e 67 65 72 2e 63 6f 6d 22 2c 20 22 73 74 61 6e 66 6f 72 64 2e 65 64 75 22 2c 20 22 61 69 72 62 6e 62 2e 63 6f 6d 22 2c 20 22 77 68 6f 69 73 2e 63 6f 22 2c 20 22 74 69 6d 65 2e 63 6f 6d 22 2c 20 22 61 63 74 69 76 65 6d 69 6e 64 2e 64 65 22 2c 20 22 67 69 70 68 79 2e 63 6f 6d 22 2c 20 22 6d 61 70 79 2e 63 7a 22 2c 20 22 77 69 6b 69 68 6f 77 2e 63 6f 6d 22 2c 20 22 70 68 70 62 62 2e 63 6f 6d 22 2c 20 22 61 6c 69 62 61 62 61 2e 63 6f 6d 22 2c 20 22 67 6f 6f 67 6c 65 2e 63 61 22 2c 20 22 66 64 61 2e 67 6f 76 22 2c 20 22 37 2d 7a 69 70 2e 6f 72 67 22 2c 20 22 6d 6f 7a 69 6c 6c 61 2e 63 6f 6d 22 2c 20 22 63 61 66
                                                  Data Ascii: atista.com", "12377.cn", "smashballoon.com", "springer.com", "stanford.edu", "airbnb.com", "whois.co", "time.com", "activemind.de", "giphy.com", "mapy.cz", "wikihow.com", "phpbb.com", "alibaba.com", "google.ca", "fda.gov", "7-zip.org", "mozilla.com", "caf
                                                  2024-07-22 10:34:54 UTC1369INData Raw: 2e 6f 72 67 22 2c 20 22 6c 61 74 69 6d 65 73 2e 63 6f 6d 22 2c 20 22 73 6f 75 72 63 65 6d 6f 64 2e 6e 65 74 22 2c 20 22 73 68 6f 70 70 79 2e 67 67 22 2c 20 22 62 6f 6f 74 73 74 72 61 70 64 61 73 68 2e 63 6f 6d 22 2c 20 22 6e 65 74 64 6e 61 2d 73 73 6c 2e 63 6f 6d 22 2c 20 22 69 6e 64 65 70 65 6e 64 65 6e 74 2e 63 6f 2e 75 6b 22 2c 20 22 79 6f 75 6b 75 2e 63 6f 6d 22 2c 20 22 77 6f 77 73 6c 69 64 65 72 2e 63 6f 6d 22 2c 20 22 79 61 64 69 2e 73 6b 22 2c 20 22 73 75 69 74 61 62 6c 65 6e 61 6d 65 73 2e 63 6f 6d 22 2c 20 22 63 73 73 6d 6f 62 61 6e 2e 63 6f 6d 22 2c 20 22 74 72 69 70 61 64 76 69 73 6f 72 2e 69 74 22 2c 20 22 77 77 77 2e 6e 68 73 2e 75 6b 22 2c 20 22 6d 69 70 63 6d 73 2e 63 6f 6d 22 2c 20 22 65 77 65 62 64 65 76 65 6c 6f 70 6d 65 6e 74 2e 63 6f
                                                  Data Ascii: .org", "latimes.com", "sourcemod.net", "shoppy.gg", "bootstrapdash.com", "netdna-ssl.com", "independent.co.uk", "youku.com", "wowslider.com", "yadi.sk", "suitablenames.com", "cssmoban.com", "tripadvisor.it", "www.nhs.uk", "mipcms.com", "ewebdevelopment.co
                                                  2024-07-22 10:34:54 UTC1369INData Raw: 2c 20 22 72 6f 62 6f 74 73 74 78 74 2e 6f 72 67 22 2c 20 22 69 6f 6e 6f 73 2e 66 72 22 2c 20 22 62 6f 72 6c 61 62 73 2e 69 6f 22 2c 20 22 65 76 65 6e 74 62 72 69 74 65 2e 63 6f 2e 75 6b 22 2c 20 22 67 69 74 6c 61 62 2e 63 6f 6d 22 2c 20 22 66 74 2e 63 6f 6d 22 2c 20 22 61 6e 67 69 65 73 6c 69 73 74 2e 63 6f 6d 22 2c 20 22 74 68 65 6d 65 2d 66 75 73 69 6f 6e 2e 63 6f 6d 22 2c 20 22 73 68 75 74 74 65 72 73 74 6f 63 6b 2e 63 6f 6d 22 2c 20 22 63 79 62 65 72 66 6f 6c 6b 73 2e 70 6c 22 2c 20 22 7a 7a 79 69 64 61 2e 6e 65 74 22 2c 20 22 62 6c 6f 67 73 70 6f 74 2e 63 6f 6d 2e 65 73 22 2c 20 22 6d 61 70 71 75 65 73 74 2e 63 6f 6d 22 2c 20 22 68 6f 74 6c 6f 67 2e 72 75 22 2c 20 22 73 62 61 2e 67 6f 76 22 2c 20 22 70 65 6f 70 6c 65 2e 63 6f 6d 2e 63 6e 22 2c 20 22
                                                  Data Ascii: , "robotstxt.org", "ionos.fr", "borlabs.io", "eventbrite.co.uk", "gitlab.com", "ft.com", "angieslist.com", "theme-fusion.com", "shutterstock.com", "cyberfolks.pl", "zzyida.net", "blogspot.com.es", "mapquest.com", "hotlog.ru", "sba.gov", "people.com.cn", "
                                                  2024-07-22 10:34:54 UTC1369INData Raw: 22 66 6f 72 74 75 6e 65 2e 63 6f 6d 22 2c 20 22 76 69 61 63 61 6e 61 64 61 6d 65 64 2e 63 6f 6d 22 2c 20 22 66 72 65 73 68 64 65 73 6b 2e 63 6f 6d 22 2c 20 22 75 6b 2e 63 6f 6d 22 2c 20 22 66 72 65 65 6e 6f 64 65 2e 6e 65 74 22 2c 20 22 61 6e 6f 6e 79 6d 69 7a 65 2e 63 6f 6d 22 2c 20 22 62 6c 6f 67 73 70 6f 74 2e 64 65 22 2c 20 22 61 61 72 6f 6e 70 61 72 65 63 6b 69 2e 63 6f 6d 22 2c 20 22 77 61 6c 6d 61 72 74 2e 63 6f 6d 22 2c 20 22 68 65 74 7a 6e 65 72 2e 64 65 22 2c 20 22 70 79 74 68 6f 6e 2e 6f 72 67 22 2c 20 22 72 6b 6e 2e 67 6f 76 2e 72 75 22 2c 20 22 6d 65 74 69 2e 67 6f 2e 6a 70 22 2c 20 22 68 6f 73 74 6e 65 74 2e 6e 6c 22 2c 20 22 65 6e 61 6d 61 64 2e 69 72 22 2c 20 22 62 69 74 6c 79 2e 63 6f 6d 22 2c 20 22 73 65 63 2e 67 6f 76 22 2c 20 22 6f 73
                                                  Data Ascii: "fortune.com", "viacanadamed.com", "freshdesk.com", "uk.com", "freenode.net", "anonymize.com", "blogspot.de", "aaronparecki.com", "walmart.com", "hetzner.de", "python.org", "rkn.gov.ru", "meti.go.jp", "hostnet.nl", "enamad.ir", "bitly.com", "sec.gov", "os
                                                  2024-07-22 10:34:54 UTC1369INData Raw: 70 75 62 2e 63 6f 6d 22 2c 20 22 61 6d 61 7a 6f 6e 2e 63 61 22 2c 20 22 6e 6d 6c 73 63 6f 6e 73 75 6d 65 72 61 63 63 65 73 73 2e 6f 72 67 22 2c 20 22 6d 79 6f 72 64 65 72 62 6f 78 2e 63 6f 6d 22 2c 20 22 73 6b 69 70 74 68 65 64 69 73 68 65 73 2e 63 6f 6d 22 2c 20 22 6e 70 6d 6a 73 2e 63 6f 6d 22 2c 20 22 6a 75 73 74 67 69 76 69 6e 67 2e 63 6f 6d 22 2c 20 22 62 65 66 72 69 65 6e 64 65 72 73 2e 6f 72 67 22 2c 20 22 68 65 69 73 65 2e 64 65 22 2c 20 22 73 70 68 69 6e 78 2d 64 6f 63 2e 6f 72 67 22 2c 20 22 66 6f 72 6d 73 74 61 63 6b 2e 63 6f 6d 22 2c 20 22 68 6f 6d 65 61 64 76 69 73 6f 72 2e 63 6f 6d 22 2c 20 22 62 6f 78 2e 63 6f 6d 22 2c 20 22 6d 75 66 66 69 6e 67 72 6f 75 70 2e 63 6f 6d 22 2c 20 22 61 63 75 69 74 79 73 63 68 65 64 75 6c 69 6e 67 2e 63 6f 6d
                                                  Data Ascii: pub.com", "amazon.ca", "nmlsconsumeraccess.org", "myorderbox.com", "skipthedishes.com", "npmjs.com", "justgiving.com", "befrienders.org", "heise.de", "sphinx-doc.org", "formstack.com", "homeadvisor.com", "box.com", "muffingroup.com", "acuityscheduling.com


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  128192.168.2.449997104.16.149.130443984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:54 UTC95OUTGET /permanentUrlWhitelist.json HTTP/1.1
                                                  Host: acscdn.lavasoft.com
                                                  Connection: Keep-Alive


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  129192.168.2.449998104.16.149.130443984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:55 UTC156OUTPOST /v1/event-stat?Type=NanoBrowser&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 1654
                                                  2024-07-22 10:34:55 UTC1654OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 54 72 69 67 67 65 72 22 3a 22 64 61 69 6c 79 61 63 74 69 76 69 74 79 22 2c 22 42 72 6f 77 73 65 72 22 3a 7b 22 43 68 72 6f 6d 65 22 3a 7b 22 49 73 44 65 66 61 75 6c 74 22 3a 74 72 75 65 2c 22 49 73 49 6e 73 74 61 6c 6c 65 64 22 3a 74 72 75 65 2c 22 49 73 52 75 6e 6e 69 6e 67 22 3a 66 61 6c 73 65 2c 22 4f 72 69 67 69 6e 61 6c 48 6f 6d 65 50 61 67 65 22 3a 22 61 62 6f 75 74 3a 68 6f 6d 65 22 2c 22 4f 72 69 67 69 6e 61 6c 53 65 61 72 63 68 22 3a 22 47 6f 6f 67 6c 65 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 7d 2c 22 45 64 67 65 22 3a 7b 22 49 73 44 65 66 61 75 6c 74 22 3a 66 61 6c 73 65 2c 22 49 73 49 6e 73 74 61 6c 6c 65 64 22 3a 66 61 6c 73 65 2c 22 49 73 52 75 6e 6e 69 6e 67 22 3a
                                                  Data Ascii: {"Data": {"Trigger":"dailyactivity","Browser":{"Chrome":{"IsDefault":true,"IsInstalled":true,"IsRunning":false,"OriginalHomePage":"about:home","OriginalSearch":"Google","Version":"117.0.5938.132"},"Edge":{"IsDefault":false,"IsInstalled":false,"IsRunning":
                                                  2024-07-22 10:34:55 UTC479INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:55 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: close
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7f018346a57-EWR
                                                  2024-07-22 10:34:55 UTC35INData Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}
                                                  2024-07-22 10:34:55 UTC5INData Raw: 30 0d 0a 0d 0a
                                                  Data Ascii: 0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  130192.168.2.450003104.16.149.130443984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:55 UTC156OUTPOST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 364
                                                  2024-07-22 10:34:55 UTC364OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 45 76 65 6e 74 44 61 74 61 22 3a 22 32 34 68 72 73 22 2c 22 45 76 65 6e 74 4e 61 6d 65 22 3a 22 4d 69 63 72 6f 74 61 72 67 65 74 69 6e 67 54 69 6d 65 72 22 2c 22 42 72 6f 77 73 65 72 4e 61 6d 65 22 3a 22 22 2c 22 53 65 61 72 63 68 45 6e 67 69 6e 65 22 3a 22 22 2c 22 49 6e 73 74 61 6c 6c 44 61 74 65 22 3a 22 32 30 32 34 2d 30 37 2d 32 32 54 30 30 3a 30 30 3a 30 30 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65 2d 31 31 32 38 2d 34 65 36 30 2d 62 65 65 61 2d 32 37 32 30 34 31 64 66 36 34 35 32 22 2c 22 4c 61 6e 67 75 61 67 65 22 3a 22 65 6e 2d 55 53 22 2c 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22
                                                  Data Ascii: {"Data": {"EventData":"24hrs","EventName":"MicrotargetingTimer","BrowserName":"","SearchEngine":"","InstallDate":"2024-07-22T00:00:00","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Language":"en-US","MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698"


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  131192.168.2.450006104.16.148.130443984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:55 UTC86OUTGET /api/v2/url/blacklist HTTP/1.1
                                                  Host: acs.lavasoft.com
                                                  Connection: Keep-Alive


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  132192.168.2.450009104.16.149.130443984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:56 UTC156OUTPOST /v1/event-stat?Type=NanoBrowser&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 1654
                                                  2024-07-22 10:34:56 UTC1654OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 54 72 69 67 67 65 72 22 3a 22 64 61 69 6c 79 61 63 74 69 76 69 74 79 22 2c 22 42 72 6f 77 73 65 72 22 3a 7b 22 43 68 72 6f 6d 65 22 3a 7b 22 49 73 44 65 66 61 75 6c 74 22 3a 74 72 75 65 2c 22 49 73 49 6e 73 74 61 6c 6c 65 64 22 3a 74 72 75 65 2c 22 49 73 52 75 6e 6e 69 6e 67 22 3a 66 61 6c 73 65 2c 22 4f 72 69 67 69 6e 61 6c 48 6f 6d 65 50 61 67 65 22 3a 22 61 62 6f 75 74 3a 68 6f 6d 65 22 2c 22 4f 72 69 67 69 6e 61 6c 53 65 61 72 63 68 22 3a 22 47 6f 6f 67 6c 65 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 7d 2c 22 45 64 67 65 22 3a 7b 22 49 73 44 65 66 61 75 6c 74 22 3a 66 61 6c 73 65 2c 22 49 73 49 6e 73 74 61 6c 6c 65 64 22 3a 66 61 6c 73 65 2c 22 49 73 52 75 6e 6e 69 6e 67 22 3a
                                                  Data Ascii: {"Data": {"Trigger":"dailyactivity","Browser":{"Chrome":{"IsDefault":true,"IsInstalled":true,"IsRunning":false,"OriginalHomePage":"about:home","OriginalSearch":"Google","Version":"117.0.5938.132"},"Edge":{"IsDefault":false,"IsInstalled":false,"IsRunning":
                                                  2024-07-22 10:34:56 UTC479INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:56 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: close
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7f71ef443c8-EWR
                                                  2024-07-22 10:34:56 UTC35INData Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}
                                                  2024-07-22 10:34:56 UTC5INData Raw: 30 0d 0a 0d 0a
                                                  Data Ascii: 0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  133192.168.2.450011104.16.149.130443984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:56 UTC156OUTPOST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 364
                                                  2024-07-22 10:34:56 UTC364OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 45 76 65 6e 74 44 61 74 61 22 3a 22 32 34 68 72 73 22 2c 22 45 76 65 6e 74 4e 61 6d 65 22 3a 22 4d 69 63 72 6f 74 61 72 67 65 74 69 6e 67 54 69 6d 65 72 22 2c 22 42 72 6f 77 73 65 72 4e 61 6d 65 22 3a 22 22 2c 22 53 65 61 72 63 68 45 6e 67 69 6e 65 22 3a 22 22 2c 22 49 6e 73 74 61 6c 6c 44 61 74 65 22 3a 22 32 30 32 34 2d 30 37 2d 32 32 54 30 30 3a 30 30 3a 30 30 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65 2d 31 31 32 38 2d 34 65 36 30 2d 62 65 65 61 2d 32 37 32 30 34 31 64 66 36 34 35 32 22 2c 22 4c 61 6e 67 75 61 67 65 22 3a 22 65 6e 2d 55 53 22 2c 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22
                                                  Data Ascii: {"Data": {"EventData":"24hrs","EventName":"MicrotargetingTimer","BrowserName":"","SearchEngine":"","InstallDate":"2024-07-22T00:00:00","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Language":"en-US","MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698"
                                                  2024-07-22 10:34:56 UTC479INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:56 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: close
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7f848e1424a-EWR
                                                  2024-07-22 10:34:56 UTC35INData Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}
                                                  2024-07-22 10:34:56 UTC5INData Raw: 30 0d 0a 0d 0a
                                                  Data Ascii: 0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  134192.168.2.450012104.16.149.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:56 UTC156OUTPOST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 364
                                                  2024-07-22 10:34:56 UTC364OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 45 76 65 6e 74 44 61 74 61 22 3a 22 32 34 68 72 73 22 2c 22 45 76 65 6e 74 4e 61 6d 65 22 3a 22 4d 69 63 72 6f 74 61 72 67 65 74 69 6e 67 54 69 6d 65 72 22 2c 22 42 72 6f 77 73 65 72 4e 61 6d 65 22 3a 22 22 2c 22 53 65 61 72 63 68 45 6e 67 69 6e 65 22 3a 22 22 2c 22 49 6e 73 74 61 6c 6c 44 61 74 65 22 3a 22 32 30 32 34 2d 30 37 2d 32 32 54 30 30 3a 30 30 3a 30 30 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 65 38 64 35 62 35 30 65 2d 31 31 32 38 2d 34 65 36 30 2d 62 65 65 61 2d 32 37 32 30 34 31 64 66 36 34 35 32 22 2c 22 4c 61 6e 67 75 61 67 65 22 3a 22 65 6e 2d 55 53 22 2c 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22
                                                  Data Ascii: {"Data": {"EventData":"24hrs","EventName":"MicrotargetingTimer","BrowserName":"","SearchEngine":"","InstallDate":"2024-07-22T00:00:00","InstallId":"e8d5b50e-1128-4e60-beea-272041df6452","Language":"en-US","MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698"
                                                  2024-07-22 10:34:56 UTC479INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:56 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: close
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7f8cdf71849-EWR
                                                  2024-07-22 10:34:56 UTC35INData Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}
                                                  2024-07-22 10:34:56 UTC5INData Raw: 30 0d 0a 0d 0a
                                                  Data Ascii: 0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  135192.168.2.450017104.16.149.130443984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:57 UTC166OUTPOST /v1/event-stat?Type=ValidateMicrotargeting&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 683
                                                  2024-07-22 10:34:57 UTC683OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 43 68 72 6f 6d 65 43 75 72 72 65 6e 74 53 65 61 72 63 68 22 3a 22 47 6f 6f 67 6c 65 22 2c 22 43 68 72 6f 6d 65 56 65 72 73 69 6f 6e 22 3a 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 2c 22 46 65 61 74 75 72 65 4d 61 74 63 68 22 3a 74 72 75 65 2c 22 46 69 72 65 66 6f 78 43 75 72 72 65 6e 74 53 65 61 72 63 68 22 3a 22 47 6f 6f 67 6c 65 22 2c 22 46 69 72 65 66 6f 78 56 65 72 73 69 6f 6e 22 3a 22 31 31 38 2e 30 2e 31 22 2c 22 49 6e 73 74 61 6c 6c 41 67 65 22 3a 22 30 22 2c 22 49 73 43 68 72 6f 6d 65 49 6e 73 74 61 6c 6c 65 64 22 3a 74 72 75 65 2c 22 49 73 46 69 72 65 66 6f 78 49 6e 73 74 61 6c 6c 65 64 22 3a 74 72 75 65 2c 22 4f 75 72 49 6e 73 74 61 6c 6c 65 64 45 78 74 65 6e 73 69 6f 6e 73 22 3a 5b 5d 2c 22 4f 75 72 53 65
                                                  Data Ascii: {"Data": {"ChromeCurrentSearch":"Google","ChromeVersion":"117.0.5938.132","FeatureMatch":true,"FirefoxCurrentSearch":"Google","FirefoxVersion":"118.0.1","InstallAge":"0","IsChromeInstalled":true,"IsFirefoxInstalled":true,"OurInstalledExtensions":[],"OurSe
                                                  2024-07-22 10:34:57 UTC479INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:57 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: close
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7fc6bda7ce4-EWR
                                                  2024-07-22 10:34:57 UTC35INData Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}
                                                  2024-07-22 10:34:57 UTC5INData Raw: 30 0d 0a 0d 0a
                                                  Data Ascii: 0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  136192.168.2.450019104.16.149.130443984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:57 UTC166OUTPOST /v1/event-stat?Type=ValidateMicrotargeting&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 683
                                                  2024-07-22 10:34:57 UTC683OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 43 68 72 6f 6d 65 43 75 72 72 65 6e 74 53 65 61 72 63 68 22 3a 22 47 6f 6f 67 6c 65 22 2c 22 43 68 72 6f 6d 65 56 65 72 73 69 6f 6e 22 3a 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 2c 22 46 65 61 74 75 72 65 4d 61 74 63 68 22 3a 74 72 75 65 2c 22 46 69 72 65 66 6f 78 43 75 72 72 65 6e 74 53 65 61 72 63 68 22 3a 22 47 6f 6f 67 6c 65 22 2c 22 46 69 72 65 66 6f 78 56 65 72 73 69 6f 6e 22 3a 22 31 31 38 2e 30 2e 31 22 2c 22 49 6e 73 74 61 6c 6c 41 67 65 22 3a 22 30 22 2c 22 49 73 43 68 72 6f 6d 65 49 6e 73 74 61 6c 6c 65 64 22 3a 74 72 75 65 2c 22 49 73 46 69 72 65 66 6f 78 49 6e 73 74 61 6c 6c 65 64 22 3a 74 72 75 65 2c 22 4f 75 72 49 6e 73 74 61 6c 6c 65 64 45 78 74 65 6e 73 69 6f 6e 73 22 3a 5b 5d 2c 22 4f 75 72 53 65
                                                  Data Ascii: {"Data": {"ChromeCurrentSearch":"Google","ChromeVersion":"117.0.5938.132","FeatureMatch":true,"FirefoxCurrentSearch":"Google","FirefoxVersion":"118.0.1","InstallAge":"0","IsChromeInstalled":true,"IsFirefoxInstalled":true,"OurInstalledExtensions":[],"OurSe
                                                  2024-07-22 10:34:57 UTC479INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:57 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: close
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7fd6fb84388-EWR
                                                  2024-07-22 10:34:57 UTC35INData Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}
                                                  2024-07-22 10:34:57 UTC5INData Raw: 30 0d 0a 0d 0a
                                                  Data Ascii: 0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  137192.168.2.450013104.16.149.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:57 UTC62OUTGET /urlblacklist.json HTTP/1.1
                                                  Host: acscdn.lavasoft.com
                                                  2024-07-22 10:34:57 UTC385INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:57 GMT
                                                  Content-Type: application/json
                                                  Content-Length: 201625
                                                  Connection: close
                                                  Last-Modified: Wed, 15 Nov 2023 13:57:17 GMT
                                                  ETag: "6554ce3d-31399"
                                                  CF-Cache-Status: HIT
                                                  Age: 62214
                                                  Expires: Tue, 23 Jul 2024 06:34:57 GMT
                                                  Cache-Control: public, max-age=72000
                                                  Accept-Ranges: bytes
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7fdfcca423f-EWR
                                                  2024-07-22 10:34:57 UTC984INData Raw: 5b 22 6c 61 69 7a 68 65 6e 67 73 6c 74 2e 63 6e 22 2c 22 6d 79 74 6f 6f 6c 7a 2e 6e 65 74 22 2c 22 70 72 6f 74 65 63 74 32 34 37 2e 6f 6e 6c 69 6e 65 22 2c 22 78 78 6c 61 73 74 2e 63 6f 6d 22 2c 22 77 6f 72 6c 64 73 61 6e 61 6c 79 74 69 63 73 2e 63 6f 6d 22 2c 22 73 6b 69 6c 6c 74 72 61 6e 73 66 6f 72 6d 2e 63 6f 2e 69 6e 22 2c 22 6c 65 6c 61 65 72 2e 63 6f 6d 22 2c 22 6a 70 6f 70 73 69 6e 67 6c 65 73 2e 65 75 22 2c 22 72 69 73 71 75 65 67 61 6c 6b 78 2e 63 6f 6d 22 2c 22 73 76 65 74 76 79 68 6f 64 2e 73 6b 22 2c 22 6d 6f 76 69 65 63 72 75 6d 62 73 2e 6e 65 74 22 2c 22 70 68 72 61 62 75 2e 67 6f 2e 74 68 22 2c 22 6f 6e 6c 79 69 6e 64 69 61 6e 78 2e 63 63 22 2c 22 69 6b 69 73 73 2e 6f 6e 6c 69 6e 65 22 2c 22 75 72 65 77 73 61 77 61 6e 69 2e 61 75 74 6f 73
                                                  Data Ascii: ["laizhengslt.cn","mytoolz.net","protect247.online","xxlast.com","worldsanalytics.com","skilltransform.co.in","lelaer.com","jpopsingles.eu","risquegalkx.com","svetvyhod.sk","moviecrumbs.net","phrabu.go.th","onlyindianx.cc","ikiss.online","urewsawani.autos
                                                  2024-07-22 10:34:57 UTC1369INData Raw: 6b 61 74 6d 6f 76 69 65 68 64 2e 6d 6f 76 22 2c 22 62 6c 75 65 67 61 73 6c 61 6d 70 2e 6f 72 67 22 2c 22 64 72 61 67 67 65 64 6c 69 6e 65 2e 6f 72 67 22 2c 22 67 68 35 79 73 33 67 72 79 35 64 35 33 32 2e 78 79 7a 22 2c 22 6b 61 61 6d 75 75 2e 6f 72 67 22 2c 22 73 61 6f 6d 61 32 32 30 2e 78 79 7a 22 2c 22 6c 69 76 65 74 76 33 36 35 2e 6d 65 22 2c 22 70 69 73 69 2e 70 69 63 73 22 2c 22 76 61 6c 75 65 2d 6c 69 66 65 2e 78 79 7a 22 2c 22 72 69 64 6f 6d 6f 76 69 65 73 2e 74 76 22 2c 22 70 68 69 6c 77 69 6e 2e 70 68 22 2c 22 61 64 6d 69 72 61 6c 73 68 69 70 70 69 6e 67 2e 63 6f 6d 22 2c 22 66 72 65 65 74 6f 6f 6c 6f 6e 6c 69 6e 65 2e 63 6f 6d 22 2c 22 76 69 74 61 6c 61 6d 73 65 65 2e 63 6f 6d 22 2c 22 6f 72 69 67 6c 6e 61 6c 64 61 74 65 2e 63 6f 6d 22 2c 22 72
                                                  Data Ascii: katmoviehd.mov","bluegaslamp.org","draggedline.org","gh5ys3gry5d532.xyz","kaamuu.org","saoma220.xyz","livetv365.me","pisi.pics","value-life.xyz","ridomovies.tv","philwin.ph","admiralshipping.com","freetoolonline.com","vitalamsee.com","origlnaldate.com","r
                                                  2024-07-22 10:34:57 UTC1369INData Raw: 79 2e 63 6f 6d 22 2c 22 61 69 73 68 6f 72 74 2e 74 6f 70 22 2c 22 70 72 6f 6d 6c 61 7a 65 72 2e 72 75 22 2c 22 6c 65 66 74 62 69 6c 6c 2e 74 6f 70 22 2c 22 75 70 73 63 61 72 72 69 61 67 65 70 61 79 6d 65 6e 74 2e 63 6f 6d 22 2c 22 69 6e 76 65 73 74 6c 69 65 2e 63 6f 6d 22 2c 22 74 35 2d 77 69 6b 69 2e 64 65 22 2c 22 66 72 65 65 73 6f 66 74 72 75 73 2e 72 75 22 2c 22 70 61 70 73 74 72 65 61 6d 2e 63 6c 75 62 22 2c 22 77 6f 72 6c 64 6e 65 77 73 2d 32 34 2e 63 6f 6d 22 2c 22 65 6e 73 74 72 65 61 6d 2e 74 6f 70 22 2c 22 73 6f 72 63 65 72 65 72 6f 66 74 65 61 2e 63 6f 6d 22 2c 22 6d 79 63 6c 69 63 6b 2d 32 2e 63 6f 6d 22 2c 22 6c 65 6c 69 65 7a 6f 72 67 67 72 6f 65 70 2e 6e 6c 22 2c 22 6d 75 61 74 68 65 6e 67 61 79 2e 63 6f 6d 22 2c 22 78 6e 2d 2d 38 30 61 63
                                                  Data Ascii: y.com","aishort.top","promlazer.ru","leftbill.top","upscarriagepayment.com","investlie.com","t5-wiki.de","freesoftrus.ru","papstream.club","worldnews-24.com","enstream.top","sorcereroftea.com","myclick-2.com","leliezorggroep.nl","muathengay.com","xn--80ac
                                                  2024-07-22 10:34:57 UTC1369INData Raw: 64 65 2e 6c 69 66 65 22 2c 22 67 30 66 2e 63 6e 22 2c 22 65 73 75 6e 32 31 2e 63 6e 22 2c 22 62 61 6f 66 65 6e 67 6a 69 68 75 6f 2e 63 6f 6d 22 2c 22 6b 65 79 67 65 6e 73 2e 70 72 6f 22 2c 22 63 68 61 72 6d 61 6e 74 65 73 76 6f 69 73 69 6e 65 73 6d 75 72 65 73 2e 63 6f 6d 22 2c 22 76 69 61 74 72 69 73 2d 65 2d 63 68 61 6e 6e 65 6c 2e 63 6f 6d 22 2c 22 73 68 6f 72 74 6c 79 61 6d 75 73 65 6d 65 6e 74 2e 63 6f 6d 22 2c 22 32 31 39 32 39 2e 72 75 22 2c 22 67 65 74 6d 61 63 6b 65 65 70 65 72 73 6f 66 74 70 72 6f 2e 78 79 7a 22 2c 22 74 68 65 73 79 6e 74 68 65 73 69 73 2e 61 70 70 22 2c 22 63 75 74 69 6c 6e 6b 73 2e 63 6f 6d 22 2c 22 61 75 74 6f 62 69 6b 65 72 73 2e 78 79 7a 22 2c 22 70 69 72 61 74 65 2d 70 72 6f 78 79 2e 74 6f 70 22 2c 22 34 35 2e 31 34 38 2e
                                                  Data Ascii: de.life","g0f.cn","esun21.cn","baofengjihuo.com","keygens.pro","charmantesvoisinesmures.com","viatris-e-channel.com","shortlyamusement.com","21929.ru","getmackeepersoftpro.xyz","thesynthesis.app","cutilnks.com","autobikers.xyz","pirate-proxy.top","45.148.
                                                  2024-07-22 10:34:57 UTC1369INData Raw: 79 77 70 6a 6b 2e 63 6f 6d 22 2c 22 73 79 6c 76 69 6e 61 6e 6f 72 72 65 79 2e 63 6f 6d 22 2c 22 6c 6f 6e 38 38 2e 74 6f 70 22 2c 22 76 6c 61 65 6b 61 6e 2e 6b 7a 22 2c 22 73 75 70 74 72 61 66 2e 63 6f 6d 22 2c 22 67 65 74 66 6c 69 6b 2e 63 6f 6d 22 2c 22 63 6f 6f 6c 74 72 6b 2e 78 79 7a 22 2c 22 66 6c 69 72 74 74 6f 6d 65 2e 63 6f 6d 22 2c 22 6d 61 73 61 63 2e 73 62 73 22 2c 22 6e 61 69 6c 6d 61 67 61 7a 69 6e 65 2e 6f 6e 6c 69 6e 65 22 2c 22 72 6f 76 32 2e 6e 65 74 22 2c 22 63 61 73 74 6c 65 63 61 70 69 74 61 6c 2e 76 63 22 2c 22 6d 6f 62 69 6c 65 74 6f 72 72 65 6e 74 2e 69 6e 66 6f 22 2c 22 63 77 62 74 69 2e 63 6f 6d 2e 62 72 22 2c 22 70 6f 73 61 64 61 6c 61 72 6f 62 6c 65 64 61 2e 63 6f 6d 22 2c 22 61 6c 6c 75 72 69 6e 67 67 61 6c 67 2e 63 6f 6d 22 2c
                                                  Data Ascii: ywpjk.com","sylvinanorrey.com","lon88.top","vlaekan.kz","suptraf.com","getflik.com","cooltrk.xyz","flirttome.com","masac.sbs","nailmagazine.online","rov2.net","castlecapital.vc","mobiletorrent.info","cwbti.com.br","posadalarobleda.com","alluringgalg.com",
                                                  2024-07-22 10:34:57 UTC1369INData Raw: 2c 22 74 6f 72 69 6f 6c 75 6f 72 2e 63 6f 6d 22 2c 22 63 72 61 63 6b 73 75 72 6c 2e 63 6f 6d 22 2c 22 70 72 79 76 69 74 61 6e 6e 79 61 2e 74 6f 70 22 2c 22 63 68 61 6e 67 62 65 65 72 2e 73 69 74 65 22 2c 22 61 64 6f 6e 73 6f 6e 6c 79 64 2e 78 79 7a 22 2c 22 74 68 65 6d 65 6e 63 6f 64 65 2e 63 6f 6d 22 2c 22 70 65 72 61 74 75 72 61 6e 70 65 64 69 61 2e 69 64 22 2c 22 74 65 6c 75 74 6f 70 69 65 7a 2e 63 6c 75 62 22 2c 22 76 73 67 7a 64 64 6a 2e 63 6f 6d 22 2c 22 61 64 61 70 61 2d 67 72 6f 75 70 2e 63 6f 6d 22 2c 22 73 68 65 65 74 2d 6d 75 73 69 63 2e 78 79 7a 22 2c 22 72 6f 63 6b 68 61 74 74 65 72 2e 63 6f 6d 22 2c 22 63 6f 6e 73 63 69 6f 75 73 6e 65 73 73 71 75 61 69 6e 74 2e 63 6f 6d 22 2c 22 76 61 6c 6c 65 73 76 69 73 69 6f 2e 63 61 74 22 2c 22 63 73 69
                                                  Data Ascii: ,"torioluor.com","cracksurl.com","pryvitannya.top","changbeer.site","adonsonlyd.xyz","themencode.com","peraturanpedia.id","telutopiez.club","vsgzddj.com","adapa-group.com","sheet-music.xyz","rockhatter.com","consciousnessquaint.com","vallesvisio.cat","csi
                                                  2024-07-22 10:34:57 UTC1369INData Raw: 2e 63 6f 6d 2e 75 61 22 2c 22 63 61 6d 61 64 6d 69 6e 2e 72 75 22 2c 22 6a 75 62 74 31 32 2e 78 79 7a 22 2c 22 72 6b 6e 2e 67 6f 76 2e 72 75 22 2c 22 31 32 33 6d 6f 76 69 65 2e 6c 74 64 22 2c 22 64 73 32 2e 63 6c 75 62 22 2c 22 79 6f 6d 73 74 2e 6f 72 67 22 2c 22 73 75 69 62 65 2e 65 64 75 2e 63 6e 22 2c 22 38 78 62 65 74 33 30 30 2e 63 6f 6d 22 2c 22 61 70 70 6c 65 69 64 78 79 2e 74 6f 70 22 2c 22 62 69 6f 6c 61 62 73 68 6f 70 32 34 2e 63 6f 6d 22 2c 22 6d 79 66 69 6c 65 73 74 6f 72 65 2e 63 6f 6d 22 2c 22 6f 72 6b 6c 69 6e 6b 2e 63 6f 6d 22 2c 22 65 78 70 6c 6f 72 72 2e 6e 65 74 22 2c 22 67 6f 74 72 61 63 6b 72 65 64 69 72 65 63 74 2e 63 6f 6d 22 2c 22 6a 61 76 69 65 72 64 65 6c 61 73 65 6e 2e 63 6f 6d 22 2c 22 62 72 69 61 6e 73 73 63 6c 75 62 2e 63 63
                                                  Data Ascii: .com.ua","camadmin.ru","jubt12.xyz","rkn.gov.ru","123movie.ltd","ds2.club","yomst.org","suibe.edu.cn","8xbet300.com","appleidxy.top","biolabshop24.com","myfilestore.com","orklink.com","explorr.net","gotrackredirect.com","javierdelasen.com","brianssclub.cc
                                                  2024-07-22 10:34:57 UTC1369INData Raw: 2c 22 64 69 73 63 6c 6f 73 65 70 72 6f 67 72 61 6d 77 65 64 6e 65 73 64 61 79 2e 63 6f 6d 22 2c 22 6b 69 6e 6f 6e 65 77 73 2e 70 72 6f 22 2c 22 6f 68 6e 79 64 65 6c 69 67 68 74 66 75 6c 64 61 74 65 73 2e 6c 69 66 65 22 2c 22 62 6f 6b 65 70 69 64 2e 62 6f 6e 64 22 2c 22 62 6f 72 69 73 2e 64 65 22 2c 22 6d 75 6e 64 6f 63 69 6e 65 6d 61 74 6f 67 72 61 66 69 63 6f 2e 6e 65 74 22 2c 22 62 65 74 61 63 65 6e 74 61 75 72 69 2e 74 6f 70 22 2c 22 6f 6d 67 6e 6f 74 65 2e 6e 65 74 6c 69 66 79 2e 61 70 70 22 2c 22 67 72 6f 77 6e 75 70 67 61 6c 6f 72 65 2e 6c 69 66 65 22 2c 22 69 6d 70 6f 73 73 69 62 6c 65 6f 66 66 65 72 73 2e 63 6f 6d 22 2c 22 76 6b 73 74 72 65 61 6d 2e 74 6f 70 22 2c 22 68 6f 74 70 72 6f 6d 6f 74 69 6f 6e 73 2e 6f 6e 6c 69 6e 65 22 2c 22 69 6f 2e 6b
                                                  Data Ascii: ,"discloseprogramwednesday.com","kinonews.pro","ohnydelightfuldates.life","bokepid.bond","boris.de","mundocinematografico.net","betacentauri.top","omgnote.netlify.app","grownupgalore.life","impossibleoffers.com","vkstream.top","hotpromotions.online","io.k
                                                  2024-07-22 10:34:57 UTC1369INData Raw: 2e 69 74 22 2c 22 6f 6f 72 63 61 73 65 6c 6c 73 2e 63 6f 6d 22 2c 22 6f 6e 65 64 61 73 68 2e 6e 65 74 22 2c 22 74 70 61 73 2e 72 75 22 2c 22 74 65 6e 69 38 35 73 74 61 62 30 31 64 2e 63 6f 6d 22 2c 22 74 68 6f 73 65 63 61 6e 64 79 2e 63 6f 6d 22 2c 22 6e 69 6c 6b 6e 61 72 66 2e 78 79 7a 22 2c 22 72 65 69 66 65 66 72 61 75 65 6e 2e 63 6f 6d 22 2c 22 72 6f 73 65 33 33 2e 74 6f 70 22 2c 22 73 74 6f 6e 65 61 67 65 70 65 64 69 61 2e 63 6f 6d 22 2c 22 6d 79 70 72 69 76 61 74 65 2e 70 69 63 73 22 2c 22 73 6e 61 70 78 2e 69 6e 66 6f 22 2c 22 67 74 61 75 74 6f 63 6c 69 63 6b 65 72 2e 63 6f 6d 22 2c 22 66 6d 6f 76 69 65 7a 2e 69 6e 66 6f 22 2c 22 63 6f 6d 65 73 68 6f 70 69 6e 67 2e 74 6f 6b 79 6f 22 2c 22 70 65 6c 69 73 78 70 6f 72 6e 6f 2e 6e 65 74 22 2c 22 63 68
                                                  Data Ascii: .it","oorcasells.com","onedash.net","tpas.ru","teni85stab01d.com","thosecandy.com","nilknarf.xyz","reifefrauen.com","rose33.top","stoneagepedia.com","myprivate.pics","snapx.info","gtautoclicker.com","fmoviez.info","comeshoping.tokyo","pelisxporno.net","ch
                                                  2024-07-22 10:34:57 UTC1369INData Raw: 70 74 34 72 75 73 2e 72 75 22 2c 22 6c 69 76 65 64 73 6b 61 74 65 72 61 69 73 69 6e 2e 63 6f 6d 22 2c 22 61 79 65 6a 6f 6d 65 72 2e 74 6f 70 22 2c 22 6e 6a 69 32 30 2e 78 79 7a 22 2c 22 67 61 6c 61 78 79 62 79 63 6f 69 6e 2e 63 6f 6d 22 2c 22 65 73 74 61 69 6c 6f 66 61 73 68 69 6f 6e 2e 63 6f 6d 22 2c 22 61 72 63 68 65 75 72 6f 70 65 2e 69 6e 66 6f 22 2c 22 65 7a 63 67 6f 6a 61 61 6d 67 2e 63 6f 6d 22 2c 22 68 2d 67 65 6e 2e 78 79 7a 22 2c 22 78 6e 2d 2d 39 30 61 61 76 6d 66 69 37 62 31 64 2e 78 79 7a 22 2c 22 6c 69 62 72 6f 73 72 65 63 6f 6d 65 6e 64 61 64 6f 73 73 2e 63 6f 6d 22 2c 22 75 74 69 6c 69 74 79 70 72 65 73 65 6e 74 2e 63 6f 6d 22 2c 22 74 68 65 67 61 6d 65 70 6c 61 79 2e 6c 69 66 65 22 2c 22 61 69 36 38 36 38 2e 74 6f 70 22 2c 22 78 79 63 6c
                                                  Data Ascii: pt4rus.ru","livedskateraisin.com","ayejomer.top","nji20.xyz","galaxybycoin.com","estailofashion.com","archeurope.info","ezcgojaamg.com","h-gen.xyz","xn--90aavmfi7b1d.xyz","librosrecomendadoss.com","utilitypresent.com","thegameplay.life","ai6868.top","xycl


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  138192.168.2.450001104.16.148.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:57 UTC71OUTGET /api/v2/url/permanentwhitelist HTTP/1.1
                                                  Host: acs.lavasoft.com
                                                  2024-07-22 10:34:57 UTC333INHTTP/1.1 301 Moved Permanently
                                                  Date: Mon, 22 Jul 2024 10:34:57 GMT
                                                  Content-Length: 0
                                                  Connection: close
                                                  Cache-Control: public
                                                  Cache-Control: max-age=86400
                                                  Location: https://acscdn.lavasoft.com/permanentUrlWhitelist.json
                                                  api-supported-versions: 2.0
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7ff5be743bb-EWR


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  139192.168.2.450015104.16.148.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:57 UTC62OUTGET /api/v2/url/blacklist HTTP/1.1
                                                  Host: acs.lavasoft.com
                                                  2024-07-22 10:34:57 UTC324INHTTP/1.1 301 Moved Permanently
                                                  Date: Mon, 22 Jul 2024 10:34:57 GMT
                                                  Content-Length: 0
                                                  Connection: close
                                                  Cache-Control: public
                                                  Cache-Control: max-age=86400
                                                  Location: https://acscdn.lavasoft.com/urlblacklist.json
                                                  api-supported-versions: 2.0
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c7ff5f808c8a-EWR


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  140192.168.2.450021104.16.149.130443984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:58 UTC161OUTPOST /v1/event-stat?Type=BrowserExtension&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 3043
                                                  2024-07-22 10:34:58 UTC3043OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 42 72 6f 77 73 65 72 22 3a 7b 22 43 68 72 6f 6d 65 22 3a 7b 22 45 78 74 49 6e 66 6f 22 3a 5b 7b 22 69 64 22 3a 22 67 68 62 6d 6e 6e 6a 6f 6f 65 6b 70 6d 6f 65 63 6e 6e 6e 69 6c 6e 6e 62 64 6c 6f 6c 68 6b 68 69 22 2c 22 69 6e 73 74 61 6c 6c 44 61 74 65 22 3a 6e 75 6c 6c 2c 22 75 73 65 72 44 69 73 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 66 6f 72 65 69 67 6e 49 6e 73 74 61 6c 6c 22 3a 66 61 6c 73 65 2c 22 75 70 64 61 74 65 44 61 74 65 22 3a 6e 75 6c 6c 2c 22 76 65 72 73 69 6f 6e 22 3a 6e 75 6c 6c 7d 2c 7b 22 69 64 22 3a 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 2c 22 69 6e 73 74 61 6c 6c 44 61 74 65 22 3a 6e 75 6c 6c 2c 22 75 73 65 72 44 69 73 61 62 6c 65 64 22 3a
                                                  Data Ascii: {"Data": {"Browser":{"Chrome":{"ExtInfo":[{"id":"ghbmnnjooekpmoecnnnilnnbdlolhkhi","installDate":null,"userDisabled":false,"foreignInstall":false,"updateDate":null,"version":null},{"id":"nmmhkkegccagdldgiimedpiccmgmieda","installDate":null,"userDisabled":
                                                  2024-07-22 10:34:58 UTC479INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:58 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: close
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c80189fb8cd6-EWR
                                                  2024-07-22 10:34:58 UTC35INData Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}
                                                  2024-07-22 10:34:58 UTC5INData Raw: 30 0d 0a 0d 0a
                                                  Data Ascii: 0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  141192.168.2.450022104.16.149.130443984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:58 UTC156OUTPOST /v1/event-stat?Type=NanoBrowser&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 1654
                                                  2024-07-22 10:34:58 UTC1654OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 54 72 69 67 67 65 72 22 3a 22 64 61 69 6c 79 61 63 74 69 76 69 74 79 22 2c 22 42 72 6f 77 73 65 72 22 3a 7b 22 43 68 72 6f 6d 65 22 3a 7b 22 49 73 44 65 66 61 75 6c 74 22 3a 74 72 75 65 2c 22 49 73 49 6e 73 74 61 6c 6c 65 64 22 3a 74 72 75 65 2c 22 49 73 52 75 6e 6e 69 6e 67 22 3a 66 61 6c 73 65 2c 22 4f 72 69 67 69 6e 61 6c 48 6f 6d 65 50 61 67 65 22 3a 22 61 62 6f 75 74 3a 68 6f 6d 65 22 2c 22 4f 72 69 67 69 6e 61 6c 53 65 61 72 63 68 22 3a 22 47 6f 6f 67 6c 65 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 7d 2c 22 45 64 67 65 22 3a 7b 22 49 73 44 65 66 61 75 6c 74 22 3a 66 61 6c 73 65 2c 22 49 73 49 6e 73 74 61 6c 6c 65 64 22 3a 66 61 6c 73 65 2c 22 49 73 52 75 6e 6e 69 6e 67 22 3a
                                                  Data Ascii: {"Data": {"Trigger":"dailyactivity","Browser":{"Chrome":{"IsDefault":true,"IsInstalled":true,"IsRunning":false,"OriginalHomePage":"about:home","OriginalSearch":"Google","Version":"117.0.5938.132"},"Edge":{"IsDefault":false,"IsInstalled":false,"IsRunning":
                                                  2024-07-22 10:34:58 UTC479INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:58 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: close
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c801cbd04334-EWR
                                                  2024-07-22 10:34:58 UTC35INData Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}
                                                  2024-07-22 10:34:58 UTC5INData Raw: 30 0d 0a 0d 0a
                                                  Data Ascii: 0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  142192.168.2.450020104.16.149.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:58 UTC161OUTPOST /v1/event-stat?Type=BrowserExtension&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 3043
                                                  2024-07-22 10:34:58 UTC3043OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 42 72 6f 77 73 65 72 22 3a 7b 22 43 68 72 6f 6d 65 22 3a 7b 22 45 78 74 49 6e 66 6f 22 3a 5b 7b 22 69 64 22 3a 22 67 68 62 6d 6e 6e 6a 6f 6f 65 6b 70 6d 6f 65 63 6e 6e 6e 69 6c 6e 6e 62 64 6c 6f 6c 68 6b 68 69 22 2c 22 69 6e 73 74 61 6c 6c 44 61 74 65 22 3a 6e 75 6c 6c 2c 22 75 73 65 72 44 69 73 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 66 6f 72 65 69 67 6e 49 6e 73 74 61 6c 6c 22 3a 66 61 6c 73 65 2c 22 75 70 64 61 74 65 44 61 74 65 22 3a 6e 75 6c 6c 2c 22 76 65 72 73 69 6f 6e 22 3a 6e 75 6c 6c 7d 2c 7b 22 69 64 22 3a 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 2c 22 69 6e 73 74 61 6c 6c 44 61 74 65 22 3a 6e 75 6c 6c 2c 22 75 73 65 72 44 69 73 61 62 6c 65 64 22 3a
                                                  Data Ascii: {"Data": {"Browser":{"Chrome":{"ExtInfo":[{"id":"ghbmnnjooekpmoecnnnilnnbdlolhkhi","installDate":null,"userDisabled":false,"foreignInstall":false,"updateDate":null,"version":null},{"id":"nmmhkkegccagdldgiimedpiccmgmieda","installDate":null,"userDisabled":
                                                  2024-07-22 10:34:58 UTC479INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:58 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: close
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c805fdd3c42c-EWR
                                                  2024-07-22 10:34:58 UTC35INData Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}
                                                  2024-07-22 10:34:58 UTC5INData Raw: 30 0d 0a 0d 0a
                                                  Data Ascii: 0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  143192.168.2.450026104.16.149.130443984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:59 UTC156OUTPOST /v1/event-stat?Type=NanoBrowser&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 1654
                                                  2024-07-22 10:34:59 UTC1654OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 54 72 69 67 67 65 72 22 3a 22 64 61 69 6c 79 61 63 74 69 76 69 74 79 22 2c 22 42 72 6f 77 73 65 72 22 3a 7b 22 43 68 72 6f 6d 65 22 3a 7b 22 49 73 44 65 66 61 75 6c 74 22 3a 74 72 75 65 2c 22 49 73 49 6e 73 74 61 6c 6c 65 64 22 3a 74 72 75 65 2c 22 49 73 52 75 6e 6e 69 6e 67 22 3a 66 61 6c 73 65 2c 22 4f 72 69 67 69 6e 61 6c 48 6f 6d 65 50 61 67 65 22 3a 22 61 62 6f 75 74 3a 68 6f 6d 65 22 2c 22 4f 72 69 67 69 6e 61 6c 53 65 61 72 63 68 22 3a 22 47 6f 6f 67 6c 65 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 7d 2c 22 45 64 67 65 22 3a 7b 22 49 73 44 65 66 61 75 6c 74 22 3a 66 61 6c 73 65 2c 22 49 73 49 6e 73 74 61 6c 6c 65 64 22 3a 66 61 6c 73 65 2c 22 49 73 52 75 6e 6e 69 6e 67 22 3a
                                                  Data Ascii: {"Data": {"Trigger":"dailyactivity","Browser":{"Chrome":{"IsDefault":true,"IsInstalled":true,"IsRunning":false,"OriginalHomePage":"about:home","OriginalSearch":"Google","Version":"117.0.5938.132"},"Edge":{"IsDefault":false,"IsInstalled":false,"IsRunning":
                                                  2024-07-22 10:34:59 UTC479INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:59 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: close
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c8091b3b43b9-EWR
                                                  2024-07-22 10:34:59 UTC35INData Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}
                                                  2024-07-22 10:34:59 UTC5INData Raw: 30 0d 0a 0d 0a
                                                  Data Ascii: 0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  144192.168.2.450025104.16.149.130443984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:59 UTC166OUTPOST /v1/event-stat?Type=ValidateMicrotargeting&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 683
                                                  2024-07-22 10:34:59 UTC683OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 43 68 72 6f 6d 65 43 75 72 72 65 6e 74 53 65 61 72 63 68 22 3a 22 47 6f 6f 67 6c 65 22 2c 22 43 68 72 6f 6d 65 56 65 72 73 69 6f 6e 22 3a 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 2c 22 46 65 61 74 75 72 65 4d 61 74 63 68 22 3a 74 72 75 65 2c 22 46 69 72 65 66 6f 78 43 75 72 72 65 6e 74 53 65 61 72 63 68 22 3a 22 47 6f 6f 67 6c 65 22 2c 22 46 69 72 65 66 6f 78 56 65 72 73 69 6f 6e 22 3a 22 31 31 38 2e 30 2e 31 22 2c 22 49 6e 73 74 61 6c 6c 41 67 65 22 3a 22 30 22 2c 22 49 73 43 68 72 6f 6d 65 49 6e 73 74 61 6c 6c 65 64 22 3a 74 72 75 65 2c 22 49 73 46 69 72 65 66 6f 78 49 6e 73 74 61 6c 6c 65 64 22 3a 74 72 75 65 2c 22 4f 75 72 49 6e 73 74 61 6c 6c 65 64 45 78 74 65 6e 73 69 6f 6e 73 22 3a 5b 5d 2c 22 4f 75 72 53 65
                                                  Data Ascii: {"Data": {"ChromeCurrentSearch":"Google","ChromeVersion":"117.0.5938.132","FeatureMatch":true,"FirefoxCurrentSearch":"Google","FirefoxVersion":"118.0.1","InstallAge":"0","IsChromeInstalled":true,"IsFirefoxInstalled":true,"OurInstalledExtensions":[],"OurSe
                                                  2024-07-22 10:34:59 UTC479INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:59 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: close
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c809bfe07281-EWR
                                                  2024-07-22 10:34:59 UTC35INData Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}
                                                  2024-07-22 10:34:59 UTC5INData Raw: 30 0d 0a 0d 0a
                                                  Data Ascii: 0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  145192.168.2.450028104.16.148.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:59 UTC62OUTGET /api/v2/url/blacklist HTTP/1.1
                                                  Host: acs.lavasoft.com
                                                  2024-07-22 10:34:59 UTC324INHTTP/1.1 301 Moved Permanently
                                                  Date: Mon, 22 Jul 2024 10:34:59 GMT
                                                  Content-Length: 0
                                                  Connection: close
                                                  Cache-Control: public
                                                  Cache-Control: max-age=86400
                                                  Location: https://acscdn.lavasoft.com/urlblacklist.json
                                                  api-supported-versions: 2.0
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c80b494578db-EWR


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  146192.168.2.450027104.16.149.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:34:59 UTC161OUTPOST /v1/event-stat?Type=BrowserExtension&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 3043
                                                  2024-07-22 10:34:59 UTC3043OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 42 72 6f 77 73 65 72 22 3a 7b 22 43 68 72 6f 6d 65 22 3a 7b 22 45 78 74 49 6e 66 6f 22 3a 5b 7b 22 69 64 22 3a 22 67 68 62 6d 6e 6e 6a 6f 6f 65 6b 70 6d 6f 65 63 6e 6e 6e 69 6c 6e 6e 62 64 6c 6f 6c 68 6b 68 69 22 2c 22 69 6e 73 74 61 6c 6c 44 61 74 65 22 3a 6e 75 6c 6c 2c 22 75 73 65 72 44 69 73 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 66 6f 72 65 69 67 6e 49 6e 73 74 61 6c 6c 22 3a 66 61 6c 73 65 2c 22 75 70 64 61 74 65 44 61 74 65 22 3a 6e 75 6c 6c 2c 22 76 65 72 73 69 6f 6e 22 3a 6e 75 6c 6c 7d 2c 7b 22 69 64 22 3a 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 2c 22 69 6e 73 74 61 6c 6c 44 61 74 65 22 3a 6e 75 6c 6c 2c 22 75 73 65 72 44 69 73 61 62 6c 65 64 22 3a
                                                  Data Ascii: {"Data": {"Browser":{"Chrome":{"ExtInfo":[{"id":"ghbmnnjooekpmoecnnnilnnbdlolhkhi","installDate":null,"userDisabled":false,"foreignInstall":false,"updateDate":null,"version":null},{"id":"nmmhkkegccagdldgiimedpiccmgmieda","installDate":null,"userDisabled":
                                                  2024-07-22 10:34:59 UTC479INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:34:59 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: close
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c80b5c310f37-EWR
                                                  2024-07-22 10:34:59 UTC35INData Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}
                                                  2024-07-22 10:34:59 UTC5INData Raw: 30 0d 0a 0d 0a
                                                  Data Ascii: 0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  147192.168.2.450033104.16.148.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:35:00 UTC62OUTGET /api/v2/url/blacklist HTTP/1.1
                                                  Host: acs.lavasoft.com
                                                  2024-07-22 10:35:00 UTC324INHTTP/1.1 301 Moved Permanently
                                                  Date: Mon, 22 Jul 2024 10:35:00 GMT
                                                  Content-Length: 0
                                                  Connection: close
                                                  Cache-Control: public
                                                  Cache-Control: max-age=86400
                                                  Location: https://acscdn.lavasoft.com/urlblacklist.json
                                                  api-supported-versions: 2.0
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c80e6fa98cb1-EWR


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  148192.168.2.450031104.16.149.130443984C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:35:00 UTC161OUTPOST /v1/event-stat?Type=BrowserExtension&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 3043
                                                  2024-07-22 10:35:00 UTC3043OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 42 72 6f 77 73 65 72 22 3a 7b 22 43 68 72 6f 6d 65 22 3a 7b 22 45 78 74 49 6e 66 6f 22 3a 5b 7b 22 69 64 22 3a 22 67 68 62 6d 6e 6e 6a 6f 6f 65 6b 70 6d 6f 65 63 6e 6e 6e 69 6c 6e 6e 62 64 6c 6f 6c 68 6b 68 69 22 2c 22 69 6e 73 74 61 6c 6c 44 61 74 65 22 3a 6e 75 6c 6c 2c 22 75 73 65 72 44 69 73 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 66 6f 72 65 69 67 6e 49 6e 73 74 61 6c 6c 22 3a 66 61 6c 73 65 2c 22 75 70 64 61 74 65 44 61 74 65 22 3a 6e 75 6c 6c 2c 22 76 65 72 73 69 6f 6e 22 3a 6e 75 6c 6c 7d 2c 7b 22 69 64 22 3a 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 2c 22 69 6e 73 74 61 6c 6c 44 61 74 65 22 3a 6e 75 6c 6c 2c 22 75 73 65 72 44 69 73 61 62 6c 65 64 22 3a
                                                  Data Ascii: {"Data": {"Browser":{"Chrome":{"ExtInfo":[{"id":"ghbmnnjooekpmoecnnnilnnbdlolhkhi","installDate":null,"userDisabled":false,"foreignInstall":false,"updateDate":null,"version":null},{"id":"nmmhkkegccagdldgiimedpiccmgmieda","installDate":null,"userDisabled":
                                                  2024-07-22 10:35:00 UTC479INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:35:00 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: close
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c80e8de743e2-EWR
                                                  2024-07-22 10:35:00 UTC35INData Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}
                                                  2024-07-22 10:35:00 UTC5INData Raw: 30 0d 0a 0d 0a
                                                  Data Ascii: 0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  149192.168.2.450032104.16.149.130443940C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-07-22 10:35:00 UTC161OUTPOST /v1/event-stat?Type=BrowserExtension&ProductID=wc&EventVersion=1 HTTP/1.1
                                                  Content-Type: application/json
                                                  Host: flow.lavasoft.com
                                                  Content-Length: 3043
                                                  2024-07-22 10:35:00 UTC3043OUTData Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 42 72 6f 77 73 65 72 22 3a 7b 22 43 68 72 6f 6d 65 22 3a 7b 22 45 78 74 49 6e 66 6f 22 3a 5b 7b 22 69 64 22 3a 22 67 68 62 6d 6e 6e 6a 6f 6f 65 6b 70 6d 6f 65 63 6e 6e 6e 69 6c 6e 6e 62 64 6c 6f 6c 68 6b 68 69 22 2c 22 69 6e 73 74 61 6c 6c 44 61 74 65 22 3a 6e 75 6c 6c 2c 22 75 73 65 72 44 69 73 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 66 6f 72 65 69 67 6e 49 6e 73 74 61 6c 6c 22 3a 66 61 6c 73 65 2c 22 75 70 64 61 74 65 44 61 74 65 22 3a 6e 75 6c 6c 2c 22 76 65 72 73 69 6f 6e 22 3a 6e 75 6c 6c 7d 2c 7b 22 69 64 22 3a 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 2c 22 69 6e 73 74 61 6c 6c 44 61 74 65 22 3a 6e 75 6c 6c 2c 22 75 73 65 72 44 69 73 61 62 6c 65 64 22 3a
                                                  Data Ascii: {"Data": {"Browser":{"Chrome":{"ExtInfo":[{"id":"ghbmnnjooekpmoecnnnilnnbdlolhkhi","installDate":null,"userDisabled":false,"foreignInstall":false,"updateDate":null,"version":null},{"id":"nmmhkkegccagdldgiimedpiccmgmieda","installDate":null,"userDisabled":
                                                  2024-07-22 10:35:00 UTC479INHTTP/1.1 200 OK
                                                  Date: Mon, 22 Jul 2024 10:35:00 GMT
                                                  Content-Type: application/json; charset=utf-8
                                                  Transfer-Encoding: chunked
                                                  Connection: close
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
                                                  Access-Control-Expose-Headers: Content-Length,Content-Range
                                                  CF-Cache-Status: DYNAMIC
                                                  Server: cloudflare
                                                  CF-RAY: 8a72c81079cb4258-EWR
                                                  2024-07-22 10:35:00 UTC35INData Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a
                                                  Data Ascii: 1d{"message":"Event persisted"}
                                                  2024-07-22 10:35:00 UTC5INData Raw: 30 0d 0a 0d 0a
                                                  Data Ascii: 0


                                                  Statistics

                                                  CPU Usage

                                                  Click to jump to process

                                                  Memory Usage

                                                  Click to jump to process

                                                  High Level Behavior Distribution

                                                  Click to dive into process behavior distribution

                                                  Behavior

                                                  Click to jump to process

                                                  System Behavior

                                                  General

                                                  Target ID:0
                                                  Start time:06:32:53
                                                  Start date:22/07/2024
                                                  Path:C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe
                                                  Wow64 process (32bit):true
                                                  Commandline:"C:\Users\user\Desktop\FileZilla_3.67.1_win64_sponsored-setup.exe"
                                                  Imagebase:0x400000
                                                  File size:12'417'936 bytes
                                                  MD5 hash:AC97E64C3E2E865C50155DFDFFE5428A
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Reputation:low
                                                  Has exited:true

                                                  General

                                                  Target ID:2
                                                  Start time:06:33:12
                                                  Start date:22/07/2024
                                                  Path:C:\Users\user\AppData\Local\Temp\nsnF7E7.tmp\WcInstaller.exe
                                                  Wow64 process (32bit):true
                                                  Commandline:"C:\Users\user\AppData\Local\Temp\nsnF7E7.tmp\WcInstaller.exe" --silent --partner=FZ210427 --searchenbl
                                                  Imagebase:0x400000
                                                  File size:565'920 bytes
                                                  MD5 hash:CA94290A5FB89E0AAACBF01585718B17
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Reputation:low
                                                  Has exited:false

                                                  General

                                                  Target ID:3
                                                  Start time:06:33:13
                                                  Start date:22/07/2024
                                                  Path:C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe
                                                  Wow64 process (32bit):true
                                                  Commandline:.\WebCompanionInstaller.exe --partner=FZ210427 --version=9.1.0.993 --silent --partner=FZ210427 --searchenbl
                                                  Imagebase:0x780000
                                                  File size:468'184 bytes
                                                  MD5 hash:80619C0E2165AB0C217D4355461DA07D
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Yara matches:
                                                  • Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Temp\7zS8D75AF52\WebCompanionInstaller.exe, Author: Joe Security
                                                  Reputation:low
                                                  Has exited:false

                                                  General

                                                  Target ID:6
                                                  Start time:06:33:35
                                                  Start date:22/07/2024
                                                  Path:C:\Windows\SysWOW64\sc.exe
                                                  Wow64 process (32bit):true
                                                  Commandline:"sc.exe" Create "WCAssistantService" binPath= "C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe" DisplayName= "WC Assistant" start= auto
                                                  Imagebase:0xaa0000
                                                  File size:61'440 bytes
                                                  MD5 hash:D9D7684B8431A0D10D0E76FE9F5FFEC8
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Reputation:moderate
                                                  Has exited:true

                                                  General

                                                  Target ID:7
                                                  Start time:06:33:35
                                                  Start date:22/07/2024
                                                  Path:C:\Windows\System32\conhost.exe
                                                  Wow64 process (32bit):false
                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                  Imagebase:0x7ff7699e0000
                                                  File size:862'208 bytes
                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Reputation:high
                                                  Has exited:true

                                                  General

                                                  Target ID:8
                                                  Start time:06:33:35
                                                  Start date:22/07/2024
                                                  Path:C:\Windows\SysWOW64\sc.exe
                                                  Wow64 process (32bit):true
                                                  Commandline:"sc.exe" failure WCAssistantService reset= 30 actions= restart/60000
                                                  Imagebase:0xaa0000
                                                  File size:61'440 bytes
                                                  MD5 hash:D9D7684B8431A0D10D0E76FE9F5FFEC8
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Reputation:moderate
                                                  Has exited:true

                                                  General

                                                  Target ID:9
                                                  Start time:06:33:35
                                                  Start date:22/07/2024
                                                  Path:C:\Windows\System32\conhost.exe
                                                  Wow64 process (32bit):false
                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                  Imagebase:0x7ff7699e0000
                                                  File size:862'208 bytes
                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Reputation:high
                                                  Has exited:true

                                                  General

                                                  Target ID:10
                                                  Start time:06:33:36
                                                  Start date:22/07/2024
                                                  Path:C:\Windows\SysWOW64\sc.exe
                                                  Wow64 process (32bit):true
                                                  Commandline:"sc.exe" description "WCAssistantService" "Ad-Aware Web Companion Internet security service"
                                                  Imagebase:0xaa0000
                                                  File size:61'440 bytes
                                                  MD5 hash:D9D7684B8431A0D10D0E76FE9F5FFEC8
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Reputation:moderate
                                                  Has exited:true

                                                  General

                                                  Target ID:11
                                                  Start time:06:33:36
                                                  Start date:22/07/2024
                                                  Path:C:\Windows\System32\conhost.exe
                                                  Wow64 process (32bit):false
                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                  Imagebase:0x7ff7699e0000
                                                  File size:862'208 bytes
                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Reputation:high
                                                  Has exited:true

                                                  General

                                                  Target ID:13
                                                  Start time:06:33:40
                                                  Start date:22/07/2024
                                                  Path:C:\Windows\System32\regsvr32.exe
                                                  Wow64 process (32bit):false
                                                  Commandline:"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\FileZilla FTP Client\fzshellext_64.dll"
                                                  Imagebase:0x7ff73d950000
                                                  File size:25'088 bytes
                                                  MD5 hash:B0C2FA35D14A9FAD919E99D9D75E1B9E
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Reputation:high
                                                  Has exited:true

                                                  General

                                                  Target ID:14
                                                  Start time:06:33:45
                                                  Start date:22/07/2024
                                                  Path:C:\Program Files\FileZilla FTP Client\filezilla.exe
                                                  Wow64 process (32bit):false
                                                  Commandline:"C:\Program Files\FileZilla FTP Client\filezilla.exe"
                                                  Imagebase:0x7ff726ad0000
                                                  File size:4'237'896 bytes
                                                  MD5 hash:0B8A7845DA90F16EABDAEB3D9B0F018A
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Reputation:low
                                                  Has exited:false

                                                  General

                                                  Target ID:15
                                                  Start time:06:33:57
                                                  Start date:22/07/2024
                                                  Path:C:\Windows\System32\rundll32.exe
                                                  Wow64 process (32bit):false
                                                  Commandline:"C:\Windows\sysnative\RunDLL32.Exe" syssetup,SetupInfObjectInstallAction BootInstall 128 C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bddci.inf
                                                  Imagebase:0x7ff6ea9d0000
                                                  File size:71'680 bytes
                                                  MD5 hash:EF3179D498793BF4234F708D3BE28633
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Reputation:high
                                                  Has exited:true

                                                  General

                                                  Target ID:16
                                                  Start time:06:33:57
                                                  Start date:22/07/2024
                                                  Path:C:\Windows\System32\net.exe
                                                  Wow64 process (32bit):false
                                                  Commandline:"C:\Windows\sysnative\net.exe" start bddci
                                                  Imagebase:0x7ff675e00000
                                                  File size:59'904 bytes
                                                  MD5 hash:0BD94A338EEA5A4E1F2830AE326E6D19
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Reputation:high
                                                  Has exited:true

                                                  General

                                                  Target ID:17
                                                  Start time:06:33:57
                                                  Start date:22/07/2024
                                                  Path:C:\Windows\SysWOW64\sc.exe
                                                  Wow64 process (32bit):true
                                                  Commandline:"sc.exe" Create "DCIService" binPath= "C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\DCIService.exe" DisplayName= "DCIService" start= auto
                                                  Imagebase:0xaa0000
                                                  File size:61'440 bytes
                                                  MD5 hash:D9D7684B8431A0D10D0E76FE9F5FFEC8
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Has exited:true

                                                  General

                                                  Target ID:18
                                                  Start time:06:33:57
                                                  Start date:22/07/2024
                                                  Path:C:\Windows\System32\conhost.exe
                                                  Wow64 process (32bit):false
                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                  Imagebase:0x7ff7699e0000
                                                  File size:862'208 bytes
                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Has exited:true

                                                  General

                                                  Target ID:19
                                                  Start time:06:33:57
                                                  Start date:22/07/2024
                                                  Path:C:\Windows\System32\conhost.exe
                                                  Wow64 process (32bit):false
                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                  Imagebase:0x7ff7699e0000
                                                  File size:862'208 bytes
                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Has exited:true

                                                  General

                                                  Target ID:20
                                                  Start time:06:33:57
                                                  Start date:22/07/2024
                                                  Path:C:\Windows\System32\runonce.exe
                                                  Wow64 process (32bit):false
                                                  Commandline:"C:\Windows\system32\runonce.exe" -r
                                                  Imagebase:0x7ff6fec10000
                                                  File size:61'952 bytes
                                                  MD5 hash:9ADEF025B168447C1E8514D919CB5DC0
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Has exited:true

                                                  General

                                                  Target ID:21
                                                  Start time:06:33:57
                                                  Start date:22/07/2024
                                                  Path:C:\Windows\System32\net1.exe
                                                  Wow64 process (32bit):false
                                                  Commandline:C:\Windows\system32\net1 start bddci
                                                  Imagebase:0x7ff6a6bf0000
                                                  File size:183'808 bytes
                                                  MD5 hash:55693DF2BB3CBE2899DFDDF18B4EB8C9
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Has exited:true

                                                  General

                                                  Target ID:22
                                                  Start time:06:33:57
                                                  Start date:22/07/2024
                                                  Path:C:\Windows\System32\grpconv.exe
                                                  Wow64 process (32bit):false
                                                  Commandline:"C:\Windows\System32\grpconv.exe" -o
                                                  Imagebase:0x7ff7f7160000
                                                  File size:52'736 bytes
                                                  MD5 hash:8531882ACC33CB4BDC11B305A01581CE
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Has exited:true

                                                  General

                                                  Target ID:23
                                                  Start time:06:33:57
                                                  Start date:22/07/2024
                                                  Path:C:\Windows\SysWOW64\sc.exe
                                                  Wow64 process (32bit):true
                                                  Commandline:"sc.exe" description "DCIService" "Webprotection Bridge service"
                                                  Imagebase:0xaa0000
                                                  File size:61'440 bytes
                                                  MD5 hash:D9D7684B8431A0D10D0E76FE9F5FFEC8
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Has exited:true

                                                  General

                                                  Target ID:24
                                                  Start time:06:33:57
                                                  Start date:22/07/2024
                                                  Path:C:\Windows\System32\conhost.exe
                                                  Wow64 process (32bit):false
                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                  Imagebase:0x7ff7699e0000
                                                  File size:862'208 bytes
                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Has exited:true

                                                  General

                                                  Target ID:25
                                                  Start time:06:33:57
                                                  Start date:22/07/2024
                                                  Path:C:\Windows\SysWOW64\cmd.exe
                                                  Wow64 process (32bit):true
                                                  Commandline:"C:\Windows\System32\cmd.exe" /C "C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bridge_start.cmd"
                                                  Imagebase:0x240000
                                                  File size:236'544 bytes
                                                  MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Has exited:true

                                                  General

                                                  Target ID:26
                                                  Start time:06:33:57
                                                  Start date:22/07/2024
                                                  Path:C:\Windows\System32\conhost.exe
                                                  Wow64 process (32bit):false
                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                  Imagebase:0x7ff7699e0000
                                                  File size:862'208 bytes
                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Has exited:true

                                                  General

                                                  Target ID:27
                                                  Start time:06:33:58
                                                  Start date:22/07/2024
                                                  Path:C:\Windows\SysWOW64\sc.exe
                                                  Wow64 process (32bit):true
                                                  Commandline:sc start DCIService
                                                  Imagebase:0xaa0000
                                                  File size:61'440 bytes
                                                  MD5 hash:D9D7684B8431A0D10D0E76FE9F5FFEC8
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Has exited:true

                                                  General

                                                  Target ID:28
                                                  Start time:06:33:58
                                                  Start date:22/07/2024
                                                  Path:C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\DCIService.exe
                                                  Wow64 process (32bit):false
                                                  Commandline:"C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\DCIService.exe"
                                                  Imagebase:0x7ff7eaf00000
                                                  File size:3'420'376 bytes
                                                  MD5 hash:3827CA1C0EC114A29BB576BEF431F070
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Has exited:false

                                                  General

                                                  Target ID:30
                                                  Start time:06:34:05
                                                  Start date:22/07/2024
                                                  Path:C:\Windows\SysWOW64\cmd.exe
                                                  Wow64 process (32bit):true
                                                  Commandline:"C:\Windows\System32\cmd.exe" /C netsh http add urlacl url=http://+:9007/ user=Everyone
                                                  Imagebase:0x240000
                                                  File size:236'544 bytes
                                                  MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Has exited:true

                                                  General

                                                  Target ID:31
                                                  Start time:06:34:05
                                                  Start date:22/07/2024
                                                  Path:C:\Windows\System32\conhost.exe
                                                  Wow64 process (32bit):false
                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                  Imagebase:0x7ff7699e0000
                                                  File size:862'208 bytes
                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Has exited:true

                                                  General

                                                  Target ID:32
                                                  Start time:06:34:05
                                                  Start date:22/07/2024
                                                  Path:C:\Windows\SysWOW64\netsh.exe
                                                  Wow64 process (32bit):true
                                                  Commandline:netsh http add urlacl url=http://+:9007/ user=Everyone
                                                  Imagebase:0x1560000
                                                  File size:82'432 bytes
                                                  MD5 hash:4E89A1A088BE715D6C946E55AB07C7DF
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Has exited:true

                                                  General

                                                  Target ID:33
                                                  Start time:06:34:07
                                                  Start date:22/07/2024
                                                  Path:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  Wow64 process (32bit):true
                                                  Commandline:"C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe" --silent --install --geo= --searchenbl
                                                  Imagebase:0x6a0000
                                                  File size:9'332'952 bytes
                                                  MD5 hash:11CE0FC17BFCDCCF929515BD90455BAF
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Yara matches:
                                                  • Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe, Author: Joe Security
                                                  Antivirus matches:
                                                  • Detection: 4%, ReversingLabs
                                                  Has exited:false

                                                  General

                                                  Target ID:34
                                                  Start time:06:34:12
                                                  Start date:22/07/2024
                                                  Path:C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe
                                                  Wow64 process (32bit):false
                                                  Commandline:"C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe"
                                                  Imagebase:0x6f0000
                                                  File size:27'864 bytes
                                                  MD5 hash:3442D7F43B57552DB02DD69C13F6E682
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Antivirus matches:
                                                  • Detection: 4%, ReversingLabs
                                                  Has exited:false

                                                  General

                                                  Target ID:36
                                                  Start time:06:34:16
                                                  Start date:22/07/2024
                                                  Path:C:\Windows\System32\cmd.exe
                                                  Wow64 process (32bit):false
                                                  Commandline:"C:\Windows\System32\cmd.exe" /C netsh http add urlacl url=http://+:9007/ user=Everyone
                                                  Imagebase:0x7ff626930000
                                                  File size:289'792 bytes
                                                  MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Has exited:true

                                                  General

                                                  Target ID:37
                                                  Start time:06:34:17
                                                  Start date:22/07/2024
                                                  Path:C:\Windows\System32\conhost.exe
                                                  Wow64 process (32bit):false
                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                  Imagebase:0x7ff7699e0000
                                                  File size:862'208 bytes
                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Has exited:true

                                                  General

                                                  Target ID:38
                                                  Start time:06:34:17
                                                  Start date:22/07/2024
                                                  Path:C:\Windows\System32\netsh.exe
                                                  Wow64 process (32bit):false
                                                  Commandline:netsh http add urlacl url=http://+:9007/ user=Everyone
                                                  Imagebase:0x7ff73fb90000
                                                  File size:96'768 bytes
                                                  MD5 hash:6F1E6DD688818BC3D1391D0CC7D597EB
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Has exited:true

                                                  General

                                                  Target ID:40
                                                  Start time:06:34:22
                                                  Start date:22/07/2024
                                                  Path:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  Wow64 process (32bit):true
                                                  Commandline:"C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe" --minimize
                                                  Imagebase:0xc80000
                                                  File size:9'332'952 bytes
                                                  MD5 hash:11CE0FC17BFCDCCF929515BD90455BAF
                                                  Has elevated privileges:false
                                                  Has administrator privileges:false
                                                  Programmed in:C, C++ or other language
                                                  Has exited:true

                                                  General

                                                  Target ID:41
                                                  Start time:06:34:29
                                                  Start date:22/07/2024
                                                  Path:C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
                                                  Wow64 process (32bit):true
                                                  Commandline:"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\rsvnd5a7.cmdline"
                                                  Imagebase:0x400000
                                                  File size:80'296 bytes
                                                  MD5 hash:2B9482EB5D3AF71029277E18F6C656C0
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Has exited:true

                                                  General

                                                  Target ID:42
                                                  Start time:06:34:29
                                                  Start date:22/07/2024
                                                  Path:C:\Windows\System32\conhost.exe
                                                  Wow64 process (32bit):false
                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                  Imagebase:0x7ff7699e0000
                                                  File size:862'208 bytes
                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Has exited:true

                                                  General

                                                  Target ID:43
                                                  Start time:06:34:30
                                                  Start date:22/07/2024
                                                  Path:C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                  Wow64 process (32bit):true
                                                  Commandline:C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES71F3.tmp" "c:\Users\user\AppData\Local\Temp\CSC7165.tmp"
                                                  Imagebase:0x400000
                                                  File size:35'296 bytes
                                                  MD5 hash:E118330B4629B12368D91B9DF6488BE0
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Has exited:true

                                                  General

                                                  Target ID:44
                                                  Start time:06:34:30
                                                  Start date:22/07/2024
                                                  Path:C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                                                  Wow64 process (32bit):true
                                                  Commandline:"C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe" --minimize
                                                  Imagebase:0x900000
                                                  File size:9'332'952 bytes
                                                  MD5 hash:11CE0FC17BFCDCCF929515BD90455BAF
                                                  Has elevated privileges:false
                                                  Has administrator privileges:false
                                                  Programmed in:C, C++ or other language
                                                  Has exited:false

                                                  General

                                                  Target ID:45
                                                  Start time:06:34:33
                                                  Start date:22/07/2024
                                                  Path:C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
                                                  Wow64 process (32bit):true
                                                  Commandline:"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\fr_px-r0.cmdline"
                                                  Imagebase:0x400000
                                                  File size:80'296 bytes
                                                  MD5 hash:2B9482EB5D3AF71029277E18F6C656C0
                                                  Has elevated privileges:false
                                                  Has administrator privileges:false
                                                  Programmed in:C, C++ or other language
                                                  Has exited:true

                                                  General

                                                  Target ID:46
                                                  Start time:06:34:34
                                                  Start date:22/07/2024
                                                  Path:C:\Windows\System32\conhost.exe
                                                  Wow64 process (32bit):false
                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                  Imagebase:0x7ff7699e0000
                                                  File size:862'208 bytes
                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                  Has elevated privileges:false
                                                  Has administrator privileges:false
                                                  Programmed in:C, C++ or other language
                                                  Has exited:true

                                                  General

                                                  Target ID:47
                                                  Start time:06:34:34
                                                  Start date:22/07/2024
                                                  Path:C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
                                                  Wow64 process (32bit):true
                                                  Commandline:"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\xsc65psb.cmdline"
                                                  Imagebase:0x400000
                                                  File size:80'296 bytes
                                                  MD5 hash:2B9482EB5D3AF71029277E18F6C656C0
                                                  Has elevated privileges:false
                                                  Has administrator privileges:false
                                                  Programmed in:C, C++ or other language
                                                  Has exited:true

                                                  General

                                                  Target ID:48
                                                  Start time:06:34:34
                                                  Start date:22/07/2024
                                                  Path:C:\Windows\System32\conhost.exe
                                                  Wow64 process (32bit):false
                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                  Imagebase:0x7ff7699e0000
                                                  File size:862'208 bytes
                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                  Has elevated privileges:false
                                                  Has administrator privileges:false
                                                  Programmed in:C, C++ or other language
                                                  Has exited:true

                                                  General

                                                  Target ID:49
                                                  Start time:06:34:34
                                                  Start date:22/07/2024
                                                  Path:C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                  Wow64 process (32bit):true
                                                  Commandline:C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES822F.tmp" "c:\Users\user\AppData\Local\Temp\CSC821F.tmp"
                                                  Imagebase:0x400000
                                                  File size:35'296 bytes
                                                  MD5 hash:E118330B4629B12368D91B9DF6488BE0
                                                  Has elevated privileges:false
                                                  Has administrator privileges:false
                                                  Programmed in:C, C++ or other language
                                                  Has exited:true

                                                  General

                                                  Target ID:50
                                                  Start time:06:34:34
                                                  Start date:22/07/2024
                                                  Path:C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                  Wow64 process (32bit):true
                                                  Commandline:C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES827D.tmp" "c:\Users\user\AppData\Local\Temp\CSC826D.tmp"
                                                  Imagebase:0x7ff71e800000
                                                  File size:35'296 bytes
                                                  MD5 hash:E118330B4629B12368D91B9DF6488BE0
                                                  Has elevated privileges:false
                                                  Has administrator privileges:false
                                                  Programmed in:C, C++ or other language
                                                  Has exited:true

                                                  General

                                                  Target ID:51
                                                  Start time:06:34:55
                                                  Start date:22/07/2024
                                                  Path:C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
                                                  Wow64 process (32bit):false
                                                  Commandline:C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
                                                  Imagebase:0x190000
                                                  File size:46'184 bytes
                                                  MD5 hash:91857D4F6633493CF03C22BD86ED7F81
                                                  Has elevated privileges:true
                                                  Has administrator privileges:false
                                                  Programmed in:C, C++ or other language
                                                  Has exited:false

                                                  General

                                                  Target ID:52
                                                  Start time:06:36:15
                                                  Start date:22/07/2024
                                                  Path:C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Search.exe
                                                  Wow64 process (32bit):false
                                                  Commandline:"C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Search.exe" --searchConfigPath="C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Options\SearchMetadata.txt" --eventConfigPath="C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Options\EventMetadata.txt"
                                                  Imagebase:0xc60000
                                                  File size:208'600 bytes
                                                  MD5 hash:1A6E64A89F37623232F7A79A91042012
                                                  Has elevated privileges:false
                                                  Has administrator privileges:false
                                                  Programmed in:C, C++ or other language
                                                  Yara matches:
                                                  • Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Search.exe, Author: Joe Security
                                                  Antivirus matches:
                                                  • Detection: 5%, ReversingLabs
                                                  Has exited:false

                                                  General

                                                  Target ID:53
                                                  Start time:06:36:39
                                                  Start date:22/07/2024
                                                  Path:C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Search.exe
                                                  Wow64 process (32bit):false
                                                  Commandline:"C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Search.exe" --searchConfigPath="C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Options\SearchMetadata.txt" --eventConfigPath="C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Options\EventMetadata.txt"
                                                  Imagebase:0x330000
                                                  File size:208'600 bytes
                                                  MD5 hash:1A6E64A89F37623232F7A79A91042012
                                                  Has elevated privileges:false
                                                  Has administrator privileges:false
                                                  Programmed in:C, C++ or other language
                                                  Has exited:false

                                                  Disassembly

                                                  ⊘No disassembly